The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Internet-connected devices have been one of the most remarkable developments that have happened to humankind in the last decade. Although this development is a good thing, it also stipulates a high security and privacy risk to personal information. In one such recent privacy mishap, smart IP cameras manufactured by Chinese smartphone maker Xiaomi found mistakenly sharing surveillance footage of Xiaomi users with other random users without any permission. The issue appears to affect Xiaomi IP cameras only when streamed through connected Google's Nest Hub, which came into light when a Reddit user claimed that his Google Nest Hub is apparently pulling random feeds from other users instead of his own Xiaomi Mijia cameras. The Reddit user also shared some photos showing other people's homes, an older adult sleeping on a chair, and a baby sleeping in its crib that appeared on his Nest Hub screen. It appears the issue doesn't reside in Google products; instead, it c...

Landry's, a popular restaurant chain in the United States, has announced a malware attack on its point of sale (POS) systems that allowed cybercriminals to steal customers' payment card information. Landry's owns and operates more than 600 bars, restaurants, hotels, casinos, food and beverage outlets with over 60 different brands such as Landry's Seafood, Chart House, Saltgrass Steak House, Claim Jumper, Morton's The Steakhouse, Mastro's Restaurants, and Rainforest Cafe. According to the  breach notification published this week, the malware was designed to search for and likely steal sensitive customer credit card data, including credit card numbers, expiration dates, verification codes and, in some cases, cardholder names. The PoS malware infected point-of-sale terminals at all Landry's owned locations, but, fortunately, due to end-to-end encryption technology used by the company, attackers failed to steal payment card data from cards swiped at its...

Advanced persistent threats (APTs) have emerged to be legitimate concerns for all organizations. APTs are threat actors that breach networks and infrastructures and stealthily lurk within them over extended spans of time. They typically perform complex hacks that allow them to steal or destroy data and resources. According to Accenture , APTs have been organizing themselves into groups that enable them to share tactics and tools to carry out attacks at scale. Russian group Silence APT, for instance, has been reported to be actively targeting financial institutions and have successfully stolen millions of dollars from various banks worldwide. Smaller organizations also need to be wary of such threats. APT groups also use automated tools and botnets to gain access to networks, and these tactics don't discriminate based on size, industry, or value. Any vulnerable infrastructure can be breached. It is now critical for all organizations to understand how APTs operate and impleme...

The cybersecurity of a company is heavily reliant upon the skills and knowledge of the people who install, manage, and operate its security products. This means that recruiting and nurturing the best security team possible should be a CISO's top priority. Cynet's Ultimate Cybersecurity Job Posting Templates ( download here ) provide a list of the main responsibilities and skills for typical security positions, built upon research and providing IT and security managers with pre-set template job descriptions so that there is no need to create them from scratch. Because of the fact that there are many different cybersecurity job titles, with much overlap between job descriptions and responsibilities, the creation of the inclusion criteria for these positions required significant review and consideration. Six positions are included in the following job templates, including all integral aspects of the responsibility cycle in product deployment, integration, and operation, p...

A 22-year-old man who claimed to have access to more than 300 million iCloud accounts 00 million iCloud accounts —and threatened to wipe them unless Apple paid a ransom—has pleaded guilty in London to attempting to blackmail the company. In March 2017, the attacker from North London said he was a spokesperson for a hacking group calling itself the “Turkish Crime Family” and claimed to possess data from 319 million iCloud accounts. According to a statement from the U.K. National Crime Agency (NCA), he gave Apple a deadline of April 7, 2017, demanding $75,000 in cryptocurrency or $100,000 worth of iTunes gift cards in exchange for deleting the alleged database. The agency described him as a “fame-hungry cyber-criminal.” He threatened that if Apple failed to comply, he would remotely wipe victims’ Apple devices, factory-reset iCloud accounts, and publish the stolen data online. Later that month, the NCA’s National Cyber Crime Unit arrested him at his home after Apple contacted law en...