The hardware used in both the Internet of Things (IoT) and Industrial Control Systems (ICS) have many similarities; both often involve older systems incapable of running detection tools or monitoring agents due to outdated operating systems, resource limitations, proprietary systems and odd protocols such as Modbus and DNP3, amongst other restrictions. The lack of visibility into these enclaves...

The Domain Name System (DNS) is a hierarchical system that assigns names to computers, resources and services connected to the web. It is responsible for relating information associated with each Internet-based entity to a domain name. As such, DNS is an essential tool for organizing the web. In the wrong hands, however, it can be used to create domains from which to launch attacks against...

Apple has patched an application-side input validation web vulnerability in iTunes and the App Store that allowed attackers to inject malicious code into user invoices. The vulnerability received a 'High' severity level and a CVSS rating of 5.8 . It allows for session hijacking, persistent phishing attacks, and other malicious activities. Benjamin Kunz Mejri, a researcher with Vulnerability Lab...

In Part 1 , I discussed several important elements to landing a hands-on security gig, including passion and having the skills to pay the bills. Now, I’ll continue to guide you through various other essentials that could impact your career. Tools vs. Knowledge A good security analyst understands how various tools work, along with how to run the given tool. Far too often, I run into someone who...

We all know that there's a problem with passwords . Most internet users are careless when choosing passwords - either re-using the same passwords they've used elsewhere or making them too easy to crack. And if they're not guilty of that mistake, there's always the chance that their computers are infected with spyware watching their keystrokes and stealing their login credentials that way. This is...

Darkode, one of approximately 800 underground web forums, has resurfaced just two weeks after international law enforcement shut the site down. The takedown, known as " Operation Shrouded Horizon ," began two years ago under the auspices of the Federal Bureau of Investigation's office in Pittsburgh, Pennsylvania. It eventually expanded to include Europol and federal law enforcement agencies from...

A politically motivated hacking group who calls themselves 3301, appears to have compromised the website of Planned Parenthood . The politically motivated attack appears to have taken advantage of a vulnerability in an outdated version the Concrete5 website content management system. The group was not able to access the file system and the compromise appears to be limited to the contents of the...

I have been involved in the hiring process for our Security Operations Center (SOC) for about a year and a half. Throughout this time, I have reviewed resumes, conducted phone screens, and participated in the technical interviewing process. I have been both dumbfounded by the audacity of some individuals and amazed by the sheer awesomeness of rising stars. One of my primary takeaways from this...

The security breach that hit the U.S. Office of Personnel Management (OPM) has many people demanding answers as to how something so egregious could happen at such an important office. Some reports indicate that as many as 35 million federal employees’ records were exposed in the cyber attack, with some of the data coming from as far back as 35 years ago. Early indications show there were plenty of...

The Internet of Things is gradually but very surely creeping in to impact every sphere of modern life. And that goes as much for people as for business, as much for new industries as for incumbent sectors. This network of physical objects has the ability to play havoc with security and is significantly increasing the challenge of securing Industrial Control Systems (ICSs). Threats to ICSs for...

Welcome to our new blog series, covering the week’s trending topics in the world of information security. In this quick news roundup, we’ll let you know of the latest research, reports and discussions that the industry has been talking about recently. Here’s what you don't want to miss from the week of July 24, 2015: Adultery website AshleyMadison.com made headlines after a hacking group gained...

While the national transition to Europay, MasterCard and Visa, known as EMV or “Chip and PIN,” is well underway, a recent study found that as many as 42 percent of companies have either taken no steps or are unaware of any progress being made to meet the October 1, 2015, deadline. The EMV readiness study conducted by Randstad Technologies, which surveyed IT decision makers and C-level executives...

419 scams are one of the oldest and most common tricks used by fraudsters to extort money from online users. These schemes promise victims a large sum of money in exchange for a small upfront payment. In this sense, ploys, such as the Nigerian Prince scam, resemble social engineering attacks to the extent that they rely less on the expertise of the attacker and more on the weaknesses inherent in...

In September of 2014, private photos of a number of celebrities, including Kate Upton and Jennifer Lawrence, were leaked onto the image-based bulletin board 4chan. It was soon discovered that this leak occurred as a result of a brute force attack against Apple's iCloud, which until then had not limited the number of login attempts for each user account . Hackers exploited this oversight via the...

In the financial industry, business success and sustainability depends on the health of information systems. Damage to a firm’s information systems can tarnish its reputation, compromise its data, as well as result in legal fines and penalties. Large firms often depend on thousands of such systems interconnected via the internet, which raises a major security concern of corporate espionage . The...

Democratic Senators Ed Markey and Richard Blumenthal introduced on Tuesday new legislation, which would require automakers to adhere to certain standards of protection against privacy and hacking. The new bill, entitled the SPY Car Act , would call on the Federal Trade Commission (FTC) and the National Highway Traffic Safety Administration (NHTSA) to collaborate in developing the new standards for...

I am honored to be presenting at DEF CON 23 this August in Las Vegas where I will be presenting a session titled “ Confessions of a Professional Cyber Stalker ." In my talk, I will be discussing various technologies and methods I developed and used to track criminals leading to at least two dozen convictions. Many times in the process of recovering stolen devices, larger crimes would be uncovered...

Following from a recent post on ‘ Escalation of Commitment ’, a topic studied by both Economists and Psychologist, I could not resist writing a follow-up to explore the consequences for third parties that do not have the preparation and/or resources of the parties involved in scenarios of escalation of commitment in the IT security field. In the previous post, I covered the example of financial...

Late last week, UCLA Health – the Californian university’s hospital – announced it had suffered a cyber attack on its network, potentially exposing the personal and medical information of nearly 5 million patients. In a statement, the hospital said it had determined the attacker had accessed parts of the UCLA Health system, which contained names, addresses, dates of births, social security numbers...