Blog

Blog

Tor: FBI Paid Carnegie Mellon $1 Million to Expose Users

According to the Tor Project, the FBI paid researchers at Carnegie Mellon University to launch an attack on the service last year in an effort to expose some of its users. The anonymizing service has written a blog post about its findings: "The Tor Project has learned more about last year's attack by Carnegie Mellon researchers on the hidden...
Blog

Security 101 for CEOs

There are important security lessons for CEOs following the embarrassing revelation that a teenager hacked into the personal email accounts of CIA Director John Brennan and Homeland Security Secretary Jeh Johnson. This isn't the first nor will it be the last time that people hack into accounts using a variety of techniques; it illustrates the...
Blog

Three Men Indicted in 2014 JP Morgan Hack

On Tuesday, a federal court charged three men with having hacked JP Morgan Chase back in 2014, a breach that resulted in the theft of 83 million people's personal information. The 23-count indictment unsealed by the United States District Court Southern District of New York indicts three men--two Israeli citizens and an American citizen--on charges...
Blog

VERT Threat Alert: November 2015 Patch Tuesday Analysis

Today’s VERT Alert addresses 12 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-643 on Wednesday, November 11th. Ease of Use (published exploits) to Risk Table Automated Exploit Easy ...
Blog

TLS Extended Master Secret Extension: Fixing a Hole in TLS

Few Internet technologies are relied upon as heavily as TLS/SSL, yet it has been widely known for years that this fundamental security protocol does not do enough to effectively protect communications. The most visible failing of TLS is the reliance on public key infrastructure (PKI) in which every certification authority (CA) becomes a potential...
Blog

The Security Mindset: The Key to Success in the Security Field

What does it take to succeed as an information security professional? There are many paths to a successful infosec career, many top jobs in the industry, and many different types of people can excel in the field. Indeed, diversity is fundamental to good security. To be effective, security requires contributions from people of different backgrounds...
Blog

Searching The Deep Web and The Unmapped Internet

Some think it’s where sexual deviants access child pornography or where devoted drug users go to purchase their substance of choice; others see it quite differently as a marketplace completely void of personal information – the first of its kind. On the "deep web" lies the Silk Road. It’s an anonymous online market, a place few have visited. That...
Blog

Running the IoT Hack Lab @ SecTor

I’ve attended a number of conferences, and each event always comes with its unique responsibilities. If I go as an attendee, I’m generally taking notes to share information; if I go as a speaker, I’m on stage at some point talking; and if I go to help marketing, I’m at our booth shaking hands and explaining what Tripwire VERT does. All of these are...
Blog

New Ransomware Strain Targets Websites Powered by Linux OS

A security firm has uncovered a new strain of ransomware that is seeking to extort money from websites powered by the Linux operating system. On Thursday, Russian antivirus company Dr. Web added the malware, known as "Linux.Encoder.1," to its virus database. A description of the ransomware was created the following day: "Once launched with...
Blog

What Happens to Hacked Social Media Accounts

We read about hacks of social media accounts all the time, but what’s the point of it? How can someone benefit from hacking a personal social media account, especially a non-celebrity, when there are so many other things to hack? Go steal from a bank or something, right? This article is going to look at a few reasons why a social media account is...
Blog

Woman Cheated Out of $825 After Posting Photo of Winning Ticket to Facebook

A woman has lost $825 she won betting on the 2015 Melbourne Cup after she posted a photo of herself holding the winning ticket on Facebook. According to The Daily Mail, a woman named Chantelle placed a $20 bet on the 100-to-1 shot Prince of Penzance at this year's Melbourne Cup, Australia's most prestigious Thoroughbred horse race. "I've never bet...
Blog

Down But Never Out: Security Parallels from the 2015 World Series

In the early morning hours of Monday, November 1st, the Kansas City Royals won the 2015 major league baseball World Series. To be sure, the team secured its championship against the expectations of most. In the fifth game, the Royals trailed behind the New York Mets 0-2. Everyone expected that the Mets would win, but then things changed. At the top...
Blog

DarkHotel APT Employs Just-in-Time Decryption of Strings to Evade Detection

For decades, the field of computer security has evolved as a cat-and-mouse game between security researchers and malware authors. When the former devises new methods to detect malicious programs, the latter incorporates into their software dormant functionality scenarios and a variety of other evasive techniques – four of which are now particularly...
Blog

OmniRAT - the $25 way to hack into Windows, OS X and Android devices

Just last week, police forces across Europe arrested individuals who they believed had been using the notorious DroidJack malware to spy on Android users. Now attention has been turned on to another piece of software that can spy on communications, secretly record conversations, snoop on browsing histories and take complete control of a remote...
Blog

ProtonMail Suffers 'Extremely Powerful' DDoS Attack

ProtonMail, a Switzerland-based encrypted email service, recently suffered an "extremely powerful" distributed denial-of-service (DDoS) attack that has temporarily knocked it offline. On Tuesday, ProtonMail tweeted out that it was experiencing a DDoS attack and that it anticipated some of its...
Blog

Beware the Cyber Blind Spots

A blind spot is defined as “an area where a person's view is obstructed.” As a longstanding professional in the industry, seeing the rhetoric change over the years, from Information Security, through Information Assurance and now to “cyber security,” what is occurring is the creation of a significant and worrying blind spot. Sadly, what people...
Blog

Mainframe Insecuritites or Hack the Gibson. No, Really!

You can hack a toaster, a TV and a car... but a mainframe? Isn’t everything on Windows and Linux? Who still uses mainframes (specifically IBM’s flagship System Z running Z/OS)? They’re obsolete, specialized and cumbersome, just like the stuff that runs on them: TSO, JES, Walker, CICS, VTAM, MVS, IMS. And they’re pretty much sequestered from all the...
Blog

The TalkTalk Breach: Timeline of a Hack (UPDATED 11/25/15)

The UK telecommunications provider TalkTalk has made headlines in recent weeks following a breach against its website. Initially, the incident was believed to have compromised the personal and financial information of as many as four million TalkTalk customers. However, these estimates have since been revised as a result of an ongoing investigation...