Content by Mathew J. Schwartz

Spectre and Meltdown Flaws: Two More Variants Discovered

Mathew J. Schwartz  •  May 22, 2018

Researchers have discovered two new Spectre/Meltdown variants: variant 3a, a rogue system register read, and variant 4, a speculative store bypass. Some AMD, ARM, Intel and IBM Power chips have the flaws, which attackers could exploit to steal sensitive data. Some fixes have already been shipped.

DDoS Attacker Receives 15-Year Sentence

Mathew J. Schwartz  •  May 21, 2018

John Gammell of New Mexico has been sentenced to serve 15 years in prison for launching DDoS attacks against prior employers and business competitors, as well as for being a convicted felon in possession of firearms.

FCC to Investigate US Mobile Phone Location-Revealing Flaw

Mathew J. Schwartz  •  May 21, 2018

Following the disclosure of a flaw in the website of LocationSmart that could have been easily exploited to track the location of cellular phone users throughout the U.S. in real time, the Federal Communications Commission has referred the matter to its enforcement bureau for investigation.

Real-Time Mobile Phone Location Tracking: Questions Mount

Mathew J. Schwartz  •  May 18, 2018

Following reports about U.S. companies that enable government and other users to access real-time tracking information for all major U.S. wireless carriers' subscribers, provider Securus Technologies has reportedly been hacked, while LocationSmart has fixed a data-exposing flaw.

Nonstop Breaches Fuel Spike in Synthetic Identity Fraud

Mathew J. Schwartz  •  May 18, 2018

Leading the latest edition of the ISMG Security Report: Years of massive data breaches have fueled an increase in synthetic identity fraud, in which fraudsters combine real and bogus details to create more effective fake identities. Plus, has "The Dark Overlord" hacking group finally met its match?

White House Axes Top Cybersecurity Job

Mathew J. Schwartz  •  May 16, 2018

The Trump administration has eliminated the top cybersecurity coordinator role in the White House. The decision has earned a sharp rebuke from lawmakers and former government officials, who say cybersecurity demands a greater - not lesser - prominence in the federal government.

Report: Facebook App Exposed 3 Million More Users' Data

Mathew J. Schwartz  •  May 15, 2018

Researchers at the University of Cambridge, via a myPersonality test on Facebook, reportedly used data from 3 million users to power a spin-off company that delivered targeted advertising services. Facebook says the app is one of 200 that it's suspended for suspicious data handling practices.

Chili's Speed Question: To Notify or Not to Notify Quickly?

Mathew J. Schwartz  •  May 14, 2018

Chili's Grill & Bar is warning customers that an unknown number of payment cards were compromised at an unknown number of corporate-owned locations earlier this year for a period of time it suspects lasted two months. Should Chili's have waited to alert customers until it had more information?

Uninstall or Disable PGP Tools, Security Researchers Warn

Mathew J. Schwartz  •  May 14, 2018

European computer security researchers say they have discovered vulnerabilities that relate to two techniques used to encrypt emails: PGP and S/MIME. Security experts recommend all PGP users immediately delete or disable their PGP tools, pending a full fix.

Real-Time Payment Networks Face Off Against Fraudsters

Mathew J. Schwartz  •  May 11, 2018

With the rise of P2P payment networks and the U.S. working toward a real-time national payments network, the push is on to battle fraudsters. Also, attackers are hacking legitimate websites to more stealthily distribute "Gandcrab" crypto-locking ransomware.

White House Might Eliminate Cyber Coordinator Role

Mathew J. Schwartz  •  May 10, 2018

Adequately tracking the nonstop arrival and departure of officials in the Trump White House might require real-time, multidimensional flowcharts. But one thing is clear: The White House is facing a looming cybersecurity knowledge and expertise deficit, and that deficit may soon get worse.

Spectre: The Next Generation

Mathew J. Schwartz  •  May 9, 2018

Spectre and Meltdown: It's déjà vu all over again as Intel is reportedly prepping a coordinated vulnerability disclosure announcement for eight new speculative execution flaws. One of the new flaws is apparently worse than any of the three Spectre/Meltdown variants that came to light in January.

Zero-Day Attack Exploits Windows via Malicious Word Doc

Mathew J. Schwartz  •  May 9, 2018

Security alert: Microsoft has issued updates to fix 67 unique flaws in its products. One vulnerability in Windows VBScript engine is already being actively exploited in the wild via malicious Word documents and could also be employed for attacks via websites and malvertising, Microsoft warns.

Equifax: US Breach Victim Tally Stands at 146.6 Million

Mathew J. Schwartz  •  May 8, 2018

Equifax says it continues to field queries from U.S. lawmakers about the full extent of its massive 2017 data breach, which occurred after an attacker exploited its unpatched Apache Struts web application. Research finds that many more organizations are using unpatched Struts applications.

How Authentication Must Evolve in the Age of GDPR

Mathew J. Schwartz  •  May 7, 2018

Privacy regulations, user satisfaction concerns and the need to prevent data breaches are driving more organizations that must authenticate users to find "a better way of ensuring that people are who they are when they are accessing critical information," says Tony Smales, CEO of Forticode.