Blog

Blog

Heads Up Frequent Fliers: Gogo Inflight WiFi Found Issuing Fake SSL Certificates

The largest inflight Internet provider Gogo is under fire after a Google Chrome security engineer took to Twitter her discovery of the service issuing fake SSL certificates. During a recent flight, Adrienne Porter Felt ( @__apf__ ) noted that while accessing Google sites, the SSL certificate was actually being issued by Gogo – an “unstrusted issuer “ – instead of Google. hey @Gogo , why are you...
Blog

Mobile Payment Security Faces an Uphill Battle in 2015

Only one percent of consumers believe using a third-party mobile payment provider, such as Apple Pay or Google Wallet, is a safe way to pay for in-store purchases, reveals Tripwire, Inc . This past holiday season, One Poll and Dimensional Research conducted a consumer survey of over 2,011 consumers in the United States and UK . The survey’s findings include the following: Over a quarter (26...
Blog

2014: The Year of the Breach – Part 2

In anticipation of the New Year, Tripwire recently published an article that surveyed some of the better-known data breaches that occurred in 2014. We now present Part 2 of our two-part series, “2014: The Year of the Breach.” Home Depot (September) – On September 18 th , Home Depot acknowledged that it had suffered a data breach. The attackers gained entry to the perimeter of the retailer’s...
Blog

Second Member of Hacker Group ‘Lizard Squad’ Allegedly Arrested

British authorities have allegedly arrested another member of the hacker group ‘Lizard Squad.’ The Daily Dot recently broke the story after it received an email from Vinnie Omari , a 22-year-old member of the hacker group. “They took everything,” Omari explained in the email, which allegedly also contained an image of the British authorities’ search warrant for his home. “Xbox one, phones, laptops...
Blog

Ingredients for Architecting the Security of Things

One of Tripwire's many strengths is our ability to collect security data and build meaning from it. Meanwhile, the rapidly emerging Internet of Things (IoT) poses some juicy problems to tackle in this regard. I recently came across an interesting article titled 4 Big Trends that Impact Industrial Automation and What To Do About Them, Part 1 of 2 by Brian Oulton. After reading it through, these...
Blog

Apple To Add New Security Alerts Following iCloud Hack

In response to the recent debacle that exposed multiple celebrities by hackers breaking into their personal Apple accounts and leaking private images on the web, Apple has stated it plans to launch additional security alerts warning users of possible intrusion.
Blog

Vulnerability Management: Just Turn It Off! Part III

Four unnecessary risks that often appear in even the most secure networks, and step-by-step instructions on how to immediately address these considerable risks that can be hurting the security of our environment.
Blog

Vulnerability Management: Just Turn It Off! Part II

Our last post in the “Turn It Off!” blog series discussed some of the most common and yet unnecessary features that can make your environment more vulnerable, including JBoss JMX consoles, server banners and the Apache HTExploit. These risks are often encountered by our Vulnerability and Exposure Research Team (VERT), even on well-defended networks and many of which have been around for quite some...
Blog

NETGEAR Wireless Router Configuration Guide

This guide assumes that the reader has a NETGEAR branded wireless router and knows it’s address on the network. If you have forgotten the administrative password for your device, it may be necessary to perform a factory reset as outlined in this NETGEAR knowledge base article and then to login with the default password. Please note that while performing these steps, a malicious web page could...
Blog

Friends Don’t Let Friends Mix XSS and CSRF

In preparation for my upcoming talk at BSides SF about finding vulnerabilities, I would like to share today some insights regarding two common types of vulnerabilities which leverage web browser in two unique ways. The goal of these vulnerabilities is quite different however. One is used to run untrusted code while the other is used to hijack authentication. The combined effect of these issues can...
Blog

Why the Security Stack Has Ten Layers, Not Seven

The next item to tackle is the overall security architecture – and this includes several things. But let me first state the disclaimer that of course it is imperative that the correct governance and policies are in place and that technology can’t replace those things. But, it is also clear that however sophisticated, no paper document or process design will block an attack in the meantime until...
Blog

Bruce Schneier on Breaking Free from “Feudal Security”

“We live in a world where we’re ceding a lot of our power to other companies,” said Bruce Schneier ( @schneierblog ), security blogger and author of “Liars and Outliers” in our conversation at the 2013 RSA Conference in San Francisco. Schneier was referring to companies such as Google and Facebook that control our data as well as companies that control our devices, such as Apple. “These companies...