Attackers Unleash OAuth Worm via 'Google Docs' App

From DataBreach Today:

Attackers Unleash OAuth Worm via 'Google Docs' App

"A malicious app named "Google Docs" by attackers has been making the rounds, attempting to trick Google users into logging in and giving the app access permissions to their account.

The phishing campaign began with an email to victims from an address they likely would have recognized, according to multiple analyses of the attack that have now been posted online by security researchers. But the campaign quickly turned into a worm, as users authorized the bogus app in droves, allowing it to spread to their own contacts."

Organizations Fail to Maintain Principle of Least Privilege

This is a basic tenant of cybersecurity & I cannot stress how important this is to any size organization.  Yes, user audits are painful & tedious but they need to be performed at least annually.  Depending on the size of your organization & its turnover it may even be something to perform on a quarterly basis.

From Security Week:

Organizations Fail to Maintain Principle of Least Privilege

"Security requires that confidential commercial data is protected; compliance requires the same for personal information. The difficulty for business is the sheer volume of data generated makes it difficult to know where all the data resides, and who has access to it. A new report shows that 47% of analyzed organizations in 2016 had at least 1,000 sensitive files open to every employee; and 22% had 12,000 or more.

These figures come from the Varonis 2016 Data Risk Assessments report. Each year Varonis conducts more than 1,000 risk assessments for both existing and potential customers. For its latest analysis of data risk, it has selected, at random, 80 of these assessments. They cover 33 industries in 12 different countries. Forty-two of the organizations have fewer than 1000 employees, and 38 have 1001 or more employees."

Passwords are not treated as critical to security

From Help Net Security:

Passwords are not treated as critical to security

Considering the cyber world we live in, it’s time to ask whether passwords can still be considered a reliable security component – and if so, how should they be used? Look no further than Major League Baseball (MLB) where the St. Louis Cardinals allegedly hacked into the database of rival team the Houston Astros. Law enforcement officials believe the Cardinals were able to easily access the Astros’ database by using a master list of passwords that was created by Jeff Luhnow, and continued to be used after Lunhow left his position with the Cardinals to become general manager of the Astros in 2011.

How to Properly Manage Identities and Secure Documents Within Government Agencies

From Data Breach Today:

How to Properly Manage Identities and Secure Documents Within Government Agencies

Public Key Infrastructure (PKI) enables users to securely and privately exchange data shared through a trusted authority. Though it has been around for years, it has recently come back into the spotlight with Gartner's research entitled "PKI's New Lease on Life in Mobility and the Internet of Things." The value of PKI can be summed up in one word - TRUST.

Apple ditches Recovery Key in new 2FA process for El Capitan and iOS 9

From Sophos Naked Security:

Apple ditches Recovery Key in new 2FA process for El Capitan and iOS 9

Ever since Apple turned on two-step verification (2SV) in 2013, Naked Security has been advising Apple ID users to write down the generated 14-character emergency Recovery Key and then tuck it away where it's safe and sound.

Now, Apple is beta testing operating systems that offer security processes that, thankfully, cut out the Recovery Key, which has been at the heart of horror shows when users lost the precious digits.

How to turn on two-factor authentication on over 100 popular online services

From Help Net Security:


How to turn on two-factor authentication on over 100 popular online services


TeleSign launched Turn It On, a new campaign featuring a guide to two-factor authentication and providing step-by-step instructions for turning on 2FA for over a 100 popular social networking, banking, cloud computing and other online services that offer the 2FA option.

“The number one tip most experts give for increasing account security and stopping the fallout from data breaches is to turn on two-factor authentication,” said Steve Jillings, CEO of TeleSign. “Yet our research shows that the majority of consumers (61 percent) do not know what two-factor authentication is, even though it’s available on almost every account, free to the consumer and just waiting to be turned on.”

Employee credentials of half of European top 500 firms exposed online

From Help Net Security:


Employee credentials of half of European top 500 firms exposed online


Cyber attacks and data breaches very often start with phishing or spear-phishing. Access to good credentials is key - whether it's for straight emailing or direct access to target email systems, etc.

Web intelligence firm Recorded Future has recently scoured the Web’s underbelly, including paste sites and forums, for exposed corporate credentials (emails and passwords), and found that 49 percent of Europes's largest companies have had credentials belonging to their employees exposed online.

Facebook tests new "Security Check" tool to fend off account hijacking

From Sophos Naked Security:


Facebook tests new "Security Check" tool to fend off account hijacking


Ever worried that someone else might access your Facebook account?


Facebook helps with this - as well as Google, PayPal and plenty of other platforms, Facebook can send alerts any time there's a new login, and there are various versions of device management that will list all the devices that have accessed your account.


But how many users skip by these tools, if they even know they exist?

Data breaches lead to surge of spoofing attacks

From Help Net Security:


Data breaches lead to surge of spoofing attacks


The number of attacks on businesses is trending up as crimeware tools gain traction providing tools to fraudsters to automate cybercrime attacks leveraging the customer data made available from breaches.

Microsoft LAPS Tool Tackles Common Local Admin Password Problem

From ThreatPost:


Microsoft LAPS Tool Tackles Common Local Admin Password Problem


Microsoft’s release last week of the Local Administrator Password Solution (LAPS) takes some steps to address an old question of what to do with local admin passwords, but doesn’t provide a complete answer, experts said.

Google Updates Password Alert Extension, But Some Bypasses Still Work

From ThreatPost:


Google Updates Password Alert Extension, But Some Bypasses Still Work


For the second time in less than a week, Google has updated its Password Alert extension for Chrome to address a method for bypassing the warning screens that alert users that they’re entering data on a non-Google site. However, the researcher who discovered the most-recent bypass method said his technique still works on the latest version.

Yahoo develops cheap, effective biometric smartphone authentication

From Help Net Security:

Yahoo develops cheap, effective biometric smartphone authentication

A group of Yahoo researchers have demonstrated that apart from fingerprints, other parts of the human body, such as ears, fists, palms and fingers, can also be successfully used to authenticate users to their mobile phones.

Google unveils Password Alert Chrome extension, an early warning system against phishing attacks

From Sophos Naked Security:

Google unveils Password Alert Chrome extension, an early warning system against phishing attacks

Google has announced the release of a new browser extension designed to protect its users from phishing attacks.

Why you should steer users towards less predictable passwords

From Help Net Security:

Why you should steer users towards less predictable passwords

As users are instructed to create ever more complex passwords, and developers are starting to use encryption methods more difficult to crack than standard hashing functions, password crackers (and penetration testers) must wisely choose which type of password attack to try first, second, and so on.

Listen up! Qualcomm's ultrasonic 3D fingerprint scanner could one day give passwords the finger (hands-on)

From C/Net:

Listen up! Qualcomm's ultrasonic 3D fingerprint scanner could one day give passwords the finger (hands-on)

Sound waves aren't just for voices. They're also adept at priming your prints, and one day replacing your passwords.

Biometrics Is Helping Defend Against Cyber Attacks in Health-Care Industry

Note: Look at source, may be a little biased.

From Security Sales & Integration:

Biometrics Is Helping Defend Against Cyber Attacks in Health-Care Industry

To help prevent cyber espionage and enhance patient safety, medical companies have begun adopting an array of biometrics security systems that use data from a patient’s fingerprint, iris, veins or face. The new technologies are intended to deter the incentive for hacking incidents by removing reliance on information that’s easy to steal and can easily identify patients.

Visual hacking exposed

Back in the day we called this "shoulder surfing"  If someone is standing next to you and you have to enter a password, PIN ... it's NOT rude to politely ask them to turn around or take a few steps back so they cannot see what you're entering.

From Help Net Security:

Visual hacking exposed

While most security professionals focus on thwarting data breaches from cyber attacks, a new study exposes visual hacking, a low-tech method used to capture sensitive, confidential and private information for unauthorized use, as an under-addressed corporate risk.

Cybercrime fighters target human error

From Nature.com (?!?!?!):

Cybercrime fighters target human error

It would be easy to blame the poor soul at Sony Pictures Entertainment who opened the door to one of the most disastrous hacks in history just by clicking an e-mail link. As US President Barack Obama pointed out during a visit to Stanford University in California on 13 February, user negligence is often the key to a successful cyberattack.

Visa to track travelers’ smartphones to cut fraud

From The Columbus Dispatch:

Visa to track travelers’ smartphones to cut fraud

NEW YORK — Those days of calling your bank to let them know that, yes, you really are in Thailand, and yes, you really did use your credit card to buy $200 in sarongs, could be coming to an end.

Top password managers compared

From Network World:

Top password managers compared

Unless you're living off the grid in a cabin in the woods -- and, if you're reading this, you're probably not -- you have more passwords than you can manage. They're all supposed to be long, complicated, unique, and difficult to guess. Oh, and you're supposed to change them all every three to six months.