If, on Tuesday, you find yourself in San Francisco, with access to RSA, then I know how you should spend your time from 1PM PST. Alex Cox, Ken Westin, and I will be introducing our panel: Killing the Kill Chain: Disrupting the Cyber Attack Progression. Instead of talking about how you can preemptively stop an attack, we plan to show you. With Ken...

A new dark web market has appeared, focused on the selling of 0-day exploit code. The market is called "TheRealDeal Market," and although still in its infancy, there are already a few exploits listed. One exploit claims to target the recent MS15-034 Microsoft IIS Remote Code Execution vulnerability and comes with reverse shell and research...

Modern organizations that depend on SaaS have been increasingly adopting Identity Providers or single sign-ons (SSOs) in order to federate authentication back to home directory services. Most SSOs support SAML or OAuth, and a growing number of SaaS companies are jumping on board to eliminate the liability of storing customer password hashes....

According to a collection of leaked Sony emails and documents, the popular television show Doctor Who is projected to be made into a Hollywood blockbuster in the next few years. In a leaked email sent to Sony Pictures Entertainment chief executive Michael Lynton, president of international production Andrea Wong reveals that she spoke to Danny Cohen...

The Verizon 2015 Data Breach Investigations Report has always had a conversational, quirky style to share some pretty technical information about the security breach data it analyzes. So if you’re wondering what Prince has to do with vulnerability management, just know that when you read the full report, you’ll understand – a lot of song titles are...

Numbers, statistics, pie charts and survey results are everywhere – especially in the information security space. Nevertheless, have you ever finished reading a vendor whitepaper or a research institution’s annual security report and the data presented just made your spidey sense tingle? You are probably sensing a manipulation of statistics, an age...

Network Forensics is a branch of Digital Forensics that deals with the capture, storage and analysis of network traffic. Incident handlers working on computer incident response and security operations teams around the world engage in this type of analysis in order to answer the “Five Ws” in relation to incidents: [W]ho did it? [W]hat happened? ...

In the first installment of this blog post, I took you through how I completed level 1 of Tripwire Vulnerability and Exposure Research (VERTs) Capture the Flag contest. Now, I’ll show you how I finished level 2 and successfully completed the challenge.Level 2Going to the link above results in a registration page (pictured below), which requires a...

We have seen a number of nation-states beginning to use black hat hacking tools and espionage tactics in an effort to steal intellectual property from corporations, target retailer customer databases, and monitor the electronic communications of entire national populations for terrorist threats. This development, as well as the risk of cyber attacks...

A computer espionage gang has sent a rival advanced persistent threat (APT) group a spear phishing email in what might be the first reported instance of an APT-on-APT attack. In February of last year, Naikon, one of the most active APT groups in the Asian region, launched a spear phishing email campaign. Another APT group, Hellsing, was one of its...

Today’s VERT Alert addresses 11 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-610 on Wednesday, April 15th. MS15-032 Multiple Memory Corruption Vulnerabilities in Internet Explorer MULTIPLE Internet Explorer ASLR Bypass...

The Android operating system has overthrown the mobile ecosystem, and has taken no prisoners. You can barely walk down the street these days, without seeing consumers completely glued to the screens of their devices. This is the age of instant, unadulterated access to the Internet, email, music and social networking. And Android has become that...

Reading through the Verizon Data Breach Investigations Report (aka DBIR), the amount of information about last year's breaches is daunting. Let's look at one category of the report—Phishing. Teach a man to phish? Why did I focus on phishing? Because it is on the mind of a lot of CISOs these days. As we know, quite a few high-profile breaches have...

Verizon’s annual Data Breach Investigations Report (DBIR), published since 2008, has become one of the most anticipated information security industry reports. Think of it as the Data Breach Bible, as it dissects thousands of confirmed data breaches and security incidents from around the globe into emergent and shifting trends, providing us with...

There has been a dramatic increase in the attention paid to the information security field due, in part, to a number of high-profile breaches. There is a much higher level of concern over what information security means, what it provides and how to approach it. The field has graduated from fringe awareness to bad mainstream TV dramas. This growth...

Tripwire's Vulnerability and Exposure Research Team (VERT) set up a three­ and ­a ­half day Capture the Flag (CTF) contest, where over 100 people from the academic community (mostly students, but more generally, people "affiliated with an educational institution") competed in exploiting two vulnerable web applications. The idea of a CTF is that...

Earlier this week, I talked to the director of security at a Fortune 500 company. The company recently suffered a breach caused by malware. This news is not earthshattering; virtually every large organization has been hacked at one time or another, with malware being a top culprit. What is surprising, though, is the company’s drastic response to the...

Last week, Tripwire explored the story of Lance Ealy, a computer criminal who filed more than 150 fake tax refund requests, some of which he completed via the use of stolen Social Security numbers, back in 2013. We now report on the story of Timothy Lance Lai, a former private tutor who was arrested in the fall of 2014 for having helped some of his...

Security researchers have identified flaws in a specific ransomware encryptor that allow victims to decrypt their files without having to pay in 70% of cases. The encryptor, known as Trojan-Ransom.Win32.Scraper, was first detected in an attack against Japanese users on October 24, 2014. Along with CTB-Locker, it marks a new generation of ransomware...

Detecting and preventing malicious software from executing on critical systems has received a lot of attention in the information security industry lately. Being able to detect new applications, drivers and files is what Tripwire Enterprise excels at. However, there are quite a few options for a motivated attacker to take advantage of built in...