Resources

Blog

Defend Your Hospitals Crown Jewels: EHR

Electronic Health Record (EHR) systems have been around for over 40 years. The adoption surge came in the United States with an Executive Order for nationwide deployment in 2014. Today, they are the heart for most healthcare providers. The value of EHRs has been well-documented, offering improved patient care while improving organizational...
Blog

LinkedIn Messenger Flaws Enabled Attackers to Spread Malicious Files

Bad actors commonly abuse LinkedIn to launch digital attacks. With over 500 million members spread across 200 countries, the professional networking site contains crucial information that nefarious individuals can use to attack nearly any organization and its corporate data. They just need to establish an initial foothold in the company. Most of the...
Blog

California City Stops Online Utility Bill Payment System amid Breach Fears

A California city has temporarily shut down its online utility bill payment system amid fears that the portal suffered a breach. On 22 August 2017, the City Manager's Office of Oceanside, CA announced a possible security incident affecting its online bill payment system that residents can use to pay their utility (water, sewer, and trash) bills. As...
Blog

NHS Cyber Attack Allegedly Exposes Personal Data of 1.2 Million Patients

The UK’s National Health Service (NHS) has reportedly fallen victim to another massive cyber-attack, exposing the confidential records of up to 1.2 million patients. According to reports, an unknown hacker claimed to exploit a weakness in the NHS’ appointment booking system, SwiftQueue. The vendor is contracted by eight NHS trusts to manage booked...
Blog

Identity Thieves Porting Mobile Numbers to Hijack Victims' Web Accounts

Identity thieves are porting users' mobile phone numbers to devices under their control in order to hijack their web accounts. This type of attack begin when hackers call up a mobile service provider. Using a bit of social engineering, the bad actors convince an agent at the provider to transfer control of a target mobile phone number to a device...
Blog

The Forever Viral Facebook Virus

As much as Facebook has brought many people from the remotest parts of the world together, connecting them over vast expanses of space and time, the platform has become one of the major distributors for cybercriminals. Their malicious intent is to spread viruses, malware and spyware throughout the abyss that is the internet. Being able to target...
Blog

Bad Poetry Day Highlights - The Security Edition

Friday, August 18th was Bad Poetry Day. To celebrate, Tripwire decided to ask some of it's employees and friends in the community to share some of their security poems with us. Some folks tweeted theirs out using the hashtag #tripwirebadpoetryday. Others sent them in. Here are some of our favorites: Roses are red, Violets are blue Tripwire is...
Blog

Couple Arrested for Exploiting Lowe's Website Flaw to Steal Merchandise

New Jersey law enforcement has arrested a couple for abusing a vulnerability affecting Lowe's website in order to steal merchandise. On 15 August, Ocean County Prosecutor Joseph D. Coronato and Brick Township Police Chief James Riccio announced the arrests of Romela Velazquez, 24, and Kimy Velazquez, 40. Together, the couple allegedly orchestrated a...
Blog

How Prepared Are You for the NERC CIPv5 Audit?

How prepared are you for the NERC CIPv5 audit? Maybe you’re ready to jump in with both feet, maybe you have no idea where to start, or maybe you’re somewhere in the middle. No matter where you land, there are some best practices to help you along the way. While I can’t promise to rid you of all past sins and violations, I do have pointers based on...
Blog

Hacking for Innocent Lives: Using OSINT against Online Child Predators

The Internet is a potentially dangerous place for users. This is especially so for children. Oftentimes, these younger users don't yet understand that some people harbor bad intentions. They are therefore prime targets of digital predators who would seek to prey upon them online. Information security writer Kimberly Crawley explains that there are...
Blog

Lessons to learn after hackers hijack HBO's Facebook and Twitter accounts

It's never a dull day if you're working in HBO's IT security team. One day you're dealing with the unauthorised leaking of upcoming episodes of "Game of Thrones", next you're facing multi-million dollar extortion demands from hackers who've broken into your network and stolen 1.5 terabytes data and the personal contact details of your celebrity cast...
Blog

Locky Ransomware Now Appending .Lukitus to Encrypted Files

Locky ransomware is now appending the ".lukitus" extension to victims' files after it's completed its encryption routine. On 16 August, Fortinet junior anti-virus analyst Rommel Joven came across one of Locky's newest variants. https://twitter.com/rommeljoven17/status/897766198674300928 The ransomware is making its way onto users' machines via a...
Blog

The Skills Gap Is an “Entry-Level” Problem

There is much consternation and many dismal proclamations from think tanks all the way to Twitter eggs decrying the shortage of skilled information security workers. The skills gap does exist, but it isn’t a singular chasm. It’s a series of rifts and valleys, each with different characteristics. Beyond acknowledging the gap, we need to survey its...
Blog

Shipping Company Maersk Says NotPetya Cyberattack Could Cost Up to $300M

Container shipping company A.P. Moller-Maersk says a cyberattack that disrupted its operations will come with a hefty price tag of as much as $300 million in lost revenue. The Danish conglomerate, known as the largest container ship and vessel operator in the world, announced the estimated losses in its second quarter financial report. "In the last...
Blog

5 Information Security Tips for Senior and Executive Management

In the Army, we see the basic military fundamental skills being tested on every mission and operation. Whether the operator is jumping out of C-130 to scuba submersion or securing a post in country, their basic skills are always being tested. This goes for information security professionals, as well. Your basic skills sets will be tested every day....