Welcome to This Week’s [in]Security. We’ve collected and grouped together a selection of this week’s news, opinions, and research. Quickly skim these annotated links organized by topic: compliance and payment security, breaches, regulation, bugs, privacy, hacking/malware, other security & risk, and more. We hope you enjoy and find them useful.
PCI Compliance and Payments
Breaches / Leaks
Laws & Regulations / Standards
Privacy
Bugs / Design Flaws
Hacking / Malware / Cybercrime
Other Security / Risk
- Cybersecurity jargon is becoming "word salad" so (ISC)2 has published a Lexicon http://blog.isc2.org/isc2_blog/2018/02/welcome-to-the-lexicon-project.html
- Mozzilla analyzes Alexa top 1M sites year over year for security (e.g. CSP, Secure cookies, CORS, HTTPS, HSTS, and more) https://blog.mozilla.org/security/2018/02/28/analysis-alexa-top-1m-sites-2/
- New Bullteproof TLS newsletter: Chrome marking HTTP insecure, SSL and early TLS deprecation, Post-Quantum crypto, TLS mail guidance, cert life lines, TLS 1.3, text book RSA found in the wild (very bad), SSL labs changes, TLS https://www.feistyduck.com/bulletproof-tls-newsletter/issue38chromewillmarkhttppagesasnot_secure.html
- Beyond the hype, what blockchain is good for https://freedom-to-tinker.com/2018/02/26/blockchain-what-is-it-good-for/
- More on Mixpanel and other web replay tools collecting passwords and other sensitive data https://freedom-to-tinker.com/2018/02/26/no-boundaries-for-credentials-password-leaks-to-mixpanel-and-session-replay-companies/
- The underground market for counterfeit web certificates https://www.bankinfosecurity.com/darknet-vendors-sell-counterfeit-tls-certificates-a-10680
- Breached data shows US Army, FBI, and ICE personnel purchased spyware, but why? https://motherboard.vice.com/en_us/article/ywqqkw/military-fbi-and-ice-are-customers-of-controversial-stalkerware
- MIT researches propose "Veil" framework to plug private browsing modes leaks https://www.theregister.co.uk/2018/02/26/mitwangveil_browsing/
- E-mail leaves a trail of evidence, how Manafort and Gates got caught diddling documents https://www.schneier.com/blog/archives/2018/02/e-mailleavesa.html
- USPS Informed Delivery now notifies you if someone signs up to see your mail https://krebsonsecurity.com/2018/02/usps-finally-starts-notifying-you-by-mail-if-someone-is-scanning-your-snail-mail-online/
- Digital hygiene and cyber-security for the traveler https://www.datex.ca/blog/cybersecurity-travel-tips-when-going-abroad
- How can techniques developed to fight wild fires help security incident response https://www.darkreading.com/attacks-breaches/incident-management-what-it-security-can-learn-from-public-safety/a/d-id/1331120
- Tim Horton's gets hit by malware, crashing cash registers https://www.ctvnews.ca/business/virus-downs-hundreds-of-tim-hortons-cash-registers-furious-owners-threaten-lawsuit-1.3821172
- Canada to scrap $1B IBM Phoenix payroll system https://www.bloomberg.com/news/articles/2018-03-01/canada-to-scrap-ibm-payroll-plan-gone-awry-costing-c-1-billion
Off-Topic