Mandiant: Orgs are detecting cybercriminals faster than ever
The average time taken by global organizations to detect cyberattacks has dropped to its lowest-ever level of ten days, Mandiant revealed today. The cyber shop says the downward trend continues from last year’s 16 days and should be seen as “a big victory for the good guys,” but a deeper look into the underlying data shows there are still some obvious issues at play. For one, the regional breakdown in the infosec giant’s latest M-Trends report, released today, shows the new all-time low (median) average of ten days is skewed by data in previously under-achieving regions. JAPAC, for example, dropped its average dwell time to nine days, which is below the current global median – great stuff – but last year the region’s average was 33 days, more than double the global figure, which JAPAC unfavorably skewed.
US imposes visa bans on 13 spyware makers and their families
The Department of State has started imposing visa restrictions on mercenary spyware makers and peddlers, prohibiting their entry into the United States, as announced earlier in February. The crackdown has begun with 13 individuals and their close families (i.e., spouses and children) linked to commercial spyware operations. Taken pursuant to Section 212 (a)(3)(C) of the Immigration and Nationality Act, these visa restrictions allow the Secretary of State to exclude visa applications whose entry would have adverse foreign policy consequences for the U.S., effectively banning those linked to commercial spyware from entering the country.
Major Security Flaws Expose Keystrokes of Over 1 Billion Chinese Keyboard App Users
Security vulnerabilities uncovered in cloud-based pinyin keyboard apps could be exploited to reveal users’ keystrokes to nefarious actors. The findings come from the Citizen Lab, which discovered weaknesses in eight of nine apps from vendors like Baidu, Honor, iFlytek, OPPO, Samsung, Tencent, Vivo, and Xiaomi. The only vendor whose keyboard app did not have any security shortcomings is that of Huawei’s. The vulnerabilities could be exploited to “completely reveal the contents of users’ keystrokes in transit,” researchers Jeffrey Knockel, Mona Wang, and Zoë Reichert said. The disclosure builds upon prior research from the interdisciplinary laboratory based at the University of Toronto, which identified cryptographic flaws in Tencent’s Sogou Input Method last August.
The TikTok ban just passed the U.S. Senate. It’s now one small step away from becoming law.
The U.S. TikTok ban has just passed the Senate, meaning it’s just one presidential signature away from becoming law. Considering President Joe Biden has previously said he would sign the bill, it now seems practically guaranteed that the TikTok ban will actually go ahead. Seventy-nine U.S. senators approved of the TikTok ban, eclipsing the 18 who voted against it. The bill had passed the House of Representatives on Saturday, bundled with aid for Israel, Ukraine, and Taiwan. It was the second time a TikTok ban had passed the House in as many months, with the previous bill having stalled at the Senate.
Ring customers get $5.6 million in privacy breach settlement
The Federal Trade Commission is sending $5.6 million in refunds to Ring users whose private video feeds were accessed without consent by Amazon employees and contractors, or had their accounts and devices hacked because of insufficient security protections. The action is part of a settlement following a complaint from May 2023 alleging that Ring failed to implement adequate security measures to protect the devices from unauthorized access. Ring is an Amazon subsidiary known its smart home security products, including video doorbells, indoor and outdoor security cameras, central alarm hubs, smart sensors, motion-activated lights, and more.
