My boyfriend works a demanding day job at a major Canadian big box furniture and appliance retailing chain. Knowing that I write about information security for a living, he had an interesting story to tell me: "An LG Smart TV was returned to us by the customer, and it had their credit card credentials in it! Why didn't they do a factory reset first...

There are numerous ways to redirect a user to an exploit kit. Some of these methods are quite sophisticated. Take pseudo-Darkleech, for instance. This attack campaign injects malicious code into WordPress core files. That code creates a malicious iframe that redirects the user to a landing page for an exploit kit. In so doing, the campaign builds...

A new ransomware-as-a-service (RaaS) called Satan is attracting amateur computer criminals on the dark web with free licenses. Once a user creates an account for Satan and logs in, they can use the provided affiliate console to customize their ransomware campaign. The criminal can use the "Malwares" page, for instance, to specify Satan's ransom...

Some digital threats are more serious than others but when it comes to unpatched software, nothing's worse than an exploit kit. These software packages come preprogrammed with the ability to exploit active security issues on vulnerable computers. If they find one such hole agape, they'll use their exploit code to download ransomware and other...

According to new research, three in four (76 percent) organizations report being victims of phishing attacks. The findings indicate a 10 percent decrease from 2015. The third annual State of Phish report by Wombat Security analyzed data from tens of millions of simulated phishing emails over 12 months, in addition to 500 survey responses from...

Supercell, a mobile game development company, has urged users to reset their passwords following a breach that affected its forum. An administrator for the firm, which has produced popular multiplayer games like Clash of Clans and Clash Royale, announced the incident on 17 January: "We're currently looking into report that a vulnerability allowed...

Adobe is no stranger to finding itself in the security headlines for all the wrong reasons, and it seems that things may not be changing as we enter 2017. There was controversy earlier this month when news broke about how Adobe took the opportunity on Patch Tuesday of using its regular security updates to force Adobe Acrobat DC users into silently...

In the course of working with our clients to improve their security posture, I have come across several common factors that often limit a business's ability to assess and mitigate cyber security risk. Last month, we looked at a few of these themes and some real-world examples of how they apply. Let's now take a look at a few more. You can't secure...

In modern times, it is possible for an attacker to persistently and repeatedly hijack a victim's bank account at most major US banks through the victim visiting a web page. This is done without browser exploits or any visible warning. For a criminal, these attacks are cheap and highly successful. The attack that I am talking about is DNS hijacking....

A fired IT employee demanded his former employer pay him 200,000 USD in exchange for the return of its sensitive information. Triano Williams hired attorney Calvita J. Frederick to represent him in a dispute involving the American College of Education, an Indianapolis-based online provider of Master's and Doctorate degrees in teaching at which he...

15 January 2017 was yet another treat for me. I watched the most excellent Benedict Cumberbatch playing the part of the brilliant yet crazed Sherlock Holmes. Granted, this is an imaginative and fictitious portrayal of the character created by Arthur Conan Doyle. But I am wondering, if you also watched it, did you note the crossover from fiction to...

It’s January again, and as usual, various media outlets are busy reporting on vulnerability statistics from the previous year. As usual, the CVE Details folks have worked up a lot of hype based on CVE counts, and once again, the media has taken the bait with sensational headlines about Google’s Android being the most vulnerable product of 2016. For...

Back in the spring of 2015, I wrote about five types of social engineering attacks against which users should protect themselves. One of the techniques I discussed is called pretexting. It's when an attacker creates a pretext, or a fabricated scenario, to trick a target. Attackers will assume any pretense to achieve their nefarious ends. Some of...

A Dutch website builder leveraged a secret script to steal 20,000 users' login credentials, hack their accounts, and commit payment fraud. On 17 January, police in the northern Netherlands announced they're contacting 20,000 users with the advice that they change their passwords as soon as possible. This move comes several months after the world...

The ever-fickle world of pop culture has seen a resurgence of interest in Sherlock Holmes in the last five years. Fresh re-imaginings of the detective residing at 221B Baker Street have come both to the big screen and small to varying degrees of critical acclaim. Robert Downey Jr.’s version premiered in 2009, while Benedict Cumberbatch’s modern...

Another year has gone by...but "123456" still remains the most common password employed by users to protect their web accounts. On 13 January, password manager and digital vault developer Keeper Security broke the somber news in a blog post: "Looking at the list of 2016’s most common passwords, we couldn’t stop shaking our heads. Nearly 17 percent...

Implicit deny and explicit allow were two core fundamentals from the start of the information security discipline. However, as the scale and complexity of infrastructures grew, it became evident the list of things we should allow is exponentially smaller than the list of things we should deny. Say "no" to everything unless it is known to be good....

The digital world is riddled with threat actors of which we know very little. Some of these mysterious agents launch one or two modest attacks and peter out soon after crawling their way into existence. Others last a bit longer, raising hubbub and gaining notoriety in the process. Not a lot of actors make it into the latter category without the...

A targeted email campaign used a fake Microsoft Silverlight update to trick users into installing a keylogger onto their computers. Overall, the attack campaign consisted of only a few malicious emails sent to employees at a major financial services provider. Each email bore a Microsoft Office document as an attachment--an attack vector seen in...

On November 17, 2016, the security community witnessed the resurgence of a familiar enemy. That's the day when Shamoon 2, the successor of an attack campaign which first emerged in 2012, delivered Disttrack wiper malware to an organization based in Saudi Arabia. True to its design, Disttrack spread through the company's network and overwrote the...