The Myth of Consumer-Grade Security

The Department of Justice wants access to encrypted consumer devices but promises not to infiltrate business products or affect critical infrastructure. Yet that's not possible, because there is no longer any difference between those categories of devices. Consumer devices are critical...

Who Owns Your Wireless Service? Crooks Do.

Incessantly annoying and fraudulent robocalls. Corrupt wireless company employees taking hundreds of thousands of dollars in bribes to unlock and hijack mobile phone service. Wireless providers selling real-time customer location data, despite repeated promises to the contrary. A noticeable uptic...

DHS Warns Small Airplanes Vulnerable to Flight Data Manipulation Attacks

What could be more horrifying than knowing that a hacker can trick the plane's electronic systems into displaying false flight data to the pilot, which could eventually result in loss of control? Of course, the attacker would never wish to be on the same flight, so in this article, we are going t...

DHS Warning: Small Aircraft are Ripe for Hacking

The Department of Homeland Security issued an alert Tuesday warning that small aircraft are vulnerable to hackers that can gain physical access to a plane. It warned that a hacker can easily manipulate aircraft telemetry data, which can result in loss of control of the airplane. The bulletin was...

Fearing WannaCry-Level Danger, Enterprises Wrestle with BlueKeep

The nightmare vision of a “mega-worm” global BlueKeep infection could be closer to becoming reality as working exploits are now becoming available to the public, and there’s evidence that adversaries are actively scanning for the vulnerability. Researchers weighed in with Threatpost about how...

Siemens Contractor Pleads Guilty to Planting 'Logic Bomb' in Spreadsheets

A former Siemens contractor has pledged guilty in federal court Friday to secretly planting code in automated spreadsheets he had created for the company over a decade ago that deliberately crashes the program every few years. David Tinley, a 62-year-old resident of Harrison City, Pennsylvania, w...

Siemens Contractor Pleads Guilty to Planting 'Logic Bomb' in Spreadsheets

A former Siemens contractor has pledged guilty in federal court Friday to secretly planting code in automated spreadsheets he had created for the company over a decade ago that deliberately crashes the program every few years. David Tinley, a 62-year-old resident of Harrison City, Pennsylvania, w...

Science Fiction Writers Helping Imagine Future Threats

The French army is going to put together a team of science fiction writers to help imagine future threats. Leaving aside the question of whether science fiction writers are better or worse at envisioning nonfictional futures, this isn't new. The US Department of Homeland Security did the same thi...

U.S. Dept Of Defense: [████████] Boolean SQL Injection (/personnel.php?content=profile&rcnum=*)

In this report, I want to describe a dangerous SQL injection, with the help of which I was able to extract certain data from the database. I used the insights from this report 648222. Using the bug from the aforementioned report, I could find this endpoint and done SQL injection. Steps to reprodu...

U.S. Dept Of Defense: [███████] Reflected GET XSS (/mission.php?...&missionDate=*)

I will combine this vulnerability with this vulnerability described in this report 648222. If you have not read this report, I recommend reading that report first, and then studying this report. I want to note that this report cannot be closed as a duplicate to the above described report. why?...

Facebook to Pay $5 Billion Fine to Settle FTC Privacy Investigation

After months of negotiations, the United States Federal Trade Commission FTC has approved a record $5 billion settlement with Facebook over its privacy investigation into the Cambridge Analytica scandal. The settlement will put an end to a wide-ranging probe that began more than a year ago and...

Youzer - Fake User Generator For Active Directory Environments

Fake User Generator for Active Directory Environments Introduction The goal of Youzer is to create information rich Active Directory environments. This uses the python3 library 'faker' to generate random accounts. pip3 install faker You can either supply a wordlist or have the passwords generated...

The Latest Julian Assange Indictment Is an Assault on Press Freedom

By invoking the Espionage Act against Julian Assange, the Justice Department will effectively put national security journalism on trial...

Beers with Talos Ep. #53: Shiny happy election security (and ninjas)

Beers with Talos BWT Podcast Ep. 53 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded May 10, 2019 — Election security has been a dominant headline for some time, so it’s high time we take a look at what th...

Sim swapping hackers charged with stealing $2.5m worth of crypto

By Uzair Amir These hackers are part of the group called "The Community." According to an announcement made by the U.S. Department of Justice DoJ, six men have been charged for SIM swapping fraud that resulted in the theft of nearly $2.5 million $2,416,352 worth of cryptocurrency. The six men are...

Philips Tasy EMR (Update A)

1. EXECUTIVE SUMMARY --------- Begin Update A Part 1 of 7 --------- CVSS v3 4.3 ATTENTION: Low skill level to exploit --------- End Update A Part 1 of 7 --------- Vendor: Philips Equipment: Tasy EMR --------- Begin Update A Part 2 of 7 --------- Vulnerability: Cross-site Scripting, Information...

Evil TeamViewer Attacks Under the Guise of the U.S. State Department

UPDATE A targeted, email-borne attack against embassy officials and government finance authorities globally is making use of a malicious attachment disguised as a top-secret U.S. document. It weaponizes TeamViewer, the popular remote-access and desktop-sharing software, to gain full control of th...

Coalfire participates in cybersecurity disaster exercise at the 2019 HSCC Spring Summit

The Healthcare and Public Health Sector Coordinating Council HSCC conducted their biannual Joint Cybersecurity Working Group JCWG All-Hands Meeting on April 3-4, 2019. As a member of HSCC, Coalfire participated in the JCWG meeting with other security leaders from across the healthcare industry an...

A "Department of Cybersecurity"

Presidential candidate John Delaney has announced a plan to create a Department of Cybersecurity. I have long been in favor of a new federal agency to deal with Internet -- and especially Internet of Things -- security. The devil is in the details, of course, and it's really easy to get this wron...

North Korea's Hidden Cobra Strikes U.S. Targets with HOPLIGHT

A never-before-seen spyware variant called HOPLIGHT is targeting U.S. companies and government agencies in active attacks, according to the U.S. Department of Homeland Security. In an advisory this week, the United States Computer Emergency Readiness Team US-CERT said that there are nine differen...