Purple Teaming is gaining a lot of movement and popularity. Before delving deeper into some top tips for exercises, I thought I would re-iterate that “Purple Team” is essentially a buzzword for getting the most out of a pentest / red team exercise. There’s nothing complicated about it. Yes, it is a buzzword, but one that instantly helps everyone to...

I am going to put the spoiler warning right here in the first sentence: I am going to be talking about season two of Mr. Robot, and I'm not holding anything back. Read on if you have already watched it. If you haven't watched it, keep reading to see how life imitates art. And if not art, then at least a cable TV show. Those of you here at The State...

A new malware family named Alice is lean, mean, and designed solely to empty the safe of ATMs. Researchers at the Los Angeles security software company Trend Micro first discovered Alice in November 2016. It appears to have been in the wild since October 2014. Alice makes use of several evasive techniques to avoid detection. First, it follows the...

‘Twas the night before Christmas, when all through the house, not a creature was stirring, not even a mouse...” But you can bet your Inbox received at least one lump of coal in the form of a phishing email. That’s right, the bad actors have been very naughty in 2016 delivering millions of fraudulent messages trying to entice trustworthy people to...

2016 was an exciting year in information security. There were mega-breaches, tons of new malware strains, inventive phishing attacks, and laws dealing with digital security and privacy. Each of these instances brought the security community to where we are now: on the cusp of 2017. Even so, everything that happened in 2016 wasn't equally significant....

A free tool called RansomFree that helps protect computers and servers running Windows against ransomware is now available for download. Boston security firm Cybereason developed its tool to respond to the evolution of ransomware, including the ability of most crypto-malware to bypass anti-virus solutions. As Cybereason Labs researcher Uri Sternfeld...

Ask any geek and they'll tell you how fun it is to install Linux on a new machine. Whether you're trying out a new distro or installing an upgraded version, there is something cathartic about jumping on the Linux bandwagon and hacking away on a new system. Although Linux by nature is more secure than Windows, there are still steps that need to be...

The Federal Bureau of Investigations (FBI) has arrested a man for renting out portions of the Xtreme DDoS-for-hire service to conduct distributed denial of service attacks. On 9 December, the FBI arrested and charged Sean Sharma, a 26-year-old graduate student at the University of Southern California, for launching a DDoS attack against the San...

There are a lot of great benefits to a connected car like the new Toyota Highlander: increased integration, a more comfortable driving experience and personalized controls, just to name a few. However, with increased computing power comes increased risk that hackers could take control of a car remotely, causing it to speed up, turn off, or turn...

2016 was a busy year for ransomware. Some samples targeted critical infrastructure, while others went after rival crypto-malware families. Some adopted new techniques to prey upon users, whereas others went offline entirely. Hundreds if not thousands of ransomware families now dominate the playing field. But they're not all created equal. Here are 10...

U.S. law enforcement has arrested a man on charges that he helped orchestrate hacking attacks against JPMorgan Chase and other financial institutions. On 14 December, FBI agents arrested Joshua Samuel Aaron, also known as "Mike Shields," at John F. Kennedy International Airport. BBC News reports that Aaron had been living in Russia as a fugitive. He...

To convey language, the computing industry relies on American Standard Code for Information Interchange (ASCII), or 7-bit binary numbers used to depict every letter, number, and special character. ASCII doesn't allow for the straightforward representation of Unicode, or all the characters and symbols which factor into the computing industry's...

In January 2017, note-taking app Evernote is set to introduce a new privacy policy that introduces machine learning features. The privacy policy has got many users hot under the collar, fearful that some Evernote employees will be able to read their notes. There is no option to opt-out. While we...

Researchers believe the BlackEnergy group launched malware attacks against the Ukrainian financial sector in the second half of 2016. ESET malware researcher Anton Cherepanov says the malware attacks started off with spear-phishing emails. Attached to the messages were Microsoft Excel documents containing malicious macros as an initial infection...

Vacuums, refrigerators and thermostats – OH MY! Take a stroll through the homewares section of your favorite store and you are likely to find that nearly all home appliances lighting, and thermostats have a “smart” model or feature. Such is the reality of the Internet of Things (IoT). With two IT professionals in our household, we run it a bit...

In the course of working with our clients to improve their security posture, I have come across several common themes that often limit a business's ability to assess and mitigate cyber security risk. Let's take a look at some of these themes and real-world examples of how they apply. You can't secure it if... You Don't Know It's There As wireless...

In the past, Osiris was mostly known as an Egyptian god of the afterlife, the underworld, and the dead. Now it's known as the latest extension of the Locky ransomware menace, as its creators decided to switch from a Norse mythology theme to an Egyptian one. .osiris Locky Gets Better at Avoiding Detection No user wants to see the .osiris file...

User Behavior Analytics. Network threat detection. The increasing focus on using security data analytics to extract insight and find or predict ‘bad’ has brought with it an influx of marketing promising close-to-magical results. Among the offenders are those machine learning products suggesting data can be thrown at an algorithm and – voila! –...

IT professionals are instrumental to strengthening an organization's digital security. They must fulfill a variety of duties to work towards that end. One of their most important responsibilities is helping their company detect and respond to data breaches. But there's a problem. Most information security personnel are overconfident in their...

Today’s VERT Alert addresses 12 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-703 on Wednesday, December 14th. Ease of Use (published exploits) to Risk Table Automated Exploit Easy ...