How to hack a Jeep Cherokee – but don’t try this at home, kids

From Sophos Naked Security:

How to hack a Jeep Cherokee – but don’t try this at home, kids

"Charlie Miller and Chris Valasek originally hacked a Jeep Cherokee in 2015, physically controlling it – and a nervous journalist occupying it – on the highway. FCA, the company that makes the Cherokee, recalled 1.4m of them and issued a patch. In response, the pair hacked that one, too, and gained more control, rather than less. Earlier this year, they put all their notes online, which most of us missed until Valasek tweeted it."

Cisco Patches Critical Flaw in Small Business Router

From SecurityWeek:

Cisco Patches Critical Flaw in Small Business Router

"Cisco has released a firmware update for one of its small business routers to address a critical vulnerability that can be exploited for denial-of-service (DoS) attacks and arbitrary code execution.

The vulnerability, discovered by researchers from GeekPwn, a China-based IoT-focused hacking competition, affects CVR100W Wireless-N VPN routers. The company said there was no evidence of malicious exploitation."

Samsung Smart TV flaw leaves devices open to hackers

From Sophos Naked Security:

Samsung Smart TV flaw leaves devices open to hackers

"Your Samsung Smart TV might be pretty dumb.

Penetration testing firm Neseso has found that a 32-inch Tizen-based smart TV, first released as part of the 2015 model year and still being sold in North America, isn’t authenticating devices that connect to it via Wi-Fi Direct.

Rather than requiring a password or PIN to authenticate devices that want to connect to the TV – like, say, your smartphone when you want to use it as a remote control – it’s relying on a whitelist of devices that the user’s already authorized."

Murder victim’s Fitbit contradicts husband’s version of events

From Sophos Naked Security:

Murder victim’s Fitbit contradicts husband’s version of events

"A murdered woman’s Fitbit data indicates her husband may have lied about her being shot to death by a masked intruder who, he’d claimed, had zip-tied him to a chair and calmly cut him up… without leaving any scent anywhere in or around the house that a police dog could sniff out.

According to court documents, the woman, Connie Dabate, was shot dead in her Ellington, Connecticut home on December 23 2015. The weapon used to murder her was a .357 Magnum that her husband, Richard, had bought months earlier."

New BrickerBot Variants Emerge

From SecurityWeek:

New BrickerBot Variants Emerge

"New variants of a recently discovered BrickerBot Internet of Things (IoT) malware capable of permanently disabling devices were observed last week, Radware security researchers warn.

BrickerBot first emerged about a month ago, with two variants observed in early April. The first threat had a short life span of less than a week and targeted BusyBox-based Linux devices. The other is still activ and targeting devices both with and without BusyBox. Devices with an exposed Telnet service that is secured with default credentials are potential victims."

Flaws in Hyundai App Allowed Hackers to Steal Cars

From SecurityWeek:

Flaws in Hyundai App Allowed Hackers to Steal Cars

"South Korean carmaker Hyundai has released updates for its Blue Link mobile applications to address vulnerabilities that could have been exploited by hackers to locate, unlock and start vehicles.

The Blue Link application, available for both iOS and Android devices, allows users to remotely access and monitor their car. The list of features provided by the app includes remote engine start, cabin temperature control, stolen vehicle recovery, remote locking and unlocking, vehicle health reports, and automatic collision notifications."

Elon Musk’s Billion-Dollar Crusade to Stop the A.I. Apocalypse

From Vanity Fair:

Elon Musk’s Billion-Dollar Crusade to Stop the A.I. Apocalypse

"Elon Musk is famous for his futuristic gambles, but Silicon Valley’s latest rush to embrace artificial intelligence scares him. And he thinks you should be frightened too. Inside his efforts to influence the rapidly advancing field and its proponents, and to save humanity from machine-learning overlords."

Watch hackers remotely immobilize a car while it's traveling on a highway

From Network World:

Watch hackers remotely immobilize a car while it's traveling on a highway

Two hackers were able to remotely disable the transmission of a Jeep Cherokee while a Wired journalist was driving it at about 70 miles per hour on a highway.

The IoT Convergence: How IT and OT Can Work Together to Secure the Internet of Things

From Tripwires State of Security blog:

The IoT Convergence: How IT and OT Can Work Together to Secure the Internet of Things

In the past, information technology (IT) and operational technology (OT) were seen as two distinct domains of a business. The former focused on all technologies that were necessary to manage the processing of information, whereas the latter supported the devices, sensors and software that were necessary for physical value creation and manufacturing processes.

In The Cyber Realm, Let’s Be Knights Not Blacksmiths

From Dark Reading:

In The Cyber Realm, Let’s Be Knights Not Blacksmiths

It happens every year. I attend the major security conferences and watch them devolve into rhetoric-filled conduits void of productivity and education. In fact, many decisions-makers no longer attend. And if they do, they don’t appear at many sessions and avoid venturing into the noise of the vendor exhibit floor.

 

It’s the same monotonous commotion. Vendors and experts flooding the floor and claiming, “We are the only one doing this.” It’s been quite a while since I’ve seen new technology that makes me think, “Wow, that’s unique.” Each year, everyone has their spin on four components of the same mantra:

• Artificial Intelligence/Machine-Learning 
• Big Data Analytics
• Anomaly Detection 
• Finding the “Right Needle in the Stack of Needles”

The 'Internet of Things' as a Security Risk

From Data Breach Today:

The 'Internet of Things' as a Security Risk

In the interview, Hay identifies three risks associated with Internet of Things devices connected to an enterprise network:

• Creating a new attack vector: Consumer-oriented IoT devices can be manipulated to give hackers new avenues to exploit enterprise networks remotely.
• "Keeping bad company": IoT devices could be linked to cloud services that could be controlled by untrustworthy hosts, which might not promptly patch vulnerabilities, resulting in compromised user credentials, exposure of personal information or revelation of trade secrets.
• Facilitating new vulnerabilities: Installing on enterprise networks minimally secured, relatively cheap consumer gadgets - so-called "toys in the attack" - creates new avenues for remote exploitation.

Spyware Vendor Alert: Suspend Software

From Data Breach Today:

Spyware Vendor Alert: Suspend Software

Surveillance software maker Hacking Team, also known as HT S.r.l., has confirmed that it has been hacked (see Surveillance Software Firm Breached).

The Italian company has advised users of its spyware - sold to police and government intelligence agencies - to temporarily suspend their use of the software, pending the company's data breach investigation.

Why Hackers Are Trying to Get Into Your Refrigerator

From Inc. Magazine:

Why Hackers Are Trying to Get Into Your Refrigerator

More and more, the physical world and the online world are intricately connected. Vital systems that support life and civilization are connected to the Internet--the power grid, sewers, transportation, and many others. And all that critical infrastructure is run by error-prone humans, meaning it's vulnerable to devastating cyberattacks.

On a more local, personal scale, an ever-increasing number of consumer gadgets and appliances are now equipped to communicate over the Internet. By 2020, market research firm IDC estimates, the so-called The Internet of Things will comprise 200 billion devices. As with our infrastructure, however, connecting all that equipment makes it a potential target for hackers. Unfortunately, medical devices, smart TVs, refrigerators, and thermostats do not have proper security protocols.

IoT Devices Hosted On Vulnerable Clouds In 'Bad Neighborhoods'

From Dark Reading:


IoT Devices Hosted On Vulnerable Clouds In 'Bad Neighborhoods'


OpenDNS report finds that organizations may be more susceptible to Internet of Things devices than they realize.

Internet of Things devices do create new opportunities for attackers to remotely exploit organizations that are too casual about securing their corporate network from unfamiliar Fitbits, according to new research released today by OpenDNS.

IoT devices entering enterprises, opening company networks to attacks

From Help Net Security:


IoT devices entering enterprises, opening company networks to attacks


OpenDNS released The 2015 Internet of Things in the Enterprise Report, a worldwide data-driven security assessment of Internet of Things (IoT) devices and infrastructure found in businesses.

Using anonymized data from the billions of Internet requests routed through OpenDNS’s global network daily, the report details the scale to which IoT devices are present in enterprise environments and uncovers specific security risks associated with those devices. Key findings indicate IoT devices are prevalent in highly regulated industries, and infrastructure supporting those devices are vulnerable to well-known and patchable security flaws.


I find this particularly disturbing:


Though traditionally thought of as local storage devices, Western Digital cloud-enabled hard drives are now some of the most prevalent IoT endpoints observed. Having been ushered into highly-regulated enterprise environments, these devices are actively transferring data to insecure cloud servers.

Russian billboard advertising contraband hides when it recognises cops

From Sophos Naked Security:

Russian billboard advertising contraband hides when it recognises cops

Moscow's Don Giulio Salumeria promises "small islands of warm and sunny Italy," offering authentic Italian prosciutto, ricotta, mozzarella and tiramisu for sale in the cold lands of Russia.

Fat lot of good any of it will do Muscovites, given that Russia has banned food imports from the European Union and the US.

CANard – Vehicle Hacking Platform

From SecTechNo:


CANard – Vehicle Hacking Platform


Hacking cars have been demonstrated several times this year. New technologies that were implemented served in improving Cars connectivity and usability, but on the other hand have opened some security gaps that car manufactures should fix.

IoT and the great data heist

From Help Net Security:


IoT and the great data heist


The term mobile has evolved from the device that simply made and received phone calls, to smartphones, wearables and a multitude of devices in the home.

Securing the smart grid: European Network of Cyber Security

From Help Net Security:


Securing the smart grid: European Network of Cyber Security


Dr. Klaus Kursawe is the Chief Scientist at the European Network of Cyber Security (ENCS), where he is leading the research and development activities for critical infrastructure security. In this interview he talks about the challenges related to smart grid security.

RSA Highlighted Impending IoT Troubles

From Dark Reading:

RSA Highlighted Impending IoT Troubles

As attendees digest the messages coming out of RSA Conference last week, they're sifting through plenty of important themes that came to light be it information sharing, big data analytics' impact on security,  and the use of automation to better level the playing field with the scale attackers have achieved. But perhaps one of the most lasting topics to bridge across conference session tracks and cocktail debates is the impending difficulties enterprise IT will face in securing the Internet of Things (IoT).