Resources

Blog

Microsoft Patching: Don't Forget to Read the Fine Print

During my career, I have built and managed hundreds of production-level client and server systems, and nothing can be more worrisome than when it comes time to apply patches and upgrades to software. Why? Because things can, and often times, do go wrong during patch and upgrade cycles. According to a few reports, it is possible that system...
Blog

Data Breach Hits Telstra's Pacnet, Exposes Customer Data

Telstra's Pacnet has begun contacting its customers following the discovery of a data breach that compromised its corporate IT servers on which customer data is stored. Several high-profile Pacnet customers, including the Australian Federal Police and other government agencies, were exposed by the breach. It is unclear at this time whether the...
Blog

LogJam: Researchers Identify Another Web Encryption Vulnerability

A new potentially high-impact vulnerability called LogJam has been revealed by researchers, which has similarities to the FREAK (CVE-2015-0204) vulnerability disclosed a few months ago, whereby a man-in-the-middle attack can be implemented to weaken the encryption between client and server. Like FREAK, the LogJam vulnerability takes advantage of...
Blog

More Top Conferences in Information Security – Readers' Choice Edition

Last week, we published a list of the top 10 conferences in information security. In our article, we strove to include some of the biggest events in the industry. But realizing that we likely missed a few, we invited you – our readers – to write in and let us know of the conferences you feel should have made the list. Thank you to those who provided...
Blog

New Malware Threat Discovered Every 4 Seconds, Report Says

According to a recent report, analysts discovered a record-breaking 4.1 million new malware threats in the second half of 2014. Researchers at German antivirus firm G DATA revealed that the 77 percent spike from 2013 resulted in nearly six million new malware strains identified last year alone. ...
Blog

Vulnerability in Safari Allows Attackers to Spoof Websites

A security firm has discovered a vulnerability in Apple’s Safari Browser that allows attackers to spoof legitimate websites and phish for user credentials. Security firm Deusen reveals that the flaw works by using a short script to force Safari into loading one page while still displaying the URL of another page. This script is provided below: &lt...
Blog

Researcher Appears to have Exploited Vulnerability During Flight

On Friday May 15th, a Canadian news outlet published a copy of the application for a search warrant filed by the FBI after Chris Roberts was removed from a United flight for tweeting about hacking a plane. If you’ve never read a search warrant for electronic devices, it’s an educational read. The purpose of the warrant was to allow the FBI to search...
Blog

Computer Criminals Brought to Justice – Randall Charles Tucker

Last week, we explored the story of Valérie Gignac, a Canadian woman who is believed to have hacked users’ webcams and subsequently harassed them. We now report on the story of Randall Charles Tucker, a serial distributed denial of service (DDoS) attacker who targeted the websites of government authorities whom he felt were guilty of unjust behavior...
Blog

GTA V Mods ‘Angry Planes’ and ‘Noclip’ Found to Contain Malware

Some mods of the popular computer game Grand Theft Auto V have been found to contain malware. In the game’s online forums, users have identified malicious code in the ‘Angry Planes’ and ‘Noclip’ mods. The former spawns planes that attack players, and the latter allows players to walk through walls and other objects. One GTAForums user aboutseven...
Blog

5 Gems in the World of Information Security Conferences

Last week, Tripwire compiled a list of the top 10 information security conferences. We made a special effort to ensure that our article included the biggest, most industrialized conferences in the industry, and we feel that we succeeded in capturing the major brands across the infosec conference landscape. Even so, we recognize that information...
Blog

Hackers Gaining Access to Starbucks Accounts

Updated at 9:00 AM PST. According to reports, hackers have gained access to a number of Starbucks mobile app accounts. The source of the compromise is reportedly due to account passwords being guessed or reused, giving attackers access to customer accounts through the application program interface ...
Blog

Oregon Data Breach Used by Theft Ring to File Fraudulent Tax Returns

Federal law enforcement have arrested five men for filing close to 1,000 fraudulent tax returns using the stolen information they obtained from a breach that compromised the data of 125,000 people, 88,000 of whom were listed in an Oregon employment company’s database. Lateef A. Animawun, 34, of Smyrna, Georgia; Oluwatobi R. Dehinbo, 30, of Marietta,...
Blog

United Airlines Bug Bounty - Find Vulnerabilities, Win Airmiles!

It seems more and more companies are beginning to understand the benefits of running a bug bounty program, encouraging vulnerability researchers to report security flaws responsibly (for a reward) rather than publishing details on the web or selling a flaw to potentially malicious parties. The latest high profile firm found running a bug bounty is...
Blog

VERT Threat Alert: May 2015 Patch Tuesday Analysis

Today’s VERT Threat Alert addresses 13 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-614 on Wednesday, May 13th. MS15-043 VBScript ASLR Bypass CVE-2015-1684 VBScript and JScript ASLR Bypass CVE-2015-1686 ...