Bug Bounties: An Overview of Their Past, Present, and Future

Bug bounties, security acknowledgements, and reward programs all have strong ties to IT security today. But that wasn’t always the case. In the past, public penetration testers and security researchers mostly looked out for their personal benefit without recognizing their own responsibility to the security community. The reason? In a lot of cases, the consultants […]… Read More

The post Bug Bounties: An Overview of Their Past, Present, and Future appeared first on The State of Security.

from Bug Bounties: An Overview of Their Past, Present, and Future

4 Things Birdwatching Can Teach About Security Awareness

Sometimes you find inspiration in unlikely places. Never did I think, for example, that I would be able to connect my day job as a writer in the security awareness field with a burgeoning hobby of mine: birdwatching. But the more I “bird,” the more what I learn about birdwatching—both in the field and from […]… Read More

The post 4 Things Birdwatching Can Teach About Security Awareness appeared first on The State of Security.

from 4 Things Birdwatching Can Teach About Security Awareness

Information Security Events For May

Here are information security events in North America this month:   IEEE International Symposium on Hardware Oriented Security and Trust (HOST 2017) : May 1 to 5 in McLean, VA, USA   BigSecurity 2017 : May 1 to 4 in Atlanta, GA, USA   CSO50 Security Confab 2017 : May 1 to 3 in Scottsdale, [...]

The post Information Security Events For May appeared first on Infosec Events.

from Information Security Events For May

Week 17 In Review – 2017

Resources  Probable-Wordlists - github.com Wordlists sorted by probability originally created for password generation and testing VM escape - QEMU Case Study - www.phrack.org Virtual machines are nowadays heavily deployed for personal use or within the enterprise segment. Network security vendors use for instance different VMs to analyze malwares in a controlled and confined environment. Vulnerabilities [...]

The post Week 17 In Review – 2017 appeared first on Infosec Events.

from Week 17 In Review – 2017

Netflix and Orange is the New Black Are Being Held for Ransom

Netflix has been asked to pay an unspecified amount in ransom. Un-aired episodes of the show, Orange is the New Black (OTNB) is the hostage. This time it’s personal: I wait months for the new season and I don’t want any spoilers. I met Jenji Kohan’s husband, Chris Noxon, years ago at a marketing conference […]

The post Netflix and Orange is the New Black Are Being Held for Ransom appeared first on Bromium.

from Netflix and Orange is the New Black Are Being Held for Ransom

Book Review: Bitcoin and other virtual currencies for the 21st Century by J. Anthony Malone

A very handy book to approach Bitcoin.Let me try to share with you the main learning points I collected from this book. As always, here it goes my personal disclaimer: the reading of this very personal and non-comprehensive summary by no means replaces...

from Book Review: Bitcoin and other virtual currencies for the 21st Century by J. Anthony Malone

R⁶ — Using pandoc from R + A Neat Package For Reading Subtitles

Once I realized that my planned, larger post would not come to fruition today I took the R⁶ post (i.e. “minimal expository, keen focus) route, prompted by a Twitter discussion with some R mates who needed to convert “lightly formatted” Microsoft Word (docx) documents to markdown. Something like this: to: This is definitely a job... Continue reading →

from R⁶ — Using pandoc from R + A Neat Package For Reading Subtitles

Can Blockchain Technology Secure Your Vote?

Once I realized that my planned, larger post would not come to fruition today I took the R⁶ post (i.e. “minimal expository, keen focus) route, prompted by a Twitter discussion with some R mates who needed to convert “lightly formatted” Microsoft Word (docx) documents to markdown. Something like this: to: This is definitely a job... Continue reading →

from Can Blockchain Technology Secure Your Vote?

Hacker holds Netflix to ransom over ‘Orange is the New Black’

A hacker claims to have released the new series of the hit prison TV show “Orange is the New Black” onto the internet, after Netflix failed to agree to pay an undisclosed ransom.

Read more in my article on the We Live Security blog.

from Hacker holds Netflix to ransom over ‘Orange is the New Black’

ShadowBrokers Leak: A Machine Learning Approach

During the past few weeks I read a lot of great papers, blog posts and full magazine articles on the ShadowBrokers Leak (free public repositories: here and here) released by WikiLeaks Vault7.  Many of them described the amazing power of such a too...

from ShadowBrokers Leak: A Machine Learning Approach

KNOW before NO

I recently posted the below on the SANS Internet Storm Center.

A good friend told me that an engaged information security professional is one who leads with the KNOW instead of the NO. This comment struck me and has resonated well for the last several years. It has encouraged me to better understand the desires of the business areas in an attempt to avoid the perception of being the "no police”. 

We are each able to recognize the value in sprinkling in the information security concepts early and often into software development projects. This approach saves each of the stakeholders a great deal of time and frustration. Especially when compared to the very opposite approach that often causes the information security team to learn at the very last minute of a new high profile project that is about to launch without the proper level of information security engagement.

There are certainly projects and initiatives that may very well still warrant a “no” from an information security perspective. Before we go there by default, I respectfully invite us all to KNOW before we NO. I truly believe that each of us can all improve the level of engagement with our respective business areas by considering this approach. In what areas can you KNOW before you NO next week?

Please leave what works in the comments section below.

Russell Eubanks

from KNOW before NO

Friday Squid Blogging: Live Squid Washes up on North Carolina Beach

A "mysterious squid" -- big and red -- washed up on a beach in Carteret County, North Carolina. Someone found it, still alive, and set it back in the water after taking some photos of it. Squid scientists later decided it was a diamondback squid. So, you think that O'Shea might know the identity of the squid Carey Walker found...

from Friday Squid Blogging: Live Squid Washes up on North Carolina Beach

FTC Says Identity Theft Victims Don’t Always Need a Police Report

Victims of identity theft don’t always need to file a police report, explains the Federal Trade Commission (FTC) in an alert. In an effort to help simplify the recovery process for identity theft victims, the FTC has created a government portal at IdentityTheft.gov. Victims just need to register with this page and answer some questions. […]… Read More

The post FTC Says Identity Theft Victims Don’t Always Need a Police Report appeared first on The State of Security.

from FTC Says Identity Theft Victims Don’t Always Need a Police Report

Working with Autism in Application Security

Gender disparities in STEM fields are a widespread and persistent problem.  Last month, some of my female coworkers hosted a webinar and sparked some discussion about these issues in application security.  It coincided with a great article in The Atlantic about the same thing, so it’s good that the community is devoting attention to diversity […]

The post Working with Autism in Application Security appeared first on WhiteHat Security.

from Working with Autism in Application Security

Working with Autism in Application Security

Gender disparities in STEM fields are a widespread and persistent problem.  Last month, some of my female coworkers hosted a webinar and sparked some discussion about these issues in application security.  It coincided with a great article in The Atlantic about the same thing, so it’s good that the community is devoting attention to diversity […]

The post Working with Autism in Application Security appeared first on WhiteHat Security.

from Working with Autism in Application Security

Threat Round-up for Apr 21 – Apr 28

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 21 and April 28. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

• Doc.Macro.MaliciousHeuristic-6298845-0
  Office Macro
  Office macro code is used to further compromise a target system. Macros can leverage external system binaries to execute other binaries to further compromise the system. This signature looks for code associated with hiding the core functionality by including junk code.
   
• Win.Dropper.DarkComet-6301230-0
  Trojan/RAT dropper
  This is a malware dropper. It currently drops the DarkComet RAT. The file is a slightly modified version of wextract.exe, a legitimate Windows tool to unpack archives. The malware payload is stored in the resource section of the binary. The dropper binary is actually a multi-format file, and can be interpreted both as a PE executable as well as a cab archive. The modified Windows binary will extract the payload binary from itself and run the extracted file.
   
• Win.Trojan.ServStart
  Trojan
  ServStart is a trojan that installs a persistent service on the victim’s machine. The service exfiltrates information about the infected computer including machine name, username, keyboard language, and computer performance specifications. The malware server can respond with commands to download and execute files, or execute shell commands. ServStart has been observed using multiple dynamic DNS providers for its command and control infrastructure.
   
• Win.Trojan.Agent-6298180-0
  Trojan (credential stealer)
  This sample attempts to collect stored credentials from a number of installed applications and then attempts to transmit those credentials back to a PHP application on a possibly compromised server.
   
• Win.Trojan.PWS-6299789-0
  Password stealer, injector
  PWS (also known as Fareit or Chisburg) is a credential & sensitive information harvester. Select information such as banking credentials or web browser password databases are queried for on the infected host. Any discovered data is propagated to a C2. These recent samples are protected with the Armadillo packer & rely on both code injections & dropped VBScript code.
   
• Win.Dropper.Emotet-6301061-0
  Dropper
  This dropper is delivered through different mechanism, most of the time the victims is redirected to a website to get it through malicious pdf, http iframe injected. Once running on the computer the binary is gathering details on volume disk drive and other details, injecting process, dropping itself and contacting internet to execute more. Websites observed delivering ransomware and trojan banker.

---

Threats

Doc.Macro.MaliciousHeuristic-6298845-0

Indicators of Compromise

Registry Keys

• N/A

Mutexes

• N/A

IP Addresses

• N/A

Domain Names

• storefronts[.]pl

File Hashes

• 23b90b1c55fdbbd371655da0ccf359e891deb51ed5bbc0ac772c5d572f4b3a42
• 2471636a92daa0a54095aa66b55ad2fea5fd5d6372b0be9d65d1d1e2cef31bd5
• 2b24221aabc8cd18e756a579b29a005fc9c33213f5ec963b9b6ccf4e6187b23b
• 4b781b8370f973b9204b44c8ce3615692fc66c1613967a44924984d35fba7bc4
• 4ee6b9bb8e903bed9a82c7dad6d62163e3a4f759ade5f5f8fcf899945bfd9264
• 564c37dcd8322bd6e8cabc788f982a35f7d3e335c3d736ce544fc17a6b090183
• 59b54e7c4e052adbc1d64dc61623af6f55db1a8692b373cb6ca871ba087feaac
• 6930d456c506c94b9e19a08659181b7d376254dca652d0e56c305764867578d2
• 6a0eae0addd6ce84966ac1bd006e9582036eaaa1011a38190f700871cc37de24
• 7045d8f339cab73cf0ec7f31a7b3a31a84057f0b275f789f4bfed9dffee35564
• 7638745d08de218fa16e9c0828ed0a1139223d3ebddf4bb528bc3ae185cea90e
• 81cdded9aa21513ad9c6ae04455a7fce68129135f3358b9c5e28a80139e78f21
• 93472e054b4b4fcc54a71a32b6275f8b35c8ef84490248d21c094f19a537c773
• a0bfeb90468ddf50a3c85d5074e002b1d89995d6377eceeb0781ba5292facbcc
• b3dfdfcfea160ed34eb69da55909294f78d2b5a6320cbf5151a3da01c6449631
• c185559d0a38e782167beacff78a7a72544d82890b5e5723e6a25a70e6e16d59
• d2c1b89129e3e26544bfbef3fac4567c3629817a98ded9ce5c7dee485d0364a9
• f2e4fe273c4a8cc1cd7799d5558c58b8a08dfe160235dfa2eb2a8bad9bba40aa
• 02481825e922c38ba797ebc18d5a8273ede8c5a4d52eecd2f58eb569533d780b
• 06736e5f3127a54bbe6bb25f4a82ca95371e5cc8654a893c02d3d4e677e0b916
• 21b039f3171f26911290dad3e1ce0da6d6d3545e11f9a119408922ac2ae06db6
• 2643f9f8dce45983eac80feeebd16adbd498e3a644ef8b05bc40448be9342ddf
• 2ac6b5487c69427476b48bcbbddd7646842e02363a0d4ebe1b1998da6d1f55a8
• 2dad87b69ee91bfa71d911b791e5468efb6ce689ccc4cde3e91626cbfcfc14ab
• 2f4853b54c36adf9ca9fbb163dacedee78b6b027fac3c24c72120e9d8cc6f01e

Coverage

Detection Screenshots

AMP

ThreatGrid

Umbrella

Malware

---

Win.Dropper.DarkComet-6301230-0

Indicators of Compromise

Registry Keys

• N/A

Mutexes

• N/A

IP Addresses

• N/A

Domain Names

• N/A

File Hashes

• 05C8DE4B97737440913F5C714082AD647281FA50F1904B1BF11EDB8560294FAC
• 07D9D6DA8C6CD162DD9FC78AC48EAF82BC49D4239908AF354E44C4822FE06D62
• 099ADD24586D77C5F2B8EFB9C33A8A11B5A0C11001A8534D9635A674ADC260AD
• 0A155F4F20367E4D23B6D238208FA5F943A1341E47BDBB2DBC520CCB27AD120B
• 150420EDB4BF00DADCF71601781DBE3BD6E34CBA767153B9F82307EDDF391395
• 15F2BB3B4A12A6F5B0965FDE62AE21B2796D7659BBA8011FC22AF40D465984BE
• 318B2A4F06345E95C63E4623F52E0E7C57257548C74E0C7A272FCB64D3F49692
• 4B0BB06E09ED0B2EDB085641E125490E9B1A6CC5652C05C77C78E47CF9448D35
• 507874BA705282183F928D3AE11ED5497A0F1EAC3368DE75C392D17749CB8EE9
• 55FDFC65C0C10A958239E0447E5696989FE66557437EB725849BB578D882D74E
• 5D31C073C4B7322A7DE871D533D520DE2444466D0C944CB06F6244D2CE57D49D
• 6597E2DD82FC203BA2C609B358B2E0CAE37A4309808626DA27BD58614077D646
• 6A23031FDD70C6D57D8FE9C8D3EFE6A423C38BF2D46B9B24959E5CA7D0714FCA
• 6C652B0E4998456F150515EBF50CA569CF373BA709442F6909DD7D4330C83D2E
• 6EB12C46F0605D8F915C8E895FC70D189D9E8825775EBDB464A9A24834887E60
• 776B2679819B1E0385E1630EEEC50190DAAAEC0EEF9F659EE728C47991FABFBB
• 77FA104262E3FF983B3418540FF744E0EAAE5E66388333ED785EF6F5AA2801F9
• 7D6765A1F6589A554457D9363F702F65E81DDDA52EB62C600250E0F94C473A16
• 8590486CD299DAA9BF42497EF28028364E4E18B6C60B725736A7D2DDC73BBC2F
• 92EABA06563800BA670249E90D91C32F9D315889439BCAA73F24D2C08E285B84

Coverage

Detection Screenshots

AMP

ThreatGrid

---

Win.Trojan.ServStart

Indicators of Compromise

Registry Keys

• HKLM\SYSTEM\CONTROLSET001\SERVICES\NATIONALLWC\Description
  "Providesufl a domain server for NI security."

Mutexes

• Nationallwc

IP Addresses

• N/A

Domain Names

• syhaw1516.codns[.]com
• wrop0422.codns[.]com
• ansbase.9966[.]org

File Hashes

• fbbc6852ff1947fcd820b90e60ab71af93ffad079bd13a0d2b514955bb1c9d62
• 40eddfac964b69ee2e26742faaacfe50960fa0232a1b9a11c382e61cecd700ff
• 6106eda3ae39449fec42db2caf4f1b5f994d72b5a759dddfd77a8a29ebb3f497
• c106435a2aced27d03ee5531eda025b14cec106106a1c7ca750127090f6d2039
• 8d4366eff17da1c18ab3fed1692628756a8f41f3145877f895b7ef950055262f
• 3be7ab79f032cf24b09fc05b08544fd61ec7e3fd355f8ab7b4580eb43d8c3e55
• ff6b7320d6b75a638c0f2d024f43853dd78993276a8f6b5f7463d6317858dd9c
• c9a193d273f606860bee0dd4a878a6421233b05ac4c6faf357d9324f0d6a575a
• 932d8d5829570237e9ab7688dd2d3c03812a05157f72af124cabf530be583789
• ba07a79a2f4d51eaac585b0f50e3b1e61d8fc555592aadb1e5d3916fb26b0e27

Coverage

Detection Screenshots

AMP

ThreatGrid

Umbrella

---

Win.Trojan.Agent-6298180-0

Indicators of Compromise

Registry Keys

• N/A

Mutexes

• N/A

IP Addresses

• 212.129.14[.]211

Domain Names

• tranexestin[.]com

File Hashes

• afc3ba4941b89a4467e2f1a4ab0df2c88ef5e39264182a4b3a2dbbfa5b022e3f

Coverage

Detection Screenshots

AMP

ThreatGrid

Umbrella

---

Win.Trojan.PWS-6299789-0

Indicators of Compromise

Registry Keys

• USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
• \MACHINE\Software\Wow6432Node\Microsoft\Tracing
• \MACHINE\Software\Wow6432Node\Microsoft\Tracing\tmpVtFw4a_RASMANCS
• USER\S-1-5-21-2580483871-590521980-3826313501-500\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
• USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft
• USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
• USER\S-1-5-21-2580483871-590521980-3826313501-500\Software\Microsoft\Visual Basic\6.0
• \MACHINE\Software\Wow6432Node\Microsoft\Tracing\tmpVtFw4a_RASAPI32
• USER\S-1-5-21-2580483871-590521980-3826313501-500\Software
• USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History
• MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
• USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\MICROSOFT\Visual Basic
• USER\S-1-5-21-2580483871-590521980-3826313501-500\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2

Mutexes

• N/A

IP Addresses

• 92.53.96[.]120

Domain Names

• cv42569.tmweb[.]ru

File Hashes

• dddde27836842e0f950b5622e1be7a0f51072db573b2f2e41d20d4b4c45028d8
• dc086f745c35b2abe58675e546b475ed64f15ea6e9d4492a0502476f784ea85c
• 97cd05c529002b85ae756a9e7b7da7a538026583f0886a235cf48b72c378551a
• 2992c6ce7ccda6fef751a912eafb8a31e3426bde8964ccf31b0512390bd61615

Coverage

Detection Screenshots

AMP

ThreatGrid

Umbrella

---

Win.Dropper.Emotet-6301061-0

Indicators of Compromise

Registry Keys

• N/A

Mutexes

• N/A

IP Addresses

• 188.165.220[.]214

Domain Names

• N/A

File Hashes

• f566fdc382f6988599cb16894d8a9a92e291d83574834de705d6367b520b6b50
• dda1fffa38e3f9d30833d201b542422aed15a41253b2a72797ad38dfba8fe535
• 6d4fa878e2930cb3bedc2078855f6d7db7b6b136464f6dff256d8c62657b505f
• 8ad1c1655d6d3b2a4931ae2dd9eb4e3b7be488a7f39b9c396fe1eeda2eda05a7
• c0e8a92ba6ce12d803ecfccd01432f855e6fd9ad19825602a74a081459e25389
• 5598fdcc6c0c2e7bdb095193a5f986e6cf22fdcca26c2e8451c46d787ef18435

Coverage

Detection Screenshots

AMP

ThreatGrid

Umbrella

from Threat Round-up for Apr 21 – Apr 28

NSA stops controversial program that searches Americans’ emails

The government's surveillance court previously warned the National Security Agency (NSA) that searching Americans' emails and text messages that were collected domestically would not be constitutional.

from NSA stops controversial program that searches Americans’ emails

Friday Squid Blogging: Live Squid Washes up on North Carolina Beach

A "mysterious squid" -- big and red -- washed up on a beach in Carteret County, North Carolina. Someone found it, still alive, and set it back in the water after taking some photos of it. Squid scientists later decided it was a diamondback squid.

So, you think that O'Shea might know the identity of the squid Carey Walker found on the Portsmouth Island Beach, just by looking at an emailed photo or two? Indeed, he did. After a couple of days of back-and-forth emails -- it can be difficult to connect consistently with a world-famous man who lives now in Australia -- he reported that, while unusual to be seen on beaches in our parts, this was not a particularly unusual squid: It was a diamondback squid, known in scientific nomenclature as Thysanoteuthis rhombus.

T. rhombus, also known as the diamond squid or diamondback squid, is a large species that grows to about 100 centimeters in length, which translates to about 39 inches, and ranges in weight from 20 to 30 kilograms, which translates to 44 to 50 pounds. Which means that, if nothing else, Carey Walker is pretty good at estimating the weight and length of big red squids he picks up on remote beaches.

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

Read my blog posting guidelines here.

from Friday Squid Blogging: Live Squid Washes up on North Carolina Beach

Jumping Airgaps with a Laser and a Scanner

Researchers have configured two computers to talk to each other using a laser and a scanner.

Scanners work by detecting reflected light on their glass pane. The light creates a charge that the scanner translates into binary, which gets converted into an image. But scanners are sensitive to any changes of light in a room­ -- even when paper is on the glass pane or when the light source is infrared -- which changes the charges that get converted to binary. This means signals can be sent through the scanner by flashing light at its glass pane using either a visible light source or an infrared laser that is invisible to human eyes.

There are a couple of caveats to the attack -- the malware to decode the signals has to already be installed on a system on the network, and the lid on the scanner has to be at least partially open to receive the light. It's not unusual for workers to leave scanner lids open after using them, however, and an attacker could also pay a cleaning crew or other worker to leave the lid open at night.

The setup is that there's malware on the computer connected to the scanner, and that computer isn't on the Internet. This technique allows an attacker to communicate with that computer. For extra coolness, the laser can be mounted on a drone.

Here's the paper. And two videos.

from Jumping Airgaps with a Laser and a Scanner

BYOD – Bring Your Own Disaster

Today’s business landscape is constantly evolving, presenting new opportunities and challenges like the migration to public and private clouds, the never-ending wider roll-out of mobility and BYOD programs, and all of the new cyberthreats designed to exploit these technologies. At the RSA conference this year in San Francisco, Checkpoint decided to find out what cyber […]

The post BYOD – Bring Your Own Disaster appeared first on Netswitch Technology Management.

from BYOD – Bring Your Own Disaster

NSA ends controversial program that searches Americans’ emails

The government's surveillance court previously warned the National Security Agency (NSA) that searching Americans' emails and text messages that were collected domestically would not be constitutional.

from NSA ends controversial program that searches Americans’ emails

Tallinn Cyber Security Conference 2017, Adrian Davis’ ‘Closing Keynote’

Permalink

from Tallinn Cyber Security Conference 2017, Adrian Davis’ ‘Closing Keynote’

Tallinn Cyber Security Conference 2017, Adrian Davis’ ‘Closing Keynote’

Permalink

from Tallinn Cyber Security Conference 2017, Adrian Davis’ ‘Closing Keynote’

2017 Verizon DBIR Highlights: Analyzing the Latest Breach Data in 10 Years of Incident Trends

10 years and counting! Such is the milestone of Verizon’s 2017 Data Breach Investigations Report (DBIR). Like in years past, the 10th version of Verizon’s research initiative highlights new patterns, evolving trends, and interesting findings in the information security field. It does so by synthesizing reports that Verizon received of discovered security incidents and breaches, […]… Read More

The post 2017 Verizon DBIR Highlights: Analyzing the Latest Breach Data in 10 Years of Incident Trends appeared first on The State of Security.

from 2017 Verizon DBIR Highlights: Analyzing the Latest Breach Data in 10 Years of Incident Trends

New OSX.Dok malware intercepts web traffic

Most Mac malware tends to be unsophisticated. Although it has some rather unpolished and awkward aspects, a new piece of Mac malware, dubbed OSX.Dok, breaks out of that typical mold. Categories: Mac Threat analysis Tags: AppleDokument.zipmacmacOSmalwareOSX.Dokphishing (Read more...)

The post New OSX.Dok malware intercepts web traffic appeared first on Malwarebytes Labs.

from New OSX.Dok malware intercepts web traffic

Jumping Airgaps with a Laser and a Scanner

Researchers have configured two computers to talk to each other using a laser and a scanner. Scanners work by detecting reflected light on their glass pane. The light creates a charge that the scanner translates into binary, which gets converted into an image. But scanners are sensitive to any changes of light in a room­ -- even when paper is...

from Jumping Airgaps with a Laser and a Scanner

News in brief: Kashmir blocks social media; ‘whaling’ victims revealed; TalkTalk GDPR fine ‘would be £59m’

Your daily round-up of some of the other stories in the news

from News in brief: Kashmir blocks social media; ‘whaling’ victims revealed; TalkTalk GDPR fine ‘would be £59m’

Low Risk Threat: DDoS Extortion Letters

Summary Adversaries calling themselves the Lizard Squad have been sending businesses extortion letters, demanding payment in bitcoin to prevent a Distributed Denial of Service (DDoS) or other attack against their applications. These letters have been sent to businesses across the...

from Low Risk Threat: DDoS Extortion Letters

Low Risk Threat: DDoS Extortion Letters

Summary Adversaries calling themselves the Lizard Squad have been sending businesses extortion letters, demanding payment in bitcoin to prevent a Distributed Denial of Service (DDoS) or other attack against their applications. These letters have been sent to businesses across the...

from Low Risk Threat: DDoS Extortion Letters

Stealing Browsing History Using Your Phone's Ambient Light Sensor

There has been a flurry of research into using the various sensors on your phone to steal data in surprising ways. Here's another: using the phone's ambient light sensor to detect what's on the screen. It's a proof of concept, but the paper's general conclusions are correct:

There is a lesson here that designing specifications and systems from a privacy engineering perspective is a complex process: decisions about exposing sensitive APIs to the web without any protections should not be taken lightly. One danger is that specification authors and browser vendors will base decisions on overly general principles and research results which don't apply to a particular new feature (similarly to how protections on gyroscope readings might not be sufficient for light sensor data).

from Stealing Browsing History Using Your Phone's Ambient Light Sensor

Analytics, AI and Orchestration are Top New Security Topics

from Analytics, AI and Orchestration are Top New Security Topics

Will Congress Help Fund New State and Local Cyber Programs?

from Will Congress Help Fund New State and Local Cyber Programs?

What Makes Passwords Secure?

On average, each person has 27 online logins and passwords. They protect our bank accounts, our social media, our phones, and more. Passwords are the keys that unlock our digital lives. But what makes them so secure, and how can you make sure your passwords are doing a good job of protecting your information and […]… Read More

The post What Makes Passwords Secure? appeared first on The State of Security.

from What Makes Passwords Secure?

The Security Weaknesses of Smartphones

Introduction Our last article started off our series upon the Security weaknesses and vulnerabilities which are found on wireless devices, especially those of Smartphones. As it was discussed, the... Go on to the site to read the full article

from The Security Weaknesses of Smartphones

SonarQube: A Hidden Gem

SonarQube is an open source quality management software that analyzes and measures the technical quality of project portfolio to a method which essentially means that it helps analyze the quality of... Go on to the site to read the full article

from SonarQube: A Hidden Gem

At HPE, Strong AES FF1 Crypto and NIST Standards Matter

What happened – what is the NIST announcement? On April 12th, 2017, the National Institute of Standards and Technology (NIST) announced a cryptanalytic attack on the AES FFX Format-preserving Encryption (FPE) mode FF3, and as a result, NIST may revise Special Publication 800-38G, the document that specifies approved AES FFX FPE modes. The good news […]

The post At HPE, Strong AES FF1 Crypto and NIST Standards Matter appeared first on HPE Security - Data Security.

from At HPE, Strong AES FF1 Crypto and NIST Standards Matter

OpenStack User Survey Indicates Growth in Most Sectors

Although there might be something of a red flag in user satisfaction, the platform continues to dominate the private cloud. read more

from OpenStack User Survey Indicates Growth in Most Sectors

OpenStack User Survey Indicates Growth in Most Sectors

Although there might be something of a red flag in user satisfaction, the platform continues to dominate the private cloud. read more

from OpenStack User Survey Indicates Growth in Most Sectors

Interesting Facts on Data Breaches

The 2017 Data Breach Investigations Report by Verizon was just recently published and it contains a few interesting data points: 75% of the breaches were conducted by outsiders. So, the outsider threat is by far bigger than the insider. However, if you would assume breach, you kind of kill both attacks with one approach 51%…

from Interesting Facts on Data Breaches

Antbleed, The Bitcoin Backdoor

Catalin Cimpanu writing at Bleeping Computer, regales us with the tale of Antbleed, a newly discovered tidbit...

from Antbleed, The Bitcoin Backdoor

Tallinn Cyber Security Conference 2017, ‘Panel Discussion, Klaid Mägi, Siret Schutting, Amar Singh, Adrian Davis and Joseph Carson’

Catalin Cimpanu writing at Bleeping Computer, regales us with the tale of Antbleed, a newly discovered tidbit...

from Tallinn Cyber Security Conference 2017, ‘Panel Discussion, Klaid Mägi, Siret Schutting, Amar Singh, Adrian Davis and Joseph Carson’

News in brief: Cassini dives into Saturn’s rings; Mexican pirate site move; Twitter under fire from spooks

Your daily round-up of some of the other stories in the news

from News in brief: Cassini dives into Saturn’s rings; Mexican pirate site move; Twitter under fire from spooks

Is my microwave watching me? Top 5 steps to ensure it’s not

I confess, I am drawn to any device that promises to make my life easier. My first experience with what we now call the Internet of Things (IoT) was a few years ago, when I bought a number of internet-connected lightbulbs. The feeling I had  turni...

from Is my microwave watching me? Top 5 steps to ensure it’s not

Sucuri Firewall Dashboard Update

If you are a customer of ours, you may have noticed the recent updates we’ve made to our dashboard. These changes enhance your ability to manage the Sucuri Firewall and view detailed reports on the attacks being blocked from accessing your site. The dashboard has a new layout that improves both navigatio, clarity and usability if the product.

If you’re not familiar with our firewall, it’s a cloud-based Website Application Firewall (WAF) and Intrusion Prevention System (IPS).

Continue reading Sucuri Firewall Dashboard Update at Sucuri Blog.

from Sucuri Firewall Dashboard Update

The State of Mobile App Performance

In our previous blog, we saw how a new generation of users are increasing the expectations of a mobile app like never before and identified the three key success criteria for mobile apps: 1) increase customer conversions, 2) drive installs...

from The State of Mobile App Performance

Microsoft Migrates Windows 10 Technical Documentation to their new Docs Portal

In order to provide a more responsive experience across various screen sizes, Microsoft is slowly migrating content from their TechNet Library site. read more

from Microsoft Migrates Windows 10 Technical Documentation to their new Docs Portal

TCG to Demonstrate IoT and Network Security Solutions at InterOp ITX May 16-18, 2017

PORTLAND, ORE. April 27, 2017 — Trusted Computing Group (TCG) and members will demonstrate standards-based solutions for the Internet of Things and network security at the May Interop ITX conference and exhibits (@Interop) in Las Vegas. TCG members CoSoSys, Mocana, OnBoard Security and Tempered Networks will show a variety of solutions in booth #234 in the Interop Business … Continue reading "TCG to Demonstrate IoT and Network Security Solutions at InterOp ITX May 16-18, 2017"

The post TCG to Demonstrate IoT and Network Security Solutions at InterOp ITX May 16-18, 2017 appeared first on Trusted Computing Group.

from TCG to Demonstrate IoT and Network Security Solutions at InterOp ITX May 16-18, 2017

Discovery of 8,800 servers sends warning to Asian cybercriminals

Move shows the importance of international co-operation to take down cybercrime at its roots

from Discovery of 8,800 servers sends warning to Asian cybercriminals

Reading Analytics and Privacy

Interesting paper: "The rise of reading analytics and the emerging calculus of reading privacy in the digital world," by Clifford Lynch:

Abstract: This paper studies emerging technologies for tracking reading behaviors ("reading analytics") and their implications for reader privacy, attempting to place them in a historical context. It discusses what data is being collected, to whom it is available, and how it might be used by various interested parties (including authors). I explore means of tracking what's being read, who is doing the reading, and how readers discover what they read. The paper includes two case studies: mass-market e-books (both directly acquired by readers and mediated by libraries) and scholarly journals (usually mediated by academic libraries); in the latter case I also provide examples of the implications of various authentication, authorization and access management practices on reader privacy. While legal issues are touched upon, the focus is generally pragmatic, emphasizing technology and marketplace practices. The article illustrates the way reader privacy concerns are shifting from government to commercial surveillance, and the interactions between government and the private sector in this area. The paper emphasizes U.S.-based developments.

from Reading Analytics and Privacy

Hack the US Air Force, and make cash… legally!

Humans make mistakes, and vulnerabilities can creep into projects unspotted. The more trusted eyes checking a service – with the approval of the systems’ owners – the better.

Read more in my article on the We Live Security blog.

from Hack the US Air Force, and make cash… legally!

Smashing Security #018: Windows is a virus. True or False?

Security firm Webroot drops a clanger when it declared Windows was malicious and borked customers' PCs, millennials are streaming a lot of movies illegally, and blackmailers are targeting members of the Ashley Madison cheating site again. All this and ...

from Smashing Security #018: Windows is a virus. True or False?

Diving into the darknet

The deep web is often confused with the darknet and while the two have similarities, they are not synonymous. There is a very fine line between the deep and dark web.

from Diving into the darknet

Top Security Tips for your WordPress Website

Whenever you talk about WordPress security, every gig hands you a list of security plugins. My point of view and approach are different. I am not saying that using security plugins will not provide you efficient security. All I am saying is that only using security plugins will not completely secure your website. You have […]… Read More

The post Top Security Tips for your WordPress Website appeared first on The State of Security.

from Top Security Tips for your WordPress Website

Why We Need More Women in Cyber Security

Women currently represent only 11 percent of the cyber security workforce worldwide. This statistic is cause for alarm because it’s a key factor in the massive talent shortage that is impacting this crucially important field. It is estimated that, as of now, there are 1 million unfilled cyber security jobs—and that number is growing fast. This […]… Read More

The post Why We Need More Women in Cyber Security appeared first on The State of Security.

from Why We Need More Women in Cyber Security

A mysterious botnet has hijacked 300,000 devices, but nobody knows why

Researchers know what the botnet is capable of — but they don't seem to know what it'll actually do.

from A mysterious botnet has hijacked 300,000 devices, but nobody knows why

A mysterious botnet has hijacked 300,000 devices, but nobody knows why

Researchers know what the botnet is capable of — but they don't seem to know what it'll actually do.

from A mysterious botnet has hijacked 300,000 devices, but nobody knows why

Almost two million Androids infected by FalseGuide malware, masquerading as game guides

A malware family known as FalseGuide masqueraded as game guides on Google Play to infect nearly two million Android devices. David Bisson reports.

from Almost two million Androids infected by FalseGuide malware, masquerading as game guides

Unpatched mobiles and trojanized systems

Organizations provide their end-users means of connecting to internal network resources, typically laptops with specific operating systems under the control of IT. As technology advances, access may also be allowed also to mobile devices apart f...

from Unpatched mobiles and trojanized systems

Analyzing Cyber Insurance Policies

There's a really interesting new paper analyzing over 100 different cyber insurance policies. From the abstract:

In this research paper, we seek to answer fundamental questions concerning the current state of the cyber insurance market. Specifically, by collecting over 100 full insurance policies, we examine the composition and variation across three primary components: The coverage and exclusions of first and third party losses which define what is and is not covered; The security application questionnaires which are used to help assess an applicant's security posture; and the rate schedules which define the algorithms used to compute premiums.

Overall, our research shows a much greater consistency among loss coverage and exclusions of insurance policies than is often assumed. For example, after examining only 5 policies, all coverage topics were identified, while it took only 13 policies to capture all exclusion topics. However, while each policy may include commonly covered losses or exclusions, there was often additional language further describing exceptions, conditions, or limits to the coverage. The application questionnaires provide insights into the security technologies and management practices that are (and are not) examined by carriers. For example, our analysis identified four main topic areas: Organizational, Technical, Policies and Procedures, and Legal and Compliance. Despite these sometimes lengthy questionnaires, however, there still appeared to be relevant gaps. For instance, information about the security posture of third-party service and supply chain providers and are notoriously difficult to assess properly (despite numerous breaches occurring from such compromise).

In regard to the rate schedules, we found a surprising variation in the sophistication of the equations and metrics used to price premiums. Many policies examined used a very simple, flat rate pricing (based simply on expected loss), while others incorporated more parameters such as the firm's asset value (or firm revenue), or standard insurance metrics (e.g. limits, retention, coinsurance), and industry type. More sophisticated policies also included information specific information security controls and practices as collected from the security questionnaires. By examining these components of insurance contracts, we hope to provide the first-ever insights into how insurance carriers understand and price cyber risks.

from Analyzing Cyber Insurance Policies

A story of fonts by the EITest HoeflerText campaign

The HoeflerText campaign is known for a fake font download that delivers the Spora ransomware. But did you know it also uses special characters in the dropper's file name? Categories: Cybercrime Social engineering Tags: chromeeitestfonthoeflertextmalwareransomwareSpora Ransomware (Read more...)

The post A story of fonts by the EITest HoeflerText campaign appeared first on Malwarebytes Labs.

from A story of fonts by the EITest HoeflerText campaign

US Air Force asks hackers to do their worst

The military unit has joined the bug bounty movement following the success of the "Hack the Pentagon" competition.

from US Air Force asks hackers to do their worst

FIRST TC Amsterdam 2017 Wrap-Up

Here is my quick wrap-up of the FIRST Technical Colloquium hosted by Cisco in Amsterdam. This is my first participation to a FIRST event. FIRST is an organization helping in incident response as stated on their website: FIRST is a premier organization and recognized global leader in incident response. Membership

[The post FIRST TC Amsterdam 2017 Wrap-Up has been first published on /dev/random]

from FIRST TC Amsterdam 2017 Wrap-Up

Tallinn Cyber Security Conference 2017, Aleks Koha’s ‘Privacy as a Foundation for Your Security Perimeter’

Permalink

from Tallinn Cyber Security Conference 2017, Aleks Koha’s ‘Privacy as a Foundation for Your Security Perimeter’

Set Up Child Domain on Windows Server 2016

Karim Buzdar Extra domains make the network more complex to administer. In the past extra domains were created because of the limitations in creating a large number of obj...

from Set Up Child Domain on Windows Server 2016

Stealth Bomber maker admits hackers stole workers’ W-2 tax forms

US military contractor Northrop Grumman has admitted that hackers managed to infiltrate its systems, and gained access to sensitive employee records. Read more in my article on the Hot for Security blog.

from Stealth Bomber maker admits hackers stole workers’ W-2 tax forms

Do you know where your old email addresses are?

A big UK mobile provider is about to kill of a whole list of old email domains. We look at what can go wrong when old email addresses die.

from Do you know where your old email addresses are?

Recursive DNS – The Achilles Heel Of Advanced Threats

We all know what happens whenever anyone or anything tries to access a resource on the Internet. It all starts with a DNS request that translates a URL (www.akamai.com) into an IP address (104.97.77.24): Now if we dive a little...

from Recursive DNS – The Achilles Heel Of Advanced Threats

News in brief: celebs’ phone hacking settled; German court raps Facebook; Ashley Madison victims hit again

Your daily round-up of some of the other stories in the news

from News in brief: celebs’ phone hacking settled; German court raps Facebook; Ashley Madison victims hit again

Control Visibility of Windows Settings Pages in the Windows 10 Creators Update

Microsoft is now providing a new Group Policy in the latest feature update for Windows 10 that gives you control over what settings pages appear inside the Windows Settings app. read more

from Control Visibility of Windows Settings Pages in the Windows 10 Creators Update

“Fast and Furious 8: Fate of the Furious”

So "Fast and Furious 8" opened this weekend to world-wide box office totals of $500,000,000. I thought I'd write up some notes on the "hacking" in it. The tl;dr version is this: yes, while the hacking is a bit far fetched, it's actually more realistic ...

from “Fast and Furious 8: Fate of the Furious”

Making Sense of the General Data Protection Regulation (GDPR)

The upcoming GDPR compliance deadline of May 2018 affects any organization across the world that collects, processes, or stores data on citizens of the European Union. The intent behind the GDPR is to better protect the privacy of EU citizens, and the mechanism to do so is through harmonizing the existing data privacy laws across […]… Read More

The post Making Sense of the General Data Protection Regulation (GDPR) appeared first on The State of Security.

from Making Sense of the General Data Protection Regulation (GDPR)