Content by Mathew J. Schwartz

Unpatched VPN Servers Targeted by Nation-State Attackers

Mathew J. Schwartz  •  October 7, 2019

Nation-state attackers have been targeting known flaws that customers have yet to patch in their Pulse Secure, Palo Alto and Fortinet VPN servers, Britain's National Cyber Security Center warns, adding that any organization that didn't immediately apply patches should review logs for signs of hacking.

Malware Most Foul: Emotet, Trickbot, Cryptocurrency Miners

Mathew J. Schwartz  •  October 4, 2019

Banking Trojans and cryptocurrency mining malware continue to be among the most-seen types of malicious code used for nontargeted attacks. But cybercrime attackers are increasingly running targeted campaigns, security researchers warn.

Support for Expunging Huawei Gear From Carrier Networks Grows

Mathew J. Schwartz  •  October 2, 2019

A bipartisan group of lawmakers has introduced a bill to help U.S. telecommunications providers "rip and replace" any Chinese-built networking equipment. The move comes as many experts warn that using Huawei or ZTE 5G equipment poses an unacceptable national security risk.

Zynga's Breach Notification: How Not to Inform Victims

Mathew J. Schwartz  •  October 1, 2019

"Cyberattacks are one of the unfortunate realities of doing business today," reads gaming company Zynga's data breach notification, thus breaking the first rule of crisis management: Own your mistakes. Hacker Gnosticplayers claims the company was still storing passwords using outdated SHA1.

Baltimore Ransomware Carnage Compounded by Local Storage

Mathew J. Schwartz  •  September 30, 2019

The city of Baltimore's ransomware outbreak - $18 million in costs and counting - led to many crypto-locked files being lost forever, because no IT policy mandated centralized file backups. But effective IT solutions exist to help solve this challenge, provided they're deployed in advance of an attack.

Cryptocurrency Shakedown: Old Tactics, New Twist

Mathew J. Schwartz  •  September 27, 2019

More proof that when it comes to crime, there's nothing new under the sun: Federal prosecutors have charged two men with attempting to extort cryptocurrency worth more than $12 million from a startup firm planning to undertake an initial coin offering, in part via physical intimidation.

Why Did Trump Mention CrowdStrike to Ukraine's President?

Mathew J. Schwartz  •  September 26, 2019

Why did U.S. President Donald Trump discuss cybersecurity firm CrowdStrike with the president of Ukraine, saying "the server, they say Ukraine has it"? Experts say Trump appears to be referring to one or more conspiracy theories, none of which have a basis in reality.

Did GandCrab Gang Fake Its Ransomware Retirement?

Mathew J. Schwartz  •  September 25, 2019

Did the gang behind GandCrab fake its retirement? Security experts say there's mounting evidence that the operators of the notorious ransomware-as-a-service operation only announced their retirement after ramping up the rival Sodinokibi/REvil service.

JPMorgan Chase's Russian Hacker Pleads Guilty

Mathew J. Schwartz  •  September 24, 2019

Russian national Andrei Tyurin pleaded guilty to perpetrating massive hack attacks against leading U.S. financial services firms and others from 2012 to mid-2015. Victims included JPMorgan Chase, from which he stole details of 83 million customer accounts.

AI Surveillance Tech Promises Safety, But at What Cost?

Mathew J. Schwartz  •  September 23, 2019

Artificial intelligence technologies that provide surveillance capabilities can have upsides as well as downsides. Unfortunately, as developers and governments rush to experiment, security, privacy, data protection and liability questions remain unanswered.

Accused JPMorgan Chase Hacker Plans to Plead Guilty

Mathew J. Schwartz  •  September 20, 2019

Russian national Andrei Tyurin, who was extradited last year from Eastern Europe to the United States, has stated that he plans to accept a plea deal he's reached with federal prosecutors. Tyurin has been charged with numerous crimes, including hacking JPMorgan Chase and stealing 83 million customer records.

Supply Chain Attacks: Hackers Hit IT Providers

Mathew J. Schwartz  •  September 19, 2019

A hacker group called Tortoiseshell has been hitting targets in the Middle East since at least July 2018, apparently targeting IT service providers to gain access to many potential targets at once. The campaign is fresh proof that criminals and nation-state attackers alike continue to favor supply chain attacks.

Adoption of AI Surveillance Technology Surges

Mathew J. Schwartz  •  September 18, 2019

Governments are rapidly adopting AI surveillance technology to advance political goals, according to a new report from the Carnegie Endowment for International Peace. While Chinese suppliers dominate, liberal democracies and authoritarian regimes alike are developing and procuring such technology.

Report: Encrypted Smartphone Takedown Outed Canadian Mole

Mathew J. Schwartz  •  September 17, 2019

The Canadian government has arrested a senior intelligence official on charges of working as a mole. He was reportedly unmasked after investigators found someone had pitched stolen secrets to the CEO of Phantom Secure, a secure smartphone service marketed to criminals that authorities shuttered last year.

Life After Snowden: US Still Lacks Whistleblowing Rules

Mathew J. Schwartz  •  September 16, 2019

Ahead of the release of Edward Snowden's memoirs chronicling his decision to bring illegal "big data" domestic U.S. surveillance programs to light, a former NSA intelligence specialist points out that the U.S. still lacks a whistleblowing law to protect intelligence workers who spot illegal activity.