Vulnerability Description A heap-based buffer overflow was found in glibc's __nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker able to make an application call either of these functions could use this flaw to execute arbitrary code with the permissions of the user...

Banks are required by law to follow government regulations; these subject the banks to specific requirements, restrictions and guidelines. The end goal being, among other things, transparency. What about setting specific requirements for banking website security? Pew Research Center statistics reveal that 51% of U.S. adults bank online and 35% of...

On Wednesday, January 28, the National Cyber Security Alliance (NCSA) will launch its eighth annual Data Privacy Day in the United States in an effort to emphasize the importance of “respecting privacy, safeguarding data and enabling trust.” The annual day of awareness aims to encourage consumers to become educated on how to strengthen the privacy...

Here's a piece of advice for anyone responsible for securing a corporation's data: If you discover security researcher Randy Westergren is using your app, you had best take a long hard look at whether you are protecting your users' information properly. Because, if you're not, there's a good chance that he might be about to tell you what you're...

Five cyber criminals down; five to go. Last week, we learned about Lin Mun Poo, a Malaysian hacker who at one time infiltrated a prominent U.S. financial institution as well as a contractor for the Department of Defense. Tripwire now continues its series on some of the most notorious cyber criminals brought to justice with Vladislav Anatolievich...

We’ve looked at the Tripwire IP360 Scoring System and how risk is commonly used in two different scenarios, so I figured it was worthwhile to dive into the other complex element of Tripwire’s scoring: skill. Skill is a term that, even within the IP360 Scoring System, has evolved over the years and it’s worth looking at the evolution of the word in...

The movie ‘Blackhat’ succeeds in highlighting the prevalence of security breaches caused by human error. Even so, it fantasizes many aspects of our digital world to help depict an international cyber crisis and flubs as a film more generally. ‘Blackhat,’ starring Chris Hemsworth and Viola Davis, is an American action thriller about a former...

More than 5,000 devices used to operate gas stations across the United States were found vulnerable to dangerous Internet attacks, revealed a security researcher this week. The flaw was found in the gas stations’ automated tank gauges, or ATGs, which raise alarms indicating an issue with the tank or gauge, such as a fuel spill. The devices also...

As part of a security awareness campaign, a seven-year-old girl was able to successfully hack a public WiFi hotspot in 10 minutes and 54 seconds. Seven-year-old Betsy Davis entered into the ethical hacking demo, meaning that a security expert supervised the entirety of the experiment, with only her laptop. She was then able to find out how to hack...

The ever-controversial hacker-turned-millionaire-entrepreneur Kim Dotcom has announced the public beta launch of an end-to-end encrypted audio and video chat service, which he calls MegaChat. Anyone with an account on Mega's file-sharing file-syncing service can now access what is claimed to be a more secure alternative to Skype, boasting end-to-end...

I started getting involved in learning about the STIX (more here) and TAXII standards in earnest last year. These emerging standards enable effective sharing of cyber threat data in automated ways between different products, people and organizations. In many ways, that makes me a newcomer to these emerging standards; by that point in time The MITRE...

Cross-site scripting, commonly referred to as XSS, is listed third in the OWASP Top 10 for 2013 Web Application Security risks. Unlike SQL injection attacks, which target data on the server, XSS provides a vector for attacking the users of a vulnerable web site. At a general level, XSS is when an attacker can cause a web site to render with...

Hacker Halted is an IT security conference with the intention of educating the attendees in security and ethics. Last year, the conference was held in Atlanta on October 16-17. What VERT Presented at Hacker Halted VERT presented an implementation of a protocol independent fuzzer, which was built using python. We developed a fuzzer because we...

The Dallas-based restaurant chain Wingstop has reported its currently investigating a possible “data security attack” at four of its franchise locations, with one incident suspected of dating back to 2012. The company announced over the weekend that the potential breach may have allowed attackers to steal payment card information, such as account...

Security researchers have found that the developers of ComRAT, a complex remote administration tool, are still hard at work. Per an article published on its blog, G Data Software was able to successfully identify 46 different samples of the spyware and trace it to as far back as 2007. Some believe that the malware, otherwise known as ‘Turla’ and ...

Within the last 10 years, our communities have become dependent on technology to support their homes and their business relationships. It may even arrive at the assertion that 99.99% of the population in any developed society will be utilising technology in both direct and indirect ways, say by association with the use of online banking, ATMs, on...

Last week, Tripwire published the story of Albert Gonzalez, a notorious hacker who was arrested in 2010 for his colorful record of cybercrime, including the 2009 breach against Heartland Payment Systems, Inc. that compromised 134 million credit cards. Tripwire now continues its series of some of the most notorious cyber criminals brought to justice...

On Friday, Verizon patched a vulnerability in its My FIOS app that allowed users to compromise and send messages from other users’ email accounts. The vulnerability was first reported by Randy Westergren, a senior software developer for XDA-Developers. Westergren details in a blog post that he first found the vulnerability while he was proxying...

Recently, Tripwire reported on the launch of ‘Silk Road Reloaded,’ the newest iteration of the Silk Road underground market where users can purchase drugs and fake IDs. The fact that Silk Road has returned is a testament to users’ ongoing ability to purchase illegal goods online, not to mention merchants’ ability to sell these products. After all,...

This report was prepared by The Institute for National Security Studies (INSS) and The Cyber Security Forum Initiative (CSFI) to create better cyber situational awareness (Cyber SA) of the nature and scope of threats and hazards to national security worldwide in the domains of cyberspace and open source intelligence. It is provided to Federal, State...