Resources

Blog

Researcher Finds XSS Bug in Google By Accident

A security researcher recently discovered a cross-site scripting (XSS) vulnerability in Google by accident. Patrik Fehrenbach explains in a blog post that he came across the flaw after deciding to take advantage of Google Cloud Console's 60-day free trial and test for XSS bugs. XSS flaws come in two types. A bug is 'reflected' if the payload...
Blog

117 million LinkedIn email addresses and passwords put up for sale

The LinkedIn hack of 2012 just got a whole lot worse. If you recall, in 2012 LinkedIn reset users' passwords after hackers broke into the network, stole a database of password hashes, and posted some 6.5 million account credentials on a Russian password forum. LinkedIn was left humbled by the security breach, which revealed that they had not used a...
Blog

Cybersecurity Automation and Orchestration: Next Generation Solutions to Today’s Big Cyber Problems

Very quietly, in 2011, the US Department of Homeland Services published a paper entitled "Enabling Distributed Security in Cyberspace," a paper that was then way ahead of its time. The paper "explores the idea of a healthy, resilient – and fundamentally more secure – cyber ecosystem of the future, in which cyber participants, including cyber devices...
Blog

How EDR Can Complement Your Organization's Security Policies

Information security is more than just checking a box. It also includes security awareness, a feature I discussed in my previous article on endpoint detection and response (EDR) which is just as important as the tools, technologies and other solutions an organization uses to strengthen its digital security. To make a difference, security awareness...
Blog

Breach at Nulled.io Hacker Forum Exposes Over 500K Registered Users

A popular underground hacker forum used by cybercriminals to trade and purchase leaked data, stolen credentials and software cracks was recently breached. According to Risk Based Security, hackers leaked a 1.3GB compressed archive containing a massive 9.45GB database file with the details of more than 536,000 Nulled.io user accounts, including...
Blog

Silk Road 3.0 Makes Its Debut on the Dark Web

Silk Road 3.0, the latest iteration of the infamous underground web marketplace, has appeared on the dark web. On Monday, a Reddit user announced the return of Silk Road and said its newest incarnation is being administered by the same person who currently operates Crypto Market, another dark web marketplace. Both portals currently share the same...
Blog

Defending Your Kingdom with a Knight

If I were a Chess piece to protect my organisation, which piece would I be and why? It’s too easy to choose the big player piece like the King but King’s rule the Kingdom and are protected by those around them, so in my mind, they don’t do very much. So, I choose to be a Knight. In Chess, I like playing the piece. It has so many unique qualities...
Blog

Sun Tzu & Security in 2016 – Part Two

In the first installment of this two-part article series, we took a brief look at the influence of Sun Tzu’s The Art of War and began our exploration of the theme of deception in warfare as it relates to cyber and information security. Let’s move on to another high-level theme running through the text: the importance of agility and variation in...
Blog

Why You Should Double-Check Your Vulnerability Data

Our ability to protect our systems from vulnerabilities is often only as good as the information available to us. One source, OVAL definitions, promises to “provide enterprises with accurate, consistent, and actionable information so they may improve their security.” Unfortunately, blindly trusting that this data is accurate could still leave your...
Blog

Adobe Readies Patch for "Critical" Vulnerability in Flash Player

Adobe is expected to release a patch for a "critical" vulnerability in Flash Player in its upcoming monthly security update. On Tuesday, the American multinational computer software company released a security advisory for Flash Player. In that bulletin, it discusses the vulnerability CVE-2016-4117. "A critical vulnerability (CVE-2016-4117) exists...
Blog

Overconfidence Plagues Financial IT Pros' Ability to Detect a Breach, Finds Survey

Back in February, Tripwire first unveiled its 2016 Breach Detection Survey. The study evaluated the confidence and efficacy with which IT professionals in the United States could implement seven key security controls: PCI DSS, SOX, NERC CIP, MAS TRM, NIST 800-53, CIS 20 Critical Controls, and IRS 1075. Together, those controls recommend accurate...
Blog

How to Tell if Your iPhone Has Been Secretly Hacked

You know you're living in interesting times when an app designed to tell you if your iOS device has been jailbroken is outselling the likes of Minecraft and Grand Theft Auto. And that's exactly what a new app called System and Security Info has managed to do, topping the paid apps chart ahead of some of the world's most famous games. ...
Blog

VERT Threat Alert: May 2016 Patch Tuesday Analysis

Today’s VERT Alert addresses 17 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-670 on Wednesday, May 11th. Ease of Use (published exploits) to Risk Table Automated Exploit Easy ...
Blog

Sun Tzu & Security in 2016 - Part One

Anyone who has read their fair share of security books, briefings, or blogs or sat through several infosec presentations by now has come across Sun Tzu, the ancient Chinese military General, strategist and philosopher. More specifically, I'm sure you've heard of his 5th century BC treatise known in the Western world as The Art of War. Outside of its...
Blog

GoDaddy Remediates Blind XSS Vulnerability

GoDaddy has remediated a blind cross-site scripting (XSS) vulnerability that attackers could have used to take over, modify, or delete users' accounts. Security researcher Matthew Bryant discovered the flaw using a tool XSS Hunter late last year. At that time, he found he could set his first and last name to an XSS payload. He opted to use a generic...
Blog

4 Reasons Why the Cloud Is More Secure Than Legacy Systems

We tend to fear what we do not understand. Especially when it comes to new technologies. We oftentimes worry… and worry some more… before finally embracing a new gadget, platform, or feature and deciding to incorporate it into our lives. Brian David Johnson, futurist at Intel, is responsible for creating models that predict how people will interact...
Blog

Understanding Prioritization - Patches and Vulnerabilities

Here at Tripwire, one of the responsibilities of VERT (Vulnerability and Exposure Research Team) is the monthly publication of our Patch Priority Index (PPI). Equal parts science and art, the PPI is released by VERT researchers who deal with vulnerabilities resolved by these patches on a daily basis. When this process first began, it prompted a very...