What do Robert M. Lee, Eric Byres, Sean McBride, Dr. Oliver Kleineberg, and Sid Snitkin all have in common? If any of these names do not ring a bell, they’re each industrial cybersecurity experts in different realms. Along with Tripwire customers and other industry leaders, they will be sharing fast-paced perspectives and challenging you to think...

“Hello, again, friend. It all went quiet for a while and the depictions of hacking and cyber on TV seemed to become trite and clichéd again. We stopped seeing him, Mr. Robot, but now he’s back again. Did you see him, too?” This blog may contain spoilers and was written following ‘eps3.2_legacy.so,’ which seems a good enough point into the new...

BULLETIN CVE APSB17-32 CVE-2017-11292 Microsoft Browser - IE CVE-2017-11790,CVE-2017-11822,CVE-2017-11813 Microsoft Browser - Edge CVE-2017-11794,CVE-2017-8726 Microsoft Browser - Scripting engine CVE-2017-11796, CVE-2017-11808, CVE-2017-11809, CVE-2017-11805, CVE...

Industrial control systems (ICS) are no strangers to digital attacks. In its Threat Landscape for Industrial Automation Systems in H1 2017 report (PDF), Kaspersky Lab blocked attack attempts against 37.6 percent of ICS computers that use the Russian security firm's products. It also detected 18,000 variants of 2,500 different malware families that...

By now, we’re all aware of the Equifax breach that affected 143 million customer records. Equifax reports that Apache Struts vulnerability CVE-2017-5638 was used by the attackers. Equifax was not running its vulnerable struts application in a container, but what if it had been? Containers are more secure, so this whole situation could have been...

In our previous article, we laid the groundwork for what we believe to be a serious threat to ICS/SCADA devices: social engineering. We continue here with some definitions, some of which you may already know. Phishing Phishing is a relatively broad term for any attempt to trick victims into sharing sensitive information, such as passwords,...

At the U.S. Republican National Convention in Cleveland last year, more than 1,200 people connected to free WiFi networks with names like “I Vote Trump! Free Internet,” “I Vote Hillary! Free Internet,” and “Xfinitywifi.” They transferred gigabytes of data, doing things like checking e-mails and chatting. Some even shopped on Amazon or logged into...

Google has announced a bug bounty program covering other developers' popular Android apps available for download in its Play Store. On 19 October, the American multinational technology company launched its Google Play Security Rewards Program. Here's a high-level description of the new framework: "Google Play is working with the independent bug...

In 2014, the FBI warned that healthcare systems, including medical devices, were at an increased risk of cyber-attacks due to the unfortunate coupling of poor cybersecurity practices in the healthcare industry with patient health information (PHI) that commands high value on the dark web. This warning has largely been realized. The cost and frequency...

A new, “highly prevalent” strain of Android malware was found infecting several Minecraft-related apps on the Google Play store, adding compromised devices into a botnet. According to security researchers at Symantec, at least eight mobile apps – with an install base ranging from 600,000 to 2.6 million devices – were infected with Sockbot. “The...

On 16 October, news first emerged of what's known as "KRACKs." These malicious techniques exploit vulnerabilities that affect a protocol used for securing Wi-Fi networks. Bad actors could therefore leverage KRAcks to potentially expose encrypted information exchanged over otherwise secure wireless connections. As of this writing, the computer...

As part of this ongoing series (previous parts, in order, here, here, here and here), I have been trying to make the case that differing interests make cooperation on cybersecurity issues virtually impossible. This is not criticism. It’s just reality. And while it would be easy to look at Brexit or Eastern European and American politics as a push...

If you've read a security blog anytime in the last year, you haven't escaped mention of the dreaded skills gap for cybersecurity professionals. There seems to be consensus that it's getting harder to hire skilled security staff, though the reason for that is up for debate – some say we're just going about it the wrong way, while others claim it is an...

Today’s VERT Alert addresses the Microsoft October 2017 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-746 on Wednesday, October 11th. In-The-Wild & Disclosed CVEs CVE-2017-8703 This CVE describes a publicly disclosed denial of service vulnerability which impacts the Windows Subsystem for...

Do you go fishing? You may or may not, but we see far too much phishing going on in the Internet ocean, and it scares us. The risk of over-phishing is not necessarily our concern. Our concern rests in that phishing is so easy, and big fat phish of this Internet ocean are getting gobbled up. And that’s not good for us because many of us don't really...

Apple has released an update that is designed to better protect passwords for encrypted APFS volumes on machines running macOS High Sierra. APFS is short for Apple File System. The Cupertino-based tech giant created it to fix some issues involving Mac OS Extended. Apple File System is meant for computers with flash or solid-state drive (SSD) storage...

Last time, I spoke with Kim Wong, a woman who recently acquired a cybersecurity role in Britain's financial services industry. This time, I'm honored to speak with Keren Elazari. Not only has she given TED talks but also founded BSidesTLV in Tel Aviv, Israel. We had a wonderful chat! Kimberly Crawley: Please tell me a bit about what you do. KE: I'm...

Walk into almost any health care facility in America, and chances are, you’ll find a variety of new technologies that didn’t exist even a decade ago. All of your personal information is now digitized, allowing you to move doctors with little to no delay, the treatment you receive is now faster and more efficient, and even payment options can be done...

If you are one of those enthusiastic and adventurous entrepreneurs who are on the verge of launching your own online business, here's an important question for you: have you secured your start-up enough so that it can battle the security threats of today? If you haven't, now is the time to do so. In this blog, let's take a look at some of the...

When I got an email giving me the opportunity to work as an intern for Tripwire, I jumped at the chance. I have always been intrigued by the world of cybersecurity and ethical hacking, so this internship truly struck home. The internship started with going through the 2017 Verizon Data Breach Investigation Report (DBIR) over the summer. The goal was...