We've been hearing a lot about IoT security recently. The news is overwhelming us with stories about baby dolls and baby monitors that can listen in on conversations at home, not to mention surveillance cameras that provide video streams to unauthorized individuals. To better understand these events, let’s start by looking at what is IoT. According...

A researcher has uncovered security holes in Google's bug-tracking database that could have potentially resulted in malicious hackers accessing sensitive information, including details of ways to exploit unpatched vulnerabilities in Google products. Researcher Alex Birsan has described how he managed to trick Google Issue Tracker (known internally...

Negligence by a third-party contractor exposed the personal information of approximately 50,000 Australian employees online. A Polish security researcher who uses the moniker "Wojciech" discovered the information while searching for open Amazon S3 buckets. The details belong to 48,270 employees of Australian government agencies, banks, and a utility...

“Hello, again, friend. It all went quiet for a while and the depictions of hacking and cyber on TV seemed to become trite and clichéd again. We stopped seeing him, Mr. Robot, but now he’s back again. Did you see him, too?” This blog may contain spoilers and was written following ‘eps3.2_legacy.so,’ which seems a good enough point into the new...

BULLETIN CVE APSB17-32 CVE-2017-11292 Microsoft Browser - IE CVE-2017-11790,CVE-2017-11822,CVE-2017-11813 Microsoft Browser - Edge CVE-2017-11794,CVE-2017-8726 Microsoft Browser - Scripting engine CVE-2017-11796, CVE-2017-11808, CVE-2017-11809, CVE-2017-11805, CVE...

Britain's largest and busiest airport has launched an investigation to determine how someone found a USB containing 2.5GB of its data on the street. News of the incident involving Heathrow London Airport first came to light when an unemployed man contacted The Sunday Mirror. He told the tabloid he was on his way to a local library to search for work...

In my last interview, I spoke to Katherine Teitler, who is the director of content for MISTI Training Institute. She also helps run the InfoSec World conference. This time, I spoke with Carrie Roberts. She has a senior red team role with Walmart. She's also a pretty good cartoonist if I say so myself. Kimberly Crawley: Tell me a bit about what you...

Google has announced a bug bounty program covering other developers' popular Android apps available for download in its Play Store. On 19 October, the American multinational technology company launched its Google Play Security Rewards Program. Here's a high-level description of the new framework: "Google Play is working with the independent bug...

Nobody welcomes the prospect of having our online accounts hacked. It's a pain in the neck resetting passwords, warning your contacts, and worrying about the prospect that your identity may be stolen. But for some of us, the consequences of having our Gmail account compromised by state-sponsored hackers could be even more catastrophic and even life...

When designing systems today, everyone is aware that security is an essential feature, even in systems that you don’t think are critical. The recent Equifax breach brought home to me one of the most important factors of designing secure systems (software or not): delivering systems with secure defaults. In today’s threat-rich environment, the...

If you've read a security blog anytime in the last year, you haven't escaped mention of the dreaded skills gap for cybersecurity professionals. There seems to be consensus that it's getting harder to hire skilled security staff, though the reason for that is up for debate – some say we're just going about it the wrong way, while others claim it is an...

In my last interview, I got to speak with Keren Elazari. Not only did she start BSides TLV but also contributed to a book about women in technology. The book is Women in Tech: Take Your Career to the Next Level with Practical Advice and Inspiring Stories, which was authored by Tarah Wheeler. So, guess who I got to speak with this time? Yep, Ms....

As organizations' IT environments become increasingly more complex, so too does the software they install on their systems. Software developers and managers have embraced microservices written in node.js and Spring Boot, for example. These new types of dynamic applications challenge organizations to establish appropriate trust chains and secure old...

If you still haven't properly secured your Twitter account with two-factor authentication then you have one less excuse today. Twitter has announced that you can now use third-party apps (such as Google Authenticator, Authy, or 1Password) to verify yourself at login. https://twitter.com/TwitterSafety/status/943542421698125824 Which is great news,...

A Bitcoin exchange has announced it has filed for bankruptcy and will cease all operations after suffering its second hacking attack this year. On 19 December, South Korean exchange Youbit announced at 04:35 local time that bad actors had hacked its website and stolen 17 percent of its assets in the process. BBC News reports that the hackers didn't...

It seems like everyday you see a new report about a massive data leak caused by someone accidentally exposing files stored in AWS S3 Buckets to everyone on the Internet. Many may remember Verizon’s infamous snafu that leaked data records for six million of their customers due to a misconfiguration in their S3 buckets. Since then, there have also been...

An oil transportation company discovered someone had installed Monero-mining software on its systems without its authorization. On 14 December, Vladimir Rushailo, vice president of the Russian state-owned transport monopoly Transneft, revealed that the company had found that one of its computers had automatically downloaded software designed to mine...

A new ransom-based email scam campaign is demanding that all recipients either meet the sender's demands and pay up or die. On 11 December, Spiceworks user Dave Lass shared the campaign with other members of the professional IT industry network. The scam doesn't waste any time in attempting to frighten the recipient. It begins with the subject line ...

The National Capital Poison Center (NCPC) in Washington, DC has published notice of a ransomware attack it suffered back in 2017. According to the news release (PDF), the critical health resource detected a ransomware infection on its systems in October 2017. It then launched an investigation into the matter with the assistance of a third-party...

A criminal stole "a significant amount of data" in a hacking attack that targeted one of the busiest airports in Australia. According to The West Australian, the breach occurred in March 2016 when a Vietnamese man named Le Duc Hoang Hai abused a third-party contractor's credentials to access the systems at Perth Airport, the fourth busiest airport...