In the first part of this blog series, we discussed some core objectives, characteristics and principles of the GDPR, which is due to take effect on 25th May 2018. In this second article, we will discuss in greater depth some of the core IT security objectives relating to GDPR. The purpose of the GDPR is to establish directions to protect “natural...

Microsoft has patched a 17-year-old bug hidden in its Office suite that attackers can use to execute arbitrary code on vulnerable machines. The vulnerability resides in Microsoft Equation Editor (EQNEDT32.EXE). It's a component that allows users to insert and edit equations into Microsoft Word documents as an Object Linking and Embedding (OLE) item....

Phishing is becoming a major threat vector for organizations all around the world. Phishing is the exercise of sending illegitimate emails designed to elicit a response from the end user, whether that’s clicking on a link that infects them with malware or tricking the user into volunteering information that they normally would not provide like a...

Unless you’ve been living in Slab City or off the grid for a while, you’ve probably heard this year’s omnipresent buzzword ‘blockchain.’ But perhaps you're a bit clueless as to what this newer technology entails. In a recent HSBC survey of 12,000 respondents in 11 countries, 80 percent of people could not explain how blockchain works. Don’t worry,...

Today’s VERT Alert addresses the Microsoft November 2017 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-752 on Wednesday, November 15th. In-The-Wild & Disclosed CVEs CVE-2017-8700 A Cross Origin Resource Sharing bypass could allow information disclosure in ASP.NET Core. Microsoft has...

Security researchers have discovered a new banking Trojan that is actively targeting U.S. financial institutions. Dubbed IcedID, the malware is believed to have emerged in the wild back in September 2017, when its first test campaigns were launched. According to IBM X-Force, IcedID was developed with “modular malicious code and modern capabilities”...

A cryptocurrency miner has earned its place on a list of the top 10 most wanted malware for the month of October 2017. The browser-mining service in question goes by the name "CoinHive." It's a piece of JavaScript that site owners can embed into their websites. Whenever a user visits their domain thereafter, CoinHive will activate and begin mining for...

In part one of this two-part series, I described what we know about the September 14 attack against the drug sites on the Tor network. To review: The attack simultaneously took down 11 drug sites on the dark web, yet traffic patterns were unaffected. The site administrators indicated a problem on a public forum; and There was no discernible...

Last time, I spoke with Nitha Suresh. She's written IEEE papers and knows her stuff when it comes to pentesting and aircraft data networks. This time, I had the pleasure of interviewing Victoria Walberg. She has a lot of ideas when it comes to IoT and the cloud. Kimberly Crawley: Please tell me about what you do, Victoria. Victoria Walberg: I'm a...

A group of Muslim activists hacked a 'secure' mailing list used by the ISIS terrorist group and published 2,000 of its email subscribers online. On 10 November, a spokesperson for Amaq, one of the Islamic State's key outlets for communicating with its supporters and members, sent out an email written in Arabic to its subscribers. The update...

Think of all the recent DDoS attacks. They all seem to share the common trait of bad guys disrupting the normal flow of data against a legitimate business. Sometimes, these attacks are used for revenge, and other times, they are used for ransom. Sometimes, however, the bad guys become the targets. This is the story of an odd caper that played out on...

It's always encouraging to see Tripwire's products hold its own in an independent review. It's even better when the solutions excel. Indeed, those positive assessments confirm what everyone at Tripwire already knows about the strength of the company's offerings. The folks at SC Magazine recently published one such evaluation of Tripwire Enterprise. In...

Soft skills are a hot topic in information security. You’ll see a lot of articles, blogs and talks on the subject. I’d like to go a little deeper – beyond the basics of soft skills and talk about a concept from communication theory that can be used to achieve behavior change – efficacy. Efficacy is the ability to achieve a desired effect. In risk...

Hackers have been found exploiting a freshly-uncovered vulnerability in Microsoft's software to install malware on business computers. According to security researchers, since last month a Russia-linked hacking group known as APT28 have been using a Microsoft protocol called Dynamic Data Exchange (DDE) to run malicious code through a poisoned Word...

Hackers have done the unthinkable by making off with a charity's funds right before the start of the 2017 Christmas season. The Utah Association for Intellectual Disabilities (UAID) first noticed something was wrong when it had not received any new email applications for help since 22 October. Typically, the charity gets numerous applications in...

While data center consolidation has been trending in government and commercial spaces since the 1970s, new government initiatives and directives released recently have created a new sense of urgency: those who haven’t yet consolidated are now required to. Many organizations are now looking to the cloud to meet the requirements. Whether they know it...

I’ve been involved in information technology and infosec since the mid-1990s. Until recently, I had not been actively attending infosec or hacker conferences. I started attending DEF CON in 2013 when the conference was held at the Rio Hotel. DEF CON was the first hacker conference I ever attended. I did not know many in the community and certainly...

Fraudsters are increasingly targeting potential home buyers and real estate professionals with wire fraud schemes and phishing scams. In May 2017, the FBI revealed that the identified exposed losses resulting from business email compromise (BEC) scams increased by 2,370 percent between January 2015 and December 2016. Those scams preyed on...