Bad actors are leveraging a new file hosting service in order to launch attack campaigns involving FormBook and other malware. Near the end of March, researchers at Deep Instinct observed a new FormBook attack. The infection chain for this campaign began with a phishing email that contains a malicious attachment. In the sample analyzed by Deep...

In Part 1 of this series, we looked at some of the metrics that an executive team would want to see to identify how the business risk is trending. It is very important to keep in mind that if the business does not see the information security program as effective and efficient, they will not continue to invest in information security projects. In this...

Last week, I had a very informative chat with my friend, CISO and cybersecurity policy expert Magda Chelly. I learned a lot about the Chief Information Security Officer role from her. This week, I spoke to Ashanti, who’s a security-minded Rust developer. She also enjoys making music, but she’s not the pop star who worked with Ja Rule. Her path in...

Digital attackers are using an Excel 4.0 macro dropper to infect unsuspecting users with a new variant of the ServHelper backdoor. In summer 2019, researchers at Deep Instinct detected a new attack campaign launched by digital threat group TA505. This operation began by attempting to trick users into opening an attached Excel document. When a user...

Tripwire's March 2019 Patch Priority Index (PPI) brings together the top vulnerabilities for March 2019. First on the patch priority list this month are patches for Microsoft's Browser, Scripting Engine and VBScript. These patches resolve 23 vulnerabilities, including fixes for Memory Corruption, Elevation of Privilege, Security Feature Bypass and...

Google has introduced new methods, an updated user interface and other changes through which 2-step verification (2SV) will work for G Suite accounts. On 26 March, Google announced three changes that will affect admins and end users of G Suite customers when they use 2SV going forward. The first change concerns updated user interfaces for 2-step...

One of the main issues I find across the information security industry is that we constantly need to justify our existence. Organizations have slowly realized they need to spend on IT to enable their businesses. Information security, on the other hand, is the team that is constantly preventing the business from freely doing as they please. IT is seen...

This post is one in a series of posts describing TLS CBC padding oracles I have identified on popular web sites. The other posts in this series include an overview of CBC padding oracles, a walkthrough of how I came to develop a new CBC padding oracle scanner, and a write-up on the GOLDENDOODLE attack. Although not POODLE per se, Zombie POODLE is in...

*UPDATE: Padcheck source is now available on GitHub: https://github.com/Tripwire/padcheck* Since August, I’ve spent countless hours studying CBC padding oracle attacks toward the development of a new scan tool called padcheck. Using this tool, I was able to identify thousands of popular domains which could be targeted by an active network adversary ...

This post is one in a series of posts describing TLS CBC padding oracles I have identified on popular web sites. The other posts in this series include an overview of CBC padding oracles, a walkthrough of how I came to develop a new CBC padding oracle scanner, and a write-up on the Zombie POODLE attack. GOLDENDOODLE is the name I’ve given for...

A parking garage used by employees of the Canadian Internet Registration Authority (CIRA) suffered a ransomware infection. At the end of their morning commute on 27 March, employees of CIRA arrived at a parking garage maintained by Precise Parklink. The garage typically uses Precise Parklink's "Automated Parking Revenue Control System" to verify...

Taiwan-based technology giant ASUS is advising concerned customers to run a newly-created diagnostic tool on their Windows computers after hackers pushed out malware to what some security researchers have estimated to be as many as one million PCs using ASUS's own Live Update software tool. As Motherboard reported earlier this week, researchers at...

A popular web browser's hidden ability poses a serious risk to more than 500 million Google Play users and their Android devices. Malware analysts at Doctor Web recently observed that UC Browser, a web browser developed by the Alibaba-owned Chinese mobile Internet company UCWeb, can secretly download and execute new libraries and modules from third...

It’s a turbulent time in geopolitics today, and activity in the geopolitical landscape inevitably intertwines with increased cyber activity across borders. Reports of nation-state attacks are on the rise. Attacks on U.S. energy infrastructure, NotPetya, the Sony breach and the WannaCry global outbreak have all recently been attributed to nation...

This is now my third year of interviewing women in information security for Tripwire’s The State of Security. My experience has been amazing so far. I have learned so much from so many people – a few of whom were transgender and one nonbinary. In response to this diversity of viewpoints, I decided to rename my spring 2019 series to be more inclusive...

The U.S. Federal Emergency Management Agency (FEMA) improperly shared the personally identifiable information (PII) of 2.3 million hurricane and disaster survivors with a contractor. The Department of Homeland Security's Office of Inspector General (DHS OIG) detected FEMA's violation while auditing...

When Shelley published his famous poem in 1816, he was telling us that the only constant in life is change. This was not a new concept, even then. Heraclitus proposed the same concept around 500 BCE with ‘Panta rhei’ (Life is Flux or everything changes). Even though we all know and understand this ancient concept, people still have difficulty with...

Welcome to Tripwire Patch Insanity! Comprised of 26 vulnerabilities divided into two conferences and four divisions, the goal of this tournament is to declare which named vulnerability is king of Patch Insanity! The original list of named vulnerabilities was taken from Hanno Böck’s named vulnerabilities repo. Any entries that did not have published...

A county government in North Carolina has suffered a ransomware infection for the third time in the past six years. According to a statement published on its website, the Orange County government observed on 18 March that a virus had infected its network. It responded by shutting down all servers,...