This Version of Metacurity is on Hiatus While We Move to a New Format

While Metacurity has been a wonderful challenge over the past five years, it makes no financial sense in its current format. Therefore, we are going on hiatus until after Labor Day to create a new newsletter version of Metacurity. We are also going to set up an automated page, behind a paywall, that is lightly edited, with no original summaries, updated once per day, offering the same curated and clustered cybersecurity news developments you’ve come to expect from the site. Thanks to our smart and steady readers out there and sign up for our updates. Read more about this development here.
http://dlvr.it/RdMLDC

Online Exam Proctoring Company ProctorU Has Confirmed Data Breach, 440,000 People Allegedly Affected

Online exam proctoring solution ProctorU has confirmed a data breach after a threat actor released a stolen database of user records on a hacker forum. Last month, Bleeping Computer reported that a known data breach seller had leaked 18 company’s databases for free on a hacker forum. One of the leaked databases was for Proctoru.com and contains user records for 444,000 people allegedly registered at the online proctoring service. The database contains email addresses, full names, addresses, phone numbers, hashed passwords, the affiliated organization, and other information. Some of the colleges and universities that may be impacted are North Virginia Community College, UCLA, Princeton, University of Texas, Harvard, Yale, Syracuse University, Columbia, UC Davis, and many more.
http://dlvr.it/RdK1G2

Chinese Government is Blocking Encrypted HTTPS Connections That Use TLS 1.3 and ESNI

Since the end of July, the Chinese government has deployed an update to its national censorship tool, the Great Firewall (GFW), to block encrypted HTTPS connections that are being set up using interception-proof protocols and technologies, according to a joint report published this week by three organizations tracking Chinese censorship — iYouPort, the University of Maryland, and the Great Firewall Report. Chinese officials are only targeting HTTPS traffic that is set up with new technologies like TLS 1.3 and ESNI (Encrypted Server Name Indication).
http://dlvr.it/RdJHrz

Small Government Contractor Anomaly Six Can Track Movements of Hundreds of Millions of Mobile Phones Worldwide, Draw Location Data From More Than 500 Apps

A small U.S. company called Anomaly Six LLC with ties to the U.S. defense and intelligence communities has embedded its software in numerous mobile apps, allowing it to track the movements of hundreds of millions of mobile phones worldwide, according to interviews and documents reviewed by The Wall Street Journal. In its marketing material, Anomaly said it is able to draw location data from more than 500 mobile applications, in part through its own software development kit, or SDK, that is embedded directly in some of the apps.
http://dlvr.it/RdG6n4

Hackers Deface Tens of Reddit Channels to Show Pro-Trump Messages, NFL, Disneyland, Boston Celtics Channels Affected

A massive hack hit Reddit after tens of Reddit channels have been hacked and defaced to show messages in support of Donald Trump’s reelection campaign. The Reddit channels defaced include those for NFL, many TV shows, The Pirate Bay, Disneyland, Disney’s Avengers, Boston Celtics, several city channels, and more. The channels have combined tens of millions of subscribers. Although Reddit hasn’t issued any details on the hack, the massive scale of the incident suggests that the intruder(s) might have gained access to a high-privileged moderator or admin account. Channel owners who are having problems have been asked to report problems in a Reddit ModSupport thread. The Reddit hack also comes after Reddit banned r/The_Donald, a channel for Donald Trump supporters.
http://dlvr.it/RdCfBY

Troy Hunt Open Sources 'Have I Been Pwned,' Asks the Community to Help Support the Effort

On the heels of an aborted merger and acquisition initiative, highly respected cybersecurity expert Troy Hunt has decided open source his ground-breaking Have I Been Pwned code base. He said he is turning over the code to the public “for the betterment of the project and frankly for the betterment of everyone who uses it.” He said the project solely depends on him and is asking the community to help support the effort.
http://dlvr.it/RdCf64

Researchers Who Intercepted Signals of Eighteen Satellites Says Satellite Communications Put Millions of People at Risk

Satellite-based Internet is putting millions of people at risk, despite providers adopting new technologies that are supposed to be more advanced Oxford Ph.D. candidate James Pavur showed. Pavur intercepted the signals of 18 satellites beaming Internet data to people, ships, and planes in a 100 million-square-kilometer swath that stretches from the United States, Caribbean, China, and India. Pavur said current solutions such as VPNs are ineffective for satellite communications and that he is presenting his findings so that the community can devise solutions.
http://dlvr.it/RdCB4M

Government Bank Regulator Fines Capital One $80 Million for Inadequate Risk Assessment Processes That Led to Data Breach

The Office of the Comptroller of the Currency (OCC) has fined Capital One $80 million over a data breach last year that compromised the personal information of about 106 million card customers and applicants. The OCC said the bank failed “to establish effective risk assessment processes“ before transferring information-technology operations to the public cloud and “to correct the deficiencies in a timely manner.” The order requires the bank to make risk-management changes and beef up its cybersecurity defenses. The bank said it has already made many of the needed changes.
http://dlvr.it/Rd7ylB

Top Voting Machine Vendor ES&S Has a New Vulnerability Disclosure Policy That Gives Ethical Hackers More Latitude to Find Bugs

The country’s largest voting machine vendor ES&S announced a new vulnerability disclosure policy that will allow it to work more closely with security researchers to find software bugs in the company’s IT networks and websites. The new policy, which gives the company 90 days to fix problems before the researchers go public, allows researchers to probe ES&S’s corporate systems and public-facing websites, but not the election systems in place at jurisdictions around the country, which are subject to different testing regimes.
http://dlvr.it/Rd7ydQ

State Department Will Pay Up to $10 Million for Information on Foreign Government Hackers Trying to Interfere in U.S. Elections, Issues Report on Russia's Continued Disinformation Campaigns

The State Department said it would offer rewards of up to $10 million for information to help identify any person who, acting at the direction of a foreign government, tries to hack into election or campaign infrastructure. The diplomatic arm of the government offered the bounty on the same day it released a report that states Russia continues to use a network of proxy websites to spread disinformation in the West. The report, produced by the Department’s Global Engagement Center, says that the Strategic Culture Foundation is directed by Russia’s foreign intelligence service, the S.V.R., and stands as “a prime example of longstanding Russian tactics to conceal direct state involvement in disinformation and propaganda outlets.”
http://dlvr.it/Rd7T5j

Canon Hit by Maze Ransomware Attack, Attackers Claim Theft of Ten Terabytes of Data, Private Databases

Canon has suffered a ransomware attack that impacts numerous services, including Canon’s email, Microsoft Teams, USA website, and other internal applications. A suspicious outage has taken place on Canon’s image. canon cloud photo and video storage service resulting in the loss of data for users of their free 10GB storage feature. The image.canon site suffered an outage on July 30th, 2020, and over six days, the site would show status updates until it went back in service yesterday, August 4th. At that point, a message appeared that said, “there was no leak of image data.” Today, however, a widespread system issue occurred, and Canon’s USA website is displaying error messages. BleepingComputer has obtained a partial screenshot of the alleged Canon ransom note, which we have been able to identify as from the Maze ransomware. The attackers told Bleeping Computer they stole “10 terabytes of data, private databases, etc” as part of the attack on Canon.
http://dlvr.it/Rd4Fhs

Zoom Bond Hearing of Twitter Hack 'Mastermind' Was Interrupted When People Played Loud Music, Porn Video

A judge was forced to suspend the virtual bond hearing of Graham Clark, the 17-year-old accused of being the “mastermind” behind the recent massive Twitter hack after several people got into the Zoom meeting posing as CNN and BBC staffers and played loud music and even a porn video. Judge Christopher Nash said next time he’ll require a password.
http://dlvr.it/Rd4FdP

Hacker Publishes List of Plaintext Usernames and Passwords With IP Addresses for More Than 900 Pulse Secure VPN Enterprise Servers

A hacker has published a list of plaintext usernames and passwords, along with IP addresses for more than 900 Pulse Secure VPN enterprise servers, an analyst at threat intelligence firm Bank Security discovered. ZDNet got a hold of the list the help of threat intelligence firm KELA and verified its authenticity. The list includes IP addresses of Pulse Secure VPN servers, Pulse Secure VPN server firmware version, SSH keys for each server, a list of all local users and their password hashes, admin account details, last VPN logins (including usernames and cleartext passwords) and VPN session cookies. The analyst said that all the Pulse Secure VPN servers included in the list were running a firmware version vulnerable to the CVE-2019-11510 vulnerability. Threat intelligence company Bad Packets said that earlier this year it discovered 677 of the 913 IP addresses to be vulnerable and it appears they haven’t patched yet.
http://dlvr.it/Rd3mVB

Microsoft Awarded $13.7 Million in Bug Bounties Over Past Year, Three Times the Amount Awarded During Previous Year

Microsoft awarded $13.7 million in bug bounties to security researchers who have reported vulnerabilities over the last 12 months through 15 bug bounty programs, representing more than three times the amount awarded during the previous year when researchers earned a total of $4.4 million in Microsoft bug bounty awards. So far, in 2020, Microsoft has launched two new research grants and six new bug bounty programs, receiving 1,226 eligible vulnerability reports from 327 security researchers located in countries from six continents.
http://dlvr.it/Rd0W59

NSA Releases Guidance to Defense and Security Personnel on How to Limit Collection of Mobile Location Data

The National Security Agency (NSA) released guidance to Department of Defense and other national security programs on how to limit the collection of location data from their devices. The NSA warns that in addition to mobile devices storing location data in their own mobile device logs, cellular networks receive real-time coordinates for cellphones every time they connect to the system, meaning that users can be tracked across a wide area. Another interesting piece of advice: limit web-browsing on the device as much as possible because that can yield several different forms of location data.
http://dlvr.it/Rd0W40

Interpol Warns of 'Alarming' Rate of Cybercrime Related to the COVID-19 Pandemic, Predicts That It Will Increase in the Near Future

Interpol warned of an “alarming” rate of cybercrime during the coronavirus pandemic, with criminals taking advantage of people working from home to target significant institutions. The law enforcement organization said that in one four-month period (January to April) around 907,000 spam messages, 737 incidents related to malware and 48,000 malicious URLs, all related to COVID-19, were detected by one of its private-sector partners. Interpol has concluded that “a further increase in cybercrime is highly likely in the near future” and “threat actors are likely to continue proliferating coronavirus-themed online scams and phishing campaigns to leverage public concern about the pandemic.”
http://dlvr.it/Rd02xg

DigitalCrazyTown Stopped Publishing Years Ago - Please Visit Metacurity.com or DCT-Associates.com

Years ago, when I was gearing up to change careers, I launched DigitalCrazyTown as a place to keep my expertise and skills visible while I was exploring what to do. People I know in the communications and tech sector loved the name Digital Crazy Town, and in particular loved my email address, which ended (and still does) in digitalcrazytown.com. So my digitalcrazytown.com email address is the one I've been using for years and the one most people use.

Since this blog was active, however, I launched a news destination for the cybersecurity industry, Metacurity.com, and a new company, DCT Associates. I also write for CSO Online and other publications and do paid-speaking and consulting engagements.

So, if you happen to get an email from my digitalcrazytown.com email address, just know that even though the publication is now defunct,

Broadcasting as a Cyber Threat Vector: Ten Steps Broadcasters Need to Take Now


Cyber threats to financial institutions, electric utilities, broadband providers, government agencies, Hollywood studios and even emerging Web-connected household appliances get a lot of ink. But one major potential threat vector, television and radio broadcasting, doesn't conjure up the kind of concerns that these other avenues of cyber intrusion do.

That's changing, though, in the wake of a major cyber attack that took place last April when French broadcaster TV5Monde was hijacked, with eleven of its channels going dark and its social media outlets commandeered to display pro-ISIS messages. Although a group called the CyberCaliphate claimed credit for the damaging breach, the French government has lately cast some blame on Russian hackers who, the government suggests, was using the CyberCaliphate as a false flag.

Whatever the case may be, the TV5Monde attack was a wake-up call to the broadcasting sector that it too is vulnerable to the kinds of disruptive cyber intrusions and attacks that affect other critical aspects of society. That's why top broadcasting publication TVNewsCheck and I have joined hands to offer the first of its kind webinar, "Cybersecurity for Broadcasters: Ten Steps You Need to Take Right Now," aimed at helping broadcasters come up to speed on how to protect their assets from unwanted and potentially damaging cyber intrusions and how to become more resilient in the face of what will undoubtedly be more future cyber attacks.

Slated for July 22 from 2 pm to 3:30, the webinar features a top line-up of experts (with more to come) including:
  • Rear Admiral (ret) David Simpson, Bureau Chief, FCC Public Safety and Homeland Security
  • Kelly Williams, Engineering & Technology Policy, Senior Director, National Association of Broadcasters
  • Ed Czarnecki, Strategy & Global Government Affairs, Senior Director, Monroe Electronics
For more background on the array of cybersecurity concerns that broadcasters face, check out the piece I wrote for TVNewsCheck that I hope lays it all out fairly well and stayed tuned for more information as we update the speaker line-up. If you have any thoughts or questions, drop me an email. (As a personal aside, it's been nice to bring my two areas of professional experience, communications media and cybersecurity, together in an interesting project, something I hope to continue to explore).

And don't forget to check out Metacurity.com, a continuously updated source of cybersecurity intelligence and news aimed at solving the info-overload that increasingly bedevils most infosec professionals.

Top Cybersecurity Writers, By the Numbers


Last week I posted an analysis of how often various publications appeared during the first six weeks or so of active tracking on Metacurity, our new continuously updated resource on cybersecurity news and information. (For more on Metacurity and how we're selecting which articles and blog posts make the cut, see this post).

Now we turn to the actual journalists, bloggers, pundits and others who actually write the posts.  As the table below shows, 128 writers appeared more than once in approximately 1,220 posts from March 29 through mid-day on May 6 (links are to the writers' Twitter profiles, where they could be found).

Topping the list is Darren Pauli from The Register, not a surprise given that The Register also topped our list of publications, focused as it is on the nitty-gritty of IT technology. In fact, the vast majority of writers who top the list below are focused almost exclusively on matters related to information security -- again no surprise.

A word of caution though:  quantity does not necessarily equal quality. Many of the top writers working in the field appear lower down on the list presumably because they are not pressured to fill the hole each day and are given some latitude to spend time on bigger pieces or on related beats, such as privacy and national security.

In addition, some excellent writers are working for publications that put content behind paywalls and are not reflected here (Politico is the exception because some Politico pieces are available without paid subscriptions).

I was surprised at the amount of feedback I received on the first post detailing the publications by the numbers and welcome again feedback on this list.  As Metacurity evolves we will be adding additional publications, bloggers and sources and new features that make the site a more dynamic resource for cybersecurity news and information. Give us your feedback on the sources we rely upon and what additional information we should be incorporating into our system.

Metacurity Posts by Writer, 3/29/2015 to 5/6/2015
Writer# PostsPrimary Publication
Darren Pauli32 The Register
Waqas31 Hack Read
Eduard Kovacs27 Security Week
John Leyden24 The Register
Maria Korolov21 CSO Online
Dan Goodin20 Ars Technica
Michael Mimoso19 Threat Post
AFP17 Security Week
BrianPrince17 Security Week
Mike Lennon16 Security Week
Zack Whittaker16 ZDNet
Lorenzo Franceschi-Bicchierai15 Motherboard
Adam Greenberg15 SC Magazine
Brian Krebs15 Krebs on Security
Ashley Carman12 SC Magazine
Lucian Constantin12 CSO Online
Dennis Fisher12 Threat Post
Aliya Sternstein12 NextGov
Thomas Fox-Brewster11 Forbes
Andy Greenberg11 Wired
Kelly Jackson Higgins11 Dark Reading
Charlie Osborne11 ZDNet
Sara Peters11 Dark Reading
Cory Bennett10 The Hill
Graham Cluley10 Graham Cluley
ERICKA CHICKOWSKI9 Passcode
Richard Chirgwin9 The Register
Jeremy Kirk9 CSO Online
Steven Ragan9 CSO Online
Iain Thomson9 The Register
Danielle Walker9 SC Magazine
Kim Zetter9 Wired
Dustin Volz8 National Journal via Next Gov
Robert Abel7 SC Magazine
Kyle Ellison7 We Live Security
Julian Hattem7 The Hill
Alexander Martin7 The Register
JAIKUMAR VIJAYAN7 Passcode
Stewart Baker6 Lawfare
Cyrus Farivar6 Ars Technica
Grant Gross6 Computer World
Shaun Nichols6 The Register
Mohana Ravindranath6 Next Gov
Bruce Schneier6 Lawfare
Sara Sorcher6 Passcode
Leon Spencer6 ZDNet
Taylor Armerding5 CSO Online
Chris Brook5 Threat Post
Joseph Cox5 Motherboard
Brian Donohue5 Threat Post
Sean Gallagher5 Ars Technica
Frank Konkel5 NextGov
Dave Lewis5 Forbes
Mario Trujillo5 The Hill
DAN FROOMKIN4 The Intercept
Hallie Golden4 NextGov
Robert Graham4 Errata Security
Swati Khandelwal4 The Hacker News
Rachel King4 ZDNet
Glyn Moody4 Ars Technica
Jordan Pearson4 Motherboard
Nicole Perlroth4 New York Times
Elise Viebeck4 The Hill
Wang Wei4 Hacker News
Paul Farrell3 The Guardian
Samuel Gibbs3 The Guardian
Roger Grimes3 Info World
Shane Harris3 The Daily Beast
Michael Heller3 TechTarget
Ben Kepes3 Forbes
Jason Koebler3 Motherboard
David Kravets3 Ars Technica
Mohit Kumar3 The Hacker News
Tony Morbin3 SC Magazine
Paolo Passeri3 Hackmageddon
Steve Ranger3 ZDNet
Teri Robinson3 SC Magazine
Jack Schofield3 ZDNet
Evan Selinger3 Passcode
Darlene Storm3 Computer World
Lee Suster3 SC Magazine
Kevin Tofel3 ZDNet
Joe Uchill3 Passcode
David Auerbach2 Slate
Violet Blue2 ZDNet
Tony Bradley2 CSO Online
Steve Cobb2 We Live Security
Kenneth Corbin2 CSO Online
Chris Duckett2 ZDNet
Kristen Eichensehr2 Just Security
Lee Fang2 The Intercept
Kelly Fiveash2 The Register
John Fontana2 ZDNet
Natalie Gagliordi2 ZDNet
Megan Geuss2 Ars Technica
Alexandra Gheorghe2 Hot for Security
Stephen Glasskeys2 Computer World
Jack Goldsmith2 Lawfare
Matthew Goldstein2 New York Times
Tim Greene2 Computer World
Wendy Grossman2 ZDNet
Robert Hackett2 Fortune
Kat Hall2 The Register
David Harley2 WeLiveSecurity
Alex Hern2 The Guardian
Michael Horowitz2 ComputerWorld
Patrick Howell O'Neill2 Daily Dot
Gregg Keizer2 Computer World
Herb Lin2 Lawfare
Rafal Los2 Security Week
Alan Martin2 We Live Security
Tony Martin-Vegue2 CSO Online
Joseph Menn2 Reuters
Jack Moore2 Next Gov
Joe Mullin2 Ars Technica
Ellen Nakashima2 Washington Post
David Perera2 Politico
Jason Polancich2 Security Week
Fahmida Rashid2 Security Week
Paul Roberts2 Passcode
Paul Rosenzweig2 Lawfare
Simon Sharwood2 The Register
Marc Solomon2 Security Week
Patrick Tucker2 Defense One
Camille Tuutti2 NextGov
Bob Violino2 CSO Online
Martyn Williams2 Computer World
Eileen Yu2 ZDNet

Top Cybersecurity News and Information Sources, By The Numbers - UPDATE


(Update:  Astute reader and topic maps (semantic integration) maven Patrick Durusau pointed out to me that I had the New York Times listed twice in an earlier version of this list, once as The New York Times and once as simply New York Times. The new list corrects this glitch.  Not only that but he also pointed out that National Journal and NextGov are different publications, which they indeed are.  But because NextGov publishes so many National Journal pieces, I'm not 100% certain from the data alone which came from which, so I merged the two.  He also kindly went out of his way to put hyperlinks to the relevant publications in my table!)

Starting on March 29, I began to systematically sift through voluminous news articles, blog posts and other sources to pick the most relevant, timely and knowledgeable items on cybersecurity matters to post on Metacurity.com. (See previous post for an introduction to Metacurity and an explanation of the criteria used for selection.) From that date through mid-day on May 6, Metacurity featured 1,220 posts from across well over 100 different publications, mostly traditional consumer interest and trade publications, as well as specialized blogs.

In an effort to better improve the selection and publication process, we’re currently analyzing the data to develop better filters and formulas.  One slice of interesting information is the frequency with which various publications appear across the still-nascent data set – obviously over time the data will change as the database gets bigger, more sources are added and newsworthy developments shift.

Articles Posted in Metacurity, 3/29/2015 to 5/6/2015
Source# Posts% Total
The Register1008.2%
SecurityWeek907.4%
CSOOnline685.6%
ZDNet625.1%
SC Magazine594.8%
Ars Technica483.9%
DarkReading483.9%
ThreatPost*413.4%
NextGov and National Journal413.4%
ComputerWorld322.6%
Hack Read322.6%
The Hill322.6%
Forbes312.5%
Motherboard302.5%
Passcode272.2%
Wired221.8%
WeLiveSecurity211.7%
The Guardian191.6%
New York Times171.4%
Krebs on Security151.2%
The Hackers News110.9%
Hot for Security100.8%
Lawfare Blog100.8%
The Intercept90.7%
Wall Street Journal90.7%
IT World70.6%
Slate60.5%
Just Security50.4%
Politico50.4%
Reuters50.4%
Schneier on Security50.4%
BBC News40.3%
Errata Security40.3%
Network World40.3%
TechTarget40.3%
The Daily Beast40.3%
The Diplomat40.3%
Washington Post40.3%
Bloomberg30.2%
Business Insider30.2%
DailyDot30.2%
Fortune30.2%
Google Security**30.2%
Hackmageddon30.2%
International Business Times30.2%
Telegraph30.2%
USA Today30.2%
FCW***30.2%
Financial Times20.2%
Freedom to Tinker20.2%
Harvard Business Review20.2%
Info World20.2%
Medium20.2%
MIT Technology Review20.2%
Quartz20.2%
The Security Ledger20.2%
Associated Press20.2%
Total99381.4%
*Technically a corporate blog by Kaspersky but features many newsworthy, journalistic-type posts.
**Technically a corporate blog by Google but important because of the nature of the posts.
***Recent resource added.

Of the sources published, 57 or 58 publications (I merged National Journal and NextGov)  received two or more posts, excluding posts from vendor blogs. Of these 57 or 58  sources, The Register grabbed more of the screen time than any other publication, no surprise given its focus on the nitty-gritty reality of IT technology. Likewise, all but one of the other top ten resources have as their main focus information security, IT technology or other specialized subjects where cybersecurity is a main concern.

The appearance of inside-politics publications such as the National Journal (which cross-publishes with NextGov) and The Hill is likewise no surprise given the ascendancy of cybersecurity in Washington and the pendency of cybersecurity legislation. A good deal of excellent coverage of Washington-related cybersecurity matters appears in paid-access-only publications such as Politico, which launched last year its own cybersecurity publication and makes some articles available outside its paywall. Paid-access publications don’t appear on Metacurity because, well, that would be too frustrating for casual visitors.  This may change over time.

For now, this list is interesting but definitely subject to change as time moves on, as more publications beef up their cybersecurity beats and as we refine our methods for pinpointing the best sources and items of information.

Stay tuned and please talk to us. Tell us what resources we're missing that you rely on and what additional types of information you'd like to see in the mix.

Twitter Delicious Facebook Digg Stumbleupon Favorites More