Following the recent attacks against DYN (and Krebs, OVH and others) by the Merai botnet, there has been chatter about ‘hacking back’ as a means of active defense. If you missed the story or aren’t really sure what happened, there’s a good video on it here from Threatwire to get you up to speed but, […]
Additional information on Friday’s massive DDoS against DYN (affecting sites like Twitter, Reddit, Amazon and more)
The Internet is just coming back to life after a massive DDoS attack against Internet Performance Management company DYN on Friday. The attack affected a number of high profile sites including Twitter, Reddit and Amazon as well as thousands of smaller sites that use DYN’s services. Details are still a bit sketchy but most are […]
Vecrypt v1.19 released and fixes multiple low, medium and critical risk vulnerabilities
The open-source encryption software and successor to Truecrypt Veracrypt has been updated to v1.19 to address vulnerabilities discovered in a recently completed code audit. The update addresses all critical, medium and low-risk vulnerabilities and workarounds have been provided for those vulnerabilities not yet addressed. The audit was completed against Veracrypt v1.18 and was completed on […]
Massive DDoS against high profile websites highlight flaws in IoT
The Internet of Things (IoT) is the nickname / moniker that’s been given to the now prolific network of ‘smart’ and ‘connected’ devices like thermostats, cameras, DVRs, toasters, refrigerators and the like making their way into homes and businesses across the planet. It’s made the news quite a bit lately (so much that the IoT […]
Seagate employees sue after tax data exposed in phishing attack
Many of you may remember the previous post regarding the phishing attack at Seagate where an employee, responding to a phishing email that claimed to be from the CEO, forwarded the W-2 ‘and other data’ to an attacker. According to this article from the Inquirer, a number of affected employees have now filed a class […]
WhatsApp contradicts its previous position and will now serve ads
WhatsApp is a chat platform that built it’s brand on privacy and strong security. In 2014, they were acquired by Facebook for $22 billion (WhatApp generated about $0.03 per user in revenue, Facebook paid about $55 per user in the deal) but subscribers were assured that this was a good thing and that the privacy […]
Vulnerability Assessment or Penetration Test, which do I need (and why)?
When I meet people and tell them what we do (I usually lead with ‘Offensive Security’, that seems to be a real conversation starter), the conversation almost always ends up going something like “What is a vulnerability assessment, what is a penetration test, do I need one and, if so, which one do I need?” […]
Insider breach at Sage and potentially exposed on-premise Sage servers
Insider breach may have led to unauthorized access to UK customer data According to this article at Data Breach today, Sage UK accounts may have been affected by an insider breach. British police arrested a 32 year old woman at Heathrow Airport on suspicion of conspiracy to defraud and confirm that the woman is currently […]
Cisco patches vulnerability from Shadow Brokers breach
According to this article from ThreatPost and this one from The Register, we’re already starting to see the first trickle of patches resulting from the Shadow Brokers. Looking at the information available though, this doesn’t look too bad (so far). Some important things that jumped out to me about the Cisco vulnerability (there’s also a […]
Social Engineering, what is it and why is it important?
What is Social Engineering? Once again, the Social Engineering Capture The Flag (SECTF) competition at DEF CON was a huge success. Social Engineering (SE) is is basically hacking the human element in an organization, tricking the victim into giving the attacker sensitive information about the target. Attacking the human allows an attacker to bypass the […]