• Thwarting DDoS Technique that Threatened Large-Scale Cyberattack

    Researchers have developed a technique that could allow a relatively small number of computers to carry out DDoS (distributed denial of service) attacks on a massive scale, overwhelming targets with false requests for information until they were thrown offline. The attack exploits vulnerabilities in the Domain Name System or DNS. The researchers alerted a broad collection of companies responsible for the internet’s infrastructure to their findings.

  • IoT: Which Devices Are Spying on You?

    When hungry consumers want to know how many calories are in a bag of chips, they can check the nutrition label on the bag. When those same consumers want to check the security and privacy practices of a new IoT device, they aren’t able to find even the most basic facts. Not yet, at least.

  • Users Rarely Change Passwords after a Breach – or They Choose a Weaker Password

    Have you been pwned? In other words, have any of your username / password combinations been stolen during any of the many data breaches in recent years? Chances are, they probably have, and it’s also likely you didn’t take the proper precaution of changing your password to a more secure one. That’s not necessarily your fault.

  • Protecting the 2020 Presidential Election

    In 2019 the federal government appropriated for states $425 million, following the $380 million provided to states at the beginning of 2018, with both outlays aiming to help states prevent a repeat of Russia’s interference in the 2016 presidential election. Then the coronavirus pandemic came ashore, leading states to use previously appropriated election security funds for coronavirus-related election expenses. This is a problem: the U.S. election infrastructure is not yet fully secure, while America’s adversaries continue to augment their technical election-interference capabilities.

  • Sharing Personal Information on Social Media Is Risky

    An innocent, seemingly fun and engaging social media trend has been popping up on news feeds. In an act of solidarity with high school seniors who were finishing out their final semester at home due to the coronavirus stay-at-home order, Facebook users were sharing their own senior class photos in nostalgic posts. While it is a nice sentiment and the presence of cameras in nearly every cellphone has made it easy to take and exchange pictures, there are certain security considerations one should keep in mind.

  • Germany Has “Hard Evidence” of Russian Cyberattack on Parliament

    German Chancellor Angela Merkel says there is “hard evidence” of the involvement of “Russian forces” in a 2015 cyberattack on the German parliament in which documents from her own parliamentary office were reportedly stolen. Last week that federal prosecutors in Germany had issued an arrest warrant for a suspected officer with Russia’s GRU military intelligence agency.

  • U.S. to Accuse China of Hacking COVID-19 Vaccine Research

    For months, U.S. officials have been warning about a spike in cyberattacks during the coronavirus pandemic, but they’ve stopped short of pointing fingers at any one country. Now, as the all-out global race for a coronavirus vaccine accelerates and hackers home in on related scientific research, U.S. officials are preparing to single out a long-standing cyber adversary: China.

  • Enhancing Privacy Protections for Android Applications

    From navigation to remote banking, mobile device users rely on a variety of applications to streamline daily tasks, communicate, and dramatically increase productivity. While exceedingly useful, the ecosystem of third-party applications utilizes a number of sensors – microphones, GPS, pedometers, cameras – and user interactions to collect data used to enable functionality. Troves of sensitive personal data about users are accessible to these applications and as defense and commercial mobile device users become increasingly reliant on the technology, there are growing concerns around the challenge this creates for preserving user privacy.

  • Assessing Cyber Risk from External Information

    There is a vision for the future of assessing cybersecurity: The goal is a system of cyber metrics that are transparent, auditable, practical, scalable and widely agreed upon. To that end, it is useful—indeed, imperative—to evaluate various approaches to cyber risk quantification with the aim of informing the development of a public standard for measuring cybersecurity.

  • Wobbly” Tracing App “Failed” Clinical Safety and Cybersecurity Tests

    The government’s coronavirus contact tracing app has so far failed the tests needed to be included in the NHS app library, HSJ understands. Jasmine Rapson writes in HJS that the app is being trialed on the Isle of Wight this week, ahead of a national rollout later this month. Senior NHS sources told HSJ it had thus far failed all of the tests required for inclusion in the app library, including cyber security, performance and clinical safety. There are also concerns at high levels about how users’ privacy will be protected once they log that they have coronavirus symptoms, and become “traceable,” and how this information will be used. Senior figures told HSJ that it had been hard to assess the app because the government was “going about it in a kind of a ham-fisted way. They haven’t got clear versions, so it’s been impossible to get fixed code base from them for NHS Digital to test. They keep changing it all over the place.” HSJ’s source described the app as “a bit wobbly.”

  • Predicting and Countering Cyberttacks

    The U.K Defense and Security Accelerator (DASA) announce nearly £1m to further develop technology that predicts and counters cyber-attacks. “This work will develop, adapt and merge the novel approaches explored in Phase 1 of the competition, to proactively defend deployed U.K. military systems and networks from the rapidly growing threat of offensive cyber action from aggressive adversaries,” DASA said.

  • Cyber Operations against Medical Facilities During Peacetime

    In the face of the coronavirus pandemic, governments around the world have tried to compensate for insufficient hospital beds and intensive care units by nationalizing private medical facilities and relying on military ships and improvised evac hospitals. Adina Ponta writes that at a time when overcrowded medical and testing facilities struggle with shortages in supplies and a huge influx of patients, hacker groups have exploited their inattention to cybersecurity.

  • New Privacy Threat Combines Device Identification with Biometric Information

    A new study by computer scientists has revealed a new privacy threat from devices such as smartphones, smart doorbells and voice assistants that allows cyber attackers to access and combine device identification and biometric information.

  • The COVIDSafe App Was Just One Contact Tracing Option. These Alternatives Guarantee More Privacy

    Since its release on Sunday, experts and members of the public alike have raised privacy concerns with the Australian federal government’s COVIDSafe mobile app. Many Australians have said that they worried about “the security of personal information collected” by the app. In its coronavirus response, the government has a golden opportunity to build public trust. There are other ways to build a digital contact tracing system, some of which would arguably raise fewer doubts about data security than the app.

  • The Department of Defense Should Not Wage Cyber War Against Criminal Hackers During the Coronavirus Crisis

    Politicians and pundits in the United States have frequently described the challenge of controlling the COVID pandemic with the language of waging war. Erica D. Borghard writes that given this terminology, it can be tempting to look to the Department of Defense (DOD) to solve problems it was not meant to address. While nefarious actors in cyberspace are seeking to capitalize on scared and vulnerable individuals during the pandemic for criminal gain and national strategic objectives, “any efforts to leverage DOD capabilities in combating these efforts must distinguish between nation-state and criminal activity,” she writes.