Cybersecurity

The first Thursday in May, May 2 this year, is World Password Day, intended to raise awareness of password best practices and the need for strong passwords. To mark the occasion this year, two cybersecurity companies have taken unique approaches to motivate everyone to take password security more seriously.

New samples of Emotet have been observed using different post-infection traffic than previous versions, according to analysis just published by cybersecurity company Trend Micro. Additionally, that analysis revealed Emotet is attempting to use compromised connected devices as proxy command and control servers to evade detection. These discoveries also show that the malware is being used to compromise and collect vulnerable connected devices, which could become resources for other malicious purposes.

The National Institute of Standards and Technology (NIST) has published a revised version of its Vetting the Security of Mobile Applications special publication. Despite their utility, mobile applications, or “apps,” can pose serious security risks to an organization and its users due to vulnerabilities that may exist within their software. Such vulnerabilities may be exploited to steal information, control a user’s device, deplete hardware resources, or result in unexpected app or device behavior.

A team consisting of researchers from Microsoft Research, Inria, and Carnegie Mellon University’s CyLab recently released the world's first verifiably secure industrial-strength cryptographic library – a set of code that can be used to protect data and is guaranteed to protect against the most popular classes of cyberattacks. The library is called “EverCrypt” and is available for download on GitHub. "With EverCrypt, we can rule out entire classes of vulnerabilities," said CybLab’s Bryan Parno, who is also an associate professor of Computer Science and Electrical and Computer Engineering.