We thought we would end the year looking beyond the world of APT  and spearphishing.  Chris Poulin of IBM has assembled a list of 19 hacks that will keep you up nights.  Hacks of pacemakers, yachts, ATM's, insulin pumps and our favorite -- cars. In Comprehensive Experimental Analyses of Automotive Attack Surfaces the researchers discuss how: We discover that remote exploitation is feasible via a broad range of attack vectors (including mechanics tools, CD players, Bluetooth and cellular radio), and further, that wireless communications channels allow long distance vehicle control, location tracking, in-cabin audio exfiltration and theft. From Comprehensive Experimental Analyses of Automotive Attack Surfaces, this  is [...]

The widely report attacks on banks in South Korea provide a strong lesson in the importance of using up-to-date software. As the Los Angeles Times reports, the attack was not technically sophisticated.  Nevertheless, as the New York Times reports, the attack was extremely effective in causing havoc in South Korea. Avast! has determined that this attack exploited non-current versions of Internet Explorer.   If the users had been using correctly configured versions of current software, instead of being damaged, the attack would have been stopped by the browser.

Yesterday, March 12, James R. Clapper, the Director of National Intelligence, provided the United States Senate with the annual US INTELLIGENCE COMMUNITY WORLDWIDE THREAT ASSESSMENT.   The first threat in the report is Cyber. While we think it is important to read the entire discussion of Cyber, we think this excerpt provides a good summary of the situation: Foreign intelligence and security services have penetrated numerous computer networks of US Government, business, academic, and private sector entities. Most detected activity has targeted unclassified networks connected to the Internet, but foreign cyber actors are also targeting classified networks. Importantly, much of the nation’s [...]