Trending Now
LATEST
Episode 110 – Review of Black Hat, Defcon, and the effect of security policies
Josh and Kurt talk about Black Hat and Defcon and how unexciting they have become. What happened with hotels at Defcon, and more importantly how many security policies have 2nd and 3rd level effects we often can't foresee. We end with important...
ISC StormCast for Monday, August 20th 2018
Fragmentsmack Summary https://isc.sans.edu/forums/diary/Back+to+the+90s+FragmentSmack/23998/HP Does Not Release Patches for Non-Windows Users
6 reasons gamification improves cybersecurity training
Experts suggest using gaming as a framework to bolster cybersecurity training for employees. Find out why.
How to manage cloud security when providers and customers share responsibility
Who is responsible for cloud security: The service provider or the customer? Many people view it as a shared-responsibility relationship. Here are best practices for managing that relationship.
Botnet of smart air conditioners and water heaters could bring down the power grid
If smart appliances that can be remotely controlled over the internet were to be compromised and used in a botnet, then attackers could cause local power outages or even large-scale blackouts, according to a presentation given by Princeton University...
Make a Wish: Dark Reading Caption Contest Winners
Certification, endpoint security, 2FA, phishing, and PII were among the themes and puns offered by readers in our latest cartoon caption competition. And the winners are ...
Stealthy ad fraud campaign evades detection. — Research Saturday
Researchers at Bitdefender have been tracking a bit of complex rootkit malware called Zacinlo that they suspect has been operating virtually undetected for over six years. Bogdan Botezatu is a senior cyber security analyst with Bitdefender, and he describes...
Facebook Messenger backdoor demand, bail in Bitcoin, and lots more
If you're not already suffering from Black Hat/DEF CON overload Roundup It's time for another rapid roundup of computer security news beyond what we've already reported.…
Release the Edge – Paul’s Security Weekly #571
This week, our very own Larry Pesce delivers the Technical Segment on Spoofing GPS with a hackRF! In the Security News, Hacking Police Bodycams, Adobe execution flaws, Google expands to Bug Bounty Program, and if you live in Australia,...
Apache Releases Security Updates for Tomcat Native
Original release date: August 17, 2018The Apache Foundation has released security updates to address vulnerabilities in Apache Tomcat Native. A remote attacker could exploit these vulnerabilities to take control of an affected server.NCCIC encourages users and administrators to review...
SentinelOne makes YouTube delete Bsides vid ‘cuz it didn’t like the way bugs were reported
Research silenced amid copyright, trademark claim Updated If you were at BSides Manchester in England this week, you hopefully caught James Williams' presentation on the shortcomings of some commercial antivirus tools.…
‘Oh sh..’ – the moment an infosec bod realized he was tracking a cop car’s movements by its leaky cellular gateway
Internet boxes blab coordinates on login pages Black Hat If you want to avoid the cops, or watch deliveries and call-outs by trucks and another vehicles in real-time, well, there's potentially not a lot stopping you.…
Researchers Find New Fast-Acting Side-Channel Vulnerability
A group of researchers from Georgia Tech have discovered a method for pulling encryption keys from mobile devices without ever touching the phones, themselves.
Malicious Cryptomining & Other Shifting Threats
Skybox Security CMO Michelle Johnson Cobb discloses research results that include a spike in malicious cryptomining during Bitcoin's peak, a shift to outside-the-perimeter mobile threats, and more.
The Economics of AI-Enabled Security
While AI greatly enhances security, Securonix CTO Tanuj Gulati points out the need for predictable cost models that insulate SOCs from the variables of massive data volume and intense real-time processing.
Election risks—hacking and influence. Chinese industrial espionage spike. Misconfigured project management. Necurs appears briefly. Bogus Fortnite downloads. What they heard in the banya.
In today's podcast we run through a brief guide to election risks, and the difference between hacking and influence operations. An Alaskan trade mission prompts a wave of Chinese industrial espionage. Misconfigured project management pages may have exposed Canadian...
Using Threat Deception on Malicious Insiders
Illusive Networks CEO Ofer Israeli reveals how distributed deception technology can be as effective against insider threats as it is against outsiders, since it thwarts the lateral movement common to both.
Filtering the Threat Intelligence Tsunami
Reversing Labs CEO Mario Vuksan contends that SOCs are overwhelmed by global threat intelligence, and can benefit more from a targeted "pull" model that focuses on YARA-type binary pattern matching.
Indian Bank Hit in $13.5M Cyberheist After FBI ATM Cashout Warning
On Sunday, Aug. 12, KrebsOnSecurity carried an exclusive: The FBI was warning banks about an imminent “ATM cashout” scheme about to unfold across the globe, thanks to a data breach at an unknown financial institution. On Aug. 14, a bank...
Cyber Security Requires A New Approach
The recent boom in cyber crime means it is no longer a problem reserved for IT departments. It’s now a responsibility for the entire organisation – from C-level executives to those in marketing and sales, everyone must work together...
7 Signs You Have Malware and How to Get Rid of It
Is your PC acting strange? Look for these signs you have malware, but don't freak out if it turns out that you do. Our tips can help you get rid of it.
Ensuring Web Applications Are Hardened, Secure
Ofer Maor of Synopsys Software Integrity Group describes how automated testing can non-intrusively pinpoint where developers may be inadvertently exposing data and/or violating compliance mandates.
Microsoft: 5 tips for developers to reduce malware false positives
Digitally signing files and keeping a good reputation are among the best practices Microsoft lays out for developers.
Marap Malware Appears, Targeting Financial Sector
A new form of modular downloader packs the ability to download other modules and payloads.
Building Security into the DevOps Pipeline
As companies pump more code into production at a faster pace, CA Veracode VP of Security Research Chris Eng stresses the importance of avoiding vulnerabilities by building security directly into the DevOps pipeline.
LEADERS
Indian Bank Hit in $13.5M Cyberheist After FBI ATM Cashout Warning
On Sunday, Aug. 12, KrebsOnSecurity carried an exclusive: The FBI was warning banks about an imminent “ATM cashout” scheme about to unfold across the globe, thanks to a data breach at an unknown financial institution. On Aug. 14, a bank...
SuperProf private tutor site massively fails password test, makes accounts super easy to hack
Superprof, which claims to be “the world’s largest tutoring network”, has made its newest members’ passwords utterly predictable… leaving them wide open to hackers.
Apple hacked by 16-year-old who “dreamed” of working for firm
An Australian teenager has admitted hacking into Apple’s internal network and stealing 90 GB worth of files. The 16-year-old has pleaded guilty to breaking into Apple’s systems on multiple occasions over the course of a year, from his...
New Ways to Track Internet Browsing
Interesting research on web tracking: "Who Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies:
Abstract: Nowadays, cookies are the most prominent mechanism to identify and authenticate users on the Internet. Although protected by the Same Origin...
Weekly Update 100
Presently sponsored by: Netsparker - dead accurate web application security scanning solution - Scan websites for SQL Injection, XSS & other vulnerabilitiesMade it to 100! And by pure coincidence, it aligned with the week where I've tuned out more...
