WhatsApp Encryption Security Flaws Could Allow Snoops to Slide Into Group Chats

WIRED Threat Level

German researchers say that a flaw in the app's group-chat feature undermines its end-to-end encryption promises. Security

Slack Launched Encryption Key Addon For Businesses

Security Affairs

Slack announced today to launch encryption keys that will help businesses to protect their data. Slack announced today to launch encryption keys that will help businesses to protect their data. Slack announced today to launch encryption keys that will help businesses to protect their data. What is the purpose of Enterprise Key Management if Slack really encrypts the data? Slack currently encrypts your data in transit and at rest.

Flaws in several self-encrypting SSDs allows attackers to decrypt data they contain

Security Affairs

The encryption system implemented by popular solid-state drives (SSDs) is affected by critical vulnerabilities that could be exploited by a local attacker to decrypt data. “We have analyzed the hardware full-disk encryption of several SSDs by reverse engineering their firmware.

Attackers Are Messing with Encryption Traffic to Evade Detection

Dark Reading

Unknown groups have started tampering with Web traffic encryption, causing the number of fingerprints for connections using Transport Layer Security to jump from 19,000 to 1.4

OilRig APT group: the evolution of attack techniques over time

Security Affairs

Security researcher Marco Ramilli presents a comparative analysis of attacks techniques adopted by the Iran-Linked OilRig APT group. I would define this group of references as reports. Those reports have been divided into 4 timing groups in order to simplify the evaluation process.

Ransomware, Trojan and Miner together against “PIK-Group”

Security Affairs

Security expert Marco Ramilli analyzed a new piece of malware apparently designed to target PIK-Group that implements ransomware , Trojan, and Miner capabilities. which according to google translate would be: “PIK Group of Companies order details”. SecurityAffairs – PIK Group, hacking).

GreyEnergy cyberespionage group targets Poland and Ukraine

Security Affairs

Security researchers from ESET published a detailed analysis of a recently discovered cyber espionage group tracked as GreyEnergy. Experts from ESET speculate the BlackEnergy threat actor evolved into two separate APT groups, namely TeleBots and GreyEnergy.

Groups 109

North Korea-linked group Lazarus targets Latin American banks

Security Affairs

According to security reearchers at Trend Micro, the North Korea-linked APT group Lazarus recently targeted banks in Latin America. The North Korea-linked APT group Lazarus recently targeted banks in Latin America, Trend Micro experts reported. ZNFJ-A) – encrypted backdoor.

Groups 111

Whitefly espionage group was linked to SingHealth Singapore Healthcare Breach

Security Affairs

Security experts at Symantec linked the massive Singapore Healthcare breach suffered by SingHealth to the ‘Whitefly’ cyberespionage group. In 2018, the largest healthcare group in Singapore, SingHealth, has suffered a massive data breach that exposed personal information of 1.5

WhatsApp Downplays Damage of a Group Invite Bug

Threatpost

WhatsApp said that claims that infiltrators can add themselves to an encrypted group chat without being noticed is incorrect. Cryptography Government Hacks Privacy Apple iPhone Encryption End to end encryption Facebook FBI Moxie Marlinspike Open Whisper Systems Ruhr University Bochum Signal WhatsApp

The Risk of Weak Online Banking Passwords

Krebs on Security

“The way it works today, you the aggregator or app stores the credentials encrypted and presents them to the bank. Latest Warnings The Coming Storm 2FA Aite Group alex holden Alissa Knight Brian Costello Financial Data Exchange Hold Security Mint Paypal Plaid YNAB Yodlee Zelle

Alleged Iran-linked APT groups behind global DNS Hijacking campaign

Security Affairs

Security expert uncovered a DNS hijacking campaign targeting organizations in various industries worldwide and suspects Iranian APT groups. According to the experts, the campaign is carried out, with “moderate confidence,” by APT groups linked to the Iranian Government.

Turla APT group adds Topinambour Trojan to its arsenal

Security Affairs

Kaspersky researchers revealed that since earlier this year, Russia-linked APT group Turla used new variants of the KopiLuwak Trojan in targeted attacks. Security experts at Kaspersky revealed that the Russia-linked APT group Turla used new variants of the KopiLuwak Trojan in targeted attacks since early 2019. In the past months, security experts reported the APT group has been updating its arsenal.

OceanLotus APT group leverages a steganography-based loader to deliver backdoors

Security Affairs

The OceanLotus APT group, also known as APT32 or Cobalt Kitty , leverages a steganography-based loader to deliver backdoors on compromised systems. “ Threat actors used a custom steganography algorithm to hide the encrypted payload within PNG images to to avoid detection.

National Academy of Sciences Encryption Study

Data Matters

After supporters and opponents of mandated government access to encrypted communications publicly feuded for much of 2016, reprising arguments they’ve had since at least the days of the “Clipper Chip,” these “encryption debates” seemed to quiet down for much of last year. Wray further argued that, while the FBI “supports information security measures, including strong encryption[,]. Few would describe 2017 as a quiet year.

The stealthy email stealer in the TA505 hacker group’s arsenal

Security Affairs

Experts at Yoroi -Cybaze Z-Lab observed a spike in attacks against the banking sector and spotted a new email stealer used by the TA505 hacker group. The post The stealthy email stealer in the TA505 hacker group’s arsenal appeared first on Security Affairs.

China-linked APT10 group behind new attacks on the Japanese media sector

Security Affairs

Recently researchers from FireEye uncovered and blocked a campaign powered by the Chinese APT10 cyber espionage group aimed at Japanese media sector. Experts noticed the group since around mid-2016 when it was using PlugX, ChChes, Quasar and RedLeaves malware in targeted attacks.

Facebook Will Shift to Emphasize Encrypted Ephemeral Messages, Zuckerberg Says: eDiscovery Trends

eDiscovery Daily

In a post to Facebook last week, founder Mark Zuckerberg outlined a vision of the future that includes end-to-end encryption and an ephemeral lifespan for private messages and photos.

Researchers find vulnerabilities in WhatsApp that allow to spread Fake News via group chats

Security Affairs

WhatsApp has been found vulnerable to multiple security flaws that could allow malicious users to spread fake news through group chats. Quoting a message in a reply to a group conversation to make it appear as if it came from a person who is not even part of the group.

Australia's spyware law could expose phones to exploitation, business group warns

The Guardian Data Protection

Peter Dutton warned bid to boost government’s surveillance powers could give criminals more tools Peter Dutton’s proposed legislation to expand the government’s surveillance capabilities into telecommunication devices through the inclusion of spyware risks could create “systemic weakness or vulnerability” that would be open to exploitation, Australia’s peak industry group has warned.

ICO Stresses Importance of Encryption for Data Security

Hunton Privacy

On August 28, 2013, on the UK Information Commissioner’s Office’s (“ICO’s”) blog, Simon Rice, Technology Group Manager for the ICO, discussed the importance of encryption as a data security measure. He stated that storing any personal information is “inherently risky” but encryption can be a “simple and effective means” to safeguard personal information and reduce the risk of security breaches. Selecting the Correct Encryption Method. Safeguarding the Encryption Key.

600,000 affected by huge data breach in Michigan

Information Management Resources

The effects of a September 2018 ransomware attack are still reverberating for Wolverine Solutions Group, which serves both health insurers and provider organizations. Ransomware Data breaches Hacking Encryption HIPAA regulations

Hacker broke into super secure French Government’s Messaging App Tchap hours after release

Security Affairs

The popular French white hat hacker Robert Baptiste (aka @fs0c131y) discovered how to break into Tchap , a new secure messaging app launched by the French government for encrypted communications between officials and politicians.

GDPR: Data transfers outside the EU – what are the rules?

IT Governance

This includes transfers to another company within the same corporate group. Pseudonymisation and encryption. The GDPR advises organisations to pseudonymise and/or encrypt all personal data. Encryption also obscures information by replacing identifiers with something else.

GDPR 65

WhatsApp Vulnerability

Schneier on Security

Matthew Green has a good description : If all you want is the TL;DR, here's the headline finding: due to flaws in both Signal and WhatsApp (which I single out because I use them), it's theoretically possible for strangers to add themselves to an encrypted group chat.

Chinese LuckyMouse APT has been using a digitally signed network filtering driver in recent attacks

Security Affairs

Security experts observed the LuckyMouse APT group using a digitally signed 32- and 64-bit network filtering driver NDISProxy in recent attacks. The APT group has been active since at least 2010, the crew targeted U.S.

Granular Security at the App Level

Thales eSecurity

My last blog about Vormetric Application Encryption covered new RESTful APIs and it revealed that those APIs provide quite a bit of granular control in the use of encryption keys. This blog returns to the “SDK” flavor of Vormetric Application Encryption. Encryption

Days After Massive Breach, Marriott Customers Await Details

The Security Ledger

» Related Stories Massive Marriott Breach Underscores Risk of overlooking Data Liability Researchers: GDPR Already Having Positive Effect on Cybersecurity in EU Report: Small, Stealthy Groups Behind Worst Cybercrimes.

Telstra warns public trust will crumble unless access to data is limited

The Guardian Data Protection

Telstra Data protection Australia news Telecommunications industry Technology Privacy Encryption

Podcast Episode 133: Quantum Computing’s Security Challenge and Life After Passwords

The Security Ledger

I'm joined by Avesta Hojjati, Head of DigiCert Labs and Brian LaMacchia, Distinguished Engineer and Head of the Security and Cryptography Group at Microsoft Research to talk about coming quantum revolution and what it means for security. I’m joined by Avesta Hojjati, Head of DigiCert Labs and Brian LaMacchia, Distinguished Engineer and Head of the Security and Cryptography Group at Microsoft Research to talk about coming quantum revolution and what it means for security.

IoT 40

Crypto Fight: US Lawmakers Seek Freedom From Backdoors

Data Breach Today

Secure Data Act' Tries to End Long-Running Encryption Standoff A bipartisan group of U.S. lawmakers has reintroduced legislation in the House that would stop the government from forcing software vendors to intentionally weaken their products for surveillance purposes. Two prior attempts to enact the legislation in Congress have failed

Sodin Ransomware includes exploit for Windows CVE-2018-8453 bug

Security Affairs

In October, Kaspersky revealed that the CVE-2018-8453 vulnerability has been exploited by the APT group tracked as FruityArmor , a cyber-espionage group that was first observed in 2016 while targeting activists, researchers, and individuals related to government organizations.

Researchers Find New Fast-Acting Side-Channel Vulnerability

Dark Reading

A group of researchers from Georgia Tech have discovered a method for pulling encryption keys from mobile devices without ever touching the phones, themselves

Victims of Pylocky ransomware can decrypt their files for free

Security Affairs

Victims of the PyLocky Ransomware can use a tool released by security researcher Mike Bautista at Cisco Talos group to decrypt their files for free. The encryption routines are implemented using the PyCrypto library and leverage the 3DES (Triple DES) cipher.

Marriott: Data on 500 Million Guests Stolen in 4-Year Breach

Krebs on Security

Marriott said the intruders encrypted information from the hacked database (likely to avoid detection by any data-loss prevention tools when removing the stolen information from the company’s network), and that its efforts to decrypt that data set was not yet complete.

Data 247

Platinum APT and leverages steganography to hide C2 communications

Security Affairs

The Platinum cyber espionage group uses steganographic technique to hide communications with the Command and Control Servers (C&C). The APT group was discovered by Microsoft in 2016, it targeted organizations in South and Southeast.

WhatsApp Compromised by Spyware

Adam Levin

The vulnerability, discovered earlier this month, allowed third parties to see and intercept encrypted communications. The spyware deployed has been traced back to NSO Group, an Israeli cyber company alleged to have enabled Middle East governments to surveil its citizens.

Securing Sensitive Data in Pivotal Cloud Foundry

Thales eSecurity

Fortunately, transparent data encryption can protect sensitive data without slowing down operations and does not require changing services and applications. Vormetric Transparent Encryption. This effectively limits data file access to only allowed users and groups.

Cloud 109

GUEST ESSAY: Australia’s move compelling VPNs to cooperate with law enforcement is all wrong

The Last Watchdog

When government agencies and international intelligence groups pooled together resources to gather user data, the VPN’s encryption seemed like the light at the end of the tunnel. All telecoms companies will have to build tools in order to bypass their own encryption. This shakes the very foundations upon which Internet security and VPN end-to-end encryption are built. ” Australia has now become the first Western nation to ban encryption.

These hackers have breached FBI-affiliated websites and leaked data online

Security Affairs

Media outlet Techcrunch reported that a hacker group has breached several FBI-affiliated websites and leaked the stolen info online. TechCrunch spoke to one of the hackers, who didn’t identify his or her name, through an encrypted chat late Friday. “We