This week, SonicWall protects against the newest Intel chip vulnerability, millions more records are found unprotected online and Google Chrome has a serious security flaw.

SonicWall Spotlight

SonicWall Extends SMB Cybersecurity Ambitions – Security Boulevard

• SonicWall’s Dmitriy Ayrapetov provides insight into SonicWall’s newest product releases, where SonicWall is heading and the benefits of unifying cybersecurity systems.

SonicWall Aims at Evasive Cyber Threats Targeting Wireless Networks, Cloud Apps, Endpoints – CRN (India)

• CRN India review the new SonicWall releases in detail and Jeff Wilson, Senior Research Director at IHS Markit, highlights the need for cloud protection as provided by SonicWall Cloud App Security 2.0.

Cyber Security News

‘Spoiler’ Flaw in Intel CPUs is Similar to Spectre – Yet Dangerously Different – Tech Radar

• A new Intel chip vulnerability dubbed ‘Spoiler’ is similar to the Spectre flaw that allows an attacker to exploit the way PC memory works. Attackers using the flaw can, amongst other things, view data from running programs which should otherwise not be accessible. SonicWall RTDMI identifies and blocks this threat.

Google Confirms Serious Chrome Security Problem – Here’s How to Fix It – Forbes

• Google issues an urgent update warning for all Chrome users after a zero-day vulnerability was discovered being exploited in the wild.

An Email Marketing Company Left 809 Million Records Exposed Online – Wired (UK)

• Researchers found over 150 gigabytes of detailed private data, including hundreds of millions of unique email addresses and personal social media accounts, easily accessible online after an “email verification” company left the records exposed.

Project Zero Discloses High-Severity Apple macOS Flaw – Threat Post

• Google Project Zero researchers detail a new high-severity macOS flaw after Apple failed to patch it by the 90-day disclosure deadline.

A CEO Cheat Sheet for the Cybersecurity Big One – Forbes

• Warren Buffet calls it “The Big One” – it’s the worst-case cybersecurity scenario for a company. Forbes provide a CEO cheat sheet with tips on how to prepare for it.

Cyberattack Planning Is Still Depressingly Poor, Even in Big Businesses – ZDNet (UK)

• A report by the British government has found that while most companies have some kind of cybersecurity strategy in place, many have not tested it, or fail to fully understand the threats faced.

After the Breach: Six Key Actions to Take – IT Pro Portal

• Contain, Identify, Determine, Announce, Offer, and Make Sure it doesn’t happen again – IT Pro Portal detail six steps a company must follow if they suffer a data breach.

Ransomware Warning: The Gang Behind This Virulent Malware Just Changed Tactics Again – ZDNet (UK)

• The gang behind the GandCrab ransomware, who sell it through a Ransomware “as-a-service” model, are under constant cybersecurity scrutiny and continue to change tactics. Instead of targeting small networks they are now advertising to those who want to go after larger targets for a bigger payday.

In Case You Missed It

• New Spoiler Side-Channel Attack Threatens Processors, Mitigated by SonicWall RTDMI – Brook Chelmo
• Eight New Ways the SonicWall Capture Cloud Platform Protects Businesses – Bill Conner
• Modern SaaS Security: How to Secure Email, Data, User Access in the Age of Cloud Apps – Ganesh Umapathy
• Easier Wi-Fi Planning, Security & Management from the Cloud – Srudi Dineshan
• Advanced Endpoint Detection & Response (EDR) Comes to Capture Client 2.0 – Brook Chelmo

This week, ATM hacking is so easy cybercriminals turn it into a game, the flaws in blockchain are investigated, and the British Labour Party lockdown their data.

SonicWall Spotlight

January 2019 Cyber Threat Data: New Year, New Malware Attack Variants – SonicWall Blog

• SonicWall’s threat blog for January 2019 finds that while overall malware attacks are dropping, the variants of malware are growing with twice as many new threats diagnosed compared to the same time last year.

Cyber Security News

Once Hailed as Unhackable, Blockchains Are Now Getting Hacked – MIT Technology Review

• MIT Technology review traces how all blockchain technology payments like Bitcoin are vulnerable to “51% Attacks” due to the inherent structure of blockchain. Renting enough mining power to attack bitcoin would cost more than $260,000 per hour but, with lesser-known blockchain currencies, this figure drops dramatically.

Russian Hackers Targeted European Research Groups, Microsoft Says – New York Times

• Microsoft reports that the hacker group Fancy Bear, often associated with Russian intelligence, are targeting European think tanks and NGOs in the lead up to the 2019 European Parliament election. Russian officials deny any links to the group.

Data-Spewing Spectre Chip Flaws Can’t Be Killed by Software Alone, Google Boffins Conclude – The Register (UK)

• Although Intel announced hardware fixes for some of the Spectre vulnerabilities in 2018, Google researchers have concluded that the proposed solution of simply fixing the remaining issues with software is not a viable option.

ATM Hacking Has Gotten so Easy, the Malware’s a Game – Wired

• ATM hacking is usually seen as easily preventable if basic cybersecurity protocols are followed. However, many ATMs worldwide simply never receive updates. As a result, theft from ATMs has become so easy that some hackers have turned their hacking malware into a game.

Ransomware Attacks Classified as a Felony Under Proposed Maryland Bill – Health IT Security

• Proposed legislation in Maryland wants to lower the financial threshold for a ransomware attack to be considered as a felony from $10,000 to $1,000 USD.

POS Firm Says Hackers Planted Malware on Customer Networks – ZDNet

• A Point of Sale (POS) company based in Minnesota announced that a security breach in January 2019 led to almost 140 of its customers being affected by malware. Full details are not available, but it is likely that any card details used on the POS systems while the malware was active were compromised.

When Cyberattacks Pack a Physical Punch – Threat Post

• “Physical” cyberattacks, where hardware is compromised or physical infrastructure like a burglar alarm is attacked, now count for more than one in ten data breaches. Threat Post investigates the shrinking gap between cyber and physical security.

Data Breach Rumours Abound as UK Labour Party Locks Down Access to Member Databases – The Register (UK)

• The UK Labour Party announced this week that its databases would be unavailable after confirmed access by “individuals who are not, or are no longer, authorised to do so.” It is likely this refers to the recently launched Independent Group of breakaway MPs who made headlines leaving the party this past week.

In Case You Missed It

• 7 Reasons to Upgrade to the Next Generation of SonicWall Email Security Appliances – Ganesh Umapathy
• Bill Conner: How the UK Is Taking Malware Seriously – Nicole Landfield
• Network Security for K-12 School District Simplified with Powerful Firewall, Failover Capabilities – Brook Chelmo
• In the Field: Real-World Success with SonicWall Overdrive 2.0 – Joe Velderman
• SSL, TLS Certificates Expiring on US Government Sites During Federal Shutdown – Brook Chelmo

This week, Collections #2-5 drop over 2 billion stolen logins, Bangladesh is suing a Philippines bank over cybertheft and SonicWall CEO Bill Conner discusses keeping up with the cybersecurity market.

SonicWall Spotlight

Could Cash-Rich Facebook Be Considering Acquisition Targets? – Real Money

• SonicWall CEO Bill Conner is quoted by Real Money talking about Facebook’s need for cybersecurity acquisitions in a piece that speculates where the company might go next.

Are We Really Aware of What Mobile Malware Is? – VarIndia

• SonicWall’s Debasish Mukherjee is interviewed as part of a panel discussing the mobile malware. He talks about the data SonicWall Capture Labs found on the Android platform throughout 2018.

SonicWall Aims to Build Brand in Critical Two Years – IT Europa

• Bill Conner, CEO of SonicWall, lends his thoughts to IT Europa talking about the future of the fast-moving cybersecurity market and why not every security company is able to keep up.

Cyber Security News

Hackers are Passing Around a Megaleak of 2.2 Billion Records – Wired

• After the leak of Collection # 1 earlier in the year Collections #2-5 continue the data dump of hacked records, largely information that has been leaked previously.

Airbus Reports Breach Into Its Systems After Cyber Attack – Reuters

• Airbus detected a cyberattack which resulted in a data breach of mostly employee data. It says the incident did not affect commercial operations.

What Was the Cybersecurity Impact of the Shutdown? – FCW

• With the Government shutdown over, the cybersecurity impact is still being worked out. FCW discuss the possible knock-on effects and how long they might last.

IT Spending Expected to Rise in 2019 Amid Shift to Cloud Services – Wall Street Journal

• Forecasts for IT enterprise spending say there will be an 8.5% growth this year, and overall IT spending is expected to rise 3.2%.

Too Few Cybersecurity Professionals Is a Gigantic Problem for 2019 –

• There is a global gap of nearly 3 million cybersecurity positions. In the USA alone 314,000 jobs were posted in a one-year period between 2017 and 2018. Cybersecurity training itself is a new area and almost no cybersecurity professional over 30 today has a formal cybersecurity degree.

Bangladesh to Sue Philippine Bank Over $81M Cyber Heist – Security Week

• A digital heist in 2016 led to the successful theft of $81 million from the Bangladesh central bank’s account with the US Federal Reserve. Bangladesh is now attempting to retrieve the funds by suing the Philippines bank that facilitated the transfer. The Federal Reserve denies that it was hacked.

Massive DDoS Attack Generates 500 Million Packets per Second – Dark Reading

• A DDos attack on Github in 2018 made headlines as the biggest ever DDos attack, but it was only a quarter of the size of the attack stopped earlier this month.

Cryptocurrency Thefts, Scams Hit $1.7 Billion in 2018: Report – Reuters

• Cryptocurrency theft rose 400 percent in 2018, with up to $1.7 billion stolen by the end of the year. $950 million of this was theft from cryptocurrency exchanges and digital wallets.

In Case You Missed It

• In the Field: Real-World Success with SonicWall Overdrive 2.0 – Joe Velderman
• SSL, TLS Certificates Expiring on US Government Sites During Federal Shutdown – Brook Chelmo
• December 2018 Cyber Threat Data: Ransomware Peaking Globally – John Lynch
• 4 Security Predictions for MSSPs in 2019 – Brook Chelmo
• Is 802.11ax Going Away? And What is Wi-Fi 6? – Srudi Dineshan

This week, one city is back to using pen and paper after a ransomware attack, cybercriminals utilize popular video game Fortnite in a money laundering scam and construction industry cranes are alarmingly vulnerable to being hacked.

SonicWall Spotlight

SSL, TLS Certificates Expiring on US Government Sites During Federal Shutdown – SonicWall Blog

• SonicWall’s Brook Chelmo explains why US Government websites are starting to suffer during the ongoing Government Shutdown, explaining that security certificates are not being updated and what kind of messages you might be seeing as a result.

Cyber Security News

Hack Brief: An Astonishing 773 Million Records Exposed in Monster Breach – Wired

• Wired details the mega-breach where at least 773 million emails and 21 million unique passwords have been released in a folder called “Collection #1.” Some are calling this the largest collection of breached data ever found, although it should be noted that Collection #1 is a compilation of both old and new leaked details.

Fortnite Is Being Used by Criminals to Launder Cash Through V-Bucks – ZDNet

• Criminals have been using the in-game currency in Fortnite for laundering money from stolen cards. It is not known exactly how much profit the cybercriminals have made, but Fortnite coins sold on eBay alone have grossed over $250,000 in two months.

Defense Department Continuously Challenged on Cybersecurity – Security Week

• A report has revealed that while the U.S. Department of Defense has been making strides to improve their cybersecurity stance, they are still struggling. In September of last year there were 266 open cybersecurity‑related recommendations, some dating as far back as 2008.

NotPetya Victim Mondelez Sues Zurich Insurance for $100 Million

• Zurich insurance rejected a $100 million claim by Mondelez saying that since the NotPetya ransomware attack has been seen by some, including the UK government, as a Russian military attack it is not covered by standard insurance against malware. Mondelez are taking legal action in response.

Oklahoma Gov Data Leak Exposes FBI Investigation Records, Millions of Department Files – ZDNet

• A storage server belonging to the Oklahoma Department of Securities was found with terabytes of confidential data exposed and accessible to the public.

Yes, You Can Remotely Hack Factory, Building Site Cranes. Wait, What? – The Register

• Cybersecurity protection on cranes, drilling rigs, and other heavy machinery has been found to be severely lacking with a report into the area finding that none of the radio remote controllers investigated had “implemented any protection mechanism to prevent unattended reprogramming.”

WEF: Cyber-Attacks a Major Global Risk for Next Decade – Infosecurity Magazine

• The World Economic Forum released a reporting stating that cyberattacks remain as one of the risks facing the world today with 82 percent of those queried stating they expect data and monetary theft attacks to increase.

Ransomware Attack Sends City of Del Rio Back to the Days of Pen and Paper – ZDNet

• Officials at Del Rio, Texas, had to abandon their computers and switch to pen and paper after a ransomware attack last week. It has not been revealed who is behind the ransomware but the FBI have been informed and are investigating.

Emotet Malware Returns to Work After Holiday Break – BankInfoSecurity

• Whether coincidence or a sign that the criminals were actually on holidays, a number of malware strains including Emotet have returned in 2019 after falling out of use towards the end of the year. BankInfoSecurity trace the history and usage of Emotet, including information on where in the world it has and has not been striking.

In Case You Missed It

• December 2018 Cyber Threat Data: Ransomware Peaking Globally – John Lynch    
• 2018 Holiday Cyber Threat Data: Final Analysis Shows Big Ransomware Spikes in US, UK – John Gordineer
• 4 Security Predictions for MSSPs in 2019 – Brook Chelmo
• Is 802.11ax Going Away? And What is Wi-Fi 6? – Srudi Dineshan

How long did it take before 2019’s first cyberattack took place? Find out this and more. SonicWall has collected this week’s best cybersecurity stories, just for you.

SonicWall Spotlight

SonicWall Celebrates Key EMEA Milestones  – Enterprise Channels MEA

• SonicWall’s Michael Berg comments on SonicWall’s boosted presence in EMEA, crediting channel expertise and commitment to speaking the local language as key factors in growth.

Ransomware Attacks Hit Legal System – Today’s General Counsel Magazine

• An investigation into the growing threat of ransomware in the legal world uses SonicWall 2018 data as its jumping off point.

Cyber Security News

The Elite Intel Team Still Fighting Meltdown and Spectre – Wired

• The Spectre and Meltdown vulnerabilities were first announced a year ago and made major waves in the news cycle due to their scope and impact. Wired follow up on the story with an in-depth look at how STORM, Intel’s strategic offensive research and mitigation hacker group, have been dealing with the problem.

Town of Salem Breach Affects 7 Million Accounts – SC Magazine

• Some payment information was exposed in the breach, but the main leak was of usernames, email addresses, hashed passwords, IP addresses, game and forum activity. The developers have stressed that no card numbers were leaked.

What We Still Don’t Know About the Cyberattack on Tribune Newspapers – Washington Post

• A cyberattack seriously hampered printing several papers owned by Tribune Publishing, including The L.A. Times. While the Tribune group say they suspect the cyberattack originated from abroad, they have given little other information and the identity and motive of attackers remain unclear.

Dublin’s Luas Tram System Threatened With Private Data Leak – ZDNet

• Dublin’s tram system is hit with what looks like a ransomware attack that threatens to expose online users unless a ransom of one bitcoin is paid.

Your Data Was Probably Stolen in Cyberattack in 2018 – and You Should Care – USA Today

• Marriott, Quora, Facebook, Dunkin’ Donuts; USA today summarize the biggest hacks of 2018 and come to the conclusion that very few people have escaped unscathed.

German Politicians Targeted in Mass Data Attack  – BBC

• Hundreds of German politicians, including Chancellor Angela Merkel, had personal details stolen and published on Twitter throughout December. No one has publicly taken responsibility for the attack yet but all parties except those on the far right were affected.

This Data-Stealing Android Malware Infiltrated the Google Play Store, Infecting Users in 196 Countries – ZDNet

• When an App is first uploaded into the Google Play Store it is subject to tough reviews to ensure it is safe for users, but some malware developers have been taking advantage of less stringent checks later down the line and injecting malware as an update.

2019’s First Data Breach: It Took Less than 24 Hours – CBR Online

• The first data breach of 2019 was reported less than 24 hours into the New Year when an estimated 30,000 Australian civil servants had work emails, phone numbers and job titles leaked. Thankfully, no financial information is said to have been affected.

In Case You Missed It

• 5 Tips to Keep You Cybersecure During Holiday Travel – Nicole Landfield
• 4 Security Predictions for MSSPs in 2019 – Brook Chelmo
• Is 802.11ax Going Away? And What is Wi-Fi 6? – Srudi Dineshan
• 6 Phishing Scams to Look Out for this Holiday Shopping Season – Ganesh Umapathy
• Video: Why Layered Security Matters – Geoff Blaine
• NRF 2019: Join SonicWall at the ‘Big Show’ – Nicole Landfield