NICER Protocol Deep Dive: Internet Exposure of etcd

Welcome to the NICER Protocol Deep Dive blog series! When we started researching what all was out on the internet way back in January, we had no idea we'd end up with a hefty, 137-page tome of a research report. The sheer length of such a thing might put off folks who might otherwise learn a thin...

[SECURITY] Fedora 33 Update: ceph-15.2.7-1.fc33

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage...

Fedora: Security Advisory for ceph (FEDORA-2020-a8f1120195)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Can Edge Computing Exist Without the Edge? Part 2: Edge Computing

In part 1 of this series, I drew the architectural distinction between a centralized cloud platform and a distributed edge network. This is an important foundation upon which to explain the difference between cloud computing and edge computing. The two serve very different and complementary...

[SECURITY] Fedora 32 Update: fossil-2.12.1-1.fc32

Fossil is a simple, high-reliability, distributed software configuration management with distributed bug tracking, distributed wiki and built-in web interface...

Fedora: Security Advisory for fossil (FEDORA-2020-50be892d25)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for fossil (FEDORA-2020-ac6cf99f87)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

A Look Ahead: 9 Cybersecurity Predictions for 2021

Following an unprecedented year, what’s to come for cybersecurity in 2021? The ripple effects of the global pandemic have created a new threat landscape. In March, 90% of CISOs we surveyed reported an increase in attack frequency. For many organizations, the key to survival amid COVID-19 has call...

[SECURITY] Fedora 32 Update: nodejs-12.18.4-1.fc32

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

JetBrains TeamCity Injection Vulnerability (CNVD-2021-09950)

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. An injection vulnerability exists in JetBrains...

Back from vacation: Analyzing Emotet’s activity in 2020

By Nick Biasini, Edmund Brumaghin, and Jaeson Schultz. Emotet is one of the most heavily distributed malware families today. Cisco Talos observes large quantities of Emotet emails being sent to individuals and organizations around the world on an almost daily basis. These emails are typically sen...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at the ISC² Security Congress 2020, November 16, 2020. I’ll be on a panel at the OECD Global Blockchain Policy Forum 2020 on November 17, 2020. The panel is called "Deep Dive: Digital Security and Distributed Ledger...

Denial of Service Vulnerability in Honeywell DCS C300 Controller (CNVD-2020-67880)

The CC-PCNT02 is a controller for Honeywell DCS C300 systems that supports Ethernet communication. A denial of service vulnerability exists in the Honeywell DCS C300 controller that can be exploited by an attacker to cause a denial of service...

[SECURITY] Fedora 31 Update: salt-3001.3-1.fc31

Salt is a distributed remote execution system used to execute commands and query data. It was developed in order to bring the best solutions found in the world of remote execution together and make them better, faster and more malleable. Salt accomplishes this via its ability to handle larger loa...

Corporate Office and Kitchen Table: Securing the Future of Work, Part 2

The workforce is remote, the data center is the cloud, the corporate network is the internet, and the security stack is at the edge. In Part 1, I focused on the future of work, the most obvious feature being that the workforce is even more distributed, even more remote. Employees expect to be abl...

[SECURITY] Fedora 32 Update: salt-3001.3-1.fc32

Salt is a distributed remote execution system used to execute commands and query data. It was developed in order to bring the best solutions found in the world of remote execution together and make them better, faster and more malleable. Salt accomplishes this via its ability to handle larger loa...

[SECURITY] Fedora 33 Update: salt-3002.1-1.fc33

Salt is a distributed remote execution system used to execute commands and query data. It was developed in order to bring the best solutions found in the world of remote execution together and make them better, faster and more malleable. Salt accomplishes this via its ability to handle larger loa...

Denial of Service Vulnerability in DCS C300 Controller CC-PCNT02

The CC-PCNT02 is a controller for Honeywell DCS C300 systems that supports Ethernet communication. A denial of service vulnerability exists in the DCS C300 controller CC-PCNT02, which can be exploited by an attacker to cause a denial of service...

[SECURITY] Fedora 32 Update: nodejs-12.19.0-1.fc32

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

[SECURITY] Fedora 31 Update: nodejs-12.19.0-1.fc31

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...