The evil twin is not just a schlocky plot device for TV crime shows and absurd soap operas, it's also a threat to your company's data. It's relatively easy for a criminal to set up an evil twin rogue wireless access point that mimics one that your users and visitors connect to, whether on your premises or in a public place, with the intention of...

An Immigrations and Customs Enforcement (ICE) special agent has subpoenaed reddit to learn more information about five users who frequent the subreddit r/darknetmarkets – an active chat room for issues pertaining to dark market websites. Special Agent Michael McFarland issued the subpoena on March 11, 2015, asking for information on these five...

Recently, I attended the O'Reilly's Software Architecture Conference — these kinds of things are both inspiring and de-spiriting. I am inspired by the speakers, their ideas, bravery and charisma. Being inspired, I cook up my own ideas for which I have no clue how to find time to act upon… sigh. So, it goes. Without adeu, I present to you my (rather...

A new Trojan-based campaign is targeting energy companies around the world in an effort to gain access to sensitive information. The majority of companies experiencing attacks are distinctly linked to the petroleum, gas and helium industries located in the Middle East – including UAE, Pakistan, Saudi Arabia and Kuwait. However, businesses in the US...

Tripwire recently hosted a webcast entitled, “PCI Breach Scenarios and the Cyber Threat Landscape with Brian Honan: Real World Cyber Attacks and Protecting Credit Card Data.” For our presentation, Brian Honan (CISM, CGEIT, CRISC), an information systems and cybersecurity specialist and a member of the Advisory Group on Internet Security to Europol’s...

Uber credentials of thousands of users were spotted for sale on an underground marketplace for as low as $1 per stolen username and password. According to a report by Ars Technica, the logins are being offered by two separate vendors on AlphaBay – an online black market operating on the Tor network. ...

I know that I am not the target demographic for CSI: Cyber. Just as I assume anyone who does anything remotely related to law enforcement isn't interested in watching a cop procedural, I don't generally watch shows that feature “hackers” – not just because my perspective might make the viewing experience frustrating, but because “hacking” is...

The popular coding website GitHub was hit with a massive denial-of-service (DDoS) attack late Thursday night, with some users experiencing intermittent service outages. According to security researcher and blogger Anthr@x, the ongoing attack, which intensified on and off for more than 24 hours, appeared to originate from the Chinese web services...

When I was about 10 years old, I read a book about Kevin Mitnick, Pengo and Robert Morris. While their exploits seemed very interesting, each story ended in jail time or at the very least, derailment of career goals. My unsophisticated Internet searching circa the early 2000s led me to the same conclusion. Hacking was a neat skill to have but the...

A new type of ransomware is encrypting victims’ video game files in addition to targeting other documents stored on their computers. According to Bleeping Computer, the ransomware strain, dubbed “TeslaCrypt,” was first discovered by Fabian Wosar of Emsisoft earlier this year. TeslaCrypt mimics other ransomware, including CryptoLocker, in that it...

If you've recently found your web browsing plagued by pornographic pop-ups and irritating adverts, there might be a simple - but dangerous - explanation. Maybe hackers have hijacked your internet router? Security researchers at Ara Labs have warned of an active campaign which has seen attackers changing DNS settings on routers, causing unauthorised...

Banks regularly undergo mandatory stress tests. These tests are clearly defined, and the results are used to determine how well each bank can maneuver through an economic calamity. If we apply the basic blueprint of a financial stress test to an IT infrastructure, we can loosely define it as: “An analysis conducted under unfavorable scenarios which...

While I work in security, when it’s quitting time, I’m a gamer through and through. My home is littered with consoles from Sega Genesis and NES to PS3 and Xbox One. My last two PC purchases have been strictly gaming machines, and I even bought a game pad for my iPhone because I enjoy playing (and streaming) Asphalt 8. This year, I’ve casually...

Ransomware has disabled a New Jersey school district’s computer systems, with the attackers demanding hundreds of Bitcoins as ransom to restore access to files seized in the attack. In a post published to the district’s website, officials at Swedesboro-Woolwich School District explain that the incident, which occurred on March 22nd, thus far...

Over the past decade, the role of the Internet has moved beyond just email and websites viewable from a small window on a heavy desktop to something we now carry with us in our bags, pockets and strapped to our wrists. It is now a driving force of the world economy and is creeping its way into every aspect of our lives. For better or worse, we are...

One could argue that cybersecurity is by far the most important Homeland Security, National Security and Public safety issue of our time. In the age of terror specifically, groups like ISIS, Al Shabaab and AQAP have managed to use the Internet to recruit and successfully spread their message with little to no counter narrative of merit....

A vulnerability in Cisco IP phones could allow unauthenticated attackers to remotely listen in on the phones’ audio streams. According to an advisory Cisco published on its website, the vulnerability (CVE-2015-0670) results from improper authentication in the default configuration of certain Cisco IP phones. “An attacker could exploit this...

Earlier this month, Tripwire announced Computer Criminals Brought to Justice, a continuation of its 10 Notorious Computer Criminals Brought to Justice series, by investigating the story of a young man who was recently arrested in connection with the 2014 hack of the U.S. Department of Defense. This week, we continue our series with Aleksei...

The printf() family of functions (printf(), fprintf(), sprintf(), etc.) are surprisingly powerful and, if not properly used, can expose a class of vulnerabilities called format string attacks. These attacks can be very bad because with a well-crafted format string, an attacker could write an arbitrary value into an arbitrary memory location. This...

Last week, the Internet fell over itself to report on a botnet allegedly comprised of 100,000 smart devices. Things. The Internet of Things had finally attacked! While it's inarguable that, at some point, these devices will be compromised, corrupted and otherwise made to serve the pernicious purposes of attackers, deeper technical analysis points...