Russian Hackers Haven't Stopped Probing the US Power Grid

Researchers warn that utilities hackers don't need to cause blackouts to do damage...

ESTA registration websites still lurk in paid ads on Google

Google has taken direct action against adverts promoting ESTA registration services, often offered by third parties at highly inflated prices. Ads displayed on the Google network shouldn’t display fees higher than what a public source or government charges for products or services. This tightenin...

As Predicted, Mobile Continued eCommerce Dominance Over the Holiday Weekend

Akamai predicted in September 2018 that mobile shopping would continue its growth this holiday shopping season. That prediction held true as we saw mobile devices increase their share of Black Friday online shopping traffic volume to 57.55%, with desktop traffic dropping to 35.91%. And for the...

Malwarebytes helps take down massive ad fraud botnets

On November 27, the US Department of Justice announced the indictment of eight individuals involved in a major ad fraud case that cost digital advertisers millions of dollars. The operation, dubbed 3ve, was the combination of the Boaxxe and Kovter botnets, which the FBI—in collaboration with...

5 New Nonlethal Weapons the Defense Department Is Developing

The US Department of Defense's Joint Non-Lethal Weapons Program is testing a new arsenal powered by lasers, plasma, chemical irritants, and more...

Stopping the Infiltration of Things

The Internet of Things – connected devices that contain network sensors to allow for remote monitoring and control, are expected to hit 75-billion devices installed by 2025. These devices include everything from home routers, remote cameras to healthcare devices. This wide-ranging...

Secret Charges Against Julian Assange Revealed Due to "Cut-Paste" Error

Has Wikileaks founder Julian Assange officially been charged with any unspecified criminal offense in the United States? — YES United States prosecutors have accidentally revealed the existence of criminal charges against Wikileaks founder Julian Assange in a recently unsealed court filing in an...

The US Didn’t Sign the Paris Call for Trust and Security in Cyberspace

Corporations have taken the lead over nations on governing the internet: The initiative might not have counted the US as a signatory, but did include Microsoft, Facebook, Google, and others...

The US Is the Only Country Where There Are More Guns Than People

The US has the worst rate of gun violence among all developed countries, and still we fail to regulate...

HSBC Data Breach Hits Online Banking Customers

International banking giant HSBC has reported that it was breached in October, as a result of a credential-stuffing attack. In a notice PDF filed with the state of California, the bank said that it became aware of some online accounts being accessed by unauthorized users between October 4 and 14...

Feds accuse Chinese firm of stealing trade secrets of US tech giant

By Uzair Amir The US Justice Department has accused China to be involved in industrial espionage. According to a press release from the department, the Chinese government has made memory chips that store data its centralized science and technology strategy only to cover its espionage activities. ...

How to Punish Cybercriminals

Interesting policy paper by Third Way: "To Catch a Hacker: Toward a comprehensive strategy to identify, pursue, and punish malicious cyber actors": In this paper, we argue that the United States currently lacks a comprehensive overarching strategic approach to identify, stop and punish...

F5 Networks BIG-IP : Side-channel processor vulnerabilities (K91229003)

The following three side-channel attacks were publicly disclosed on January 3, 2018 : CVE-2017-5715 Spectre-BTB previously known as Spectre Variant 2 Branch target injection Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosu...

China's Five Steps for Recruiting Spies in the US

A series of high-profile cases involving alleged Chinese recruits shows how the country identifies and develops potential spies stateside...

CVE-2018-18868

No-CMS 1.1.3 is prone to Persistent XSS via a contactus name parameter, as demonstrated by the VG48Z5PqVWname parameter...

Employee infects US govt network with malware after visiting 9,000 porn sites

By Uzair Amir Due to the carelessness of an employee, who apparently was a porn fan, the network of the satellite imaging facility, the U.S. Geological Survey USGS at the EROS Center, South Dakota got infected with malware. An audit carried out by the U.S. Department of the Interior’s inspector...

IoT Flaw Allows Hijacking of Connected Construction Cranes

A connected construction crane, from Telecrane, has a vulnerability that would allow cyberattackers to intercept its communications and take the equipment over. The internet of things IoT continues to add new types of objects to its footprint, as industries start leveraging connectivity to increa...

More on the Supermicro Spying Story

I've blogged twice about the Bloomberg story that China bugged Supermicro networking equipment destined to the US. We still don't know if the story is true, although I am increasingly skeptical because of the lack of corroborating evidence to emerge. We don't know anything more, but this is the...

Security Vulnerability in Internet-Connected Construction Cranes

This seems bad: The F25 software was found to contain a capture replay vulnerability -- basically an attacker would be able to eavesdrop on radio transmissions between the crane and the controller, and then send their own spoofed commands over the air to seize control of the crane. "These devices...

HackerOne: Proper verification is not done before sending invitations to researchers for certain private programs with rules e.g. "Participants must be US-based"

Hi, I would like to report something I just recently noticed upon receiving an automated invite from Hackerone for a private program. The program brief clearly states the following in program rules: █████ This is where I believe the issue is. I live in ███ and according to the program rules I...