Content by Jeremy Kirk

Despite Instagram Changes, Minors Are Still at Risk

Jeremy Kirk  •  November 11, 2019

In June, I wrote an in-depth story about how millions of Instagram users worldwide under 18 years old were exposing their email addresses, phone numbers or both. Instagram has finally made a change to address the issue - but it doesn't go far enough.

Protecting Data in Sprawling Computing Environments

Jeremy Kirk  •  November 8, 2019

Sprawling computing environments - from cloud to containers to serverless - are posing challenges in maintaining visibility and determining if data is secure, says Mike Adler of RSA.

Trend Micro Employee Sold Consumer Data to Scammers

Jeremy Kirk  •  November 7, 2019

A Trend Micro employee stole and then sold contact information for 68,000 of the company's consumer subscribers, which led to a raft of unsolicited tech support scam calls, the company says. The employee has been fired. The incident highlights the risk of insider threats.

The Malicious Macros Problem May Be Solved Soon

Jeremy Kirk  •  November 6, 2019

A handful of common lures still have astounding success in compromising computers: phishing emails, malicious links and the king of them all: the malicious Microsoft Office document. But Microsoft is introducing virtualized containers in Office 365, which will isolate untrusted documents.

Beam Me Up, Alexa: Digital Assistants Hacked By Lasers

Jeremy Kirk  •  November 5, 2019

It's a laser-focused hack. Literally. Voice-controlled assistants such as Amazon's Alexa, Apple's Siri and Google's Assistant can be tricked into executing commands by precisely directing a laser beam at a device's microphone, according to new research released on Monday.

BlueKeep Attacks Arrive, Bearing Cryptomining Malware

Jeremy Kirk  •  November 4, 2019

The cybersecurity community had been holding its breath in anticipation of mass attacks targeting the severe BlueKeep vulnerability in Windows, which Microsoft has patched. The first in-the-wild exploits have now been seen, although they don't appear to constitute an emergency - at least yet.

Trio of Web Registrars Disclose 22 Million Accounts Breached

Jeremy Kirk  •  November 1, 2019

A trio of domain name registrars are mandating a password reset after a breach affecting about 22 million accounts occurred in late August. Web.com and two of its brands, Network Solutions and Register.com are contacting victims via email.

Mobile Devices: Protecting Critical Data

Jeremy Kirk  •  October 31, 2019

Mobile devices are attractive targets for attackers because of messages, call logs, location data and more. State-sponsored groups are digging ever deeper into mobile hacking, says Brian Robison of BlackBerry Cylance.

Facebook Sues Spyware Maker Over WhatsApp Exploit

Jeremy Kirk  •  October 30, 2019

Facebook is suing NSO Group, a spyware company, alleging it developed a potent exploit to spy on WhatsApp messages sent by diplomats, journalists, human rights activists and political dissidents. Facebook is seeking damages and an injunction forbidding NSO Group from accessing its infrastructure.

How to Manage Supply Chain Risks

Jeremy Kirk  •  October 28, 2019

Agile environments benefit from development platforms and open-source software, but that also raises the risks of attacks seeded in those supply chains, says Chet Wisniewski of Sophos, who describes steps that organizations can take to mitigate the risks.

Senators Push for FTC Probe Into Amazon Over Capital One

Jeremy Kirk  •  October 25, 2019

Democratic lawmakers are urging the U.S. Federal Trade Commission to open an investigation into whether Amazon violated federal law by failing to the prevent Capital One's devastating data breach. Amazon dismissed the request as "baseless and a publicity attempt from opportunistic politicians."

Avast: Stolen VPN Credentials Led to CCleaner Attack Redux

Jeremy Kirk  •  October 23, 2019

Avast's CCleaner utility is popular - with attackers. For the second time in two years, the company says it believes CCleaner was the intended targeted of a carefully plotted intrusion executed between May and October.

NordVPN Says Server Compromised Due to Misconfiguration

Jeremy Kirk  •  October 22, 2019

Virtual private network provider NordVPN says an error by its Finish data center provider allowed an attacker to gain control of a server, but it says its broader service was not hacked. One security expert, however, says the attacker would have had "God mode" on one VPN node.

Zappos' Offer to Breach Victims: A 10 Percent Discount

Jeremy Kirk  •  October 21, 2019

Zappos is close to settling a long-running class action lawsuit filed by consumers over a 2012 data breach. The online shoe and clothing retailer's proposed compensation would be a 10 percent discount on a future online purchase. A federal judge has granted preliminary approval to the deal.

How 'Zero Trust' Better Secures Applications and Access

Jeremy Kirk  •  October 17, 2019

Organizations are accepting that the network perimeter no longer serves as the "ultimate defense" and thus adapting zero-trust principles, including least privilege, based on the understanding that they may already have been compromised, says Darran Rolls of SailPoint.