A secure computing enclave platform from Google, more attacks on Drupal content management systems and change your Twitter password
We’re bringing you the latest cyber security news Welcome to Cyber Security Today. It’s Monday May 7th. To hear the podcast click on the arrow below:
 |
 |
 |
Hackers go after important data held by organizations. But to get there they often have to go through the IT infrastructure, including the operating system. Encryption helps, but for some companies isn’t enough. Google is now offering an additional way of protection. It has created a way for organizations to create a trusted computing environment by using an open source framework it calls Asylo. Creating a trusted enclave isn’t new. But it wasn’t easy. Google says its new tools make it simpler. Asylo will verify software code integrity, provide isolation for sensitive workloads and offer communication encryption tools. It’s still early. We’ll see if IT departments take advantage.
A week ago I talked about the need for administrators of Drupal content management systems to patch their servers against the “Drupalgeddon 2.0” vulnerability. Here’s another reason: Researchers at Imperva have discovered a malware that tries to plant a cryptocurrency miner on servers that run Drupal. And last month it also found the malware trying to attack servers running the vBulletin content management system. If successful, the malware tries to install the mining software on any person’s browser that visits the infected Web site. That’s cunning, because the purpose of a content manager is to host content for Web sites. Imperva dubs this malware “Kitty” because the mining script is called “meow.” Administrators have to patch content management systems as soon as possible. And end users have to watch for signs their computers are slowing. Maybe they’ve been exploited.
Finally, by now I hope Twitter listeners have got the message from the company and changed their passwords. Twitter usually scrambles users passwords for protection. But last week it discovered a bug in the procedure copied the clear passwords to an internal company log before being encrypted. There’s no evidence, the company said, that log was disclosed to an attacker. But out of caution Twitter told users to change passwords. Would Twitter have done this had the company not been in the spotlight recently? Who knows. But it’s good publicity that it moved so fast. Other companies should learn.
That’s it for Cyber Security Today. Subscribe on Apple Podcasts, Google Play, or add us to your Alexa Flash Briefing. Thanks for listening. I’m Howard Solomon.