Content by Mathew J. Schwartz

North Korean Hacking Funds WMD Programs, UN Report Warns

Mathew J. Schwartz  •  August 7, 2019

A confidential, leaked UN report warns that North Korea has funneled an estimated $2 billion - stolen via online bank and cryptocurrency exchange heists as well as generated via cryptocurrency mining - into its nuclear and missile-development programs.

Essential Active Directory Security Defenses

Mathew J. Schwartz  •  July 26, 2019

Many organizations use Active Directory as their domain network management tool of choice. But security experts warn that without locking down and regularly auditing AD, the ease of use that it provides to network administrators can also be tapped by hackers. Start here for essential defenses.

Why Hackers Abuse Active Directory

Mathew J. Schwartz  •  July 25, 2019

Warning: Attackers are abusing poorly secured and managed implementations of Microsoft Windows Active Directory to hack organizations and distribute ransomware. Fewer old operating systems and greater Active Directory security knowledge are helping mitigate the threat. But experts say more must be done.

Is the Equifax Settlement Good Enough?

Mathew J. Schwartz  •  July 24, 2019

Given the massive impact of the Equifax data breach, is the recently announced proposed settlement fair? One consumer advocate calls the money to be paid out by the consumer reporting agency the equivalent of a "parking ticket." Here's an analysis of the settlement's terms.

Consumer Advocates Criticize Equifax Settlement Plan

Mathew J. Schwartz  •  July 23, 2019

Equifax's move to settle federal and 48 states' probes, as well as class action lawsuits, would see breach victims being able to claim up to $20,000 for unreimbursed expenses. But some consumer advocates and government officials say the proposed deal is insufficient, given the magnitude of Equifax's failures.

Equifax Negotiates Potential $700 Million Breach Settlement

Mathew J. Schwartz  •  July 22, 2019

Credit reporting giant Equifax has negotiated a proposed settlement that could reach $700 million to resolve federal and state probes into its massive 2017 data breach, as well as a nationwide class action lawsuit. The company's total post-breach tab is likely to exceed $2 billion.

Huawei Question Must Be Answered by New UK Prime Minister

Mathew J. Schwartz  •  July 19, 2019

A powerful parliamentary committee has called on Britain's new prime minister - be it Boris Johnson or Jeremy Hunt - to make a decision "as a matter of priority" about the extent to which telecommunications gear built by Huawei should be used in the nation's 5G network.

Ransomware: As GandCrab Retires, Sodinokibi Rises

Mathew J. Schwartz  •  July 17, 2019

With the GandCrab ransomware-as-service gang promising to retire - and free decryptors now aiding victims - rival Sodinokibi has already stepped into the void, security experts warn. Driven also by attackers wielding Ryuk, Dharma and Phobos, ransom payments by victims have been surging.

Security Flaw Exposed Valid Airline Boarding Passes

Mathew J. Schwartz  •  July 16, 2019

A vulnerability in global airline check-in software used by 500 airlines could have been exploited to download other individuals' valid boarding passes, potentially giving them access to restricted airport spaces, warns security expert David Stubley. The flaw in Amadeus travel software has now been fixed.

Payment Fraud: Criminals Enroll Stolen Cards on Apple Pay

Mathew J. Schwartz  •  July 15, 2019

Fraudsters continue to get new tricks up their sleeves. Criminals are increasingly using Apple Pay, setting up mobile call centers to socially engineer victims as well as tricking consumers via fake e-commerce sites that never fulfill orders, fraud-fighting experts warn.

Leak Confirms Google Speakers Often Record Without Warning

Mathew J. Schwartz  •  July 12, 2019

George Orwell's "1984" posited a world in which Big Brother monitored us constantly via "telescreens." But thanks to our "smart" AI home assistants - from Google, Amazon and others - we're increasingly installing the monitoring equipment ourselves, and it may "hear" much more than we realize.

Cybersecurity Firm McAfee Preps for Public Market Return

Mathew J. Schwartz  •  July 11, 2019

Cybersecurity firm McAfee is reportedly planning a return to the public market, eyeing an IPO that could happen as early as later this year, raise $1 billion and value the company at $5 billion, The Wall Street Journal reports. The news comes amid a record volume of technology sector IPOs, including for Crowdstrike.

Marriott Faces $125 Million GDPR Fine Over Mega-Breach

Mathew J. Schwartz  •  July 9, 2019

Britain's privacy watchdog says it plans to fine hotel giant Marriott $125 million under GDPR for security failures tied to a 2014 breach of the guest reservation database for Starwood, which Marriott acquired in 2016. Undiscovered until 2018, the breach exposed 339 million customer records.

British Airways Faces Record-Setting $230 Million GDPR Fine

Mathew J. Schwartz  •  July 8, 2019

Britain's privacy watchdog has proposed a record-breaking $230 million fine against British Airways for violating the EU's General Data Protection Regulation due to "poor security arrangements" that attackers exploited to steal 500,000 individuals' payment card data and other personal details.

Why Application Security Is Your Best Cyber Defense

Mathew J. Schwartz  •  July 8, 2019

With attackers continuing to hammer weaknesses in software, organizations must prioritize application security more than ever, says Ian Ashworth of Synopsys. Thankfully, developers and middle management - bolstered by agile methodologies and DevOps - are increasingly leading the charge.