WHITE HOUSE NEEDS TO URGENTLY FIX NATION’S APPROACH TO PROTECTING CRITICAL INFRASTRUCTURE, GROUP SAYS BY CHRISTIAN VASQUEZ
According to a detailed report from CSC 2.0, a continuation of the Cyberspace Solarium Commission that Congress established in 2019, U.S. government policies designed to protect critical infrastructure against hackers are woefully outdated and inadequate to safeguard critical infrastructure against cyberthreats. Furthermore, were an attack to occur, the commission claims the Cybersecurity and Infrastructure Security Agency (CISA) is not set up to quickly and effectively facilitate rapid response to cyberattacks on the most sensitive systems. Read about CSC 2.0's concerns and find their full report in the full story from CyberScoop.
VERIZON DBIR: SOCIAL ENGINEERING BREACHES DOUBLE, LEADING TO SPIRALING RANSOMWARE COSTS BY TARA SEALS
Verizon's 2023 Data Breach Investigations Report (DBIR), which was released earlier this week, found that a full three-quarters of data breaches in the last year (74%) involved the human element, including social engineering attacks, which accounted for 17% of all breaches. Chris Novak, managing director of cybersecurity consulting at Verizon Business, says that "The fundamentals need to improve, and organizations need to be focusing on cyber hygiene. It's probably the least sexy recommendation I can give you, but it is one of the most fundamentally important things that we see organizations still missing, and of all shapes and sizes. And it's usually because they want to focus on the new flashy technology in the industry, and they forget the basics."
SECURITY PROFESSIONAL’S TWEET FORCES BIG CHANGE TO GOOGLE EMAIL AUTHENTICATION BY AJ VICENS
Less than a month after the roll-out of Google's Brand Indicators for Message Identification (BIMI) program, scammers found a way around its controls and were able to successfully impersonate brands, sending emails to Google users that impersonated the logistics giant UPS. Google is reportedly blaming the discovery on an unnamed “third-party” for allowing its services to be used in ways that bypassed its security controls. While BIMI's goal is to prevent email phishing attacks by attaching blue check marks alongside brand logos for senders participating in the program, security researchers argue that the way BIMI is being implemented means that malicious actors could abuse the system to more effectively impersonate well-known brands, possibly increasing the odds of a successful attack.
DOZENS OF POPULAR MINECRAFT MODS FOUND INFECTED WITH FRACTURISER MALWARE BY DAN GOODIN
CurseForge, a platform that provides plugin software for Minecraft, has discovered that malware has been injected into dozens of offerings it makes available online and is advising users to immediately stop downloading or updating mods. Some of the malicious files used in the attack reportedly date back to mid-April, a sign that the account compromises have been active for weeks. People investigating the incident have made scripts available here to help check for the malicious files created by the malware, and CurseForge recently posted their own disinfection guidance. Read more about which mods are affected and how the malware works in the full story from Ars Technica.
SEXTORTIONISTS ARE MAKING AI NUDES FROM YOUR SOCIAL MEDIA IMAGES BY BILL TOULAS
The Federal Bureau of Investigation (FBI) is warning of a rising trend of malicious actors creating deepfake content to perform sextortion attacks, which typically entails publicly leaking explicit images and videos they stole or otherwise acquired, typically demanding money payments for withholding the material. But sextortionists are now reportedly scraping publicly available images of their targets, like innocuous pictures and videos posted on social media platforms. These images are then fed into deepfake content creation tools that turn them into AI-generated sexually explicit content. The full alert on the matter was published on the FBI's IC3 portal.
