If Facebook can't reach a penalty agreement with the FTC, the regulator could take the case to court and call on senior executives, such as CEO Mark Zuckerberg (pictured), to testify.

Report: Facebook Faces Multibillion Dollar US Privacy Fine

Mathew J. Schwartz • February 15, 2019

The Federal Trade Commission is reportedly negotiating a settlement with Facebook that includes a multibillion dollar fine for its privacy failures. But the social network is alarmed about the proposed settlement agreement's terms and conditions, The Washington Post reports.

Cyberwarfare / Nation-state attacks

Hack Attack Breaches Australian Parliament Network

Latest

Application Security

WannaCry Hero Loses Key Motions in Hacking Case

Jeremy Kirk • February 15, 2019

A famed British computer security researcher has lost several key motions in a federal hacking case that stems from his alleged contribution to two types of banking malware. The rulings could complicate the challenges for the defense team of Marcus Hutchins, who remains in the U.S.

Blockchain & Cryptocurrency

Protecting Cryptocurrency in the Era of 'Deep Fakes'

Nick Holland • February 15, 2019

The latest edition of the ISMG Security Report highlights how thieves can use "deep fake" photos in an attempt to steal cryptocurrency. Also featured: A discussion of the implications of "data gravity" and an analysis of whether the era of mega-breaches is ending.

Cybercrime

US Air Force Veteran Charged in Iran Hacking Scheme

Jeremy Kirk • February 14, 2019

A former U.S. Air Force counterintelligence agent was indicted for disclosing classified information and helping Iran compromise the computers of other U.S. intelligence agents. The case marks another damaging leak for the American government.

Anti-Fraud

Roses Are Red, Romance Scammers Make You Blue

Mathew J. Schwartz • February 14, 2019

This Valentine's Day, authorities are once again warning individuals to watch out for anyone perpetrating romance scams. The FTC says Americans lost $143 million to romance scams in 2017, while in the U.K., Action Fraud says reported romance scam losses in 2018 topped $64 million.

Cloud Security

Data Gravity: Will It Weigh Down Cloud Security?

Nick Holland • February 13, 2019

The 2019 RSA Conference offers an opportunity to learn about new concepts across all aspects of cybersecurity. One such area is "data gravity," which will be the topic of a session featuring Microsoft's Diana Kelley and Sian John. They discuss the concept in a joint interview.

Breach Preparedness

Battling Big Breaches: Are We Getting Better?

Mathew J. Schwartz • February 13, 2019

What if organizations' information security practices have gotten so good that they're finally repelling cybercriminals and nation-state attackers alike? Unfortunately, the five biggest corporate breaches of the past five years - including Yahoo, Marriott and Equifax - suggest otherwise.

Application Security

Major Flaw in Runc Poses Mass Container Takeover Risk

Jeremy Kirk • February 12, 2019

Red Hat, Amazon and Google have issued fixes for a serious container vulnerability. The flaw in the "runc" container-spawning tool could allow attackers to craft a malicious container able to "break out" and gain root control of a host system, potentially putting thousands of other containers at risk.

Cybercrime

No-Deal Brexit Threatens British Crime Fighting

Mathew J. Schwartz • February 12, 2019

British police say they're doing their best to cope with the possibility that the U.K. will crash out of the EU in 45 days and lose access to joint policing resources. But Richard Martin of the Met Police says replacements "will not be as efficient or effective as the tools we currently use."

Governance

Keeping Incident Response Plans Current

Marianne Kolbasuk McGee • February 12, 2019

Many healthcare organizations are falling short in their incident response plans, says Mark Dill, principal consultant at tw-Security. The former director of information security at the Cleveland Clinic discusses best practices for keeping those programs current in an interview at the HIMSS19 conference.

Endpoint Security

Apple Update: Drop Everything and Patch iOS

Mathew J. Schwartz • February 8, 2019

Apple has issued an iOS update that patches two flaws being exploited in the wild by attackers as well as the "FalmPalm" bug in Group FaceTime. Apple says it compensated the teenager who reported the FaceTime flaw and gave him an extra gift toward his tuition.

Critical Infrastructure Security

Assessing US Vulnerability to a Nation-State Cyberattack

Nick Holland • February 8, 2019

The latest edition of the ISMG Security Report features a summary of alarming new findings about the ability of the U.S. to counter a nation-state malware attack. Plus, a discussion of "fusion centers" at banks and an update on the targeting of Webstresser subscribers.

Cybercrime as-a-service

Stress Test: Police Visit Webstresser Stresser/Booter Users

Mathew J. Schwartz • February 7, 2019

Hundreds of suspected customers of Webstresser, a DDoS stresser/booter site that was disrupted last year, are being visited by law enforcement agents and may see jail time. The police message: Using darknet cybercrime services doesn't guarantee anonymity, even if you pay with bitcoin.