The nation is in the midst of a torrent of major data breaches. The most recent breaches include the Ashley Madison breach, the Office of Personnel Management breach, and the theft of millions of dollars from small- to mid-size businesses. In addition to the financial impacts, the breaches include the release of personal-data including social...

Netflix has released a new tool called Sleepy Puppy that helps security researchers capture, manage, and track cross-site scripting (XSS) propagation over extended periods of time. Two application security researchers for the movie-streaming service, Scott Behrens (@helloarbit) and Patrick Kelley (@monkeysecurity), created the Sleepy Puppy tool to...

A former United States Secret Service Agent has admitted in court that he stole Bitcoin from drug dealers and attempted to hinder an investigation into Silk Road, the underground dark web market. On Monday, Shaun Bridges, 33, appeared in federal court in San Francisco and pleaded guilty to money laundering and the obstruction of justice, reports The...

North Dakota was named the first U.S. state authorizing local police departments to fly drones with “less-than-lethal” weapons, including tasers, sound cannons, teargas and non-penetrating firearms, after the passage of House Bill 1328 last week. The initial proposal of the legislation, introduced by Rep. Rick Becker, was aimed at requiring police...

Malware is continually evolving to meet the challenges posed by security researchers and antivirus software. Recently, malicious programs have begun to incorporate evasive behaviors, which include four of the most common anti-detection techniques: 1) environmental awareness, 2) confusing automated tools, 3) timing-based evasion, and 4) obfuscating...

Rutgers University has hired three security firms to test its network for vulnerabilities following a series of targeted attacks during the 2014-2015 academic year. According to The Washington Times, FishNet Security, Level 3 Communications, and Imperva will be working with Rutgers to enhance the university's security as classes resume for the 2015...

Earlier this month, security professionals from all over the world flooded to Las Vegas, Nevada, for Black Hat USA and DEF CON. As two of the largest and most respected events in information security, it is no surprise that they are a preferred choice for security experts and product vendors alike, year after year. Those conferences are indeed...

Imagine a circumstance where a significant investment has been made into a data loss prevention (DLP) solution in which it paves the way for a lip-service approach towards cyber security, with the very real-world association of unknown exposures. As amazing as it may seem, here is such a case in history that may leave you with two opinions, which...

Security researchers have identified flaws in a specific ransomware encryptor that allow victims to decrypt their files without having to pay in 70% of cases. The encryptor, known as Trojan-Ransom.Win32.Scraper, was first detected in an attack against Japanese users on October 24, 2014. Along with CTB-Locker, it marks a new generation of ransomware...

Lloyd’s, a well-known insurance market located in London, has reported that demand for “cyber insurance” is on the rise in light of a growing number of high-profile security incidents. “Cyber risk poses the most serious threat to businesses and national economies, and it’s an issue that’s not going to go away,” said Inga Beale, chief executive of...

Last week, Tripwire explored the story of Aleksei Shushliannikov, a hacker who is responsible for having used ransomware in an attempt to launder money from victims via MoneyPak. We now report on the story of Lance Ealy, a computer criminal recently brought to justice for having filed fake tax refund requests on more than 150 Americans. According to...

According to a recent analysis of federal energy records, the nation’s power grid experiences cyber and physical attacks nearly once every four days. The investigation revealed that the critical infrastructure of the US power grid sustained 362 attacks between 2011 and 2014, causing outages or other power disturbances to the US Department of Energy....

The popular coding website GitHub was hit with a massive denial-of-service (DDoS) attack late Thursday night, with some users experiencing intermittent service outages. According to security researcher and blogger Anthr@x, the ongoing attack, which intensified on and off for more than 24 hours, appeared to originate from the Chinese web services...

If you've recently found your web browsing plagued by pornographic pop-ups and irritating adverts, there might be a simple - but dangerous - explanation. Maybe hackers have hijacked your internet router? Security researchers at Ara Labs have warned of an active campaign which has seen attackers changing DNS settings on routers, causing unauthorised...

Banks regularly undergo mandatory stress tests. These tests are clearly defined, and the results are used to determine how well each bank can maneuver through an economic calamity. If we apply the basic blueprint of a financial stress test to an IT infrastructure, we can loosely define it as: “An analysis conducted under unfavorable scenarios which...

While I work in security, when it’s quitting time, I’m a gamer through and through. My home is littered with consoles from Sega Genesis and NES to PS3 and Xbox One. My last two PC purchases have been strictly gaming machines, and I even bought a game pad for my iPhone because I enjoy playing (and streaming) Asphalt 8. This year, I’ve casually...

A recent study found that more than 2,000 apps in the Apple App Store and Google Play Store are still vulnerable to FREAK – a widespread security flaw discovered earlier this month. Attackers exploiting the vulnerability can intercept HTTPS connections between vulnerable users and servers, thus forcing them to use weakened encryption, which can then...

Vulnerability Description The CVE-2015-0291 vulnerability introduces the possibility of a denial of service attack against a system running OpenSSL 1.0.2. If a malicious client connects to an OpenSSL server and the server requests a certificate from the malicious client, the malicious client can return a malformed cert that may trigger a NULL...

On Monday, the OpenSSL project team announced new releases that would be available today to fix security issues in OpenSSL that have been discovered as part of a major security audit and code refactoring project. When this announcement hit on Monday, there was a general panic in the IT and security community as it was mentioned vulnerabilities with...

Target Corp has agreed to pay $10 million in order to settle a class-action lawsuit related to a 2013 breach that compromised users’ financial and personal information, according to court documents. The proposed settlement, which has yet to be heard in federal court, would require Target to deposit the total settlement amount into an escrow...