In our previous article, we started to lay out some important social engineering terms, such as phishing, spear-phishing and pretexting. We even introduced to you what we call “Potentially Unwanted Leaks” (PUL) as tidbits of information that, when out in the wild, become valuable nuggets to be used against you in a social engineering attack. This...

The damage done to a business's reputation and the long-term financial consequences of a data breach are never a concern that should be treated lightly. While extending an existing database into the cloud can allow users to access sensitive files and information with far greater ease, failing to address potential security concerns or underlying...

"123456" has once again topped an annual list of the worst passwords created by users in North America and Western Europe. On 19 December, password management provider SplashData released the 2017 edition of its "Worst Passwords of the Year" list. The dataset comprises five million leaked passwords exposed by data security incidents over the course...

It was late Friday afternoon when the email arrived saying he’d won a free cruise. Philip quickly opened the email and clicked the link for more information, but there was nothing there. What he didn’t know is that this cruise offer actually came from a hacker and not Cruise Giveaways of America. This was no ordinary link, either. That link...

A Bitcoin exchange has announced it has filed for bankruptcy and will cease all operations after suffering its second hacking attack this year. On 19 December, South Korean exchange Youbit announced at 04:35 local time that bad actors had hacked its website and stolen 17 percent of its assets in the process. BBC News reports that the hackers didn't...

Last time, I spoke with Jelena Milosevic. She's a nurse who discovered a huge security problem in her hospital and is now on a mission to educate people about improving medical cybersecurity. This time, I spoke with Stephanie Vanroelen. Not only is she an OWASP contributing web security specialist, but she also volunteers at a camp that teaches...

It seems like everyday you see a new report about a massive data leak caused by someone accidentally exposing files stored in AWS S3 Buckets to everyone on the Internet. Many may remember Verizon’s infamous snafu that leaked data records for six million of their customers due to a misconfiguration in their S3 buckets. Since then, there have also...

An oil transportation company discovered someone had installed Monero-mining software on its systems without its authorization. On 14 December, Vladimir Rushailo, vice president of the Russian state-owned transport monopoly Transneft, revealed that the company had found that one of its computers had automatically downloaded software designed to mine...

We want more of the CIA Triad. No, this has nothing to do with the US government agency. It stands for “confidentiality, integrity, and availability.” What it alludes to is the idea of protecting access to privileged information (confidentiality), asserting that the information hasn’t been tampered with (integrity), and that the information can be...

A new attack framework known as "Triton" is targeting industrial control systems (ICS) in an attempt to cause operational disruption and/or physical consequences. FireEye recently detected an incident at a critical infrastructure organization in which an attacker gained access to a Distributed Control System (DCS) that allows human operators to...

The media has been filled with news of identity theft, hacks, and other security woes as of late. In recent months, Uber was hacked, people had their financial information stolen by credit card skimmers, and one woman lost $59,000 to a fake police website. Such incidents cause people’s stomachs to churn. They wonder how to keep their data secure and...

A first pass look at the issue of net neutrality might not immediately bring to mind concerns around cybersecurity, but we shouldn’t ignore the logical security implications of fundamentally reclassifying the Internet. Let’s level set a little bit, for net neutrality doesn’t appear to be a simple issue for most, but it’s actually not that...

No-one responsible for computer security should forget what happened in October 2016. The Mirai botnet launched an attack on the internet, the scale of which had never been seen before. By unleashing a massive distributed denial-of-service (DDoS) attack on DNS service company Dyn, Mirai managed to knock out significant chunks of the internet -...

Compliance with NERC regulations begin with defining your organization’s policies, promoting them in the workplace, and reinforcing positive efforts. A key takeaway to transforming your compliance philosophy into a culture of compliance is by standardizing processes to meet requirements and engaging everyone to participate. Success begins with an...

A new ransom-based email scam campaign is demanding that all recipients either meet the sender's demands and pay up or die. On 11 December, Spiceworks user Dave Lass shared the campaign with other members of the professional IT industry network. The scam doesn't waste any time in attempting to frighten the recipient. It begins with the subject line ...

On 11 May 2017, President Donald Trump signed an executive order that provides guidance on strengthening the United States' digital security. The directive makes clear that each head of a U.S. federal agency or government department is ultimately responsible for managing their organization's risk. It also emphasizes their use of a specific document...

Today’s VERT Alert addresses the Microsoft December 2017 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-756 on Wednesday, December 13th. In-The-Wild & Disclosed CVEs This month, no Microsoft vulnerabilities have been publicly disclosed or are being actively exploited. There are, however, a...

Vulnerability Description A team of researchers, including Tripwire VERT’s Craig Young has announced that TLS stacks from at least 8 different vendors are vulnerable to a well-known 19-year-old protocol flaw. The problem is that these implementations allow an attacker to identify whether or not a chosen ciphertext has proper PKCS#1 v1.5 padding...

The National Capital Poison Center (NCPC) in Washington, DC has published notice of a ransomware attack it suffered back in 2017. According to the news release (PDF), the critical health resource detected a ransomware infection on its systems in October 2017. It then launched an investigation into the matter with the assistance of a third-party...