David’s Take

The final keynote lineup for next month’s RSA conference has been announced, and adds several accomplished speakers, including Kirsten Nielsen, the Homeland Security Secretary; Jane McGonigal, a director of Institute for the Future; Margot Shetterly, the author of the excellent book Hidden Figures; and Resma Saujani, the founder of Girls Who Code, to the conference. Also appearing are Shamir and Rivest (two of the company’s namesake founders) to a panel discussion. I plan on attending the show.

The malware behind last week’s Atlanta city attack, called SamSam, has been around for many years and to date the group has made more than $800,000 in its Bitcoin accounts. The research into its operations was posted on CSOonline

-- David Strom, editor of Inside Security

Top Story: Standards watch

A new extension of the DMARC email standard, called Brand Indicators for Message Identification or BIMI, has been drafted that will show an originating domain’s logo alongside the message in your inbox. The goal is to create yet another authentication mechanism to thwart phishing attacks. Major email provides including Microsoft, Yahoo, Google and Comcast have announced support. – BIMI WEBSITE

Attacks

The group behind Sanny malware attacks has made significant changes to the way it delivers their payload. They have updated their delivery techniques to a more staged approach to better hide their tactics, expanded their targets to Windows 10 computers, and made other enhancements. The group is thought to reside in Korea and has targeted English and Russian speakers for many years. – FIREEYE BLOG

While Facebook denies these claims in a blog post, my colleague Sean Gallagher says they have been scraping call and text message data in their Android Messenger app for years. “While data collection was technically opt-in, the opt-in was the default installation mode for Facebook's [entire] application, not a separate notification of data collection.” Apparently, the app collected the date, time, and length of phone calls and texts for many years. -- ARS

India’s national ID database, called Aadhaar, has a billion data records and is used for a wide range of authentication purposes including banking, buying cell phones, and government assistance. Last week it had yet another data breach that leveraged poor API security. The breach was known about for weeks and only resolved after the story was posted online, contradicting the government’s claims it was always secure. -- ZDNET

A series of Android QR readers have been found to masquerade as malware sources, according to new research. More than 500,000 downloads of the offending apps have been observed, and now they have been deleted from the Google Play store. They got by the security review because they didn’t activate the malware for a few hours after being first run. – NAKED SECURITY

Funding and merger news of the week

Averon closed a $13.3M A round led by Marc Benioff. The San Francisco-based firm does mobile ID verification and Wendell Brown is its CEO.

Kenna Security has secured a $25M C round of funding, led by Bessemer Ventures. The San Francisco-based firm has a risk analysis platform that incorporates global threat intelligence. Karim Toubba is its CEO.

Dessmann closed a $16M B funding round led by Red Star Macalline. The Stuttgart-based firm has biometric door locks.

Virsec closed a $24M B round led by BlueIO. It has app protection tools and is based in San Jose. Its CEO is Atiq Raza.

Sift Science closed a $53M D round led by Stripes Group. It has an AI-based fraud prevention tool and is based in San Francisco. It is led by Jason Tan.

Foxconn has made a move to acquire Belkin for $855M in cash. Belkin owns a variety of brands, including Linksys, Wemo and Phyn, and will continue to operate as a separate subsidiary. The Treasury Department has to approve the sale. -- ARS

The Docket

The unnamed leader of the crime gang behind Carbanak and other malware campaigns has been arrested in Spain with the help of multiple police forces from around the world, including another arrest in the Ukraine. The cops claim the gang has stolen more than a billion Euros over five years. -- EUROPOL

Artur Sargsyan, a former operator of multiple piracy-oriented websites, has been sentenced to five years in prison and ordered to pay more than $600,000 in fines. He pled guilty last fall and was sent more than 100 different takedown notices by the RIAA for copyright violations. My colleague Lisa Vaas has the details. – NAKED SECURITY

Report

Bad botnets can scrape prices from your ecommerce pages, copy your proprietary content, damage your SEO rankings, compromise your data with stolen credentials, and do lots of other damage to your business. Here is a very comprehensive report, claiming that bad bots account for a fifth of total website traffic and the vast majority of them are using advanced threats. – DISTIL NETWORKS (reg. req.)

Just for fun

From 9GAG