The US authorities have, for the first time, explicitly identified the prolific MuddyWater hacking group as an Iranian state-sponsored entity, revealing several open-source tools used by the group to target victims. US Cyber Command’s Cyber National Mission Force said in a post yesterday that the actors associated with MuddyWater are “a subordinate element within the Iranian Ministry of Intelligence and Security (MOIS).” According to the Congressional Research Service (CRS), the MOIS “conducts domestic surveillance to identify regime opponents.” It…

Some UK banks are letting their customers down with poor authentication and web security issues, according to a consumer rights group. Which? once again teamed up with independent security consultants 6point6 to appraise the “front-end” security of 15 current account providers. It looked at four criteria: encryption and protection, login, account management and navigation. The report found that, while all lenders followed strong customer authentication (SCA) rules as laid down in European banking regulations, some exposed…

What do you think keeps CIOs up at night these days? CIOs are telling me they are currently functioning under many constraints—everyone is being asked to do more with less. Innovation under these constraints is a must. Successful CIOs recognize that this is not a bad thing. In fact, a constrained environment is often a source of innovation because it helps drive creative solutions. IT departments should not be overlooked when it comes to finding…

Collecting Credentials Many of us are fond of collecting things, but not everyone is excited about Collections #1-5. In 2019, these Collections, composed of ca. 932 GB of data containing billions of email addresses and their passwords, made their way around the Internet. These collections weren’t breaches but compilations of emails and passwords that had been gathered. Even after repeat entries were whittled down, the collection still contained billions of distinct address and password combinations….

A cyber-attack on the Medical Review Institute of America (MRIoA) may have exposed the personal data of 134,571 individuals. MRIoA, which is based in Salt Lake City, Utah, said it was “the victim of a sophisticated cyber incident” discovered on November 9, 2021, that resulted in a threat actor’s gaining unauthorized access to its network and exfiltrating data. MRIoA, which provides clinical reviews and virtual medical opinions, said attackers broke into its computer system by exploiting an…