Updates to CFAA guidance, ransomware progress and problems with a Pentagon cyber push
Welcome to Changelog for 5/22/22, published by Synack! Blake here, struggling to beat the heat in Washington.
Steep costs, troubling questions roil DOD cybersecurity program rollout
About 80,000 companies that sell to the U.S. military will need to pass a cybersecurity audit before they can bid for business under rules the Defense Department plans to impose next year. But many small defense contractors aren’t prepared for the brave new world of the Cybersecurity Maturity Model Certification (CMMC) program.
The Full Disclosure movement, an open-source oops and Viasat’s Russian hacking woes
Investors are still parsing whether this is just another swing in the infamously volatile market, but many individual traders are hurting, badly. Perhaps a few large corporations with ransomware worries will snap up some cryptocurrency now to hedge against future payments.
From subversives to CEOs: How radical hackers built today’s cybersecurity industry
README adapted this article from a January 2022 report by Matt Goerzen and Gabriella Coleman.
RaidForums was crumbling before its DOJ takedown — here’s why
Cybercriminals are selling “exclusive” stolen data to multiple customers, threatening the stability of illicit marketplaces before even considering Justice Department actions.
Escalating the war on passwords, post-Roe threat modeling and more Log4j lessons
Welcome to Changelog for 5/8/22, published by Synack! I’m your host, Blake. Last week’s Hack the Capitol event was a hit — I tried my hands at my first-ever Escape Room, hosted by the Department of Homeland Security and designed with input from industrial control system gurus at the Energy Department’s network of national labs.
Ghosts of Log4j: Open-source vulnerabilities confound software developers
Most of the code in typical applications comes from open-source projects, importing dozens — and often, hundreds — of components created by volunteers. As the Log4j incident shows, those deep dependencies can carry critical vulnerabilities.
Microsoft’s take on hybrid war, a REvil comeback and Elon Musk’s push for secure Twitter DMs
Welcome to Changelog for 5/1/22, published by Synack! Blake here, reporting from Washington, D.C. I’ll be moderating a panel on ransomware threats to critical infrastructure Wednesday at Crowell & Moring LLP here, so say hello if you’ll be attending the fifth edition of the educational “Hack the Capitol” event.
REvil reloaded? A notorious Russia-based ransomware group is back
Russian authorities noisily arrested 14 alleged members of the REvil ransomware gang in January after a U.S. government request. So why is the group’s malware and infrastructure suddenly blinking back on?