Dark Reading Weekly -- December 10, 2020

Phishing Campaign Targets 200M Microsoft 365 Accounts

A well-organized email spoofing campaign has been seen targeting financial services, insurance, healthcare, manufacturing, utilities, and telecom.

Nation-State Hackers Breached FireEye, Stole Its Red Team Tools

"Novel techniques" used by the attackers cheated security tools and forensics, according to FireEye CEO Kevin Mandia.

Potential Nation-State Actor Targets COVID-19 Vaccine Supply Chain

Companies involved in technologies for keeping vaccines cold enough for safe storage and transportation are being targeted in a sophisticated spear-phishing campaign, IBM says.

Open Source Developers Still Not Interested in Secure Coding

Security and development are still two different worlds, with open source developers resistant to spending time finding and fixing vulnerabilities.

Google Security Researcher Develops 'Zero-Click' Exploit for iOS Flaw

A new patched memory corruption vulnerability in Apple's AWDL protocol can be used to take over iOS devices that are in close proximity to an attacker.

Attackers Know Microsoft 365 Better Than You Do

Users have taken to Microsoft Office 365's tools, but many are unaware of free features that come with their accounts -- features that would keep them safe.

Why I'd Take Good IT Hygiene Over Security's Latest Silver Bullet

Bells and whistles are great, but you can stay safer by focusing on correct configurations, posture management, visibility, and patching.

Trump Signs IoT Security Bill into Law

The Internet of Things Cybersecurity Improvement Act of 2020 is now official.

Kmart Hit by Egregor Ransomware

Egregor is also behind recent attacks on UbiSoft and Barnes & Noble.

NSA Warns of Exploits Targeting Recently Disclosed VMware Vulnerability

Agency urges organizations to deploy patch as soon as possible since exploit activity is hard to detect.

Cloud Security Threats for 2021

Most of these issues can be remediated, but many users and administrators don't find out about them until it's too late.

Researchers Bypass Next-Generation Endpoint Protection

Machine learning-based products can be tricked to classify malware as a legitimate file, new findings show.

EDITORS' CHOICE

Black Hat Europe: Dark Reading Video News Desk Coverage

Coming to you from virtual backgrounds and beautifully curated bookcases around the world, Dark Reading brings you video interviews with the leading researchers speaking at this week's Black Hat Europe.

Flash Dies but Warning Signs Persist: A Eulogy for Tech's Terrible Security Precedent

Flash will be gone by the end of the year, but the ecosystem that allowed it to become a software security serial killer is ready to let it happen again.

LATEST FROM THE EDGE

10 Ways Device Identifiers Can Spot a Cybercriminal

Device IDs, which are assigned to mobile devices to distinguish one from another, can help organizations flag fraud, cyberattacks, and other suspicious activities.

2021 Top Enterprise IT Trends