Wells Fargo Bans TikTok App on Company Devices

Ishita Chigilli Palli • July 13, 2020

Wells Fargo, the fourth largest bank in the U.S., has directed employees to remove the TikTok social media app from their company-issued devices, citing security concerns. The news comes after Amazon sent mixed signals to its employees about use of the social media app.

Cybercrime

It's Official: CCPA Enforcement Begins

Latest

Endpoint Security

IoT in the Enterprise: Managing Risk and Control

Jeremy Kirk • July 14, 2020

Enterprises want to make greater use of connected devices to develop new services and gain efficiencies, but security is a paramount concern. Piers Hogarth-Scott and Katherine Robins of KPMG break down the risks and the challenges around IoT security.

Application Security

Ensuring Connected Devices Are Secure

Jeremy Kirk • July 14, 2020

The lessons of the Mirai botnet's abuse of internet-connected devices four years ago have been taken to heart, says Aaron Guzman of OWASP, which is working with others to improve security benchmarks and testing for connected devices.

Endpoint Security

Product Labels Could Make IoT Risks More Transparent

Jeremy Kirk • July 14, 2020

Manufacturers are increasingly adding connectivity to everyday devices, but it's not always evident how privacy and security is managed. Detailed technical labels could give purchasers more insight, says Pardis Emami-Naeini, a post-doctoral scholar at Carnegie Mellon University.

Cybercrime

Russian Found Guilty of Hacking LinkedIn, Dropbox

Prajeet Nair • July 13, 2020

A Russian national has been found guilty of hacking LinkedIn, Dropbox and the now defunct Formspring to steal millions of user credentials, some of which were later sold on underground markets.

Billing Vendor Breach Affects 275,000

Marianne Kolbasuk McGee • July 13, 2020

Some 275,000 individuals served by a variety of healthcare sector organizations had data exposed as a result of a breach at Houston-based billing and debt collection vendor Benefit Recovery Specialists Inc. A breach at another debt collection vendor last year wound up affecting more than 20 million individuals.

Cybercrime

No 'Invisible God': Fxmsp's Operational Security Failures

Mathew J. Schwartz • July 13, 2020

To the long list of alleged hackers who failed to practice good operational security so they could remain anonymous, add another name: Andrey Turchin, who's been charged with running the Fxmsp hacking group, which prosecutors say relied on Jabber and bitcoins in an attempt to hide their real identities.

Endpoint Security

Not the Cat's Meow: Petnet and the Perils of Consumer IoT

Jeremy Kirk • July 13, 2020

Connected devices for consumers don't come with service-level agreements agreements. The travails of Petnet, the maker of an automatic, cloud-enabled pet feeder that has now gone offline offer a tale of caution that points to the need for stronger consumer protection for cloud-enabled devices.

Business Email Compromise (BEC)

US Secret Service Forms Cyber Fraud Task Force

Akshaya Asokan • July 11, 2020

The U.S. Secret Service is combining its electronic and financial crime units into a single task force that will focus on investigating cyber-related financial crimes, such as BEC schemes and ransomware attacks. The move comes as lawmakers push for the Secret Service to take a more active role in fighting cybercrime.

Account Takeover

5 Billion Unique Credentials Circulating on Darknet

Ishita Chigilli Palli • July 10, 2020

Five billion unique user credentials are circulating on darknet forums, with cybercriminals offering to sell access to bank accounts as well as domain administrator access to corporate networks, according to the security firm Digital Shadows.

Cybercrime

Malware Found Pre-Installed on Low-Cost Android Smartphones

Prajeet Nair • July 10, 2020

For the second time this year, security researchers have found malware embedded in low-cost Android smartphones distributed through a U.S. government program, security firm Malwarebytes reports.

Cybercrime

Zoom-Themed Phishing Campaign Targets Office 365 Credentials

Prajeet Nair • July 10, 2020

A recently uncovered phishing campaign is using spoofed Zoom account alerts to steal Microsoft Office 365 credentials, according to a report from Abnormal Security. These attacks come as use of the platform soars due to work-from-home arrangements.

Cybercrime

Updated Joker Android Malware Adds Evasion Techniques

Akshaya Asokan • July 10, 2020

Check Point Research reports that a new version of the Joker mobile malware that infects Android devices has emerged. The malware, hidden in apps in the Google Play store, has once again evaded Google's security tools.