The recent Anthem hack that may have compromised 80 million people’s personal health information reveals just how mainstream data breaches have become in recent years. In response to this rapidly evolving threat landscape, Boards of Directors (BoDs) and executives are now more aware of today’s cyber threats and how they might adversely affect their business. However, most executives are...

Attackers can use gaps in the X-Frame Options (XFO) support on Google’s Play Store web application to remotely install malware onto users’ Android devices. “A malicious user can leverage either a Cross-Site Scripting (XSS) vulnerability in a particular area of the Google Play Store web application, or a Universal XSS (UXSS) targeting affected browsers, to remotely install and launch the main...

I still remember my first time reading AlephOne’s ‘ Smashing the Stack for Fun and Profit ’ – despite not having the proper knowledge to understand it at the time, it put the security bug in my head. It was truly a consciousness raising experience to get that first glimpse of my computer’s inner workings. One thing I did understand from it, loud and clear, is that bounds checking is a must when...

In the face of the current wave of cyber threats, the U.S. government announced this week in Washington DC that as part of the Homeland Security initiative the current administration is creating a new agency called the Cyber Threat Intelligence Integration Centre (CTIIP) to monitor cybersecurity threats by acquiring, pooling and analysing any captured information – AKA ‘intelligence.’ This new...

Facebook announced on Wednesday the launch of a new platform for companies to easily exchange information regarding cybersecurity threats, such as malware and phishing attacks that could be impacting users. The world’s largest social network introduced the program, called ThreatExchange , as “an API-based clearinghouse for security threat information.” The company said ThreatExchange works using...

A distributed denial of service (DDoS) attack brought down the Dutch national government’s websites yesterday, officials confirm. “The Public and Communications office, part of the Ministry of General Affairs, in conjunction with Centric/Prolocation and the National Cyber Security Center (NCSC), are evaluating the attack,” the government said in a statement. Both Rijksoverheijd.nl and Government...

Today’s VERT Alert addresses 9 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-601 on Wednesday, February 11. MS15-009 Multiple Memory Corruption Vulnerabilities in Internet Explorer MULTIPLE Multiple Elevation of Privilege Vulnerabilities in Internet Explorer MULTIPLE Multiple Internet Explorer...

In February’s Patch Tuesday, Microsoft issued an update to fix a privately reported critical vulnerability in Group Policy that could allow potential attackers to achieve remote code execution (RCE) in domain networks. If successfully exploited, an attacker could gain complete control of a vulnerable system, install programs, view data and even create additional accounts with admin privileges...

With cybercrime and major hacking incidents reaching epidemic proportions, the importance of locating application-layer vulnerabilities is rising. Developers and companies are constantly striving to scan their code and improve code integrity in the early development stages, but no application is completely vulnerability-free and external scrutiny is always a bonus. This is where bug bounty...

Major cyber security incidents continue to hit the headlines. Security and privacy are top concerns for IT and security professionals, especially after 2014’s highly publicized data breaches. Companies around the globe were victim to malware, stolen data and exploited vulnerabilities. Big companies weren’t immune to this, with Target, JPMogan Chase, Home Depot and Sony Pictures suffering the...

Drones have been talked about quite a bit in the news over the past couple of years — whether it’s the use of unmanned aerial vehicles (UAV) by the military or the viral video showing Amazon’s proposal for speedy drone delivery, the devices have really grabbed people’s attention. Now, many are buying their own personal drones and most are looking at the situation as a relatively harmless trend...

Last week, we interviewed Brian Engle , the Chief Information Security Officer and Cybersecurity Coordinator for the State of Texas, and discussed with him the importance of communication in shaping cybersecurity as an ongoing management concern that businesses everywhere need to appreciate. As part of our ongoing “The Voice of the CISO” series, we now interview Robb Reck, an Information Security...

Smart television sets made by Samsung may be capturing personal information spoken by their owners and subsequently transmitting it to a third-party. This warning is based off the research of The Daily Beast , which in reviewing the SmartTV supplement to Samsung’s privacy policy discovered the following sentence: “Please be aware that if your spoken words include personal or other sensitive...

Last week, we investigated the story of Vladislav Anatolievich Horohorin , a Ukrainian hacker who was well known online for managing several web forums where cyber criminals could dump and sell users’ stolen payment card credentials. Tripwire now continues its series on some of the most notorious cyber criminals brought to justice with Vladmir Drinkman, a Russian hacker whose exploits in...

Chipotle's website and official Twitter account were compromised late Saturday evening and into Sunday morning. The website was redirected on Saturday around 6PM (PST) to Chipotle's official twitter account @chipotletweets and was then unresponsive. The Chipotle domain's technical and administrative contacts for the domain have been updated with a message from the attacker(s). The @chipotletweets...

According to the Associated Press , the attackers who targeted and exfiltrated more than 80 million customer records from Anthem Inc, were able to commandeer the credentials of at least five different employees. We know from Anthem themselves that at least one admin account was compromised, as the admin himself noticed his credentials being used to query their data warehouse. Looking at job...

The Portland-based sportswear giant Nike has been accused by MasterCard Inc. of “conspiring” to steal its cyber security talent after recruiting two top information security managers. According to a report by Bloomberg , ex-MasterCard Chief Information Security Officer William E. Dennings and former Senior Engineering Manager Ryan Fusselman were urged to resign and break their contracts with the...

The U.S. Chamber of Commerce and 16 other business lobbies have sent a letter to Washington officials urging them to oppose China’s new cyber security regulations. In the letter, technology vendors argue that China’s new regulations would require them to hand over their source code and adopt China’s encryption algorithms , measures which could potentially undermine the security of their customers...

It seems only fitting that 2014 should have ended with the much publicized hacking of Sony as the American public was inundated all year with one sensational account after another of damaging data security breaches. Those surrounding Target , UPS, K-Mart, Staples, Dairy Queen and Home Depot have certainly received the full attention of the media, as it should given its magnitude. However, this...

Patch Tuesday, the unofficial day on which Microsoft regularly releases security updates for its software products, has long been a staple of the information security community. On the second (and sometimes fourth) Tuesday of every month, Microsoft releases a unique set of security bulletins that provide patches for a range of new Common Vulnerabilities and Exposures (CVEs) – flaws which are...