#hacked (again).

Someone's flexing their cyber muscles. It appears as though the recent attack on a Ukrainian transmission facility points to a person or group using the country as a trial for refining attacks on critical infrastructure that could be used across the world. Because practice makes perfect, right?

The first attack against one of the nation's distribution facilities was conducted in December 2015 and affected 230,000 people. This recent outage struck almost one year later, causing power to go down for about 1 hour in Kiev and surrounding areas. Ukrainian security researchers who have been investigating the attack believe that it is in fact related to last year's attack. Meanwhile, the Ministry of Finance and the country's railway system have been targets as well. All fingers point to one source it seems. Ukraine is blaming Russia.

How did the hackers accomplish their second major trial run at infrastructure overtake? Unlike in the first attack where they overwrote the firmware of the remote terminal units (RTUs) that control circuit breakers, essentially bricking them, this time they simply shutdown the RTUs. Luckily, no real harm was caused, but analysts are looking at the recent incidents as a demonstration of skill. What's more worrisome, "Ukraine uses the same equipment and security protections as other countries around the globe," says Marina Krotofil, a security researcher for Honeywell Industrial Cyber Security Labs. "If the attackers learn how to go around those tools and appliances in Ukrainian infrastructures, they can then directly go to the West."

This testbed-type approach against Ukraine is considered by experts as a "standard practice" by Russian hackers for testing out their tools and attacks - Krotofil

There's no official word on who's behind the attacks, but while the jury's out, read up on Russian hackers.

#rebranding

New Year, New Hoo. There's been a lot of media coverage surrounding the recent Yahoo! security breaches, but it looks like our favorite past-time mail provider is finally getting the overhaul it needs. As far as their core business is concerned, it's being purchased by Verizon for a mere $4.8 billion, despite the recent incidents. As for the leftovers? That portion, made up of a 15% ownership of Alibaba and 35.5% stake in Yahoo Japan, will be rebranded 'Altaba,' which sounds like the title of a cartoon Disney movie. Regardless, the end of the 'You've Got Mail' era stirs up nostalgia and we can all agree Yahoo! has certainly left its' mark on Internet history.In other related news, Yahoo!'s CEO Marissa Mayer will step down from her role. Rumors are swirling as to whether or not she will be appointed for a role in Yahoo's integration at Verizon, but nothing has been confirmed. During her tenure at the company, the acquisition of Tumblr and re-vamping of Flickr both failed, and Yahoo! continued to lose revenue. For some, her absence will be a welcome change.

Founded by Stanford graduates Jerry Yang and David Filo in 1994, Yahoo was once a $125 billion company

If you've still got the hacked Yahoo! accounts on the brain, here are some tips for How to read Email Headers and Find Internet Hosts. Keep that mailbox on lock down.

#IoT

Medical device maker St. Jude has released updates to patch vulnerabilities in the company's Merlin@home Transmitter. The Merlin@home device wirelessly communicates with implanted cardiac devices. But the details of the report may still get your heart racing. 

The FDA found that hackers could potentially "modify commands to an implanted device, which could result in rapid battery depletion or administration of inappropriate pacing or shocks." No patients have been harmed, which analysts suggest is do to a lack of financial motivation in carrying out an attack such as this. Should there be an attack though, the consequences could be devastating, even life-threatening. And while St. Jude has released the patch which will automatically update when the Merlin@home device is plugged in and connected to the Merlin.net Patient Care Network, one Cryptographic expert agreed that the fixes do not solve the underlying problem that vulnerabilities existing in the implantable devices can only be fixed by updating the firmware.

Still, many agree that the cooperation between St. Jude and the FDA deserves applause, and sets the standard for other organizations who produce IoT products, especially in the healthcare industry. With the patch, additional validation and verification has been added when the device connects to the network.

This new echelon of body-interfacing IoT devices, like connected pacemakers, have the ability to cause direct physical harm. That could be effectively used as leverage against someone financially. Take a moment to consider the ramifications of body-level ransomware. -Aaron Lint,  Arxan Vice President of Research

Those in the healthcare industry, take notes. And while you're using this instance as a case study, read 10 Steps to Prepare for & Mitigate Cyber Attacks in Healthcare Industries.

#skillcertspotlight

We've heard your feedback on the TCP/IP Skill Certification Exam, so we've updated the test questions.The new test makes the course material clearer so you can truly grasp core concepts.  The TCP/IP Skill Certification Course provides a strong base knowledge for the foundation of networking and preparation for an expansive list of career opportunities. With this certification, you’ll learn topics such as: classful and subnet addressing, RTO, both the Linux and the Standard method, and Congestive Control.TCP/IP is the communication standard that devices use to exchange data across the internet, so understanding how it functions is critical. Recently, Greg Greenlee, in his blog: “8 Steps to becoming an It Professional,” places 'Learn TCP/IP' as number 4 on the list.

Over 2,200 people have taken the TCP/IP course on Cybrary since it's release.

Join the ranks and try your hand at this updated test.