Dark Reading Daily -- August 24, 2018

New Apache Struts Vulnerability Leaves Major Websites Exposed

The vulnerability, found in Struts' core functionality, could be more critical than the one involved in last year's Equifax breach.

Lazarus Group Builds its First MacOS Malware

This isn't the first time Lazarus Group has infiltrated a cryptocurrency exchange as the hacking team has found new ways to achieve financial gain.

Turla Threat Group Uses Email PDF Attachments to Control Stealthy Backdoor

The Russian-speaking group's latest tactic is the only known case of malware that's completely controllable via email, researchers at ESET say.

DNC Incident Was a Phishing Exercise

False alarm sent Democratic National Committee into high alert this week amid concerns of a new cyberattack.

The GDPR Ripple Effect

Will we ever see a truly global data security and privacy mandate?

New Mirai Variants Leverage Open Source Project

Aboriginal Linux gives Mirai new cross-platform capabilities - including Android.

Embedding Security into the DevOps Toolchain

Security teams need to let go of the traditional security stack, stop fighting DevOps teams, and instead jump in right beside them.

Wickr Adds New Censorship Circumvention Feature to its Encrypted App

Secure Open Access addresses void created by Google, Amazon decision to disallow domain fronting, company says.

CA Man Arrested for Conspiracy to Launder BEC Earnings

Ochenetchouwe Adegor Ederaine Jr., was involved with an organization engaged with wire fraud and related criminal activity, the DoJ reports.

Hackers Use Public Cloud Features to Breach, Persist In Business Networks

Attackers are abusing the characteristics of cloud services to launch and hide their activity as they traverse target networks.

It Takes an Average 38 Days to Patch a Vulnerability

Analysis of 316 million-plus security incidents uncovers most common types of real-world attacks taking place within in-production Web apps in the AWS and Azure cloud ecosystems.

7 Serious IoT Vulnerabilities

A growing number of employees have various IoT devices in their homes - where they're also connecting to an enterprise network to do their work. And that means significant threats loom.

EDITORS' CHOICE

6 Reasons Security Awareness Programs Go Wrong

While plenty of progress has been made on the training front, there's still some work ahead in getting the word out and doing so effectively.

Video from the DR News Desk at BHUSA

AI-Based POC, DeepLocker, Could Conceal Targeted Attacks

IBM research scientist discusses DeepLocker, a stealthy artificial intelligence-enhanced proof-of-concept that won't release any payload until the attacker reaches its ultimate target.

The Biggest Cybersecurity Breaches of 2018 (So Far)