Robert Lemos

In at least three separate campaigns, online attackers have used a feature of Microsoft Office documents—known as the Dynamic Data Exchange (DDE) protocol—to download and execute malware, internet security firm Zscaler stated in a Nov. 15 analysis of the attacks. The DDE fields allow a document, such as an Excel spreadsheet, to automatically update its […]

After clear evidence emerged that Russia attempted to influence the results of the 2016 U.S. presidential election by social media, and more directly by hacking election systems, state governments are embarking on a variety of efforts to use statistical auditing to verify election results. On Nov. 15, Colorado kicked off its first statewide statistical audit […]

Despite a steady diet of news coverage of major data breaches, more than two-thirds of people have never used two-factor authentication—a second way of identifying themselves when logging into an online account, according to a survey-based report published by Duo Security on Nov. 7. The report found that 28 percent of Americans had ever used […]

Facing a ban of its products by U.S. government agencies and an ongoing congressional investigation for allegedly aiding Russian intelligence, security firm Kaspersky Lab released on Oct. 25 its own analysis into whether its software was used to steal data from the U.S. government, arguing that it found only a single case where classified data […]

More than 35,000 servers that host remote desktops for companies have been compromised by an Eastern European group that is selling access to the computers for less than $15 each, threat-intelligence firm Flashpoint stated in an analysis published on Oct. 24. The compromised remote desktop protocol (RDP) servers allow the dark-web group to offer anonymization […]

Companies may get the legal power to chase cyber-criminals across the Internet, if a bill introduced in the U.S. House of Representatives passes muster. The bill, the Active Cyber Defense Certainty Act (ACDC), is the brainchild of Rep. Thomas Graves (R-GA), who started pitching the legislation in March and accepted industry comment over the past […]

While North Korean and Russian cyber operations have dominated the news, hackers linked to China continue to target a variety of organizations worldwide, according to two separate reports published by security firms in the last week. One Chinese group has revived a decade-old remote access Trojan (RAT), known as “Hacker’s Door,” and begun using it […]

While attacks attributed to Russia and China most frequently make the news, North Korea continues to have significant success online, driven by a single-minded mission and a lack of consequences for the small nation. In the latest incident to be uncovered, an online attack linked to North Korea stole classified military documents, including war plans […]

The Securities and Exchange Commission announced on Sept. 20 that the agency online filing system, where all publicly-traded companies are required to file their financial statements, was hacked in 2016 to facilitate insider trading. The SEC, which regulates U.S. stock markets, discovered the breach last year, but did not know that the issue may have […]

The software supply chain is increasingly under threat by attackers who seek to turn legitimate software programs into Trojan horses that can compromise millions of computers. On Monday, security-software firm Avast announced that its popular system-cleaning program CCleaner—developed by Piriform, a company acquired by Avast in July—had been compromised during development and infected users’ system […]

The U.S. government banned any federal agency from using products made by Russian-owned and operated security firm Kaspersky Lab, concluding that the level of access that the security products have to be too great a risk for national security. In a Binding Operational Directive (BOD) published on Sept. 13, Elaine Duke, acting Secretary of U.S. […]

Security experts have long warned that legal identity verification should not just be linked to knowing four pieces of personal information: a person’s name, address, birth date and Social Security number. Yet, many companies rely on this data as their primary way to identify their customers. Thousands of people lose control of their phone numbers […]