This Week in Application Security News March 4-10, 2018

News highlights this week: New cryptojacking attack targets both application and database servers with crypto-mining malware, ‘Kill switch’ stops memcached DDoS attacks, Ukraine sentences two citizens for DDoS extortion, UK cyber security certification pilot launched and SEC’s cybersecurity guidance falls short.

Top Story

Imperva researchers discovered a complex, new cryptojacking attack that infects both application and database servers with crypto-mining malware. RedisWannaMine demonstrates a worm-like behavior combined with advanced exploits to increase the attackers’ infection rate and fatten their wallets.

DDoS Attacks and Cyberthreat Prevention

Memcached DDoS attacks slow down as patching ramps up (eWeek, Mar 9)

Memcached patching efforts appear to be working as the attack bandwidth size of memcached DDoS attacks is now on the decline.

Ukraine sentences two citizens for DDoS extortion campaigns (Bank InfoSecurity, Mar 6)

This groundbreaking prosecution targeted attackers who demanded bitcoin payoffs.

UK cyber security certification pilot launched (Computer Weekly, Mar 8)

UK businesses now have the opportunity to improve cyber security and prove they have taken steps to protect data they hold, thanks to a police-backed certification scheme.

SEC’s new cybersecurity guidance falls short (CSO Online, Mar 5)

Those who hoped that the US Securities and Exchange Commission would impose tougher rules (and consequences for breaking them) around reporting breaches may be disappointed.