The Treasury Department has "very serious concerns" about Facebook's new Libra cryptocurrency, according to Secretary Steve Mnuchin. "Libra could be misused by money launderers and terrorist financiers. Cryptocurrencies, such as Bitcoin, have been exploited to support billions of dollars of illicit activity, like cybercrime, tax evasion, extortion, ransomware, illicit drugs, human trafficking."

Every day we read stories about data breaches and cyberattacks on business and government websites, and the resulting the loss of personally identifiable information. Cybercrime is on the rise, and given the ever-evolving methods of attack, meaningful relief and reliable measures to fend off cybercriminals are unlikely in the foreseeable future. Companies need to insure against cybertheft.

A security researcher has found a flaw in the popular video conferencing app Zoom that could be used to turn on the camera on a Macintosh computer without a user's permission. The vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without a user's permission, explained Jonathan Leitschuh, a senior software engineer at Gradle.

It is newly minted conventional wisdom that not a single information security conference goes by without a presentation about the abysmal state of IoT security. While this is a boon for researchers looking to make a name for themselves, this sorry state of affairs is definitely not beneficial for anyone who owns a connected device. IoT device owners aren't the only ones fed up, though.

While good communication is pretty much universally beneficial, there are times when it's more so than others. One such time? During a cybersecurity incident. Incident responders know that communication is paramount. Even a few minutes might mean the difference between closing an issue vs. allowing a risky situation to persist longer than it needs to.

The U.S. House Intelligence Committee recently heard expert testimony on the growing threat posed by "deepfakes" -- altered videos and other AI-generated false information -- and what it could mean for the 2020 general elections, as well as the country's national security overall. The technologies collectively known as "deepfakes" can be used to manipulate and falsify images and videos.

Chinese hackers likely are responsible for a series of cyberattacks against telecommunications companies around the world, security researchers have reported. The campaign, dubbed "Operation Soft Cell," has been active since 2012, according to Cybereason. There is some evidence suggesting even earlier activity against the telecommunications providers, all of whom were outside North America.

Firefox users should update their browsers immediately to fix a critical zero-day vulnerability. Anyone using Firefox on a Windows, macOS or Linux desktop is at risk. Mozilla issued a patch Tuesday, but the vulnerability was discovered by Samuel Groß of Google Project Zero on April 15. Mozilla's fix came after Coinbase reported exploitation of the vulnerability for targeted spearphishing attacks.

Account hijacking has become a nettlesome problem at Instagram so it has decided to do something about it. The social media company has begun testing a simpler method for users to reclaim their compromised accounts. It allows users locked out of their hacked accounts to ask for a six-digit code to be sent to the email address or phone number originally used to open the account.

Building and sustaining a brand has gotten more challenging. The global marketplace, empowered by the Internet, has delivered a raft of opportunities to businesses, but it also has opened the door for challenges. These challenges include increased competition as the result of a wider market, and increased possibilities for brand abuse. Added to that mix is the ever-present cyberthreat.

Is anyone surprised to learn that in just the first quarter of 2019 more than $1.2 billion worth of cryptocurrency was stolen? Probably not. This story follows the old line from bank robber Willie Sutton who is credited with saying that he robbed banks "because that's where the money is." So not much has changed. Cryptocurrencies are not exactly money, though, even if they do have a market value.

In IT, we've been hearing about the "cybersecurity skills shortage" for a few years. There is no shortage of statistics and data about it: More than 70 percent of participating organizations reported being impacted by the skills shortage, according to an ESG/ISSA research report. Likewise, more than half of the organizations surveyed for an ISACA report noted unfilled cybersecurity positions.

Shoppers soon might see a lot more robots in Walmart stores -- but not toy robots or even human assistant gadgets that are available for purchase. Walmart's new robots will be taking over repeatable, predictable and manual tasks that up to now have been carried out by human employees. At Walmart stores, robots will scan shelf inventory and track boxes as part of its inventory management.

The high-tech industry once again is in a tizzy over flaws discovered in Intel CPUs -- four new MDS vulnerabilities have come to light. MDS is a sub-class of previously disclosed vulnerabilities that sample data leaked from small structures within the CPU using a locally executed speculative execution side channel. The practical exploitation of MDS flaws is a very complex undertaking, however.

Many users of Facebook's WhatsApp messaging software are scrambling to patch the program in response to news of a flaw that allowed spyware to be installed on mobile phones running Android and iOS. "This new type of attack is deeply worrying and shows how even the most trusted mobile apps and platforms can be vulnerable," said Mike Campin, vice president of engineering at Wandera.

Baltimore officials have admitted that the city government once again has been victimized by ransomware -- the second such attack in just over a year. City computers reportedly were infected with the RobinHood ransomware virus. Hackers told city officials that they would unlock the computers in return for payment of three bitcoins per system, or 13 bitcoins for the entire system.

Spring may be my favorite time of year. The snow is melting, the sun is shining, and the air smells just a little bit fresher. It's as though the world is setting an example for the rest of us, letting us know that it's time to start fresh. It's time for spring cleaning -- and in the security world, spring cleaning means more than just wiping down countertops and lighting a few scented candles.

Almost two years after the infamous Equifax breach, many organizations still struggle to identify and manage open source risk across their application portfolios. Meanwhile, the latest report tracking open source security shows a 40 percent rise in the average number of open source components detected in each codebase analyzed. The scanned software includes commercial applications.

A new method for hiding the true location of a website from users of the mobile Chrome Web browser has come to light. Phishers can trick users into revealing their credentials for a legitimate website to operators of a malicious one, security researcher James Fisher reported. Scammers can exploit mobile Chrome's feature that hides the address bar when users are scrolling on a Web page.

Tesla sure didn't have a good week last week, given the kind of press coverage it got. I'm not that worried about Tesla going away, though, as its products are far too popular for it to disappear. On the other hand, management clearly needs to be fixed. What got me started looking at Tesla last week was that it pretty much announced that Nvidia was its Kryptonite.

Hackers piggybacked onto a Microsoft customer support portal between Jan. 1 and March 28 to gain access to the emails of noncorporate account holders on webmail services Microsoft manages, including MSN.com, Hotmail.com and Outlook.com. Microsoft has confirmed that a "limited" number of customers who use its Web service had their accounts compromised.

Cybersecurity experts at Microsoft's Windows Defender Security Intelligence Team this week reported their discovery of two new email-based phishing campaigns. One targets Amex users while the other targets Netflix customers. Both campaigns reportedly are very well-crafted, featuring legitimate logos and even fill-in forms that closely mimic those on the respective company's own websites.

Mozilla has announced Firefox Send, a free encrypted file-sharing service that works in any browser. To share a file, you simply visit the Send site and drag your file to a box on the Web page. Unregistered users may upload up to 1 gigabyte in files, while registered users have a 2.5 GB allowance. After uploading your files, you choose an expiration time for the link used to share them.

Microsoft has been urging customers to upgrade from its Windows 7 operating system, while attempting to ease the transition with several options for extended support. It will stop providing routine fixes and security patches effective January 2020. Regular support for Windows Server 2008 also will end at that time. Windows 7 enterprise customers can subscribe to Extended Security Updates.

Following a natural disaster that causes property damage to businesses and homes -- say a hurricane, fire or flood -- how often do you hear suggestions that the victims were at fault for their misfortune, or that they could have done something to prevent the event from occurring in the first place? Not often, right? We all know that events like that are possible. We plan around those possibilities, and we don't blame the victims.

A new cryptovirus called "B0r0nt0K" has been putting Linux and possibly Windows Web servers at risk of encrypting all of the infected domain's files. The new ransomware threat and the ransom of 20 bitcoins -- about $75,000 -- first came to light last week in a forum post. A client's website had all its files encrypted and renamed with the .rontok extension appended to them, the forum user indicated.

The e-ticketing systems of eight airlines, including Southwest Airlines and Dutch carrier KLM, have a vulnerability that can expose passengers' personal data, mobile security vendor Wandera has reported. They use unencrypted links that hackers can intercept easily. The hackers then can view and, in some cases, even change the victim's flight booking details, or print their boarding passes.

Apple has suspended its Group FaceTime application following reports that a bug in the software allowed callers to eavesdrop on the people they were calling. The flaw let a person making a FaceTime call listen through the phone of the person called before the call was accepted or rejected. It reportedly also allowed access to the front-facing camera in an iPhone.

There's been a lot of hype about blockchain over the past few years. Nowadays though, there are signs that we may be on the cusp of moving from the "blockchain will solve all your problems" segment of the hype cycle into the "blockchain may be useful for a few targeted applications" segment. Utility-based Darwinism is at work -- we're starting to see the less likely applications fall away.

Authorities can't force people to unlock their biometrically secured phones or other devices, ruled a federal judge in California. "The Government may not compel or otherwise utilize fingers, thumbs, facial recognition, optical/iris, or any other biometric feature to unlock electronic devices," Magistrate Judge Kandis A. Westmore wrote. Passcodes already are protected by the Fifth Amendment.