Blog

Blog

How to Protect Yourself From Caller ID Spoofing

Have you ever received unwanted calls from auto-dialers and telemarketers at a time when you did not want to be called? Has an auto-dialer or telemarketer ever tried to scam you? Have you noticed that the numbers of certain incoming calls don’t seem accurate? If you have answered yes to any of these questions, you might have seen a spoofed caller ID...
Blog

Here's What You Missed At BSidesSF 2015 - Day 1

It’s that time of year, again, when the brightest minds in the business gather to talk all things cyber in the city of San Francisco. To start off the busy week ahead, BSidesSF kicked off day one with some great speakers and intriguing presentations. For those of you that didn’t make it out, here’s a short and sweet recap of some of today’s talks....
Blog

The Internet of Things: Why Security Needs to Be the Future of IoT

The Internet of Things (IoT) is a buzzword that many use to describe a not-so-distant reality in which devices and machines talk to one another. To some, however, the potential of IoT extends well beyond the mere notion of a “smart,” interconnected world. Included in this group of observers is Jeremy Rifkin, an author, political advisor and social...
Blog

Killing the Kill Chain: Disrupting the Cyber Attack Progression

If, on Tuesday, you find yourself in San Francisco, with access to RSA, then I know how you should spend your time from 1PM PST. Alex Cox, Ken Westin, and I will be introducing our panel: Killing the Kill Chain: Disrupting the Cyber Attack Progression. Instead of talking about how you can preemptively stop an attack, we plan to show you. With Ken...
Blog

Zero Day Dark Web Market 'TheRealDeal' Selling MS15-034 Exploit

A new dark web market has appeared, focused on the selling of 0-day exploit code. The market is called "TheRealDeal Market," and although still in its infancy, there are already a few exploits listed. One exploit claims to target the recent MS15-034 Microsoft IIS Remote Code Execution vulnerability and comes with reverse shell and research...
Blog

Federating the AWS CLI

Modern organizations that depend on SaaS have been increasingly adopting Identity Providers or single sign-ons (SSOs) in order to federate authentication back to home directory services. Most SSOs support SAML or OAuth, and a growing number of SaaS companies are jumping on board to eliminate the liability of storing customer password hashes....
Blog

DBIR 2015: What Do Prince and Vulnerabilities Have In Common?

The Verizon 2015 Data Breach Investigations Report has always had a conversational, quirky style to share some pretty technical information about the security breach data it analyzes. So if you’re wondering what Prince has to do with vulnerability management, just know that when you read the full report, you’ll understand – a lot of song titles are...
Blog

How to Lie with Statistics: Information Security Edition

Numbers, statistics, pie charts and survey results are everywhere – especially in the information security space. Nevertheless, have you ever finished reading a vendor whitepaper or a research institution’s annual security report and the data presented just made your spidey sense tingle? You are probably sensing a manipulation of statistics, an age...
Blog

Testing Network Forensics Skills: Challenge Accepted!

Network Forensics is a branch of Digital Forensics that deals with the capture, storage and analysis of network traffic. Incident handlers working on computer incident response and security operations teams around the world engage in this type of analysis in order to answer the “Five Ws” in relation to incidents: [W]ho did it? [W]hat happened? ...
Blog

Computer Espionage Gang Targets Rival APT Group with Spear Phishing Attack

A computer espionage gang has sent a rival advanced persistent threat (APT) group a spear phishing email in what might be the first reported instance of an APT-on-APT attack. In February of last year, Naikon, one of the most active APT groups in the Asian region, launched a spear phishing email campaign. Another APT group, Hellsing, was one of its...
Blog

VERT Alert: April 2015 Patch Tuesday Analysis

Today’s VERT Alert addresses 11 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-610 on Wednesday, April 15th. MS15-032 Multiple Memory Corruption Vulnerabilities in Internet Explorer MULTIPLE Internet Explorer ASLR Bypass...
Blog

People Are The Problem (And Solution)

Reading through the Verizon Data Breach Investigations Report (aka DBIR), the amount of information about last year's breaches is daunting. Let's look at one category of the report—Phishing. Teach a man to phish? Why did I focus on phishing? Because it is on the mind of a lot of CISOs these days. As we know, quite a few high-profile breaches have...
Blog

Takeaways From the 2015 Verizon Data Breach Investigations Report

Verizon’s annual Data Breach Investigations Report (DBIR), published since 2008, has become one of the most anticipated information security industry reports. Think of it as the Data Breach Bible, as it dissects thousands of confirmed data breaches and security incidents from around the globe into emergent and shifting trends, providing us with...
Blog

Remember Who the Adversary Really Is

There has been a dramatic increase in the attention paid to the information security field due, in part, to a number of high-profile breaches. There is a much higher level of concern over what information security means, what it provides and how to approach it. The field has graduated from fringe awareness to bad mainstream TV dramas. This growth...