IN THE LAST few months, waves of ransomware attacks have pummeled the world, disrupting not just businesses but also vital services like hospital care, energy infrastructure, and telecoms. Which means the research Andrea Continella and his team have pursued recently couldn't be better timed: A tool that detects ransomware automatically, almost instantly, and restores your system from backups before hackers can fully lock it down.

Called ShieldFS, the team's innovation isn't a broad antivirus platform, but that's by design. Instead, it's a targeted feature that scans only for ransomware attacks. By keeping the scope narrow, the project could focus on identifying the unique cryptographic behaviors of ransomware, which enables ShieldFS to detect not only known types, but also any new attacks that act in a ransomware-like manner. The group, based out of the Politecnico di Milano in Italy, will present ShieldFS at the Black Hat security conference in Las Vegas on Wednesday.

"The contribution of the research is a set of indicators we have developed that can be used to tell very efficiently if a process is ransomware or if it’s a benign process," says Stefano Zanero, a systems security researcher who worked on the project. By focusing on detecting the encryption itself, rather than simply cataloging specific ransomware types to look for, ShieldFS can preempt previously unseen versions, a valuable trait when even well-known ransomware schemes can turn much more aggressive, seemingly overnight.

Shadow Guard

The researchers worked with common ransomware types, like CryptoLocker and TeslaCrypt, that attack a system in the typical way—crawling through the directory, and encrypting each file one at a time. And at Black Hat, the group will demonstrate ShieldFS defense against a WannaCry infection, the type of ransomware that spiked in May, causing major disruption.


An Iran-linked threat group named by researchers CopyKittens has been conducting foreign espionage on strategic targets in various countries. Trend Micro and ClearSky have published a report detailing the actor’s activities, including targets, tools and attack methods.

The first report on CopyKittens was published in November 2015, but the group is believed to have been active since at least 2013. The hackers initially appeared to mainly target Israeli individuals, including diplomats and researchers, but further analysis showed that its operations have also covered entities in Saudi Arabia, Turkey, the United States, Jordan and Germany.

The list of targets includes government organizations, academic institutions, IT firms, defense companies and contractors, municipal authorities, and employees of the United Nations.

According to the latest report on CopyKittens activity, dubbed Operation Wilted Tulip, the hackers have used a wide range of tools and tactics. In some cases, they relied on watering hole attacks where news and other websites were compromised and set up to deliver exploits. The organizations whose websites were abused as watering holes includes The Jerusalem Post, for which even Germany’s Federal Office for Information Security (BSI) issued an alert.

The hackers also delivered malware using malicious documents set up to exploit various vulnerabilities, including the recently discovered Office flaw tracked as CVE-2017-0199, which at one point was a zero-day. In one attack, the hackers breached the email account of an employee of the Ministry of Foreign Affairs in the Turkish Republic of Northern Cyprus. The compromised account was used to send out a weaponized document to foreign affairs ministries in various countries around the world.




Millions of IoT devices are vulnerable to cybersecurity attacks due to a vulnerability initially discovered in remote security cameras, Senrio reported this week.

The firm found the flaw in a security camera developed by Axis Communications, one of the world's biggest manufacturers of the devices.


The Model 3004 security camera is used for security at the Los Angeles International Airport and other places, according to Senrio.

The problem turned out to be a stack buffer overflow vulnerability, which the firm dubbed "Devil's Ivy."

Axis notified the security firm that 249 different models of the camera were affected by the vulnerability. It found only three models that were unaffected.


Buried Deep

The problem lies deep in the communication layer ofgSOAP, an open source third-party toolkit that is used by all kinds of device makers for IoT technology, according to Senrio.

gSOAP manager Genivia reported that the toolkit has been downloaded more than 1 million times, according to Senrio. Most of the downloads likely involved developers. Major companies including IBM, Microsoft, Adobe and Xerox are customers of the firm.

Genivia issued a new patch for gSOAP within 24 hours of being alerted to the vulnerability, and said it notified customers of the problem, according to CEO Robert van Engelen.


Tuesday, September 12, 2017 - 6:45 p.m.



The evening will be full of amazing facts brought to us by Messrs. Bob Wallace and Keith Melton as they discuss their recently released book, "Spy Sites of Washington D. C.".  It will be an evening well spent and one that's sure to open eyes about our Nation's Capital.

Following the talk, Bob and Keith will sign books.  Don't miss this one!



For additional information, please visit: SPY SITES OF WASHINGTON: SMITHSONIAN EVENT SITE