Dark Reading Daily -- December 16, 2022

Stolen Data on 80K+ Members of FBI-Run InfraGard Reportedly for Sale on Dark Web Forum

InfraGard's members include key security decision-makers and stakeholders from all 16 US civilian critical-infrastructure sectors.

Meta Ponies Up $300K Bounty for Zero-Click Mobile RCE Bugs in Facebook

Facebook's parent company has also expanded bug-bounty payouts to include Oculus and other "metaverse" gadgets for AR/VR.

Blackmailing MoneyMonger Malware Hides in Flutter Mobile Apps

Money-lending apps built using the Flutter software development kit hide a predatory spyware threat and highlight a growing trend of using personal data for blackmail.

Data Destruction Policies in the Age of Cloud Computing

It's time for on-the-record answers to questions about data destruction in cloud environments. Without access, how do you verify data has been destroyed? Do processes meet DoD standards, or do we need to adjust standards to meet reality?

DDoS Attack Platforms Shut Down in Global Law Enforcement Operation

Sweeping operation took down around 50 popular DDoS platforms, just one of which was used in 30M attacks, Europol says.

API Flaws in Lego Marketplace Put User Accounts, Data at Risk

Attackers also could breach internal production data to compromise a corporate network using vulnerabilities found in the BrickLink online platform.

Microsoft-Signed Malicious Drivers Usher In EDR-Killers, Ransomware

Malicious Windows drivers signed as legit by Microsoft have been spotted as part of a toolkit used to kill off security processes in post-exploitation cyber activity.

CSAF Is the Future of Vulnerability Management

Version 2.0 of the Common Security Advisory Framework will enable organizations to automate vulnerability remediation.

The Cybersecurity Industry Doesn't Have a Stress Problem — It Has a Leadership Problem

Organizations need servant leaders to step forward and make their teams' professional effectiveness and happiness a priority.

Live From London: Next-Gen Cybersecurity Takes Stage at Black Hat Europe

Check out our slideshow detailing the emerging cybersecurity trends in cloud, creating a defensible Internet, malware evolution, and more that lit up audiences in London.

LATEST FROM THE EDGE

Zero Trust Shouldn’t Be The New Normal

Zero trust is useful in some situations, but organizations should not be trying to fit zero trust everywhere. In some cases, identity-based networking is an appropriate alternative.

LATEST FROM DR TECHNOLOGY

NIST Finally Retires SHA-1, Kind Of

SHA-1 was deprecated in 2011. NIST has set the hashing algorithm's final retirement date to Dec. 31, 2030.

10 Hot Talks From Black Hat USA 2022