Countering threats: Steps to take when developing APIs

High profile data breaches resulting from faulty APIs continue to make headlines. In the last few months alone, T-Mobile’s data breach resulted in hackers stealing personal data of more than two million customers while Google shutdown the consumer version of Google+, citing a bug that exposed the personal profiles of up to 500,000 users, with…

Cyber-Attacks: How to Stop a Multibillion-Dollar Problem

Where there’s money, there has always been crime. Traditional bank robbery and physical assaults on ATMs are still a challenge, and now a new breed of cyber-enabled theft—using ATMs as the endpoint for cash-outs— has become a multibillion-dollar problem. One recent raid saw $13.5m stolen from India’s Cosmos Bank. Although the FBI issued a warning…

Ensuring election integrity: The overlooked last mile of securing voter data

With 99 percent of America’s votes counted by computers, security experts agree that our elections remain extremely vulnerable for a cyberattack. Fourteen states are still using fragile voting equipment consisting of digital endpoints that travel from storage to polling places. With some voting machines being so old that officials can’t even tell if they’ve been…

Most impersonated brands in email attacks? Microsoft and Amazon

Nearly two-thirds of all advanced email attacks used emails impersonating Microsoft or Amazon, according to new research by Agari. Microsoft was impersonated in 36 percent of all (brand) display name impersonation attacks in the third quarter. Amazon was the second most commonly impersonated company, used in 27 percent of these attacks. Amazon and Microsoft run…

New techniques expose your browsing history to attackers

Security researchers at UC San Diego and Stanford have discovered four new ways to expose Internet users’ browsing histories. These techniques could be used by hackers to learn which websites users have visited as they surf the web. The techniques fall into the category of “history sniffing” attacks, a concept dating back to the early…

The zero-day flaw, tracked as CVE-2018-15454, is related to the Session Initiation Protocol (SIP) inspection engine used in the company’s Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. A remote and unauthenticated attacker can exploit the vulnerability to cause an affected device to reload or consume CPU resources, resulting in a denial-of-service (DoS)…