Gift cards have caused quite a headache for retailers in the last month, exposing another way that fraudulent activity can eat into razor-thin profit margins. Gift card fraud can range from physical theft to cloning to exploiting programming errors on the merchant side. The methods of attack are very similar to what is seen with credit card fraud,...

A security researcher has demonstrated a method of attack that allows malicious actors to steal laptop encryption keys using a gadget small enough to fit inside some pita bread. Developed by Daniel Genkin and his colleagues at Tel Aviv University, the attack makes use of radio signals given off by laptops when their CPUs are busy crunching data. ...

The type of coverage a vulnerability receives on social media often correlates to that threat’s level of risk, reveals a recent report. This is just one of the findings of the 2015 State of Vulnerability Risk Management, a study issued earlier this month by NopSec Labs, a data science and research company that specializes in analyzing malware,...

The Telegraph recently published an article profiling six hacker “tribes”: secret agents, voyeurs, hacktivists, white hats, glory hunters, and cyber thieves. The article made some broad assumptions about cybercriminals that were not well-received by industry experts. As cybersecurity becomes a part of our daily lives, how can we talk about it without...

The mammoth rise in cybercrime has made organizations revise their application security strategy and implement new techniques to safeguard their software. This is largely because traditional security methodologies, such as Manual Testing and Web Application Firewalls (WAF), have been rendered irrelevant due to evolving hacking techniques. Unlike old...

According to the 2015 Information Security Breaches Survey, a PwC study that I recently analyzed in an article for The State of Security, the number of denial of service (DoS) attacks has either dropped or remained stagnant for most UK corporations over the past year. Apparently, this decline has not stopped certain malicious actors from getting...

Speculation is rife. The OPM hack will become a fascinating story if we ever actually learn the details – how exactly did attackers penetrate and exfiltrate millions of federal employee records? What weaknesses did they exploit, and how did they escalate access? More to the point, what protections could have or should have prevented the penetration...

I would wager that most people who have an iPhone or iPad use the default Apple iOS Mail application, rather than a third-party app, to read their email. And if you're one of those people, you could be at risk from an unpatched vulnerability that could allow hackers to convincingly trick you into handing them your passwords. As The Register...

With the advancements in technology, the networks today aren’t the same as I learned on nearly 20 years ago. We’ve evolved from wired only networks using hubs to the PC, to switched networks. Used mostly for Voice Over IP (VoIP) phones, the switched networks are still there, while our computers have now given up the wires to operate wirelessly. Yet,...

A typical information security conference can cost $5,000 plus plane and hotel costs and, although it might seem to be an exorbitant sum of money, many of us could easily defend the value and necessity of the training to bolster one’s technical capabilities. But when was the last time you invested even just a few hours of your time to working on...

Despite retailers’ continuous improvement in compliance with the Payment Card Industry (PCI) security standards, four out of five companies are still failing at interim assessments, according to Verizon’s latest report. The report highlights that the overall state of compliance grew significantly in 2014, with 20 percent of organizations...

Today’s VERT Alert addresses 14 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-605 on Wednesday, March 11.MS15-018Multiple Memory Corruption Vulnerabilities in Internet ExplorerMULTIPLEVBScript Memory Corruption VulnerabilityCVE-2015-0032Internet...

Earlier this month, Tripwire published its final installment of 10 Notorious Cyber Criminals Brought to Justice, a series that sought to demonstrate how law enforcement frequently catches up with individuals who use cyberspace for malicious purposes. Although our series has concluded, we as information security professionals realize that law...

According to a fellow at Columbia University, companies are not investing significantly more in information security partly because of the influence of moral hazards, or the act of one entity taking risks because others bear the burden of those actions. Benjamin Dean, a staff associate and fellow in cyber-security and internet governance at the...

There's bad news for any Windows users who were thinking that the recently-announced FREAK vulnerability wasn't something they had to particularly worry about. When first announced, it was thought that the newly-discovered flaw in SSL/TLS was limited to Apple's Safari and Google's Android web browsers, opening the possibility of hackers and...

For the past several months, the major threats to mobile security, especially within large enterprises, have relied on exploiting one thing—iOS Enterprise Certificates. With this part of Apple’s framework seemingly a significant source of danger, we’re taking a look at iOS Enterprise certificates from a mobile security perspective. By examining...

This report was prepared by The Institute for National Security Studies (INSS) and The Cyber Security Forum Initiative (CSFI) to create better cyber situational awareness (Cyber SA) of the nature and scope of threats and hazards to national security worldwide in the domains of cyberspace and open source intelligence. It is provided to Federal,...

We now appreciate the revelation that went public in February 2015 that international hackers circumvented what was supposed to be robust systems and defences, and managed to get away with an estimated $1 billion from a spectrum of around 100 banks located in 30 countries in what has been described as systemic cybercrime. With orchestration, the...

Last summer, security researchers Karsten Nohl and Jakob Lell developed a malware program, dubbed ‘BadUSB,’ to prove the insecure development of USB devices. The pair of security researchers revealed how they managed to reprogram the firmware on removable USB drives to include malicious code, giving potential attackers the ability to take over PCs...

A group of hackers were able to penetrate at least 30 financial institutions around the world and steal upwards of one billion dollars, making this attack one of the most advanced the world has yet seen. According to a report published by security firm Kaspersky Lab and sent to the New York Times, the cyber criminals, which have since been named the...