Content by Mathew J. Schwartz

Anatomy of a Cryptocurrency Phishing Campaign

Mathew J. Schwartz  •  January 17, 2018

Virtual currency that's been surging in value, stored in internet-connected banks and virtual "hot wallets": What could go wrong? The answer includes well over $175 million worth of stolen cryptocurrency and attacks that have been tied to North Korea's Lazarus Group.

NotPetya: From Russian Intelligence, With Love

Mathew J. Schwartz  •  January 16, 2018

The CIA has attributed last year's outbreak of NotPetya wiper malware to Russia's GRU military intelligence unit, The Washington Post reports. Other intelligence agencies and information security experts have reached similar conclusions, warning that Russia's hybrid warfare campaigns are intensifying.

Fancy Bear Targets US Senate, Security Researchers Warn

Mathew J. Schwartz  •  January 15, 2018

The cyber espionage group that executed a campaign against the Democratic Party has been gearing up to attack the U.S. Senate, cybersecurity firm Trend Micro warns. Separately, a Senate report demands that the White House do more to prevent the 2018 and 2020 U.S. elections from being disrupted.

Backdoored in 30 Seconds: Attack Exploits Intel AMT Feature

Mathew J. Schwartz  •  January 12, 2018

An attacker who gains physical access to a corporate PC with an Intel chip could exploit the built-in Active Management Technology to backdoor the system in about 30 seconds, unless default AMT credentials have been changed, Finnish security firm F-Secure warns.

Spectre Reversal: AMD Confirms Chips Have Flaws

Mathew J. Schwartz  •  January 12, 2018

In a reversal, chipmaker AMD is now warning that its chips are susceptible to the speculative execution flaws in microprocessors known as Spectre, but not to the Meltdown. Separately, Intel has confirmed that its firmware updates have led to stability problems for older Broadwell and Haswell processors.

Patch Now or Risk GDPR Fines Later, Regulator Warns

Mathew J. Schwartz  •  January 11, 2018

Following the alert over Meltdown and Spectre vulnerabilities, the U.K. Information Commissioner's Office is warning that failures to patch today could be punished with fines under GDPR once enforcement of the data protection law begins later this year.

Carphone Warehouse Breach: 'Striking' Failures Trigger Fine

Mathew J. Schwartz  •  January 10, 2018

Mobile phone retailer Carphone Warehouse has been hit with one of the largest fines ever imposed by Britain's data privacy watchdog after an attacker breached its outdated WordPress installation, exposing 3 million customers' and 1,000 employees' personal details.

Performance Hit: Meltdown and Spectre Patches Slow Systems

Mathew J. Schwartz  •  January 10, 2018

Fixes for the Meltdown and Spectre vulnerabilities are leading to decreased processor performance, triggering cloud service and data center slowdowns. All Windows servers - plus older PCs - as well as Linux servers appear to be experiencing noticeable slowdowns.

Meltdown and Spectre Forecast: Patch Now and Keep Patching

Mathew J. Schwartz  •  January 9, 2018

Patch or perish to protect against Meltdown and Spectre attacks, and prepare to keep patching as Intel, AMD and ARM, as well as makers of devices running Apple, Google and Windows operating systems, including Apple iOS and Android smartphones and tablets, continue to refine their fixes.

Microsoft Pauses Windows Security Updates to AMD Devices

Mathew J. Schwartz  •  January 9, 2018

Microsoft has paused issuing security updates to some Windows PCs with AMD chipsets after at least one update - meant to add some Meltdown and Spectre mitigations - has left some systems unbootable. Microsoft blamed the problem on AMD failing to properly document its firmware.

Warning: Microsoft Fix Freezes Some PCs With AMD Chips

Mathew J. Schwartz  •  January 8, 2018

Security teams are scrambling to put in place fixes for the Meltdown and Spectre flaws. But Windows users report that Microsoft's security fix for the flaws has been freezing some PCs built with CPUs from chipmaker AMD. Here are workarounds.

DHS Says 246,000 Employees' Personal Details Were Exposed

Mathew J. Schwartz  •  January 5, 2018

The U.S. Department of Homeland Security says nearly 250,000 federal employees' personal details were exposed in a 2014 breach of its Office of Inspector General's case management system. Witness testimony and an unknown number of nonemployees' personal details also were exposed.

Meltdown and Spectre: Patches and Workarounds Appear

Mathew J. Schwartz  •  January 4, 2018

Microprocessor makers Intel, ARM and AMD, as well as operating system and software developers and makers of smartphones and other devices, are rushing to prep, test and ship fixes for the serious CPU flaws exploitable via Meltdown and Spectre attacks.

Serious Meltdown and Spectre Flaws Make CPUs Exploitable

Mathew J. Schwartz  •  January 4, 2018

"Replace CPU hardware" might be the only full solution listed by CERT/CC for serious flaws in microprocessors that run millions of PCs, cloud services, servers, smartphones and other devices. Thankfully, many security experts believe patches and workarounds will mostly suffice.

Forever 21 Suffered 7-Month POS Malware Attack

Mathew J. Schwartz  •  January 3, 2018

Apparel retailer Forever 21 says point-of-sale systems in some stores were infected by malware for up to seven months, leading to the theft of customers' payment card data. The retailer says deactivated encryption technology on some POS devices exacerbated the severity of its breach.