Resources

Blog

New Type of Brute Force Attack on Office 365 Accounts

Sophisticated and coordinated hackers are constantly adapting and using innovative techniques to gain unauthorized access to corporate data. Recently, 48 Office 365 customers experienced exactly this kind of threat where an attacker implemented a new strategy to try to access high-level information. The brute force login attack was unique in that it...
Blog

Watch Out for Government Grant Scams, Warns FTC

The Federal Trade Commission (FTC) is warning the public to be on the lookout for scams that leverage fake government grants as lures. This type of ruse begins when an individual receives a cold call from someone they don't know. The caller informs them that they have won a grant of $14,000 from the National Institutes of Health (NIH), an agency of...
Blog

Super X-Ray Vision for Vulnerabilities into Non-Running Containers

Containers can be traced back to 1979 with chroot but the advent of Docker has exponentially increased the popularity and usefulness of this technology. Any technology that becomes popular and useful also becomes a target for attacks. Containers are designed to provide isolated environments rather than full virtual machines, but they make great...
Blog

Dynamic Security in an Elastic World

I have had the pleasure of working on the latest curriculum for Tripwire University. In that capacity, I've noticed more and more interest around securing cloud environments as our customers and the market continue to move towards cloud technologies. Whether it be customers who are 100% committed to the cloud and moving all of their assets up into...
Blog

VERT Threat Alert: August 2017 Patch Tuesday Analysis

Today’s VERT Alert addresses the Microsoft August 2017 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-737 on Wednesday, August 9th. In-The-Wild & Disclosed CVEs CVE-2017-8627 The first publicly disclosed vulnerability this month is a denial of service in the Windows Subsystem for Linux....
Blog

STIX 2.0: The Run for Technological Advantage

In 490 B.C. an important battle was fought between the Athenians and the powerful and seemingly unconquerable Persians: The Battle of Marathon. Going it alone, without the help of the Spartans, the Athenian army of about 10,000 men defeated King Darius’ army of about 35,000. Knowledge of the local geography, technological advantage and tactical...
Blog

July 2017: The Month in Ransomware

July was relatively slow in terms of ransomware. Some crooks must have been on vacation spending ill-gotten money at deluxe resorts. Well, why not? They sure can afford it. The rest were busy releasing small shoddy strains and reanimating old ones. Here’s what the month looked like in the numbers: 42 new samples went live, 33 existing ones were fine...
Blog

UK Government Issues Guidelines to Protect Smart Cars against Hackers

The UK government has published a series of new guidelines designed to protect smart cars against hackers and data thieves. The Department for Transport and the Centre for Protection of National Infrastructure (CPNI) created the recommendations so that organizations can use them to build safer, more secure cars as smart technology continues to...
Blog

Looking Back On SOHOpelessly Broken at DEF CON 25

DEF CON 22 was my third DEF CON and the first time ever for the IoT Village and related "SOHOpelessly Broken" contests. That year, I easily won both tracks of the competition with only a handful of hours spent analyzing and hacking routers. As anyone who’s ever attended DEF CON can tell you, there are roughly one billion options for how to spend the...
Blog

Cerber Ransomware Now Capable of Stealing Bitcoin Wallet Files

The developers of Cerber ransomware have equipped their creation with the ability to steal victims' Bitcoin wallet files. Security researchers first discovered Cerber in early 2016. Since then, the crypto-malware family has gone through at least six iterations. It's also sparked a ransomware-as-a-service (RaaS) platform that's raked in upwards of a...
Blog

The GDPR Adventure: A Legal Perspective

Adventure (ad•ven•ture) / ad-ven-cher / noun: an undertaking usually involving danger and unknown risks; an exciting or remarkable experience; and enterprise involving financial risk. Origin: Old French aventure (noun), based on Latin adventurus ‘about to happen.’ There are many people who have the privilege of saying that they get paid to be...
Blog

New Trojan Never Saves a File during Its Infection Chain

A new trojan leverages a fileless infection chain in that it never saves a file to the machine, thereby making analysis via a sandbox more difficult. It's unclear how the malware, detected by Trend Micro as JS_POWMET, initially arrives on a computer. Users could unknowingly download it from malicious websites. Alternatively, other malware could drop...
Blog

Threat Hunting: Do Hackers Know Where You Are?

The internet is full of personal and business-sensitive information if you know where to look. In a previous post, we detailed our method of collecting Open Source Intelligence (OSINT) by “scraping” the content posted to public websites where stolen information is regularly released by hackers. That post focused on email and password combinations ...
Blog

Thoughts from Black Hat 2017 and Killer Car Washes

With Black Hat 2017 and DEFCON rapidly receding into the desert sunset, I am left with a couple of thoughts after several days on the show floor talking to customers: 1. Wow! So many fidget spinners – cheap ones, expensive ones, plastic, metal, ones that lit up, ones that didn’t, and ones that were supposed to, but didn’t. The go-to schwag for...
Blog

Top 5 Barriers to Security Implementations

I have been in this business for over 10 years, specifically in the business of trying to ensure our critical infrastructure remains in a safe, reliable and secure state. After all, if our critical infrastructure were to fail, the implications could be huge. Since 2011, I think the real threat of large-scale attacks against critical infrastructure...
Blog

Privacy Group Wants Answers into Google Consumer-Tracking Program

It's widely recognized that online advertisers know a lot about web users. The most "sophisticated" of these companies gather data on potential customers by tracking their behavior around the web. Specifically, they analyze what sites users visit and what links they click. They then compile that identifying information into a database, build upon it...
Blog

Cyber Security Heroes Part 5: Scott Helme

They say you should never meet your heroes—often they will just disappoint you. But thankfully, there are also exceptions to this rule. In this five-part series, I will be introducing you to five of my key cyber security/infosec heroes. These individuals inspire me to continuously strive for more, with one even motivating me to move across the pond....
Blog

Third-Party Breach Might Have Exposed 18.5K Anthem Customers' Data

Health insurance plan provider Anthem says a third-party breach might have exposed 18,500 customers' personal and medical data. In a statement (PDF), Anthem media contact Gene Rodriguez reveals how the security incident links back to LaunchPoint Ventures LLC, a firm which provides insurance coordination services to Anthem: "On April 12, 2017,...
Blog

Shadow IT – How Do You Protect What You Don’t Know You Have?

For a cybersecurity program to succeed, it must identify the assets it aims to protect. Without a clear understanding of its assets, no organization can truly understand the value of its resources, assess the risks they face, or understand how much to spend to secure its infrastructure. Unfortunately, the process of identification is not getting any...