New Call to Regulate IoT Security By Design

A Washington, D.C. think tank whose mission is critical infrastructure security has joined the call for lawmakers to consider regulating the security of connected devices. In a report published this week, the Institute for Critical Infrastructure Technology pinned the blame for a rash of Mirai...

IoT Botnets Are The New Normal of DDoS Attacks

If you’ve been on the wrong end of what passes for a modern-day DDoS attack, you’re well familiar with the firepower of the almighty DVR. That’s right, the innocuous set-top box responsible for the posterity of your Game of Thrones seasons 1-6 is behind some of the biggest swarming attacks agains...

Locky Ransomware Distributed Via DOCM Attachments in Latest Email Campaigns

Throughout August, FireEye Labs has observed a few massive email campaigns distributing Locky ransomware. The campaigns have affected various industries, with the healthcare industry being hit the hardest based on our telemetry, as seen in Figure 1. Figure 1. Top 10 affected industries Numerous...

Locky Ransomware Distributed Via DOCM Attachments in Latest Email Campaigns

Throughout August, FireEye Labs has observed a few massive email campaigns distributing Locky ransomware. The campaigns have affected various industries, with the healthcare industry being hit the hardest based on our telemetry, as seen in Figure 1. Figure 1. Top 10 affected industries Numerous...

Microsoft Security Intelligence Report: Top Takeaways

Microsoft’s Security Intelligence Report painted a bleak picture when it comes to malware, fraudulent login attempts and the staying power of really old exploits. Key findings in the 198-page biannual report run the gamut illustrating how old threats die hard and what new threats are on the...

Polyvore: Fashion Trends Style - Customized SSL, Redefined SSL Common Names verifier, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Polyvore: Fashion Trends Style published at the 'play' market has multiple vulnerabilities...

Dekoideen - Deko, Trends & DIY - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Dekoideen - Deko, Trends & DIY published at the 'play' market has multiple vulnerabilities...

Exploit Writing and Exploit Mitigation

More and more white hats who practice offensive security and exploit writing are simultaneously talking about exploit mitigation. Granted, some are incentivized to do so by their employers or six-figure rewards programs, but the trend nonetheless is moving away from finding and fixing individual...

youtube-trends.blogspot.co.nz XSS vulnerability

Vulnerable URL: http://youtube-trends.blogspot.co.nz/search?q=%3C/script%3E%3Cscript%3Ealert%28%27+XSSPOSED%27%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 17.05.2016 Latest check for patch:| 17.05.2016 17:48 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

youtube-trends.blogspot.fr XSS vulnerability

Vulnerable URL: http://youtube-trends.blogspot.fr/search?q=%3C/script%3E%3Cscript%3Ealert%28%27+XSSPOSED%27%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 17.05.2016 Latest check for patch:| 17.05.2016 17:44 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

youtube-trends.blogspot.mx XSS vulnerability

Vulnerable URL: http://youtube-trends.blogspot.mx/search?q=%3C/script%3E%3Cscript%3Ealert%28%27+XSSPOSED%27%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 17.05.2016 Latest check for patch:| 17.05.2016 17:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

youtube-trends.blogspot.com.uy XSS vulnerability

Vulnerable URL: http://youtube-trends.blogspot.com.uy/search?q=%3C/script%3E%3Cscript%3Ealert%28%27+XSSPOSED%27%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 17.05.2016 Latest check for patch:| 17.05.2016 17:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

youtube-trends.blogspot.com.ng XSS vulnerability

Vulnerable URL: http://youtube-trends.blogspot.com.ng/search?q=%3C/script%3E%3Cscript%3Ealert%28%27+XSSPOSED%27%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 17.05.2016 Latest check for patch:| 17.05.2016 17:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

Social Media Mining: MassMine

MassMine is a social media mining and archiving application that simplifies the process of collecting and managing large amounts of data across multiple sources. It is designed with the researcher in mind, providing a flexible framework for tackling individualized research needs. MassMine is...

Report from the PCI SSC North American Community Meeting

The Payment Card Industry Security Standards Council held their 2015 North American Community Meeting this year in Vancouver, BC, from September 29 - October 1. Coalfire was well represented at the meeting, with Dan Fritsche, Managing Director, Application Security, making two presentations at th...

2015 Verizon Data Breach Investigations Report DBIR

The 2015 Verizon Data Breach Investigations Report DBIR did some mythbusting on two fronts: the estimated cost per record lost in a breach is much lower than reported elsewhere; and mobile malware is a no-go. The DBIR is Verizon’s annual data dump collected from breaches it has investigated, alon...

Microsoft Privacy Policy Promises No Targeted Advertisements

In a series of revisions to its services agreement, Microsoft says it will not scan the contents of its users’ files nor will it monitor their communications in order to target advertising based on perceived customer interests. The move is a dramatic one when contrasted with many of the Redmond,...

Microsoft Identifies New Malware Dropping Sefnit Botnet

Plenty has been written about the Sefnit malware family and its favor with using Tor to mask communication, as well as the money it’s made for criminals via click-fraud schemes. Sefnit, however, has had a pair of accomplices that until recently were regarded as harmless programs by most security...

SEC Roundtable

On Wednesday, I attended a roundtable discussion the Securities and Exchange Commission held to gather information on cybersecurity trends and potential disclosure requirements for regulated public companies and stock exchanges...

Threat Outbreak Alert: Fake Bank Loan Information Email Messages on February 17, 2014

Medium Alert ID: 32887 First Published: 2014 February 17 17:07 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain loan information for the recipient. The text in the email message attempts to convince the recipient to open...