Outsourcing critical aspects of our lives is nothing new. We trust banks to safeguard our money, even though many of us do not trust bankers. We trust taxi cab drivers with our lives, even if we do not know their first name. We do this not out of ignorance but because we trust the overall system that these components work within. With the...

Updated Tuesday, Feb. 24, 2015, 2:11 PM: Added content for Tripwire Enterprise customers to find Samba in their environment. A major vulnerability (CVE-2015-0240) has been discovered in Samba, which is a widely used and distributed SMB/CIFS Linux/Unix application for interoperability with Microsoft Windows. Samba provides integration of Linux...

Known as one of the largest bank heists ever, cybercriminals successfully exfiltrated nearly $1 billion dollars from dozens of banks and financial institutions around the world. After an extensive investigation, the verdict of these ongoing sophisticated attacks was traced to Carbanak malware. According to security firm Kaspersky Labs, Carbanak...

Last week, we investigated the story of Dmitry Olegovich Zubakha, a Russian hacker who breached Boeing’s computer networks and launched a series of distributed denial of service (DDoS) attacks against Amazon, eBay and Priceline. Tripwire now continues its series on some of the most notorious cyber criminals brought to justice with Roman Valerevich...

In September of 2014, private photos of a number of celebrities, including Kate Upton and Jennifer Lawrence, were leaked onto the image-based bulletin board 4chan. It was soon discovered that this leak occurred as a result of a brute force attack against Apple's iCloud, which until then had not limited the number of login attempts for each user...

Democratic Senators Ed Markey and Richard Blumenthal introduced on Tuesday new legislation, which would require automakers to adhere to certain standards of protection against privacy and hacking. The new bill, entitled the SPY Car Act, would call on the Federal Trade Commission (FTC) and the National Highway Traffic Safety Administration (NHTSA) to...

Following from a recent post on ‘Escalation of Commitment’, a topic studied by both Economists and Psychologist, I could not resist writing a follow-up to explore the consequences for third parties that do not have the preparation and/or resources of the parties involved in scenarios of escalation of commitment in the IT security field. In the...

Today’s VERT Alert addresses one new Out of Band Microsoft Security Bulletin. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-624 on Tuesday, July 21st. MS15-078 OpenType Font Driver Vulnerability CVE-2015-2426 MS15-078 Microsoft has released an...

Oracle has released its July 2015 Critical Patch Update that provides fixes for 193 security vulnerabilities, including a zero-day vulnerability recently discovered in Java. According to a post published on Oracle's blog, the update contains patches for a number of applications, such as Oracle Database, for which there are provided 10 security fixes...

Mozilla has blocked every version of Adobe Flash Player running in its Firefox web browser and will continue to do so until Adobe has patched certain publicly known security vulnerabilities. Firefox users who seek to view videos, adverts, and other Flash-based content will now be required to dismiss a warning that reads, "Flash is known to be...

Microsoft is ending Windows Server 2003 support on July 14, 2015, when the popular platform will no longer receive security updates. End of life migration is a serious transition for organizations, and many will keep the using outdated platforms long after the deadline. How should organizations that are still in transition prepare for the inevitable...

The private Italian spyware firm Hacking Team has become the victim of a hack itself, with more than 400GB of data compromised and released via a torrent. The hacker "PhineasFisher"– who claims responsibility for the data heist – is also responsible for surveillance tech company Gamma International based in the UK. One of the most damaging aspects...

Donald Trump doesn't appear to be having the best of times. Not only has the business tycoon and (now) Republican presidential candidate been dumped by Macy's, Univision and NBC over his comments on Mexican immigrants, but he is now possibly having to deal with the aftermath of a hacker attack too. Criminal hackers may have added to the headaches of...

With the advent of the recent failure of RBS banking systems, there is a question on the lips of many security professionals, not to mention the aware members of the public, asking: “Are today's banking systems and the applied management fit for purpose?” The initiator of this particular article was born out of the recent debacle of the failing of...

Commercial Virtual Private Network (VPN) services, claiming to provide users enhanced privacy and anonymity, may not be as secure as users think. A group of researchers from Queen Mary University of London and the University of Rome disclosed their findings today, revealing that many of the most widely used VPN services are susceptible to DNS...

Updated: July 10, 2015 - 9:00 AM PST The United States Office of Personnel Management (OPM) has recently been in the news for two separate breaches that may have compromised the information of as many as 18 million former, current and prospective federal employees. Significantly, the story of these two intrusions stretches back to as early as spring...

First, it was cloud computing that sparked the imaginations of businesses in terms of all the benefits they could receive. Then, came the division of public and private clouds; some companies wanted to keep their cloud on-premise, while others looked to cloud providers. Now, the next step in the cloud revolution has come—the gradual adoption of the...

Cisco has released patches for SSH keys vulnerabilities affecting several of its virtual appliances. The vulnerabilities were discovered during internal security testing and have been found to affect Cisco Web Security Virtual Appliance (WSAv), Cisco Email Security Virtual Appliance (ESAv), and Cisco Security Management Virtual Appliance (SMAv). ...

What's the worst thing your hackers could steal from your organisation? Sure, no-one wants to have their passwords pinched - but at least you can change them later and clean-up any problems that the hackers have caused. How about having your customer database stolen? That's undoubtedly serious, and you might find it hard work recovering the trust of...

The issue of cybersecurity has finally gained the attention of top company decision-makers in light of the ongoing large-scale breaches that continue to jeopardize company assets and customers’ privacy. However, as executives and board members become more aware of the impact of cyber attacks on the business, is awareness enough to allow them to...