Remote robbery, an ‘IT incident’ (not a breach?), and face-off on privacy

Remote robbery, Gwinnett IT Incident, and Privacy Face off

Taylor Armerding, Synopsys Software Integrity Group senior strategist, gives you the scoop on application security and insecurity in this week’s Security Mashup.

Remote robbery by Hidden Cobra, a breach by any other name, and facing down the Fourth and Fifth Amendments. Watch this week’s episode here:

Hidden Cobra FASTCash used for ATM cash grabs in the millions

via Swati Khandelwal, The Hacker News: Remember in Hackers where the crew makes fun of Joey because he thinks he “hacked” a bank and made an ATM across the country spit cash into the street? “You don’t hack a bank across state lines from your house,” Phreak says. “You’ll get nailed by the FBI.” Well, North Korea’s Hidden Cobra has been doing their own global version of this attack for at least two years now, to the tune of tens of millions in cash. Authorities believe the attack, dubbed FASTCash, looks like this: Spearphish a bank employee, install Windows malware, find the switch application server, and then approve withdrawal requests from known accounts without verifying their balances. Find out more about Hidden Cobra FASTCash and what else the group’s been up to.

FBI investigating Gwinnett data breach

via Steve Ragan, CSO: You can call it an “incident” all you like, but if it looks like a data breach and smells like a data breach… Granted, the thing that happened at Gwinnett Medical Center in Georgia isn’t playing out like the widespread ransomware attacks of late. This one looks like good old extortion, perhaps by the threat group Particle Matrix, who likes to taunt their victims by publicly accusing them of incompetence and publishing stolen data. But regardless of the ensuing interaction between PM and Gwinnett, the fact is that the hackers broke into (breached) the center’s system and stole patient records (data). If only we had a term to describe this situation. Watch to learn more about the Gwinnett data breach and their attacker’s odd behavior.

What are the rules for Face ID and the police?

via Cyrus Farivar, Ars Technica: Quick refresher: The Fourth Amendment prohibits unreasonable search and seizure without a legit warrant. The Fifth Amendment protects people against self-incrimination, among other things. A couple hundred years of judiciary proceedings have set a strong precedent in most matters involving these amendments. It’s only the edge cases we hear about. Well, here’s an edge case for you: No searches can take place without an authorized warrant (Fourth). And we can’t force people to give up passwords anyway (Fifth). So how were police able to force Grant Michalski to unlock his iPhone X using Face ID? Have we established any police Face ID rules yet? Watch this segment for more about biometrics and the Bill of Rights.

BSIMM9: Get it while it’s hot

via Synopsys Software Integrity: There’s lots of new stuff in the Building Security In Maturity Model report this year, including a new stand-alone vertical (retail) and three new cloud security activities. Get your copy here. 

Stay up-to-date on the latest security news.

Subscribe to the blog today!

*** This is a Security Bloggers Network syndicated blog from Software Integrity authored by Taylor Armerding. Read the original post at: