Resources

Blog

Applying a Stress-Test to Your IT Infrastructure

Banks regularly undergo mandatory stress tests. These tests are clearly defined, and the results are used to determine how well each bank can maneuver through an economic calamity. If we apply the basic blueprint of a financial stress test to an IT infrastructure, we can loosely define it as: “An analysis conducted under unfavorable scenarios which...
Blog

Streamers on Twitch Breach: Game Over or Restart?

While I work in security, when it’s quitting time, I’m a gamer through and through. My home is littered with consoles from Sega Genesis and NES to PS3 and Xbox One. My last two PC purchases have been strictly gaming machines, and I even bought a game pad for my iPhone because I enjoy playing (and streaming) Asphalt 8. This year, I’ve casually...
Blog

Ransomware Holds School District’s Computer Systems Hostage

Ransomware has disabled a New Jersey school district’s computer systems, with the attackers demanding hundreds of Bitcoins as ransom to restore access to files seized in the attack. In a post published to the district’s website, officials at Swedesboro-Woolwich School District explain that the incident, which occurred on March 22nd, thus far...
Blog

Computer Criminals Brought to Justice – Aleksei Shushliannikov

Earlier this month, Tripwire announced Computer Criminals Brought to Justice, a continuation of its 10 Notorious Computer Criminals Brought to Justice series, by investigating the story of a young man who was recently arrested in connection with the 2014 hack of the U.S. Department of Defense. This week, we continue our series with Aleksei...
Blog

VERT Vuln School: Format String Attacks 101

The printf() family of functions (printf(), fprintf(), sprintf(), etc.) are surprisingly powerful and, if not properly used, can expose a class of vulnerabilities called format string attacks. These attacks can be very bad because with a well-crafted format string, an attacker could write an arbitrary value into an arbitrary memory location. This...
Blog

Facebook Might Have Exposed Your Phone's Private Photos

Another serious privacy vulnerability has been found on Facebook, which could have put at risk the private photos of millions of users. The problem lies in Facebook Photo Sync, an opt-in feature that the social network introduced in late 2012, which meant any photos you took on your iPhone or Android device would automatically sync up with your...
Blog

Thousands of Android & iOS Apps Still Vulnerable to FREAK Flaw

A recent study found that more than 2,000 apps in the Apple App Store and Google Play Store are still vulnerable to FREAK – a widespread security flaw discovered earlier this month. Attackers exploiting the vulnerability can intercept HTTPS connections between vulnerable users and servers, thus forcing them to use weakened encryption, which can then...
Blog

Inside The Mind Of A Former Black Hat Hacker

Information security professionals are all too familiar with the work of black hat hackers. These individuals seek to gain unauthorized access to enterprises’ computer networks by exploiting security vulnerabilities – malicious activity which frequently threatens the personal and/or financial information of millions of customers. But what...
Blog

Security Policies - To Be Or Not To Be Pointless…

…that was the question. How many people actually find your security policies useful? Go on, guess. I’m willing to bet it’s only audit, risk, compliance management and the third-parties that assess you. Here’s the tweet from Phil Huggins (@oracuk) that kicked off a lively enough debate to make me want to write this. Phil’s core and continuing...
Blog

OpenSSL to Fix 'High' Severity Security Flaw

The OpenSSL Project, a collaborative effort designed to develop an open source toolkit that implements SSL and TLS, has announced that it will be fixing a number of security flaws on Thursday, one of which it has labeled “high” severity. The initiative made the announcement in a message circulated yesterday. “The OpenSSL project team would like to...
Blog

Taking Advantage of Critical Infrastructure Cybersecurity

Discussions around industrial control systems (ICS), such as supervisory and control data acquisition (SCADA) systems, often focus on how vulnerable the systems are. A key aspect of President Obama’s information sharing acts have been designed to encourage threat sharing to help protect the organizations and networks involved in critical...
Blog

Hey Siri, How Come Strangers Are Listening To My Private Messages?

I don't often use Siri on my iPhone, but I've got to admit that when I do it's really handy. I'll be driving the car and thinking "Arrrghh! I forgot to put out the recycling last night. I'd better say sorry to my wife as soon as possible, as she'll be mad at me." I could stop the car on the hard shoulder (which would be dangerous), I could risk...