http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2016-04-26 21:37:30 - Security Bloggers Network : Cybercriminals attacked the healthcare industry more than any other sector in 2015, according to a new report published by IBM Here's why http://www.secuobs.com/revue/news/604757.shtmlhttp://www.secuobs.com/revue/news/604757.shtml 2016-04-26 08:56:04 - Help Net Security : Who will be the victim of the next major breach Nearly all enterprises and organizations are sitting ducks for a targeted network attack Maybe it s time to take some significant steps and be able to proclaim We won t get breached again Preventative security cannot prevent a network intruder from penetrating a network 100pourcents of the time The best pen testers even guarantee that they can get into a network within two days Prevention is still More http://www.secuobs.com/revue/news/604689.shtmlhttp://www.secuobs.com/revue/news/604689.shtml 2016-04-25 14:46:52 - SecurityTube.Net : Next-Generation firewalls provide functionality well beyond the traditional filtering capabilities They offer deep protocol inspection, application identification, user based filtering, VPN functionality and more While this significantly increases the attack surface of these devices, little public research is available In this talk I will present an in-depth analysis of one of the leading NGFW solutions Besides describing the overall system architecture, I will discuss and demonstrate several critical vulnerabilities in the different components that can result in a full remote compromise of the appliance To go beyond 2015 the pure bashing of security appliances, I ll also present some positive insights All vulnerabilities in this talk were disclosed to the vendor in 2015 The vendor is providing patches The vulnerabilities will be demonstrated live during the talk, but if there is no patch available by the time of the talk, we will not show exploit code FELIX WILHELM Felix is a security researcher working for ERNW GmbH His main interests are application security, reverse engineering and virtualization security Felix has disclosed critical vulnerabilities in popular software such as Hyper-V, Xen, Typo3 or IBM GPFS and has presented his work at international conferences like PHDays, Hack in the Box, Infiltrate and Troopers For More Information Please Visit - https wwwtroopersde http://www.secuobs.com/revue/news/604591.shtmlhttp://www.secuobs.com/revue/news/604591.shtml 2016-04-25 14:46:52 - SecurityTube.Net : During the IPv6 Security Summit at Troopers 14, Chiron, an all-in-one IPv6 penetration testing framework was released publicly for first time Since then, the advanced features of Chiron were used to discover some 0-day evasion techniques against high-end commercial and open-source Intrusion Detection Prevention Systems Moreover, for Troopers 15 it was enhanced with new features, like advanced MLD support and a fake DHCPv6 server, which can be combined with its other features, like the use of arbitrary Extension Headers and fragmentation to leverage really advanced attacks In this workshop, after a quick refreshing to the basic capabilities of Chiron, we will focus on the advanced IPv6 functionalities that the framework offers We will not only show how to reproduce the latest published IPv6 attacks, but moreover, how you can create your own arbitrary IPv6 attacking scenarios for your own security assessments or penetration testing purposes A lab will be set up in order not only to reproduce the presented techniques, but to also try your skills and why not to discover your own 0-day techniques Requirements No programming experience or prior knowledge of Chiron are required Some necessary but not very basic IPv6 theory will also be given to better explain the demonstrated IPv6 attacks Bring your own Linux device with Python installed, or your favourite Operating System with VirtualBox, and you are good to go source code and virtual images with all what you need will be provided ANTONIOS ATLASIS Antonios Atlasis is an IT Security researcher with a special interest in IPv6 in securities His work has been presented in several IT Security conferences and it has resulted in the discovery of various IPv6-related vulnerabilities He is the author of Chiron, an IPv6 specialized and very flexible security assessment tool RAFAEL SCHAEFER Rafael has studied computer science with a specialization in telecommunication at the Bonn-Rhein-Sieg University of Applied Sciences Department of Computer Science His research interests include network and IPv6 security issues He wrote his highly rated bachelor thesis on IDS Recognition and Validation of IPv6 Extension Header and works as a security analyst at ERNW GmbH He has presented on IPv6 security issues at several occasions, incl Black Hat Sao Paulo, Black Hat Asia, Black Hat Europe, Troopers and Hacklu For More Information Please Visit - https wwwtroopersde http://www.secuobs.com/revue/news/604579.shtmlhttp://www.secuobs.com/revue/news/604579.shtml 2016-04-25 14:46:52 - SecurityTube.Net : TROOPERSCON - Basic Attacks and Mitigation Strategies For More Information Please Visit - https wwwtroopersde http://www.secuobs.com/revue/news/604578.shtmlhttp://www.secuobs.com/revue/news/604578.shtml 2016-04-25 10:09:06 - Help Net Security : Hewlett Packard has released critical security updates for its HP Data Protector software, which fix vulnerabilities that could allow remote code execution or unauthorized disclosure of information HP Data Protector software is automated backup and recovery software for single-server to enterprise environments, and can be set up on Windows, Unix, and Linux operating systems There are six vulnerabilities in all, with CVE-2016-2004 through CVE-2016-2007 all being considered critical No more details about them have been More http://www.secuobs.com/revue/news/604540.shtmlhttp://www.secuobs.com/revue/news/604540.shtml 2016-04-25 09:31:42 - Help Net Security : For its latest report, Vectra analyzed data from 120 customer networks comprised of more than 13 million hosts over the first quarter of 2016 All organizations showed signs of targeted attacks including internal reconnaissance, lateral movement or data exfiltration Of the 120 participating organizations, 117 detected at least one of these behaviors during each month of the study Despite that nearly 98 percent of organizations detected at least one behavior per month during the three-month More http://www.secuobs.com/revue/news/604536.shtmlhttp://www.secuobs.com/revue/news/604536.shtml 2016-04-24 16:48:05 - Security Bloggers Network : You would be wrong to think that this is just an attempt by the criminals to steal your Apple ID password - bad as that would be It's much worse than that Read more in my article on the We Live Security blog http://www.secuobs.com/revue/news/604509.shtmlhttp://www.secuobs.com/revue/news/604509.shtml 2016-04-22 15:05:23 - SecurityTube.Net : We live-demo as an attacker many Russian crimeware that's never been disclosed before, including tools and techniques to compromise legit sites, inject backdoor, inject malicious code, add botnet feature to existing malware, operate botnet, check antivirus detection rates, and circumvent security scanning We then cover very effective means to defend against every stage of their kill chain Due to the amount of content to cover and the limited time, we won t be covering the basics like what s an exploit, what are exploit kits, what are TDSs, etc At the same time because it s about understanding their tools, we ll be tracing through some source code of their tools SUN HUANG Sun Huang is a Senior Threat Researcher at Proofpoint He has more than 9 years of experience in information security Sun has participated in many security contests, and was one of the top 10 researchers in Paypal's 2013 Bug Bounty Wall of Fame He was also the third place AT T bug reporter in 2013 WAYNE HUANG Wayne Huang was Founder and CEO of Armorize Technologies, and is now VP Engineering at Proofpoint Huang is a frequent speaker at security conferences, including BlackHat '10, DEFCON '10, RSA '07 '10 '14, SyScan '08, '09, OWASP '08, '09, Hacks in Taiwan '06 '07, WWW '03 '04, PHP '07 and DSN '04 A diligent blogger on cyberthreats, his posts have been covered by the most influential media Into security since 7th grade, he has led teams to develop security products ranging from source code analysis, web application firewall, vulnerability assessment, exploit malware detection, anti-malvertising, email security, and APT defense He received his PhD in EE from National Taiwan University, and his BS and MS in CS from NCTU He holds two US patents on source code analysis For More Information Please Visit - https wwwtroopersde http://www.secuobs.com/revue/news/604425.shtmlhttp://www.secuobs.com/revue/news/604425.shtml 2016-04-22 15:05:23 - SecurityTube.Net : In this talk we will show how to attack enterprise-grade big data environments, based on eg HortonWorks or Cloudera, comprising components such as HDFS, Yarn, Hue, Flume, Hive, Spark, Sentry Ranger These environments process huge amounts of data either data stored in the cluster file system HDFS or streamed into the cluster, eg via Flume The processing of the data is performed in jobs which are typically submitted by customers into the cluster -- and those jobs can be arbitrary code even though the typical cluster language is Java We will give a detailed description on the overall concept of the environment, the tasks of the different components and how they communicate with each other We will describe the possibilities of the attackers in different network authentication positions eg with or without the capabilities to submit jobs and practically demonstrate break-out attacks from the job sandboxes which result from insufficient hardening of the different nodes or overall environment Such breakout attacks affect the information of all customers in the attacked cluster and are thus comparable to hypervisor breakouts in public cloud environments BIRK KAUER Birk is a Security Researcher at ERNW and enjoys exploitation the most, especially in very tricky and complex situations He often attends CTFs Capture the Flags to challenge himself with tricky exploits while keeping up with daily consulting and assessment work He currently holds OSCP and OSCE certificates from offsec Offensive-Security and hopefully soon the OSEE certificate MATTHIAS LUFT Matthias Luft is a security researcher and pentester working for the German security company ERNW He is interested in a broad range of topics such as DLP, virtualization, and network security while keeping up up with the daily consulting and assessment work For More Information Please Visit - https wwwtroopersde http://www.secuobs.com/revue/news/604420.shtmlhttp://www.secuobs.com/revue/news/604420.shtml 2016-04-21 15:22:16 - SecurityTube.Net : Rob Fuller has over 11 years of experience covering all facets of information security He has been behind the lines helping to design, build, and defend the US Marine Corps, US Senate, and Pentagon networks - as well as performing penetration tests and Red Team assessments against those same networks More recently, Rob has performed numerous successful Red Team assessments against commercial Fortune 50 companies representing some of the best defensive teams in the industry Rob's experience and expertise ranges from embedded and wireless devices in industrial control system networks to standard corporate IT infrastructures and domains He is a frequent speaker at a number of well-known security conferences, including ShmooCon, DefCon, DerbyCon, CarolinaCon, Area41, RVASec, and HackCon and teaches both the Metasploit Basics and Mastery classes at BlackHat USA He has also served as a technical advisor for HBO's show Silicon Valley and hosts his own show for Hak5 Discovery Channel Rob has acquired a number of certifications and awards over the years, but the ones he holds above the rest are father, husband, and United States Marine For More Information Please Visit - http dakotaconorg http://www.secuobs.com/revue/news/604325.shtmlhttp://www.secuobs.com/revue/news/604325.shtml 2016-04-21 15:09:05 - LinuxSecurity.com Latest News : LinuxSecuritycom While to date police have considered distributed denial-of-service DDoS attacks to be a low-level crime, they are now starting to take them a lot more seriously According to Mike Hulett, head of operations at the National Crime Agency's Cybercrime Unit, DDoS attacks have risen up law enforcement's agenda for a couple of reasons http://www.secuobs.com/revue/news/604319.shtmlhttp://www.secuobs.com/revue/news/604319.shtml 2016-04-21 13:04:34 - TrendLabs Security Intelligence Blog : A small webhosting provider with servers in the Netherlands and Romania has been a hotbed of targeted attacks and advanced persistent threats APT since early 2015 Starting from May 2015 till today we counted over 100 serious APT incidents that originated from servers of this small provider Pawn Storm used the servers for at least 80 high profile attacks against various governments in the US, Europe, Asia, and the Middle East Formally the Virtual Private Server VPS hosting company is registered in Dubai, United Arab Emirates UAE But from public postings on the Internet, it is apparent that the owner doesn t really care about laws in UAE In fact, Pawn Storm and another APT group, attacked the government of UAE using servers of the VPS provider through highly targeted credential phishing Other threat actors like DustySky also known as the Gaza hackers are also regularly using the VPS provider to host their Command and Control C C servers and to send spear phishing e-mails Post from Trendlabs Security Intelligence Blog - by Trend Micro Looking Into a Cyber-Attack Facilitator in the Netherlands http://www.secuobs.com/revue/news/604310.shtmlhttp://www.secuobs.com/revue/news/604310.shtml 2016-04-20 15:01:56 - Security Bloggers Network : Buildings are increasingly susceptible to cyberattacks, with the Internet of Things presenting cybercriminals with new opportunities to exploit The post Buildings at risk of cyberattacks appeared first on We Live Security http://www.secuobs.com/revue/news/604230.shtmlhttp://www.secuobs.com/revue/news/604230.shtml 2016-04-20 15:01:56 - Security Bloggers Network : Machine learning helps it to refine the abnormalities it detects in data so human security experts aren't deluged with false positives http://www.secuobs.com/revue/news/604223.shtmlhttp://www.secuobs.com/revue/news/604223.shtml 2016-04-20 14:59:50 - SecurityTube.Net : You're probably wondering how someone could possibly fill a 45 minute slot talking about the security implications of sockets after all, there are only TCP and UDP sockets, right In reality, there are several unique types of sockets used by an Android device These range from network sockets the ones we are all familiar with , to local sockets, and even kernel-level sockets When used improperly, these sockets can have devastating effects on the overall security of a device In this talk, I'll discuss several types of Linux-based sockets found on Android devices and how these sockets have historically been used to compromise devices I'll also provide the tools and techniques necessary to enumerate and interact with these sockets on your own device For More Information Please Visit - http wwwbsidesnashorg http wwwirongeekcom iphp page videos bsidesnashville2016 mainlist http://www.secuobs.com/revue/news/604214.shtmlhttp://www.secuobs.com/revue/news/604214.shtml 2016-04-20 08:53:27 - Help Net Security : Ransomware attacks against endpoints have recently taken place against hospitals in the US and Germany Attacks have increased in severity to the point that the FBI issued an alert asking businesses for help in the fight against ransomware The Ponemon Institute surveyed 694 US IT security practitioners who are involved in endpoint security in a variety of organizations Key findings Laptops pose the biggest endpoint threat to enterprises Forty-three percent of organizations believe laptops are More http://www.secuobs.com/revue/news/604193.shtmlhttp://www.secuobs.com/revue/news/604193.shtml 2016-04-19 10:38:41 - Security Bloggers Network : Researchers from MIT s CSAIL have developed an artificial intelligence platform that can predict 85pourcents of cyberattacks so long as it benefits from human input The post AI and humans successfully predict most cyberattacks appeared first on We Live Security http://www.secuobs.com/revue/news/604085.shtmlhttp://www.secuobs.com/revue/news/604085.shtml 2016-04-19 10:38:41 - Security Bloggers Network : In November 2015, outages in Sweden s Air Traffic Control System lasting several days led to hundreds of domestic and international flights being grounded at multiple airports across the country According to the International Business Times, sources in the Swedish government have claimed the outages were the result of a sustained cyber attack perpetrated by Russian Read More The post Sweden s Critical Infrastructure Was Reportedly Attacked by Russian Hackers appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/604079.shtmlhttp://www.secuobs.com/revue/news/604079.shtml 2016-04-19 09:25:24 - Help Net Security : The vast majority of enterprise end users 85pourcents want their ISPs to offer more comprehensive DDoS protection-as-a-service, according to Corero Network Security The research, which polled over 100 ISPs and 75 enterprise customers about their DDoS mitigation strategies, revealed that an alarming proportion of ISPs are still relying on outdated technologies to protect their customers For example, forty-six per cent divert DDoS traffic through a scrubbing centre an expensive and notoriously slow technique which More http://www.secuobs.com/revue/news/604073.shtmlhttp://www.secuobs.com/revue/news/604073.shtml 2016-04-19 08:14:58 - Help Net Security : Today s security systems usually fall into one of two categories man or machine So-called analyst-driven solutions rely on rules created by human experts and therefore miss any attacks that don t match the rules Meanwhile, today s machine-learning approaches rely on anomaly detection, which tends to trigger false positives that both create distrust of the system and end up having to be investigated by humans, anyway But what if there was a solution that could merge those More http://www.secuobs.com/revue/news/604071.shtmlhttp://www.secuobs.com/revue/news/604071.shtml 2016-04-18 16:19:01 - Help Net Security : Spurred by the recent discovery that the Samas aka SamSam ransomware is being spread via compromised servers running out-of-date versions of Red Hat s JBoss server software, Cisco Talos researchers have begun scanning the Internet for machines that might be at risk They found approximately 32 million vulnerable machines, but also a considerable number of those that are already compromised 2,100 backdoors have been already been installed across nearly 1600 IP addresses Another way into the More http://www.secuobs.com/revue/news/604032.shtmlhttp://www.secuobs.com/revue/news/604032.shtml 2016-04-18 16:17:37 - Office of Inadequate Security : Danny Palmer reports A virus infected computer systems at Newark Police Department in New Jersey last week, taking four http://www.secuobs.com/revue/news/604030.shtmlhttp://www.secuobs.com/revue/news/604030.shtml 2016-04-18 13:08:07 - SecurityTube.Net : Firmware attacks, mostly those that allow unauthenticated BIOS UEFI changes, disable kernel and OS security features These unauthenticated attacks have been proven trivially easy with physical access, and difficult but achievable remotely or though software-only channels Recent data breaches have revealed in-the-wild firmware-based persistence and reinfection payloads The firmware landscape has the same fragmentation problem as Android devices, but suffers from more opaque security update announcement methods and authenticated automated update processes Combine these issues with a culture landscape that still likens secure boot to an extinction level event, and it is obvious our enterprises are in danger This presentation takes a different approach to hardware and firmware security by exploring how our enterprise defenders can recognize vulnerable systems, detect, and respond to compromise Defense begins with visibility, that means baselining kernel drivers, kernels, boot loaders, ACPI table content, SMBIOS metadata, Option ROMs, UEFI drivers, and other boot related platform code it then continues into logging run time OS API-generated hardware events This data and pipeline can fuel existing correlation and indicators of compromise IOC collections to identify known good and eventually known bad Creating production deployable and repeatable recipes for these somewhat esoteric features is essential We will present a summary of immediate tools and actions for deep systems defense, an analysis of where our defenders remain blind to compromise, and recommendations on where our industry can focus tailored effort to generate massive impact For More Information Please Visit - https wwwusenixorg conference enigma2016 http://www.secuobs.com/revue/news/604010.shtmlhttp://www.secuobs.com/revue/news/604010.shtml 2016-04-17 11:44:25 - SecTechno : http://www.secuobs.com/revue/news/603959.shtmlhttp://www.secuobs.com/revue/news/603959.shtml 2016-04-15 16:48:57 - LinuxSecurity.com Latest News : LinuxSecuritycom A man faces up to 10 years in prison for launching a distributed denial-of-service DDoS attack against a security researcher Benjamin Earnest Nichols, 37, of Oklahoma City, appeared before Judge David L Horan earlier this month and pleaded guilty to one count of knowingly causing the transmission of a program or code to a protected computer http://www.secuobs.com/revue/news/603879.shtmlhttp://www.secuobs.com/revue/news/603879.shtml 2016-04-15 16:16:03 - Office of Inadequate Security : US Blizzard Offline WoW Offline, Diablo 3 Offline, Starcraft 2 Offline, Hearthstone Offline fbiarelosers http://www.secuobs.com/revue/news/603804.shtmlhttp://www.secuobs.com/revue/news/603804.shtml 2016-04-14 15:39:04 - Security Bloggers Network : Cybercriminals don't need to know much about you in order to come up with phishing scams that look way more believable than usual http://www.secuobs.com/revue/news/603774.shtmlhttp://www.secuobs.com/revue/news/603774.shtml 2016-04-14 14:55:50 - SecurityTube.Net : In the system hardening space, we ve been using chroot jails to contain compromised programs These jails were better than nothing, but were easily escaped by many attackers As Linux containers become more mature, we can use them to replace these jails This talk will teach you how to use Linux Containers, through both Docker and Ubuntu s new LXD, to create far better jails for programs, containing their compromise You will leave this demo-heavy talk immediately able to use both technologies to create containers for both attack containment and to rapidly develop and host software Jay Beale jaybeale has created several defensive security tools, including Bastille Linux and the CIS Linux Scoring Tool, both of which have been used throughout industry and government He has served as an invited speaker at many industry and government conferences, a columnist for Information Security Magazine, SecurityPortal and SecurityFocus, and a contributor to nine books, including those in his Open Source Security Series and the Stealing the Network series Jay is a founder and serves as both the Chief Technology Officer and Chief Operating Officer of the information security consulting company, InGuardians For More Information Please Visit - http shmooconorg http://www.secuobs.com/revue/news/603753.shtmlhttp://www.secuobs.com/revue/news/603753.shtml 2016-04-14 14:55:50 - SecurityTube.Net : Eric W D Rozier, Assistant Professor of EECS, University of Cincinnati The Trustworthy Data Engineering Laboratory TRUST Lab has been working with the World Bank, the Federal Bureau of Investigation FBI , the Environmental Protection Agency EPA , and the City of Cincinnati to help solve a common problem faced by many organizations involved in data driven investigations companies and entities that attempt to disguise malicious activities through attacks on the integrity of available data In this talk we will explore the challenge of assuring data integrity in heterogenous data systems that face the challenges of velocity, variety, and volume that accompany the domain of Big Data We will examine real case studies in debarrment and corruption in international procurement with the World Bank, investigations into violations of the Foreign Corrupt Practices Act with the FBI, cases of violations of the Resource Conservation and Recovery Act with the EPA, and human rights abuses of low income citizens by corporate slum-lords in the city of Cincinnati In each of these cases we will show how malicious actors manipulated the data collection and data analytics process either through misinformation, abuse of regional corporate legal structures, collusion with state actors, or knowledge of underlying predictive analytics algorithms to damage the integrity of data used by machine learning and predictive analytic processes, or the outcomes derived from these processes, to avoid regulatory oversite, sanctions, and investigations launched by national and multi-national authorities For More Information Please Visit - https wwwusenixorg conference enigma2016 http://www.secuobs.com/revue/news/603747.shtmlhttp://www.secuobs.com/revue/news/603747.shtml 2016-04-13 22:44:11 - Risk Assessment Ars Technica : Spike brings number to 54 in 2015, the highest ever recorded http://www.secuobs.com/revue/news/603683.shtmlhttp://www.secuobs.com/revue/news/603683.shtml 2016-04-13 09:17:14 - Help Net Security : Attacks on industrial control systems ICSs are increasing in frequency and have become a reality we can no longer ignore Securing these networks poses unique challenges, primarily because ICS networks are unlike traditional IT networks They use different technologies and perform discrete functions In order to protect them we first need to understand how they operate ICS networks are different Until recently, industrial networks were separated from the rest of the world by Air More http://www.secuobs.com/revue/news/603581.shtmlhttp://www.secuobs.com/revue/news/603581.shtml 2016-04-13 07:56:50 - Security Bloggers Network : THIS is why we need adblockers Poisoned ads have infected most of the Netherlands' most popular sites, affecting millions of users http://www.secuobs.com/revue/news/603576.shtmlhttp://www.secuobs.com/revue/news/603576.shtml 2016-04-12 13:39:12 - Office of Inadequate Security : Catalin Cimpanu reports Vulnerabilities known as IODR Insecure Direct Object References were found and fixed in Worldpay, http://www.secuobs.com/revue/news/603511.shtmlhttp://www.secuobs.com/revue/news/603511.shtml 2016-04-12 08:54:26 - Help Net Security : The global cloud security market is expected to grow at a CAGR of over 20pourcents until 2019, according to Technavio A key reason for the adoption of cloud security is the sudden increase in cloud-specific attacks One of the reasons for such attacks is the growing use of cloud-based services that require users to reveal their credentials This affects the confidentiality of user data, and it has resulted in several cases of identity theft, said More http://www.secuobs.com/revue/news/603486.shtmlhttp://www.secuobs.com/revue/news/603486.shtml 2016-04-12 00:58:27 - Office of Inadequate Security : Ragip Soylu and Yunus Paksoy report US attorney Preet Bharara, who has been at the top of the agenda recently in Turkey http://www.secuobs.com/revue/news/603477.shtmlhttp://www.secuobs.com/revue/news/603477.shtml 2016-04-11 19:25:49 - Slashdot Your Rights Online : Reader wiredmikey writes Swedish military computers were hacked and used in an attack targeting major US banks in 2013, the armed forces said on Monday The attack knocked out the web sites of as many as 20 major US banks and financial institutions, sometimes for several days According to Swedish military spokesman Mikael Abramsson, a server in the Swedish defense system had a vulnerability which was exploited by hackers to carry out the attacks At the time, the attack, which began in 2012 and continued for months, was one of the biggest ever reported US officials blamed Iran, suggesting it was in retaliation for political sanctions and several earlier cyberattacks on its own systems IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/603463.shtmlhttp://www.secuobs.com/revue/news/603463.shtml 2016-04-11 19:16:04 - Risk Assessment Ars Technica : Some of country's top sites ran ads that redirected to the Angler exploit kit http://www.secuobs.com/revue/news/603461.shtmlhttp://www.secuobs.com/revue/news/603461.shtml 2016-04-11 16:46:29 - Office of Inadequate Security : Sometimes it takes years before we find out more details about a particular attack On Friday, AFP reported that the source http://www.secuobs.com/revue/news/603434.shtmlhttp://www.secuobs.com/revue/news/603434.shtml 2016-04-11 14:09:34 - SecurityTube.Net : Big Data Analytics and Machine Learning are pervasive in the decision-making processes of major corporations and governments around the world This fact introduces a new opportunity and attack vector for hackers instead of stealing data, attackers can potentially influence or control the decisions of their victims In our talk we highlight the poor decisions that developers make in their code that enables attackers to drastically skew machine learning models, deliver denial of service attacks, or outright gain remote code execution We ll target applications such as Apache Hadoop with a throwback attack from 2001 and kick the doors open on OpenCV using automatic vulnerability discovery techniques We ll also recommend a plausible dynamic defense against our novel attacks Andrew Ruef is a PhD student at the University of Maryland, College Park, advised by Michael Hicks Ruef is also a researcher at Trail of Bits and is interested in reverse engineering and program analysis Rock Stevens ada95ftw began working in IT as an under-paid network administrator at the age of 15 He was selected as a 2015 Madison Policy Forum Military-Business Cybersecurity Fellow and is currently pursuing a master s degree in Computer Science at the University of Maryland College Park For More Information Please Visit - http shmooconorg http://www.secuobs.com/revue/news/603407.shtmlhttp://www.secuobs.com/revue/news/603407.shtml 2016-04-11 08:01:37 - Security Bloggers Network : In mid-March, news first broke about a ransomware attack at The Ottawa Hospital in Ottawa, Ontario The hospital released a statement soon after the attack confirming ransomware had infected four of its 9,800 computers It is believed a staff member clicked on a suspicious link that in turn downloaded the ransomware onto the hospital s computers Read More The post How Hospitals Are at Risk of Ransomware Attacks appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/603376.shtmlhttp://www.secuobs.com/revue/news/603376.shtml 2016-04-08 15:31:36 - Security Bloggers Network : 135 million Arris modems are at risk of being knocked offline for between three and 30 minutes, because of an easily patchable vulnerability David Bisson reports http://www.secuobs.com/revue/news/603261.shtmlhttp://www.secuobs.com/revue/news/603261.shtml 2016-04-08 10:00:08 - Help Net Security : A new survey conducted by Dimensional Research, which was carried out in November 2015, assessed cyber security challenges faced by organizations in the energy sector Study respondents included over 150 IT professionals in the energy, utilities, and oil and gas industries When asked if their organization had experienced a rise in successful cyber attacks in the last 12 months, seventy-seven percent of the respondents replied, yes In addition, more than two-thirds of the respondents sixty-eight More http://www.secuobs.com/revue/news/603207.shtmlhttp://www.secuobs.com/revue/news/603207.shtml 2016-04-08 04:54:05 - Office of Inadequate Security : KENS reports The Northeast Independent School District says it s been hit by the latest craze in computer viruses http://www.secuobs.com/revue/news/603179.shtmlhttp://www.secuobs.com/revue/news/603179.shtml 2016-04-08 03:36:16 - Office of Inadequate Security : But it s not like he s a hacker he only did it for the money Jane Tyler reports that Grant Manser http://www.secuobs.com/revue/news/603174.shtmlhttp://www.secuobs.com/revue/news/603174.shtml 2016-04-08 03:02:24 - TrendLabs Security Intelligence Blog : By Peter Pi, Brooks Li and Joseph C Chen Following their security advisory last April 5, 2016, Adobe has released an out of band patch today for the vulnerability CVE-2016-1019, which affects Adobe Flash Player Trend Micro has observed active zero day attacks from the Magnitude Exploit Kit affecting users of Flash 2000306 and earlier These attacks are not effective against Post from Trendlabs Security Intelligence Blog - by Trend Micro Zero-Day Attack Discovered in Magnitude Exploit Kit Targeting CVE-2016-1019 in Older Versions of Adobe Flash Player http://www.secuobs.com/revue/news/603173.shtmlhttp://www.secuobs.com/revue/news/603173.shtml 2016-04-07 16:55:00 - Security Bloggers Network : Earlier this year, Tripwire asked 200 security professionals at RSA about their organizations ability to protect against ransomware infections The results were less than promising A majority 58 percent of respondents reported to have observed a spike in spear phishing emails a common attack vector for ransomware over the past year Even so, that same percentage expressed Read More The post Survey Most Energy IT Professionals Not Confident in Ability to Detect All Targeted Attacks appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/603131.shtmlhttp://www.secuobs.com/revue/news/603131.shtml 2016-04-07 16:54:27 - Help Net Security : Imperva has recently witnessed a new type of DDoS attack they believe might become a go-to for cyber criminals looking to take sites and services down The attack was an application layer DDoS attack, aimed at exhausting a target server s RAM and CPU resources But unlike previous ones they have seen, this one was ginormous While deadly to servers, application layer attacks are not especially large in volume Nor do they have to be, as More http://www.secuobs.com/revue/news/603123.shtmlhttp://www.secuobs.com/revue/news/603123.shtml 2016-04-07 15:17:00 - LinuxSecurity.com Latest News : LinuxSecuritycom Hackers are using malware which targets Linux to build botnets to launch distributed denial of service DDoS attacks security researchers have warned http://www.secuobs.com/revue/news/603104.shtmlhttp://www.secuobs.com/revue/news/603104.shtml 2016-04-06 22:24:02 - Symantec Connect Security Response Billets : Patch due to be published this week for critical new Adobe Flash vulnerability CVE-2016-1019 IMAGE Read More http://www.secuobs.com/revue/news/603029.shtmlhttp://www.secuobs.com/revue/news/603029.shtml 2016-04-06 09:40:28 - Help Net Security : With a business model dependent on 100pourcents uptime for their online customers, the last thing SaaS companies can afford is a DDoS attack Read this DDoS eBook from Incapsula and find out Why SaaS companies are such a popular target for DDoS attacks What are the costs and risks of DDoS attacks to your business What are the steps SaaS companies can take to defend themselves How does Incapsula work Once activated through a simple More http://www.secuobs.com/revue/news/602972.shtmlhttp://www.secuobs.com/revue/news/602972.shtml 2016-04-06 00:32:48 - Risk Assessment Ars Technica : Unlike many browsers, Firefox doesn't always isolate an add-on s functions http://www.secuobs.com/revue/news/602941.shtmlhttp://www.secuobs.com/revue/news/602941.shtml 2016-04-05 17:22:37 - Security Bloggers Network : A new government report criticizes the Defense Dept for not clearly defining lead roles in the event of a cyberattack on the US http://www.secuobs.com/revue/news/602894.shtmlhttp://www.secuobs.com/revue/news/602894.shtml 2016-04-05 14:37:40 - Security Bloggers Network : The Panama Papers - big breach, big newsbut how did it happen http://www.secuobs.com/revue/news/602874.shtmlhttp://www.secuobs.com/revue/news/602874.shtml 2016-04-04 17:15:39 - LinuxSecurity.com Latest News : LinuxSecuritycom Hackers are using the jQuery JavaScript library to inject malicious code into millions of Wordpress and Joomla Web domains, researchers say http://www.secuobs.com/revue/news/602812.shtmlhttp://www.secuobs.com/revue/news/602812.shtml 2016-04-04 13:23:19 - Help Net Security : DDoS attacks are becoming increasingly larger, more complex, and perpetrated by cyber extortionist instead of hacktivists and vandals, according to a recent survey from Arbor Networks New analysis from Frost Sullivan finds that the DDoS mitigation market earned revenues of 4495 million in 2014 and estimates this to more than double to 9772 million by 2019 DDoS Downtime Calculator Incapsula s DDoS Downtime Calculator is designed to help you assess the risks associated with an More http://www.secuobs.com/revue/news/602799.shtmlhttp://www.secuobs.com/revue/news/602799.shtml 2016-04-01 13:43:12 - SecurityTube.Net : Bio Over the years RFID card cloning attacks have risen steadily in Red Team activity While card cloning can be effective, entry isn t always gained with this method alone As Red Team members, we often focus too much on the card and not enough on the technology that supports it Why settle for access to one door when you can have access to them all This talk will move beyond the card and explore all of the PACS components After an overview of the components and architecture, we ll discuss their unique attack surfaces, and how to locate them Finally, we ll put all of the attacks together to achieve complete system takeover For More Information Please Visit - http wwwcentralohioissaorg http wwwirongeekcom iphp page videos centralohioinfosec2016 mainlist http://www.secuobs.com/revue/news/602647.shtmlhttp://www.secuobs.com/revue/news/602647.shtml 2016-04-01 13:43:12 - SecurityTube.Net : Bio Aaron oversees all aspects of development and research that drive PhishMe The market-leading solution was incubated from consulting services provided by Intrepidus Group, which Aaron also co-founded Prior, Aaron served as Principal Consultant and lead instructor for McAfee s Foundstone division His background includes managing security and abuse incidents, subpoena compliance, and datacenter security for large Internet Service Providers For More Information Please Visit - http wwwcentralohioissaorg http wwwirongeekcom iphp page videos centralohioinfosec2016 mainlist http://www.secuobs.com/revue/news/602646.shtmlhttp://www.secuobs.com/revue/news/602646.shtml 2016-04-01 13:43:12 - SecurityTube.Net : Central Ohio Infosec Summit 2016 - The Nodejs Highway Attacks Are At Full Throttle For More Information Please Visit - http wwwcentralohioissaorg http wwwirongeekcom iphp page videos centralohioinfosec2016 mainlist http://www.secuobs.com/revue/news/602645.shtmlhttp://www.secuobs.com/revue/news/602645.shtml 2016-04-01 13:43:12 - SecurityTube.Net : Bio Chris Haley covers the Ohio Valley as a Senior Security Engineer with Vectra Networks Prior to joining Vectra, Chris spent nine years at Cisco in presales engineering and architecture roles, where he focused on data center and security technologies Prior to Cisco, Chris held roles as a Systems Engineering Team Lead at Radware, and as a principle security consultant specializing in penetration testing and compliance assessments He also held key roles as a network engineer at major healthcare and retail organizations Chris is a US Marine Corps veteran and received his bachelor s degree in business from the University of Massachusetts He is currently enrolled in graduate school at the University of Massachusetts in pursuit of his MBA For More Information Please Visit - http wwwcentralohioissaorg http wwwirongeekcom iphp page videos centralohioinfosec2016 mainlist http://www.secuobs.com/revue/news/602643.shtmlhttp://www.secuobs.com/revue/news/602643.shtml 2016-04-01 10:09:42 - Help Net Security : Trend Micro researcher Ricky Lawshae has unearthed a critical vulnerability in HID s VertX and Edge door controllers Exploiting the flaw is easy, and could result in attackers gaining complete control of the device, meaning they could unlock doors and switch off alarms controlled through it HID s access control systems are ubiquitous, and keep unwanted individuals out of many rooms and spaces in a huge number of office buildings, government complexes, hospitals, aeroports, etc These vulnerable More http://www.secuobs.com/revue/news/602627.shtmlhttp://www.secuobs.com/revue/news/602627.shtml 2016-04-01 08:20:04 - Help Net Security : When it comes to securing their data, SMEs remain several steps behind their larger counterparts Some reasons for the disparity in security readiness may be that SMEs have not as often been the targets of hackers, privately held companies don t face the same pressures for security as do their public-company counterparts, and that they simply may have pushed off the issue, according to Joakim Thorén, Versasec s CEO As larger companies become increasingly sophisticated around security, More http://www.secuobs.com/revue/news/602622.shtmlhttp://www.secuobs.com/revue/news/602622.shtml 2016-04-01 00:04:44 - Slashdot Your Rights Online : An anonymous reader writes Following a report from DSLReports that ATT would be imposing usage caps on the company's U-Verse broadband customers, ATT has announced it would now be following Comcast's lead by allowing users to pay 30 more a month if they wanted to avoid usage caps entirely However, ATT has taken it to a new level by allowing users to graciously avoid the 30 fee -- if they subscribe to DirecTV or U-Verse TV service These data caps allow ISPs like ATT and Comcast to cash in on internet video and make cord-cutting less viable by making streaming more expensive And now, ATT is using caps to force users to subscribe to traditional TV if they want their broadband connection to work like it used to IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/602593.shtmlhttp://www.secuobs.com/revue/news/602593.shtml 2016-03-31 04:04:38 - Office of Inadequate Security : Wow This kid got off lightly, compared to what would likely have happened here in the US News Star reports that http://www.secuobs.com/revue/news/602496.shtmlhttp://www.secuobs.com/revue/news/602496.shtml 2016-03-29 18:50:23 - Security Bloggers Network : Our 2015-2016 Global Network Application Security Report documented that 51pourcents of businesses suffered a DDoS attack in 2015 Further, 90pourcents of businesses suffered some sort of cyber attack during that same period This is an astonishing number and as network operators, we need to be prepared DDoS attacks can be a debilitating event to http://www.secuobs.com/revue/news/602339.shtmlhttp://www.secuobs.com/revue/news/602339.shtml 2016-03-29 17:56:45 - Help Net Security : Since 2012, Google has been warning Gmail users when they have been targeted by state-sponsored attackers, but now the alert will be even more visible and therefore less likely to be overlooked or ignored The new full-page warning says that Google can t say how they know that the user s account is being targeted by government-backed hackers, and urges the user to enable two-factor authentication and set up a Security Key on his or her account More http://www.secuobs.com/revue/news/602329.shtmlhttp://www.secuobs.com/revue/news/602329.shtml 2016-03-29 14:25:03 - SecurityTube.Net : Attack tree vignettes for Containers as a Service applications and risk centric threat models Tony UcedaVélez VerSprite Security CEO Tony UcedaVélez is CEO at VerSprite, an Atlanta based security services firm assisting global multi-national corporations on various areas of cyber security, secure software development, threat modeling, application security, security governance, and security risk management Tony has worked and led teams in the areas of application security, penetration testing, security architecture, and technical risk management for various organizations in Utility, Banking, Government, Retail, Healthcare, and Information Services He recently finished his latest book, Risk Centric Threat Modeling with Wiley Life Sciences and has spoken at conferences across 13 countries, 4 continents on the subject matter For More Information Please Visit - https 2016appseccaliforniaorg http://www.secuobs.com/revue/news/602291.shtmlhttp://www.secuobs.com/revue/news/602291.shtml 2016-03-29 10:59:30 - Security Bloggers Network : What were the most surprising things that we learned from the US Federal Edition of the Vormetric Data Threat Report At the top of my list was the rating for the top threat selection by 100 US IT security professionals working for Federal Agencies of their top external threats After numerous incidents over the last several years fixed on Chinese government sponsored hackers can you say APT , Iranian hackers, North Korean cyber attacks, ISIS cyberterrorists, possible Russian state-sponsored hacking and The post The Most Feared Federal Cyberattackers Cybercriminals appeared first on Data Security Blog Vormetric http://www.secuobs.com/revue/news/602263.shtmlhttp://www.secuobs.com/revue/news/602263.shtml 2016-03-29 00:59:40 - Office of Inadequate Security : Lucy Li of Fox Rothschild writes HIPAA itself does not provide a private right of action So when a hacker or rogue http://www.secuobs.com/revue/news/602228.shtmlhttp://www.secuobs.com/revue/news/602228.shtml 2016-03-28 23:51:22 - Security Bloggers Network : Part of what we do at the Microsoft Malware Protection Center involves keeping tabs on known activity groups This is some of the most interesting and intriguing work we do One particularly aggressive and persistent group we track is known within Microsoft by the code-name STRONTIUM following our internal practice of assigning chemical element names to such groups Whereas most cyber-attack groups are ultimately profit-oriented, STRONTIUM mainly seeks sensitive information Read more http://www.secuobs.com/revue/news/602222.shtmlhttp://www.secuobs.com/revue/news/602222.shtml 2016-03-28 23:51:22 - Security Bloggers Network : NASDAQ, the New York Stock Exchange and more were bombarded with DDoS attacks between 2011 and 2013, and a dam's SCADA control system was breached http://www.secuobs.com/revue/news/602221.shtmlhttp://www.secuobs.com/revue/news/602221.shtml 2016-03-25 19:42:00 - Symantec Connect Security Response Billets : The attackers mainly used Brobot malware to build a botnet of compromised servers to perform DDoS attacks against US banks and other organizations IMAGE Read More http://www.secuobs.com/revue/news/602082.shtmlhttp://www.secuobs.com/revue/news/602082.shtml 2016-03-24 21:47:11 - Office of Inadequate Security : A grand jury in the Southern District of New York indicted seven Iranian individuals who were employed by two Iran-based http://www.secuobs.com/revue/news/602006.shtmlhttp://www.secuobs.com/revue/news/602006.shtml 2016-03-24 21:09:44 - Security Bloggers Network : The US Department of Justice DoJ has indicted seven people believed to have coordinated cyberattacks on banks between 2011 and 2013, all with links to the Iranian government The post US charges seven Iranians for bank-related cyberattacks appeared f http://www.secuobs.com/revue/news/602000.shtmlhttp://www.secuobs.com/revue/news/602000.shtml 2016-03-24 20:01:28 - Slashdot Your Rights Online : An anonymous reader quotes a report from CNBC A Kentucky hospital is operating in an internal state of emergency following an attack by cybercriminals on its computer network, Krebs on Security reported Methodist Hospital, based in Henderson, Kentucky, is the victim of a ransomware attack in which hackers infiltrated its computer network, encrypted files and are now holding the data hostage, Krebs reported Tuesday The criminals reportedly used new strain of malware known as Locky to encrypt important files The malware spread from the initial infected machine to the entire internal network and several other systems, the hospital's information systems director, Jamie Reid, told Krebs The hospital is reportedly considering paying hackers the ransom money of four bitcoins, about 1,600 at the current exchange rate, for the key to unlock the files IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/601995.shtmlhttp://www.secuobs.com/revue/news/601995.shtml 2016-03-24 18:44:25 - Risk Assessment Ars Technica : Employees of two Iranian IT firms charged in attacks on bank websites, dam http://www.secuobs.com/revue/news/601994.shtmlhttp://www.secuobs.com/revue/news/601994.shtml 2016-03-24 18:03:49 - Security Bloggers Network : Seven Iranian nationals, with links to Tehran, were charged with computer hacking and conducting distributed denial-of-service attacks http://www.secuobs.com/revue/news/601983.shtmlhttp://www.secuobs.com/revue/news/601983.shtml 2016-03-24 16:41:28 - Help Net Security : The US Justice Department unsealed on Thursday an indictment charging seven Iranian computer specialists for conducting a coordinated campaign of distributed denial of service attacks against 46 major companies, primarily in the US financial sector, from late 2011 through mid-2013 The individuals Ahmad Fathi Hamid Firoozi Amin Shokohi Sadegh Ahmadzadegan, a k a Nitr0jen26 Omid Ghaffarinia, a k a PLuS Sina Keissar and Nader Saedi, a k a Turk Server were employed by two Iran-based computer companies, ITSecTeam and More http://www.secuobs.com/revue/news/601975.shtmlhttp://www.secuobs.com/revue/news/601975.shtml 2016-03-24 02:23:50 - Security Bloggers Network : One of the challenges of being security professionals for decades is that we actually remember the olden days You know, when Internet connected devices were PCs and then the industry got fancy and started issuing laptops That s what was connected to our networks If you recall, life was simpler then But you don t really have a lot of time for nostalgia You are too busy getting a handle on the explosion of devices connected to your networks, accessing your data Here is just a smattering of what you do and will see Mobile Devices Supporting smart phones and tablets seems like old news, mostly because you can t remember a time when these devices weren t on your network Despite the short amount of time elapsed, the impact on networking and security of mobility can t be understated What s more challenging is these devices have the ability to connect directly to the cellular data network and likely get around your security controls BYOD Then someone decided it was easier to have employees just use their own devices, and the bring your own device BYOD issue manifested You can have employees sign paperwork giving you the ability to control the devices and install software, but in practice employees justifiably get very cranky when they can t do something on their personal devices So balancing the need to protect corporate data with the need to not antagonize employees has been challenging Other office devices Printers and scanners have been network connected for years What s different is as more sophisticated imaging devices emerged, the on-board computers and storage turned out to be less than secure So these devices became targets and pivot points for attackers Physical security devices The new generation of physical security devices cameras, access card readers, etc are largely network connected It s great to be able to grant access to an employee who is locked out on your iPhone from the golf course, but it turns out attackers can also grant access to themselves similarly Control systems and manufacturing equipment The connected revolution has made it s way to the shop floor and facilities areas as well Whether it s a sensor collecting information from factory robots or warehousing systems, these devices are connected to networks as well, and as such can be attacked You may have heard of StuxNet, targeting control systems to access centrifuges Yeah that s what we re talking about Healthcare devices If you go into any healthcare facility nowadays, the monitoring devices and even some of the medical devices are managed through a network connection Jokes can be made about taking over a shop floor robot and what s the real impact of that But if medical devices are attacked, the ramifications are significantly more severe Connected home Whether it s a thermostat, security system, or home automation platform the expectation is that you ll manage it from anywhere you are That means a network connection and access to the Intertubes What could possibly go wrong Cars Automobiles ship now with the ability to both use your smartphone network connection and even its own cellular data service to connect to the network for traffic, music, news, and other information services The cars can send diagnostic information as well Although cool and shiny, some recent stunt hacking escapades have proven a moving automobile can be attacked and controlled remotely Again, what could go wrong with that All told, there will be billions of devices on Internet-connected networks over the next few years Those devices present potential attack surface to your organization And you don t know what is really exploitable in your environment because you don t know about the devices It seems the industry wants to put all of these devices into a generic Internet of Things IoT bucket, making IoT the buzzword du jour The latest Chicken Little poised to bring down the sky It turns out the sky has already fallen, as networks are already too vast to fully protect The problem is getting worse by the day because pretty much anything with a chip in it will be connected to a network in the near future So as opposed to having a manageable environment to protect, you have to protect Everything Internet The reality is that if it has a network address, it can be attacked Due to better fundamental architectures especially for mobile devices , it s harder to compromise these new devices than a traditional PC whew , but a sophisticated attacker certainly doesn t have an issue compromising any device they can access And that says nothing for the devices where vendors have paid very little attention to security to date Healthcare and control system devices, we re looking at you These devices have porous defenses and once the attacker gains presence on the network, the adversary has a launching point to start moving laterally towards their real target s In the Shadows -------------- So what You don t even have medical devices or control systems, why do you care The reality is that what you don t see can hurt you Your entire security program has been built to protect what you can see with traditional discovery and scanning technologies The industry has maintained a very limited view of what you should be looking for, mostly because that s all the security scanners could see The current state is that you do your scans every so often and see new devices emerge You test the devices for configuration issues and vulnerabilities, and then you add those issues to a list of things you never have time to finish Pretty straight forward, right Wrong Visible devices only make up a portion of the network-connected devices in your environment That means there are hundreds, if not thousands or more of other devices you don t know about on your network You don t scan these devices periodically and you have no idea about the security posture of said devices Each of those devices can be attacked and can provide the adversary with presence in your environment Thus your attack surface is much larger than you thought These shadow devices are infrequently discussed and even more rarely factored into a program for discovery and protection It s like a big Don t Ask, Don t Tell approach to dealing with this problem, which historically hasn t worked very well We haven t yet published anything on IoT devices or Everything Internet , but it s time Not because we see a lot of attacks in the wild yet Rather most organizations we talk to are unprepared for when the attack happens and then they ll be scrambling as always We ve espoused a visibility, then control approach to security for over a decade Now is the time to get a handle on the visibility of all devices on your network, so when it s time you ll know what you have to control And how to control it So in this new series, entitled Shining a Light on Shadow Devices, we ll focus on the risks these devices present to the organization and also how to find these devices within your environment We d like to thank ForeScout Technologies for tentatively agreeing to license the content and, as always, we ll write the series using our Totally Transparent Research methodology This ensures you ll see all of the research as it comes off the assembly line and you can keep us honest by letting us know if we re hitting the mark In the next post, we ll dig into how these classes of devices can be attacked - Mike Rothman 0 Comments Subscribe to our daily email digest http://www.secuobs.com/revue/news/601898.shtmlhttp://www.secuobs.com/revue/news/601898.shtml 2016-03-23 18:13:08 - Risk Assessment Ars Technica : Locky malware holds medical data hostage for a four-bitcoin ransom http://www.secuobs.com/revue/news/601874.shtmlhttp://www.secuobs.com/revue/news/601874.shtml 2016-03-23 15:33:22 - Help Net Security : A group of researchers from ADAC, the largest automobile club in Germany and Europe, have demonstrated how the keyless comfort locking system used by most automakers on most modern cars provides no security against vehicle theft This finding, in itself, is not new, as previous research demonstrated how easy is to fool the system into unlocking the car and starting its engine by relaying messages between the car and the smart key, at a considerable More http://www.secuobs.com/revue/news/601850.shtmlhttp://www.secuobs.com/revue/news/601850.shtml 2016-03-23 14:11:17 - Security Bloggers Network : The Finnish Defense Ministry was forced to temporarily divert web traffic from its main website following a targeted attack On Tuesday, the leading authority in the area of national defense for Finland s government said that it experienced a denial-of-service attack that began at around 10 30 GMT, reports Reuters A denial-of-service DoS attack typically involves the Read More The post Finnish Defense Ministry Diverts Web Traffic Following Targeted Attack appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/601834.shtmlhttp://www.secuobs.com/revue/news/601834.shtml 2016-03-23 13:51:37 - LinuxSecurity.com Latest News : LinuxSecuritycom Just under half of cybersecurity professionals use any form of shared cyberthreat intelligence CTI in their efforts to protect their enterprises from cyberattacks and hackers, despite CTI's potential to significantly improve security in the fight against cybercrime http://www.secuobs.com/revue/news/601800.shtmlhttp://www.secuobs.com/revue/news/601800.shtml 2016-03-22 23:53:37 - Symantec Connect Security Response Billets : CVE-2016-1788 is difficult to exploit, but within the capabilities of nation state attackers Users are advised to update to iOS 93 to reduce the risk of attack IMAGE Read More http://www.secuobs.com/revue/news/601767.shtmlhttp://www.secuobs.com/revue/news/601767.shtml 2016-03-22 16:10:18 - Slashdot Your Rights Online : An anonymous reader writes from a Wired article A group of German vehicle security researchers has released new findings about the extent of a wireless key hack, and their work ought to convince hundreds of thousands of drivers to keep their car keys next to their Pudding Pops The Munich-based automobile club ADAC recently made public a study it had performed on dozens of cars to test a radio 'amplification attack' that silently extends the range of unwitting drivers' wireless key fobs to open cars and even start their ignitions in German The ADAC researchers say that 24 different vehicles from 19 different manufacturers were all vulnerable, allowing them to not only reliably unlock the target vehicles but also immediately drive them away This clear vulnerability in wireless keys facilitates the work of thieves immensely, reads the post The radio connection between keys and car can easily be extended over several hundred meters, regardless of whether the original key is, for example, at home or in the pocket of the owner Here's the full list of vulnerable vehicles from their findings, which focused on European models the Audi A3, A4 and A6, BMW's 730d, Citroen's DS4 CrossBack, Ford's Galaxy and Eco-Sport, Honda's HR-V, Hyundai's Santa Fe CRDi, KIA's Optima, Lexus's RX 450h, Mazda's CX-5, MINI's Clubman, Mitsubishi's Outlander, Nissan's Qashqai and Leaf, Opel's Ampera, Range Rover's Evoque, Renault's Traffic, Ssangyong's Tivoli XDi, Subaru's Levorg, Toyota's RAV4, and Volkswagen's Golf GTD and Touran 5T IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/601720.shtmlhttp://www.secuobs.com/revue/news/601720.shtml 2016-03-22 14:10:30 - Slashdot Your Rights Online : SomeoneFromBelgium writes This morning there was a double bomb explosion in Brussels, Belgium In the National Airport entrance hall an estimated 13 people were killed by a big explosion around the same time another bomb exploded in Metro station 'Maalbeek,' close to the financial district, killing an estimated 10 persons Note story updates bump this figure ot at least 34 deaths Reader jones_supa adds Shots were fired and Arabic shouted before the blasts, suggesting a terrorist attack Video and images on social media showed smoke rising from an airport building and shattered windows Confused and shocked passengers fled the terminal to safety as they were evacuated by armed police Footage showed rubbish littered across the floor All traffic from and to the airport has been suspended The airport is monitoring the situation closely and will deliver further announcements in Twitter Update 03 22 13 06 GMT by T According to the New York Times and other sources, at least one of the explosions was set off by a suicide bomber Slate has an actively updating stream of updates about the attack, too IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/601713.shtmlhttp://www.secuobs.com/revue/news/601713.shtml 2016-03-22 09:57:57 - SecurityTube.Net : PS Attack is a new project being released at CarolinaCon It is a tool for generating a portable PowerShell attack environment that makes it easy for pentesters to incorporate PowerShell into their bag of tricks The generated environment is a self contained exe that comes with a lot of the latest and greatest offensive PowerShell tools, including commands for Privilege Escalation, Recon and Data Exfiltration It uses a couple of techniques to evade antivirus and Incident Response teams, making it suitable for use during live engagements In this talk we will cover how PS Attack came about, some of the design decisions behind it and how you can use it to wreck shop on your next assessment For More Information Please Visit - http wwwcarolinaconorg http://www.secuobs.com/revue/news/601688.shtmlhttp://www.secuobs.com/revue/news/601688.shtml 2016-03-21 16:15:56 - Slashdot Your Rights Online : Researchers at John Hopkins University have found a bug in the instant messaging client iMessage which, if exploited, could allow an attacker to decrypt photos and videos sent as secured messages Even Apple, with all their skills -- and they have terrific cryptographers -- wasn't able to quite get this right, said Matthew D Green, whose team of graduate students at the aforementioned university found the bug So it scares me that we're having this conversation about adding back doors to encryption when we can't even get basic encryption right Apple acknowledged the bug to The Washington Post, adding that it had partially fixed the glitch with iOS 9 software update last year The company assures that it will be offering a complete patch for the bug with iOS 93, which will be released on Monday IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/601620.shtmlhttp://www.secuobs.com/revue/news/601620.shtml 2016-03-21 16:05:46 - Risk Assessment Ars Technica : Bug can be exploited when iCloud photo is sent over iMessage, Washington Post reports http://www.secuobs.com/revue/news/601619.shtmlhttp://www.secuobs.com/revue/news/601619.shtml 2016-03-21 15:27:26 - Help Net Security : The infamous Carbanak group is again doing what it does best attacks and compromises financial institutions, and tries to steal as much money as possible from them by taking advantage of their victim payment processing networks, ATM networks and transaction systems Carbanak became a well-known name in February 2015, when Kaspersky Lab researchers shared what they knew about this gang, which has been operating since late 2013 and has stolen hundreds of millions of dollars More http://www.secuobs.com/revue/news/601616.shtmlhttp://www.secuobs.com/revue/news/601616.shtml 2016-03-21 08:23:54 - Security Bloggers Network : SCENE A man and a woman stare at a computer screen They are both visibly stressed The man is sweating through his shirt The woman grips a fistful of her own hair MAN This DDoS attack is bad Really bad WOMAN Almost as bad as this DDoS attack script pun If only actual DDoS attack Read More The post Lights, Camera, Disaster DDoS Attack Scripts Are a Threat You Need to Know appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/601568.shtmlhttp://www.secuobs.com/revue/news/601568.shtml 2016-03-21 07:54:33 - Slashdot Your Rights Online : Flu writes Yesterday, at 19 30 CET, an unprecedented DDOS attack shut down both Swedish government sites and all major news outlets, including wwwaftonbladetse, wwwexpressense, wwwsvdse, wwwdnse, wwwdise and others The attack was announced in advanced in a tweet stating 'The following days attacks against the Swedish government and media spreading false propaganda will be targeted' A large amount of traffic was detected from Russia Tension between Russia and Sweden has slowly but steadily intensified during the latest years, causing Swedish relocation of military forces to strategic location and increased cooperation with NATO IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/601564.shtmlhttp://www.secuobs.com/revue/news/601564.shtml 2016-03-20 20:22:25 - Slashdot Your Rights Online : An anonymous reader writes BitQuick, a US-based Bitcoin trader has announced that it will shut down its platform for up to 2 to 4 weeks following a cyber-attack this week The platform took this step because it has not yet identified how the hackers infiltrated their systems It is unusual for companies to take down their systems for weeks, but after the recent Cryptsy and LoanBase hacks, the company is not willing to lose millions of dollars worth of Bitcoin BitQuick announced clients of the incident, and 97pourcents already withdrew their funds from the platform IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/601558.shtmlhttp://www.secuobs.com/revue/news/601558.shtml 2016-03-19 22:55:44 - Office of Inadequate Security : RT reports A hacker group claims to have cracked the database of Switzerland s largest political party, the conservative http://www.secuobs.com/revue/news/601534.shtmlhttp://www.secuobs.com/revue/news/601534.shtml 2016-03-19 15:42:58 - Office of Inadequate Security : Over on HackRead, Waqas notes that hacktivists under the banner of Anonymous have attacked a Japanese site visit-jycom , http://www.secuobs.com/revue/news/601519.shtmlhttp://www.secuobs.com/revue/news/601519.shtml 2016-03-18 23:12:52 - Security Bloggers Network : The Federal Bureau of Investigation has issued a public service announcement warning drivers that automobiles are increasingly vulnerable to cyberattacks The post FBI warn that automobiles are vulnerable to cyberattacks appeared first on We Live Security http://www.secuobs.com/revue/news/601493.shtmlhttp://www.secuobs.com/revue/news/601493.shtml 2016-03-18 13:05:07 - SecurityTube.Net : This section of the Metasploit course covers attacking Windows 7 For More Information Please Visit - http strategicseccom http://www.secuobs.com/revue/news/601422.shtmlhttp://www.secuobs.com/revue/news/601422.shtml 2016-03-18 01:41:56 - Office of Inadequate Security : Jana Hollingsworth reports The Cloquet school district was the victim of a malicious computer software attack last week http://www.secuobs.com/revue/news/601369.shtmlhttp://www.secuobs.com/revue/news/601369.shtml 2016-03-17 11:32:11 - SecurityTube.Net : In today s world, everyone relies on cryptography to protect important data When you purchase your morning coffee, something encrypts your credit cards before sending it off for processing When you log into your work laptop and sign on to the network, the operating system uses cryptography to protect your password When you log into your bank website, your browser encrypts the traffic sent over the internet System administrators have long known that tools that use encryption such as SSH are much safer than tools that do not such as telnet Cryptographic attacks are often very difficult and require a large amount of time and resources Fortunately for attackers, the safety that cryptography provides can lull users into a false sense of security The power of modern cryptography protects clear text data by turning it into unreadable cipher text Unfortunately for defenders, weaknesses at the perimeter of the cryptosystems used to protect data can often lead to compromise This talk will demonstrate various attacks against the perimeter of cryptosystems By the end of the talk you will see how malicious actors can steal credit cards by using malware on POS systems, steal passwords from applications by dumping system memory, backdoor cryptography tools, and use vulnerabilities in cryptography software to escalate privileges on a compromised system This talk will also discuss ways that individuals and organizations can protect against these types of attacks You do not need to be technically proficient to follow along with this talk However, if you are a total nerd, do not worry there will be plenty of demos chock-full of source code and low-level system concepts to keep your mind entertained Trenton Ivey has had the desire to understand how things work since early childhood Hacking, programming, reverse engineering, and electronics quickly became some of his favorite topics of interest Today, Trenton is a Principal Consultant on the Dell SecureWorks Red Team As a seasoned penetration tester, Trenton is able to knowledgeably discuss the tactics and techniques that actually work in real world environments For More Information Please Visit - http cypherconcom http wwwirongeekcom iphp page videos cyphercon2016 mainlist http://www.secuobs.com/revue/news/601293.shtmlhttp://www.secuobs.com/revue/news/601293.shtml 2016-03-16 19:00:27 - Security Bloggers Network : Over the last decade the technology industry has grown by leaps and bounds Along with this rapid growth, cyber-attacks have evolved in parallel at an alarming rate Part of this growth can be attributed to the growing number of markets and attack services available to the public Today, those who wish to carry out a http://www.secuobs.com/revue/news/601235.shtmlhttp://www.secuobs.com/revue/news/601235.shtml 2016-03-16 15:16:18 - LinuxSecurity.com Latest News : LinuxSecuritycom Researchers are tracking a massive spam campaign pelting inboxes with Locky ransomware downloaders in the form of JavaScript attachments The huge spike, reported by security firm Trustwave, represents an extraordinary uptick in the attempted distribution of the Locky ransomware http://www.secuobs.com/revue/news/601195.shtmlhttp://www.secuobs.com/revue/news/601195.shtml 2016-03-16 07:59:23 - Security Bloggers Network : On November 3, 2015, ProtonMail, a Switzerland-based encrypted email service, tweeted out that it had been taken offline by a distributed denial-of-service DDoS attack The attack was so massive that it spread to the datacenter where the email service kept its servers, causing several banks and some tech companies to be knocked offline For days, Read More The post Report DDoS Attacks Grew in Number, Size, and Sophistication in Q4 2015 appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/601158.shtmlhttp://www.secuobs.com/revue/news/601158.shtml 2016-03-15 21:12:08 - Slashdot Your Rights Online : An anonymous reader writes According to four leading security firms, some of the recent ransomware attacks against US companies have been performed by hacking groups working at the behest of China's government From the report, Security firms Attack Research, InGuardians and G-C Partners, said they had separately investigated three other similar ransomware attacks since December Although they cannot be positive, the companies concluded that all were the work of a known advanced threat group from China IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/601113.shtmlhttp://www.secuobs.com/revue/news/601113.shtml 2016-03-14 14:49:56 - SecurityTube.Net : Techniques for glitching attacks are well known, but there is little information on how to implement a full reliable exploit on a target In this talk, we attempt to implement and execute successful voltage and clock glitching attacks on a group of target devices During the talk, we detail the necessary conditions required to create an affordable, and reliable exploit for a target device Other attacks typically involve decapping the target chip, with the use of expensive equipment typically out of reach of the normal hobbyist In contrast, electrical glitching is a technique that can be used non-invasively, and can allow attackers the ability to bypass normal software protections or generate exploitable conditions within the target device Electrical glitching involves modification of the clock or the voltage supplied to a chip Clock glitching involves sending an out of cycle clock edge in order to make the chip advance to its next state prematurely, allowing us to bypass entire instructions Voltage glitching involves increase or decreasing the voltage supplied to a chip in order to alter the state of the propagation delay experienced by the transistors in the chip, allowing you to corrupt register memory The talk will involve studying and reproducing results from well known cases of electrical glitching such as the Xbox 360 clock glitch exploit For More Information Please Visit - https wwwblackhatcom indexhtml http://www.secuobs.com/revue/news/600994.shtmlhttp://www.secuobs.com/revue/news/600994.shtml 2016-03-14 14:49:56 - SecurityTube.Net : In 2013 and 2014, JAVA and IE were the most popular attack targets for PCs Oracle introduced a pop-up window to escape from the attack spotlight Microsoft introduced isolated heap and memory protector to avoid huge attacks from UAF bugs in the second half of 2014 Based on these findings in late 2014, I predicted that 2015 would be the Year of the Flash Attack Armed with this knowledge, I worked to discover several flash 0-day attacks The most important thing to discover with flash 0-day attacks is how to get effective samples in the wild, and the second important task is how to identify 0-days effectively from these samples which maybe very large data sets In this session, I will detail the following points The various channels I used to get flash samples in the wild The process I used to identify 0-day samples from these big sets of data The tool I used to detect flash 0-day attack samples with extremely low false positive alerts For More Information Please Visit - https wwwblackhatcom indexhtml http://www.secuobs.com/revue/news/600982.shtmlhttp://www.secuobs.com/revue/news/600982.shtml 2016-03-12 15:49:42 - Security Bloggers Network : Invincea announced and released the Advanced Attack Challenge simulation engine at the RSA Conference in early March This modeling and simulation app is the manifestation of a paper we published recently on Adversarial Modeling The post Take the Advanced Attack Challenge appeared first on Invincea http://www.secuobs.com/revue/news/600888.shtmlhttp://www.secuobs.com/revue/news/600888.shtml 2016-03-11 20:17:10 - Risk Assessment Ars Technica : Oracle said the flaw was fixed Newly released exploit code shows otherwise http://www.secuobs.com/revue/news/600856.shtmlhttp://www.secuobs.com/revue/news/600856.shtml 2016-03-11 17:31:58 - Security Bloggers Network : Introduction It is clear that distributed denial-of-service DDoS attacks are still in vogue It is clear that they have become more ubiquitous, more sophisticated, and more powerful than ever Go on to the site to read the full article http://www.secuobs.com/revue/news/600847.shtmlhttp://www.secuobs.com/revue/news/600847.shtml 2016-03-11 17:31:58 - Security Bloggers Network : It seems that February was a busy month for scammers, who managed to trick a number of companies into coughing up confidential payroll information about their staff http://www.secuobs.com/revue/news/600844.shtmlhttp://www.secuobs.com/revue/news/600844.shtml 2016-03-11 17:31:58 - Security Bloggers Network : Might angry chess fanatics be behind the attack http://www.secuobs.com/revue/news/600842.shtmlhttp://www.secuobs.com/revue/news/600842.shtml 2016-03-11 16:02:12 - LinuxSecurity.com Latest News : LinuxSecuritycom Distributed Denial of Service DDoS attacks are more frequent, bigger and more damaging than ever before a new report by internet security firm Verisign has warned http://www.secuobs.com/revue/news/600837.shtmlhttp://www.secuobs.com/revue/news/600837.shtml 2016-03-11 03:48:32 - Security Bloggers Network : Popular social network app Snapchat has revealed that its employees were targeted by a scammer pretending to be the company s co-founder and CEO Evan Spiegel in a phishing attack Richard Beck, Head of Cyber Security at QA commented Reports that Snapchat has fallen victim to a phishing attack underlines the findings of a new report from PhishLabs, which concludes that this method of attack remains the top threat vector for cyber assaults As the scammers http://www.secuobs.com/revue/news/600794.shtmlhttp://www.secuobs.com/revue/news/600794.shtml 2016-03-10 07:13:29 - SecurityTube.Net : The XNU kernel powers Apple's operative systems As their market share grows, exploitation of OS X and iOS is gaining popularity The introduction of kernel exploit mitigations such as KASLR and SMEP has been overcome with new techniques vm_map_copy corruption, a well-known technique useful for bypassing KASLR and SMAP AS Isolation, has been mitigated in 1011 iOS 9 My talk will demonstrate new techniques to get around XNU's latest changes and I will demonstrate a real kernel exploit for the most recent version of El Capitain to bypass System Integrity Protection rootless For More Information Please Visit - https wwwblackhatcom indexhtml http://www.secuobs.com/revue/news/600684.shtmlhttp://www.secuobs.com/revue/news/600684.shtml 2016-03-10 07:13:29 - SecurityTube.Net : White-Box Cryptography WBC aims to provide software implementations of cryptographic algorithms that are resistant against an attacker with full access to the internals Therefore, the key must remain secure even if the attacker is able to inspect and modify the execution of the cryptographic algorithm This is often referred to as security in the White-Box context In a vanilla implementation of a cryptographic algorithm, access to intermediate results directly leads to extraction of the key To achieve security in the white-box context, data encoding schemes and strong obfuscation are typically applied This type of implementation is commonly seen in DRM systems, and is currently gaining momentum in the mobile payment market Assessing the security of WBC implementations is a challenge both for evaluators and for WBC designers, as it often requires a powerful mix of reverse engineering and applied cryptanalysis skills In this presentation, we show how attacks typically used to attack hardware cryptosystems can be ported to the white-box settings We will introduce generic yet practical attacks on WBC implementations of the TDES and AES ciphers Additionally, we will analyze the requirements for each attack and discuss potential countermeasures We have applied these attacks to recover cryptographic keys from commercial as well as academic implementations During the presentation, we will demonstrate several attacks on open source WBC implementations using custom tools If you are tasked with evaluating the attack resistance of a WBC-based solution, this presentation will provide a better understanding of what White-Box Cryptography is and how to evaluate its robustness against different key extraction attacks If you are a WBC designer, you will obtain a better understanding of what the most common weak points of such schemes are Our results highlight the importance of evaluating WBC implementations with respect to these generic attacks in order to provide correct judgment about their level of security For More Information Please Visit - https wwwblackhatcom indexhtml http://www.secuobs.com/revue/news/600673.shtmlhttp://www.secuobs.com/revue/news/600673.shtml 2016-03-10 07:13:29 - SecurityTube.Net : Continuous Integration CI tools provide an excellent attack surface due to the no poor security controls, distributed build management capability, and level of access privileges in an enterprise This talk looks at the CI tools from an attacker's perspective and to use them as portals for getting a foothold and lateral movement We will see how to execute attacks like command and script execution, credentials stealing, privilege escalation to not only compromise the build process but the underlying operating system and even entire Windows domains No memory corruption bugs will be exploited and only the features of the CI tools will be used Popular CI tools, open source as well as proprietary will be the targets The talk will be full of live demonstrations For More Information Please Visit - https wwwblackhatcom indexhtml http://www.secuobs.com/revue/news/600668.shtmlhttp://www.secuobs.com/revue/news/600668.shtml 2016-03-09 20:00:50 - Security Bloggers Network : A popular children's toy made by LeapFrog is susceptible to a variety of attacks that leverage Adobe Flash vulnerabilities David Bisson reports http://www.secuobs.com/revue/news/600620.shtmlhttp://www.secuobs.com/revue/news/600620.shtml 2016-03-09 19:52:18 - Symantec Connect Security Response Billets : Phishing attacks have linked back to YouTube channels where phishers explain their attacks and promote their tools while looking for buyers IMAGE Read More http://www.secuobs.com/revue/news/600613.shtmlhttp://www.secuobs.com/revue/news/600613.shtml 2016-03-09 15:24:53 - Security Bloggers Network : If you haven't filed your taxes yet, you really should go ahead and do it before a cybercriminal does it for you http://www.secuobs.com/revue/news/600592.shtmlhttp://www.secuobs.com/revue/news/600592.shtml 2016-03-09 15:24:53 - Security Bloggers Network : Whichever web browser you are using, you should know that using any plugin runs the risk of putting your system - and your data - in increased peril Yasin Soliman reports http://www.secuobs.com/revue/news/600589.shtmlhttp://www.secuobs.com/revue/news/600589.shtml 2016-03-08 19:01:22 - Security Bloggers Network : A highlight of the annual Global Network Application Security Report is always the deep case studies Each year, we work closely with a customer that has made the difficult, but admirable decision to shine a light on their experiences as a victim of a cyber-security attack By sharing, these customers can help others prepare http://www.secuobs.com/revue/news/600503.shtmlhttp://www.secuobs.com/revue/news/600503.shtml 2016-03-08 17:42:14 - Blog : I ve been a huge PowerShell fan ever since I first discovered it as a Systems Administrator many years ago It s an incredibly easy to use, intuitive and powerful language and helped me efficiently address a lot of tasks that came across my plate Unfortunately, the other Systems Administrators that I worked with were less keen to pick it up Years of pointing and clicking had made them nervous about using a command line For different reasons, the Information Security community is in a similar state PowerShell is an incredible platform for both offense and defense There is a lot of cutting edge work being done by members of the PowerShell community, but the Information Security community at large is unaware of a lot of their contributions This may stem from a lack of interest in Windows development or fear of having to learn yet another scripting language No matter the reason, a lot of security professionals are missing out on some great work Enter PSAttack --------------- To help make using offensive PowerShell easier, I ve created PSAttack PSAttack is a custom made console that is designed to emulate PowerShell and enhance it Built into PSAttack are over 110 offensive PowerShell commands representing some of the greatest work going on in the offensive PowerShell community This selection of tools runs the entire gamut of a security assessment including Reconnaissance, Privilege Escalation, Backdoors and Data Exfiltration It also includes a custom command called get-attack which helps to serve as an attack search engine It takes a word or phrase and returns a list of commands and their descriptions that match what you re looking for Get-Attack returning a list of commands related to the word Password All of this is bundled into a single executable that runs on anything from a fresh install of Windows 7 all the way up to a fully patched version of Windows 10 There s no installer, just double click and start attacking Not Just for the Lab -------------------- In creating PSAttack, I didn t want to create a tool that was only used in a lab environment I wanted to create something that was useful and could find its way into a penetration tester s bag of tricks To this end, PSAttack is designed to evade antivirus and other hurdles The various scripts and payloads that provide the commands are encrypted before being embedded into the executable When PSAttack is run, these scripts are decrypted directly into memory, so the plain text payloads never touch the hard drive This helps avoid detection by most antivirus solutions PSAttack is also written using native NET functions and objects to process PowerShell code, it does not rely on powershellexe Because NET is such an important part of Windows, this means that it s very difficult for an organization to prevent PSAttack from accessing the functionality it needs to run Getting PSAttack ----------------- PSAttack is available on our Github account You can either compile the code yourself using Visual Studio or you can download pre-compiled binaries from the releases tab Acknowledgments --------------- PSAttack relies on a lot of tools to make itself effective and it s important to make sure that the authors of those tools get the attention they deserve Scripts from the following tools and frameworks are incorporated into PSAttack These tools represent some of the best work being done in offensive PowerShell today PowerSploit Nishang Inveigh PowerCat IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/600493.shtmlhttp://www.secuobs.com/revue/news/600493.shtml 2016-03-08 08:28:23 - Help Net Security : A hack on the Ukrainian power grid in late 2015 blacked out more than 225,000 people, according to Claims Journal, which described this type of attack as a nightmare scenario for top US officials They also reported that US Cyber Command chief Adm Michael Rogers has previously warned that it s not a matter of if, but when attackers will also target US power systems We have seen in the past that energy companies with low More http://www.secuobs.com/revue/news/600432.shtmlhttp://www.secuobs.com/revue/news/600432.shtml 2016-03-08 00:43:41 - Security Bloggers Network : It s happened again Scammers have leveraged Phishing to gain access to W2 information at several firms, including technology powerhouse Seagate No company is immune to these types of social attacks, and organizations both large and small have become victims to a finance-based scheme that has a long reach Last week, Sunday in fact, Snapchat disclosed that someone had posed as the company s CEO and requested employee payroll data The email wasn t viewed as a scam, http://www.secuobs.com/revue/news/600410.shtmlhttp://www.secuobs.com/revue/news/600410.shtml 2016-03-07 16:56:38 - Slashdot Your Rights Online : itwbennett writes You can add Seagate to the growing list now up to 7 of companies hit by malware seeking W2 data on employees As reported on Slashdot, Snapchat disclosed the last weekend of February that someone had posed as the company's CEO and received payroll data on 700 employees The other companies hit by similar phishing scams so far are Central Concrete Supply Co, Mercy Housing Inc, Magnolia Health Corporation, BrightView, and Polycom Seagate learned of the incident on March 1, and the story was broken by Brian Krebs after a former employee received a notice and reached out to him IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/600378.shtmlhttp://www.secuobs.com/revue/news/600378.shtml 2016-03-07 11:15:23 - SecurityTube.Net : Software developers have provided unlimited job security for the infosecindustry Likewise, malware authors also have a history of making baddesign choices that allow defenders opportunities to use those mistakesagainst them Between failed crypto implementations in ransomware to'license verification' of commercial malware tools, even malware softwaredevelopers suckThis talk will focus on several case studies, one being of AlienSpy JSocket and the design decisions made by the author that can be used to great effect to disable the malware world-wide The earlier version, AlienSpy, was knocked outworldwide forcing the developer to create an entire new version of the malware and have all his customers reinstall potentially losing theirvictims Others will be added for interesting current events For More Information Please Visit - https bsidessfcom http wwwirongeekcom iphp page videos bsidessf2016 mainlist http://www.secuobs.com/revue/news/600340.shtmlhttp://www.secuobs.com/revue/news/600340.shtml 2016-03-07 11:15:23 - SecurityTube.Net : While we will never see the end of generalized mass attacks, the real damage is being done through highly targeted attacks I will discuss why targeted attacks are so effective and economically advantageous to the attacker and why that trend is likely to continue After considering several examples I will provide some suggestions for countermeasures against this strategy For More Information Please Visit - https bsidessfcom http wwwirongeekcom iphp page videos bsidessf2016 mainlist http://www.secuobs.com/revue/news/600334.shtmlhttp://www.secuobs.com/revue/news/600334.shtml 2016-03-07 10:40:15 - Help Net Security : Here s an overview of some of last week s most interesting news, reviews and articles RSA Conference 2016 coverage Check out our coverage page to see what you ve missed at RSA Conference 2016 CTB Locker ransomware now also encrypts websites The well-known crypto ransomware CTB Locker is back After a considerable slowdown in distribution, it is being pushed onto users again, and this time its executable has been signed with a stolen certificate But what is More http://www.secuobs.com/revue/news/600326.shtmlhttp://www.secuobs.com/revue/news/600326.shtml 2016-03-07 02:57:10 - Office of Inadequate Security : Daniel Thomas reports The damaging cyber attack on TalkTalk s website last year will lead to a fundamental change in how http://www.secuobs.com/revue/news/600307.shtmlhttp://www.secuobs.com/revue/news/600307.shtml 2016-03-06 03:37:31 - Slashdot Your Rights Online : An anonymous reader writes with this story from the New York Times, excerpting After three years of planning, an immigrant rights group in Jackson Heights is set to start a smartphone app for day laborers, a new digital tool with many uses Workers will be able to rate employers think Yelp or Uber , log their hours and wages, take pictures of job sites and help identify, down to the color and make of a car, employers with a history of withholding wages They will also be able to send instant alerts to other workers The advocacy group will safeguard the information and work with lawyers to negotiate payment Adds the submitter Although I completely support the app, personally, I see this encountering some significant legal challenges Hope they've lawyered up Though the use case is different, this is similar in spirit to cop watch apps, like Cell411 and the ACLU's Mobile Justice And of course there's Periscope IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/600271.shtmlhttp://www.secuobs.com/revue/news/600271.shtml 2016-03-05 19:52:37 - Office of Inadequate Security : Moonpigcom has had two security incidents that I ve previously noted on this site, but a matter before a UK court now http://www.secuobs.com/revue/news/600261.shtmlhttp://www.secuobs.com/revue/news/600261.shtml 2016-03-04 17:11:13 - Help Net Security : CyberArk announced at RSA Conference new real-time threat detection and containment capabilities to help organizations secure against cyber attacks targeting Microsoft Active Directory infrastructure Compromising Active Directory empowers attackers to take control of the business The new CyberArk Privileged Threat Analytics v30 features targeted analytics and the ability to analyze network traffic to better detect indications of an attack early in the lifecycle, including credential theft, lateral movement and privilege escalation These features enable incident More http://www.secuobs.com/revue/news/600188.shtmlhttp://www.secuobs.com/revue/news/600188.shtml 2016-03-04 07:45:54 - Security Bloggers Network : Over reliance on AM software is increasing organizational risk beyond acceptable levels Mitigating this risk requires viewing AM software as just another security layer one that is inadequate by itself http://www.secuobs.com/revue/news/600131.shtmlhttp://www.secuobs.com/revue/news/600131.shtml 2016-03-04 04:17:10 - Security Bloggers Network : A new vulnerability could leave as many as one-third of HTTPS websites open to decryption The post One-third of HTTPS websites left vulnerable to DROWN attack appeared first on We Live Security http://www.secuobs.com/revue/news/600118.shtmlhttp://www.secuobs.com/revue/news/600118.shtml 2016-03-03 21:46:31 - Risk Assessment Ars Technica : Researcher-devised exploit threatens Bitcoin wallets and other high-value assets http://www.secuobs.com/revue/news/600093.shtmlhttp://www.secuobs.com/revue/news/600093.shtml 2016-03-03 16:06:30 - LinuxSecurity.com Latest News : LinuxSecuritycom For the third time in less than a year, security researchers have found a method to attack encrypted Web communications, a direct result of weaknesses that were mandated two decades ago by the US government http://www.secuobs.com/revue/news/600044.shtmlhttp://www.secuobs.com/revue/news/600044.shtml 2016-03-03 14:57:11 - Help Net Security : ThreatMetrix announced at RSA Conference the newest innovation in the fight against global cybercrime the Digital Identity Graph, a framework for anonymized global digital identities on the internet The Digital Identity Graph maps the complex and ever-changing associations among people and their communication devices, account credentials, telephone numbers, physical addresses and the businesses with which they interact Using the underlying graph framework, ThreatMetrix can define digital persona relationships on a global scale, enabling businesses More http://www.secuobs.com/revue/news/600035.shtmlhttp://www.secuobs.com/revue/news/600035.shtml 2016-03-03 12:16:33 - Help Net Security : The Maritime Trade Information Sharing Center, Gulf of Guinea MTISC-GoG has denied that it has suffered a data breach that could result in sea pirates knowing details about ships in the region, including their position MTISC GoG is aware of the currently unsubstantiated allegations contained within the ISPS Statement issued by Danish Coastguard regarding information security at the Centre in Accra, Ghana Despite urgent requests for further information, nothing has been provided by the More http://www.secuobs.com/revue/news/600020.shtmlhttp://www.secuobs.com/revue/news/600020.shtml 2016-03-03 06:58:07 - Risky Business : Tagline YSoSerial makes deserialisation attacks serious Media URL http mediariskybiz RB401mp3Content HeadersContent Length 35909421 Content Type audio mpeg On this week's show we get into a serious technical discussion about deserialisation attacks with with one of Adam Boileau's colleagues, Brendan Jamieson about the biggest issue in infosec that no one is talking about -- deserialisation vulnerabilities and their exploitation This attack class is a serious problem in enterprise environments thanks to the release of the YSoSerial tool about a year ago Pen-testers who are across this bug class are finding issues everywhere they look, and hardly anyone is talking about it But we do, this week read more http://www.secuobs.com/revue/news/599978.shtmlhttp://www.secuobs.com/revue/news/599978.shtml 2016-03-03 06:17:37 - Slashdot Your Rights Online : An anonymous reader writes Verizon's most recent Data Breach Digest includes a curious hacking case Apparently a group of sea pirates have hired a hacker who uploaded a Web shell to a shipping company's CMS that allowed them to download cargo inventories and ship routes They then used this information to attack ships, equipped with a barcode reader and weapons of course , searching specific crates, emptying all the high-value cargo, and making off with the loot within minutes of launching their attacks IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/599976.shtmlhttp://www.secuobs.com/revue/news/599976.shtml 2016-03-02 20:46:58 - Darknet The Darkside : http://www.secuobs.com/revue/news/599940.shtmlhttp://www.secuobs.com/revue/news/599940.shtml 2016-03-02 15:30:42 - LinuxSecurity.com Latest News : LinuxSecuritycom A new deadly security vulnerability has been discovered in OpenSSL that affects more than 11 Million modern websites and e-mail services protected by an ancient, long deprecated transport layer security protocol, Secure Sockets Layer SSLv2 http://www.secuobs.com/revue/news/599912.shtmlhttp://www.secuobs.com/revue/news/599912.shtml 2016-03-02 10:19:25 - Help Net Security : Akamai Technologies has shared the latest DDoS and web application attacks numbers in its Q4 2015 State of the Internet report DDoS attack activity at a glance During Q4, repeat DDoS attacks were the norm, with an average of 24 attacks per targeted customer in Q4 Three targets were subject to more than 100 attacks each and one customer suffered 188 attacks an average of more than two per day During Q4, Akamai mitigated More http://www.secuobs.com/revue/news/599879.shtmlhttp://www.secuobs.com/revue/news/599879.shtml 2016-03-02 05:51:57 - SecurityTube.Net : Domestic routers have lately been targeted by cybercrime due to the huge amount of well-known vulnerabilities which compromise their security The purpose of this paper is to appraise SOHO router security by auditing a sample of these devices and to research innovative attack vectors More than 60 previously undisclosed security vulnerabilities have been discovered throughout 22 popular home routers, meaning that manufacturers and Internet Service Providers have still much work to do on securing these devices A wide variety of attacks could be carried out by exploiting the different types of vulnerabilities discovered during this research Jose Antonio Rodriguez Garcia, Ivan Sanz de Castro, and Álvaro Folgado Rueda independent IT security researchers held this presentation at DeepSec 2015 For More Information Please Visit - https deepsecnet http://www.secuobs.com/revue/news/599867.shtmlhttp://www.secuobs.com/revue/news/599867.shtml 2016-03-02 05:51:57 - SecurityTube.Net : At DeepSec 2015 Nikhil Mittal held a presentation about CI tools and they use for attackers Continuous Integration CI tools provide excellent attack surfaces due to no poor security controls, the distributed build management capability and the level of access privileges in an enterprise This talk looks at the CI tools from an attacker s perspective, using them as portals to get a foothold and for lateral movement We will show how to execute attacks like command and script execution, credentials stealing and privilege escalation how to not only compromise the build process but the underlying Operating System and even entire Windows domains No memory corruption bugs will be exploited and only the features of the CI tools will be used Popular CI tools, open source as well as proprietary, will be the targets The talk will be full of live demonstrations For More Information Please Visit - https deepsecnet http://www.secuobs.com/revue/news/599858.shtmlhttp://www.secuobs.com/revue/news/599858.shtml 2016-03-01 17:49:51 - Help Net Security : There s a new attack that breaks the communication encryption provided by SSL and TLS and can therefore lead to theft of extremely sensitive data exchanged between users and a vulnerable server It has been dubbed DROWN Decrypting RSA with Obsolete and Weakened eNcryption by the group researchers who discovered it, and the stems from the fact that many servers out there still support SSLv2, the extremely old and insecure predecessor to TLS In technical terms, More http://www.secuobs.com/revue/news/599813.shtmlhttp://www.secuobs.com/revue/news/599813.shtml 2016-03-01 17:12:36 - Security Bloggers Network : pr-cyber-reference-architecturepng Hewlett Packard Enterprise leads transformation of cyber defense with Build it In and Stop it Now approach Learn more about these efforts and new announcements at RSA Conference 2016, in booth 3411 IMAGE IMAGE IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/599798.shtmlhttp://www.secuobs.com/revue/news/599798.shtml 2016-03-01 16:12:29 - LinuxSecurity.com Latest News : LinuxSecuritycom More than 11 million websites and e-mail services protected by the transport layer security protocol are vulnerable to a newly discovered, low-cost attack that decrypts sensitive communications in a matter of hours and in some cases almost immediately, an international team of researchers warned Tuesday http://www.secuobs.com/revue/news/599789.shtmlhttp://www.secuobs.com/revue/news/599789.shtml 2016-03-01 14:26:52 - Risk Assessment Ars Technica : Low-cost DROWN attack decrypts data in hours, works against TLS e-mail servers, too http://www.secuobs.com/revue/news/599774.shtmlhttp://www.secuobs.com/revue/news/599774.shtml 2016-03-01 03:04:41 - Office of Inadequate Security : Abby Sewell reports that Los Angeles County Department of Health Services computers were hit with a ransomware attack just http://www.secuobs.com/revue/news/599714.shtmlhttp://www.secuobs.com/revue/news/599714.shtml 2016-02-29 14:43:36 - SecurityTube.Net : Banking malware is one of the most serious threats to both end-users and financial institutions It is reported that over 1,400 financial institutions have been targeted by attackers using financial trojans and the top 15 targeted financial institutions were targeted by more than 50 percent of the trojans in 2013 One major tactic of banking malware is the use of man-in-the-browser attacks web injection attacks In fact, almost all modern banking malware use this tactic In this paper, we first explain how banking malware conducts credential stealing and automatic transaction with man-in-the-browser attacks, and analyse several web injection scripts from prevalent banking malware families Then we present our survey of existing techniques against these malware, as well as their limitations Next, inspired by the observation that banking malware's injection is based on a certain context of the target web pages, we propose an application layer system to protect financial institutions from web injection attacks The system works as an HTTP reverse proxy in front of protected web servers, and injects a fake context into the target page, according to the malware's web injection configuration The fake context traps the banking malware's web injection scripts in an invisible HTTP element An alert is also triggered when injection happens, so the system detects the ongoing attacks More importantly, it prevents credential stealing as the web injection scripts are injected into invisible decoy elements Finally, we report the results of an experiment based on banking malware samples collected in the wild The results shows that the system can detect and prevent web injection attacks from these samples For More Information Please Visit - https wwwvirusbulletincom http://www.secuobs.com/revue/news/599644.shtmlhttp://www.secuobs.com/revue/news/599644.shtml 2016-02-28 19:22:28 - Office of Inadequate Security : BBC reports Hackers supporting the Islamic State group launched an attack on a small solar energy company in Sussex with http://www.secuobs.com/revue/news/599589.shtmlhttp://www.secuobs.com/revue/news/599589.shtml 2016-02-27 13:29:23 - Security Bloggers Network : External cybersecurity threats get all the press, and they are certainly dangerous Shadowy international gangsters, brilliant but evil hackers, mom-and-pop-shop criminals stealing from us one Target transaction at a time as fictional as it http://www.secuobs.com/revue/news/599544.shtmlhttp://www.secuobs.com/revue/news/599544.shtml 2016-02-26 02:24:48 - Office of Inadequate Security : Michael Mimoso reports The nation-state sponsored hacker group allegedly behind the 2014 attack against Sony Pictures http://www.secuobs.com/revue/news/599422.shtmlhttp://www.secuobs.com/revue/news/599422.shtml 2016-02-25 19:16:07 - Slashdot Your Rights Online : AmiMoJo writes Back in November 2015 it was speculated that Carnegie Mellon University CMU helped the FBI attack the TOR network Now, both the name of the university and the existence of a subpoena have been confirmed in a recent filing in one of the affected criminal cases The record demonstrates that the defendant's IP address was identified by the Software Engineering Institute SEI of Carnegie Mellon University CMU sic when SEI was conducting research on the Tor network which was funded by the Department of Defense DOD , an order filed on Tuesday in the case of Brian Farrell reads Between January and July 2014, a large number of malicious nodes operated on the Tor network, with the purpose, according to the Tor Project, of deanonymising dark web sites and their users The attack relied on a set of vulnerabilities in the Tor software which have since been patched and according to one source, the technique could unmask new hidden services within two weeks IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/599402.shtmlhttp://www.secuobs.com/revue/news/599402.shtml 2016-02-25 17:46:35 - Risk Assessment Ars Technica : Survey, YouTube offer proof that people are blowing up ATMs to get the cash inside http://www.secuobs.com/revue/news/599391.shtmlhttp://www.secuobs.com/revue/news/599391.shtml 2016-02-25 11:41:23 - SecurityTube.Net : Mr Seidl jseidl is the nominee of this years top submitter of presentation proposals He submitted a number of interesting presentation proposals in various technical areas Of these proposals, the programme comittee selected two that we feel is really interesting The title on Mr Seidls first presentation is PhysICS Using physics simulation engine to demonstrate impacts on industrial control attacks In this presentation Seidl will use VirtuaPlant as a mechanism to describe attacks against infrastructure Mr Seidls second talk title Reducing attack surface on ICS with Windows native solutions In this presentation Mr Seidl will describe how all the free things that already is available in the windows toolkit can be put to best use By really applying the usage of things like Applocker, Software Restriction Policy, EMET, PowerShell, CScript, WScript and the likes, an asset owner can do alot of security enhancements with a little effort Mr Seidl is an independent security researcher, and have worked as a contractor with many utility companies to secure their infrastructure and environment For More Information Please Visit - https 4sicsse http://www.secuobs.com/revue/news/599343.shtmlhttp://www.secuobs.com/revue/news/599343.shtml 2016-02-25 04:24:46 - Help Net Security : Niara, a provider of security analytics for attack detection and incident response, announced that the latest release of its security analytics platform analyzes any data source and supports the customization of its behavioral analytics modules, providing organizations with visibility into attacks and risky behaviors inside their environments Organizations can now derive security insights from data sources by combining Niara s built-in behavioral analytics with custom modules unique to their particular environment As a result, organizations benefit More http://www.secuobs.com/revue/news/599319.shtmlhttp://www.secuobs.com/revue/news/599319.shtml 2016-02-24 13:46:59 - Help Net Security : Independent Security Evaluators ISE published a study that demonstrates security flaws to be pervasive within the healthcare industry The research found that adversaries could deploy cyber attacks that result in physical harm to patients 100pourcents of the hospitals investigated all had very serious security issues, suggesting broader implications across the entire industry The following diagram shows how an attack that disrupts the accurate delivery of medicine can directly affect a patient s health In this case, More http://www.secuobs.com/revue/news/599251.shtmlhttp://www.secuobs.com/revue/news/599251.shtml 2016-02-24 13:08:44 - SecurityTube.Net : 4SICS 2015 - Panel day 2 Research on ICS attacks and ICS attackers For More Information Please Visit - https 4sicsse http://www.secuobs.com/revue/news/599247.shtmlhttp://www.secuobs.com/revue/news/599247.shtml 2016-02-24 13:08:44 - SecurityTube.Net : Mr Sherif is an experienced Web application Penetration Tester that is currently employed by the Egyptian CERT In his presentation Simulating Attacks on infrastructure systems in Egypt , Mr Sherif will give a closer look at what you find if you scan your countrys IP address ranges for sensitive control systems Also, what will happen if you deployed ICS honeypots to research how the hackers attacking ICS systems in Egypt Mr Sherif started his career as a web developer then moved to the information security field He has contributed to many security projects and he is the co-founder of iScanner project Mr Sherif has been acknowledged by many companies eg Yahoo, Ebay, Adobe, LinkedIn for finding security issues in their websites as part of various bug-bounty programs For More Information Please Visit - https 4sicsse http://www.secuobs.com/revue/news/599243.shtmlhttp://www.secuobs.com/revue/news/599243.shtml 2016-02-24 08:51:50 - Help Net Security : Cylance revealed a multi-year, multi-attack campaign against the Japanese critical infrastructure Their research uncovers how a well-organized and well-funded threat group, likely associated with a nation state, has used a variety of attack vectors and techniques to infiltrate and gather sensitive information from companies in electric utilities, oil and gas, finance, transportation and construction Since 2010, a threat group with considerable resources has been using various exploits to attack commercial interests around the globe, with a More http://www.secuobs.com/revue/news/599220.shtmlhttp://www.secuobs.com/revue/news/599220.shtml 2016-02-24 06:30:33 - Security Bloggers Network : There is nothing more frustrating to a customer or client who is unable to access the website of a company, bank or retailer Multiple emails and attempts to check out often lead to the viewpoint of forget them I will just go to another e-retailer to see if they have it in stock Equally frustrating, and Read More The post Defending Your Network Against DDoS Attacks appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/599212.shtmlhttp://www.secuobs.com/revue/news/599212.shtml 2016-02-23 18:27:29 - Help Net Security : Illusive networks launched illusive 30 with Attacker View, a technology that enables IT security professionals to view their corporate network from an attacker s perspective Armed with a detailed map of how attackers view and traverse a network, IT security professionals can now visualize attack paths and adapt their security strategy to mitigate attacker s lateral movement Attacker View differs from mapping software and network architecture by showing the attack vectors found on each machine, and illustrates More http://www.secuobs.com/revue/news/599160.shtmlhttp://www.secuobs.com/revue/news/599160.shtml 2016-02-23 02:30:59 - Office of Inadequate Security : Sarwar Kashani reports The authorities had in the past proposed that the sprawling Jammu and Kashmir Entrepreneurship http://www.secuobs.com/revue/news/599046.shtmlhttp://www.secuobs.com/revue/news/599046.shtml 2016-02-22 22:08:17 - Security Bloggers Network : Mobile malware is a growing threat Banking, shopping, email We do things on our phones that used to only be done on our desktop PC Hackers know valuable data is stored on people s phones, and they increasingly find new ways to attack mobile users The most common mobile threats are adware packaged as fun gaming IMAGE http://www.secuobs.com/revue/news/599025.shtmlhttp://www.secuobs.com/revue/news/599025.shtml 2016-02-22 21:30:58 - Darknet The Darkside : http://www.secuobs.com/revue/news/599019.shtmlhttp://www.secuobs.com/revue/news/599019.shtml 2016-02-22 20:43:59 - Symantec Connect Security Response Billets : Employees at six Russian banks were sent spoofed emails delivering TrojanRatopak in a narrow, targeted attack IMAGE Read More http://www.secuobs.com/revue/news/599016.shtmlhttp://www.secuobs.com/revue/news/599016.shtml 2016-02-22 15:52:43 - Risk Assessment Ars Technica : We don't know motivation behind this, says distro creator http://www.secuobs.com/revue/news/598987.shtmlhttp://www.secuobs.com/revue/news/598987.shtml 2016-02-19 23:41:57 - Security Bloggers Network : 2016 socjpg Why security cannot be an afterthought when modernizing your infrastructure IMAGE IMAGE IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/598854.shtmlhttp://www.secuobs.com/revue/news/598854.shtml 2016-02-19 21:13:10 - Security Bloggers Network : Recently there has been a lively discussion regarding the latest alleged leak of NASA which allegedly included over 250GB of employee information, flight logs, videos, and radar feeds The hack was meticulously described in a lengthy http://www.secuobs.com/revue/news/598833.shtmlhttp://www.secuobs.com/revue/news/598833.shtml 2016-02-19 18:43:24 - Security Bloggers Network : A Google researcher has been reporting severe vulnerabilities in security suites from Kaspersky, Trend Micro, MalwareBytes, FireEye, AVG, ESET and now Comodo http://www.secuobs.com/revue/news/598825.shtmlhttp://www.secuobs.com/revue/news/598825.shtml 2016-02-19 18:43:24 - Security Bloggers Network : Opening Crawl There is unrest in IT security Thousand of malicious events pass undetected each day, and have overwhelmed the limited capabilities of SIEM to protect the enterprise These attackers and rogue insiders, motivated by profit and revenge, continue to steal data without fear of detection In an effort to stem the tide, dozens of companies have created an ARMY OF ANALYTICS TOOLS to assist the overwhelmed SIEM they are The Analytics Clones End Crawl As you wander the halls of Moscone center, you'll be wondering how and where all these little firms offering 'advanced' threat http://www.secuobs.com/revue/news/598819.shtmlhttp://www.secuobs.com/revue/news/598819.shtml 2016-02-18 17:15:03 - Slashdot Your Rights Online : An anonymous reader writes with a story at Ars Technica, citing a Yahoo News interview, that National Security Agency Director Michael Rogers has explicitly blamed the terrorist attacks which struck Paris last November on communications backed by strong crypto From the article Because of encrypted communications, he said, we did not generate the insights ahead of time Clearly, had we known, Paris would not have happened Rogers did not explicitly re-launch the campaign waged by FBI director James Comey to force technology companies to provide a golden key to encrypted communications Rogers called encryption foundational to our future and added that arguing over encryption backdoors was a waste of time But he did say that encryption was making the job of the NSA and law enforcement more difficult The interview comes shortly after the FBI won an order requiring Apple to provide technical means to bypass the security measures preventing them from unlocking the iPhone 5C belonging to Syed Rizwan Farook Farook, along with his wife, are responsible for the December mass shooting in San Bernardino, California IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/598689.shtmlhttp://www.secuobs.com/revue/news/598689.shtml 2016-02-18 12:55:39 - Help Net Security : Many WordPress websites are still being misused to perform layer 7 DDoS attacks against target servers, even though preventing them from participating in these attacks is as simple as disabling the pingback feature If you are not familiar with the terminology, Layer 7 attacks also known as http flood attacks are a type DDoS attack that disrupts your server by exhausting its resources at the application layer, instead of the network layer, Sucuri Security CTO More http://www.secuobs.com/revue/news/598652.shtmlhttp://www.secuobs.com/revue/news/598652.shtml 2016-02-18 08:42:48 - Security Bloggers Network : Sophisticated targeting is one of the most important trends in security right now Although most of the malware and attacks we see are still un-targeted, the biggest and most damaging ones are highly targeted Targeted attacks have four major advantages for the hacker They are harder to detect because they impact a much smaller population Read More The post In The Crosshairs The Trend Towards Targeted Attacks appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/598631.shtmlhttp://www.secuobs.com/revue/news/598631.shtml 2016-02-17 18:04:42 - Security Bloggers Network : Dozens of online florists saw themselves struck by targeted distributed denial-of-service DDoS attacks leading up to Valentine's Day this year David Bisson reports http://www.secuobs.com/revue/news/598560.shtmlhttp://www.secuobs.com/revue/news/598560.shtml 2016-02-17 02:56:50 - Risk Assessment Ars Technica : Nitro Zeus reportedly targeted Iran's air defenses, communications, and power grid http://www.secuobs.com/revue/news/598479.shtmlhttp://www.secuobs.com/revue/news/598479.shtml 2016-02-17 02:22:03 - Security Bloggers Network : Remember to always be wary of unsolicited, unusual text messages and installing apps from third-party sources on your Android smartphone Read more in my article on the State of Security blog http://www.secuobs.com/revue/news/598472.shtmlhttp://www.secuobs.com/revue/news/598472.shtml 2016-02-16 21:43:01 - Security Bloggers Network : Sometimes it feels terrible to be right In our recent Global Application Network Security Report we predicted an increase in complex encrypted attack vectors and the importance of putting in place adequate defenses that can scale and inspect encrypted traffic Just last week, we got a vivid example of the increasing threat posed by http://www.secuobs.com/revue/news/598461.shtmlhttp://www.secuobs.com/revue/news/598461.shtml 2016-02-16 00:52:12 - Slashdot Your Rights Online : An anonymous reader writes The Hollywood Presbyterian Medical Center has been hit by a cyber-attack and its systems are now being held hostage by hackers that are demanding a ransom of 9,000 Bitcoin, which is about 36 million 32 million in today's currency Management has forbidden staff to turn on their computers, fearing the attack might spread, and the Radiation and Oncology departments have been completely shut down because they can't use their equipment The staff were also forced to use fax machines rather than email, and to write down patient data on paper patients had had to come in in person for results IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/598372.shtmlhttp://www.secuobs.com/revue/news/598372.shtml 2016-02-15 19:22:01 - Risk Assessment Ars Technica : Active attacker community often emptied accounts minutes after they went live http://www.secuobs.com/revue/news/598355.shtmlhttp://www.secuobs.com/revue/news/598355.shtml 2016-02-15 08:22:45 - SecurityTube.Net : by Billy Rios A talk at Kaspersky Lab's Security Analyst Summit TheSAS2015 For More Information Please Visit - http sas2015inriafr http://www.secuobs.com/revue/news/598284.shtmlhttp://www.secuobs.com/revue/news/598284.shtml 2016-02-14 20:19:52 - Help Net Security : Several Cisco Adaptive Security Appliance ASA products appliances, firewalls, switches, routers, and security modules have been found sporting a flaw that can ultimately lead to remote code execution by attackers The vulnerability CVE-2016-1287 is critical, as it can be exploited by an unauthenticated, remote attacker by sending crafted UDP packets to the affected system Cisco ASA Software is affected if the system is configured to terminate Internet Key Exchange IKE v1 or IKE More The post Critical bug found in Cisco ASA products, attackers are scanning for affected devices appeared first on Help Net Security http://www.secuobs.com/revue/news/598264.shtmlhttp://www.secuobs.com/revue/news/598264.shtml 2016-02-14 20:19:52 - Help Net Security : A new study conducted by Dimensional Research evaluated the confidence of IT professionals regarding the efficacy of seven key security controls that must be in place to quickly detect a cyber attack in progress Study respondents included 763 IT professionals from retail, energy, financial services and public sector organizations in the US The majority of the respondents displayed high levels of confidence in their ability to detect a data breach even though they were unsure More The post When it comes to cyber attack detection, IT pros are overconfident appeared first on Help Net Security http://www.secuobs.com/revue/news/598261.shtmlhttp://www.secuobs.com/revue/news/598261.shtml 2016-02-13 17:48:08 - Office of Inadequate Security : Chris Vickery writes An exposed database was serving potentially arbitrary HTML through the mobile version of Microsoft s http://www.secuobs.com/revue/news/598221.shtmlhttp://www.secuobs.com/revue/news/598221.shtml 2016-02-13 14:48:15 - Office of Inadequate Security : NBCLA reports A Southern California hospital was a victim of a cyber attack, interfering with day-to-day operations, the http://www.secuobs.com/revue/news/598210.shtmlhttp://www.secuobs.com/revue/news/598210.shtml 2016-02-13 02:32:49 - Symantec Connect Security Response Billets : Attackers can take advantage of February s increased download rates for apps related to Valentine's Day and dating to spread malware IMAGE Read More http://www.secuobs.com/revue/news/598189.shtmlhttp://www.secuobs.com/revue/news/598189.shtml 2016-02-12 15:55:55 - Security Bloggers Network : Netflix malware and phishing attack campaigns are contributing to the rise of a black market built around the sale of stolen credentials Lionel Payet, a threat intelligence officer at Symantec Security Response, explains in a blog post how he recently came across two unique attack campaigns that are targeting users of the popular web streaming Read More The post Netflix Malware, Phishing Attacks Contributing to Rise of Black Market appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/598165.shtmlhttp://www.secuobs.com/revue/news/598165.shtml 2016-02-12 08:50:51 - SecurityTube.Net : by Doug Madory A talk at Kaspersky Lab's Security Analyst Summit TheSAS2015 For More Information Please Visit - http sas2015inriafr http://www.secuobs.com/revue/news/598112.shtmlhttp://www.secuobs.com/revue/news/598112.shtml 2016-02-12 08:17:12 - Help Net Security : A new study conducted by Dimensional Research evaluated the confidence of IT professionals regarding the efficacy of seven key security controls that must be in place to quickly detect a cyber attack http://www.secuobs.com/revue/news/598104.shtmlhttp://www.secuobs.com/revue/news/598104.shtml 2016-02-11 17:51:57 - Security Bloggers Network : Malware attack disguises itself as an email from your workplace's Kyocera KM-1650 printer Repeat after me Thou shalt not open dodgy-looking attachments in unsolicited emails http://www.secuobs.com/revue/news/598057.shtmlhttp://www.secuobs.com/revue/news/598057.shtml 2016-02-11 15:21:08 - Security Bloggers Network : Crooks have used a list of close to 500,000 social security numbers to milk an IRS portal of more than 100,000 taxpayers' e-filing PINs http://www.secuobs.com/revue/news/598031.shtmlhttp://www.secuobs.com/revue/news/598031.shtml 2016-02-11 11:49:14 - Help Net Security : Several Cisco Adaptive Security Appliance ASA products - appliances, firewalls, switches, routers, and security modules - have been found sporting a flaw that can ultimately lead to remote code exec http://www.secuobs.com/revue/news/598012.shtmlhttp://www.secuobs.com/revue/news/598012.shtml 2016-02-11 01:02:56 - Security Bloggers Network : I keep seeing this Ezra Klein Vox article attacking Donald Trump It's wrong in every way something can be wrong Trump is an easy target, but the Vox piece has almost no substance Yes, it's true that Trump proposes several unreasonable policies, such as banning Muslims from coming into this country I'll be the first to chime in and call Trump a racist, Nazi bastard for these things But I'm not sure the other candidates are any better Sure, they aren't Nazis, but their politics are just as full of hate and impracticality For example, Hillary wants to force Silicon Valley into censoring content, brushing aside complaints from those people overly concerned with freedom of speech No candidate, not even Trump, is as radical as Bernie Sanders, who would dramatically reshape the economy Trump hates Mexican works inside our country, Bernie hates Mexican workers in their own countries, championing punishing trade restrictions Most of substantive criticisms Vox gives Trump also applies to Bernie For example, Vox says His view of the economy is entirely zero-sum for Americans to win, others must lose His message isn't so much that he'll help you as he'll hurt them That's Bernie's view of the economy as well He imagines that economy is a zero-sum game, and that for the 1pourcents rich to prosper, they must take from the 99pourcents of everyone else Bernie's entire message rests on punishing the 1pourcents for the sin of being rich It's the basis of all demagoguery that you find some enemy to blame Trump's enemies are foreigners, whereas Bernie's enemies are those of the wrong class Trump is one step in the direction of the horrors of the Nazi Holocaust Bernie is one step in the direction of the horrors of old-style Soviet and Red Chinese totalitarian states -- either of which killed even more people About Trump's dishonesty, Vox says He lies so constantly and so fluently that it's hard to know if he even realizes he's lying Not true Trump just lies badly He's not the standard slick politician, who are lie so fluently that we don't even realize they are lying Whether we find a politician's lying to be objectionable isn't based on any principle except whether that politician is on our side I gave 10 to all 23 presidential candidates, and get a constant stream of emails from the candidates pumping for more money They all sound the same, regardless of political party, as if they all read the same book How To Run A Presidential Campaign For example, before New Years, they all sent essentially the same message Help us meet this important deadline , as if the end of the year is some important fund-raising deadline that must be met It isn't, that's a lie, but such a fluent one that you can't precisely identify it as a lie If I were to judge candidate honesty, based on donor e-mails, Bernie would be near the top on honesty, and Hillary would be near the bottom, with Trump unexceptionally in the middle Vox's biggest problem is that their attack focuses on Trump's style more than substance It's a well-known logical fallacy that serious people avoid Style is irrelevant Trump's substance provides us enough fodder to attack him, we don't need to stoop to this low level The Vox piece is great creative fiction about how nasty Trump is, missing only the standard dig about his hair, but there's no details as to exactly why Trump's policies are bad, such as the impractical cost of building a 2000 mile long wall between us and Mexico, or the necessity of suspending the 6th Amendment right to due process when deporting 20 million immigrants Vox's complaint about Trump's style is mostly that he doesn't obey the mainstream media All politicians misspeak There's no way to spend that many hours a day talking to the public without making the most egregious of mistakes The mainstream media has a way of dealing with this, forcing the politician to grovel They resent how Trump just ignores the problem and barrels on to the next thing That the press can't make his mistakes stick makes them very upset Imagine a situation where more than half the country believes in an idea, but nobody stands up and publicly acknowledges this That's a symptom of repressed speech You'd think that the only suppressor of speech is the government, but that's not true The mainstream media is part of the establishment, and they regularly suppress speech they don't like I point this out because half the country, both Democrats and Republicans, support Trump's idea of preventing Muslims from coming into our country Sure, it's both logically stupid and evilly racist, but that doesn't matter, half the country supports it Yet, nobody admits supporting the idea publicly, because as soon as they do, they'll be punished by the mass media Thus, the idea continues to fester, because it can't openly be debated People continue to believe in this bad idea because they are unpersuaded by the ad hominem that you are such a racist The bedrock principle of journalism is that there are two sides to every debate When half the country believes in a wrong idea, we have to accept that they are all probably reasonable people, and that we can change their minds if we honestly engage them in debate This sounds like I'm repeating the media bias trope, which politicians like Trump use to deflect even fair media coverage they happen not to like But it's not left-wing bias that is the problem here Instead, it's that the media has become part of the establishment, with their own seat of power Ezra Klein's biggest achievement before Vox was JournoList, designed to help the established press wield their power at the top of the media hierarchy Trump's sin are many, but if you read Ezra Klein's article closely, you'll see that Trump's biggest problem is Ezra Klein's impotence at changing people's minds about Trump It's Trump's speaking truth to media power that is the core of Klein's criticisms http://www.secuobs.com/revue/news/597963.shtmlhttp://www.secuobs.com/revue/news/597963.shtml 2016-02-10 18:12:02 - Help Net Security : The US Internal Revenue Service IRS has revealed more details about an attack it suffered last month, mounted by unknown individuals with the aim to file fraudulent tax returns and funnel the return http://www.secuobs.com/revue/news/597925.shtmlhttp://www.secuobs.com/revue/news/597925.shtml 2016-02-10 16:51:18 - Office of Inadequate Security : Feb 9 The IRS recently identified and halted an automated attack upon its Electronic Filing PIN application on http://www.secuobs.com/revue/news/597917.shtmlhttp://www.secuobs.com/revue/news/597917.shtml 2016-02-10 16:14:11 - Risk Assessment Ars Technica : Breach comes a year after a previous hack compromised 300,000 people http://www.secuobs.com/revue/news/597890.shtmlhttp://www.secuobs.com/revue/news/597890.shtml 2016-02-10 13:42:26 - Security Bloggers Network : A computer-generated voice called in a report of shots fired at the home of the author of the Internet Swatting Hoax Act http://www.secuobs.com/revue/news/597872.shtmlhttp://www.secuobs.com/revue/news/597872.shtml 2016-02-10 11:52:01 - SecurityTube.Net : FuityWifi can be used to deploy advanced attacks against users and companies by deploying these attacks a common user becomes a trigger to compromise the corporate network For More Information Please Visit - http wwwsteelconinfo http://www.secuobs.com/revue/news/597851.shtmlhttp://www.secuobs.com/revue/news/597851.shtml 2016-02-09 12:14:10 - SecurityTube.Net : The Tor network is a widely used system for anonymous communication However, Tor is known to be vulnerable to attackers who can observe traffic at both ends of the communication path In this paper, we show that prior attacks are just the tip of the iceberg We present a suite of new attacks, called Raptor, that can be launched by Autonomous Systems ASes to compromise user anonymity First, AS-level adversaries can exploit the asymmetric nature of Internet routing to increase the chance of observing at least one direction of user traffic at both ends of the communication Second, AS-level adversaries can exploit natural churn in Internet routing to lie on the BGP paths for more users over time Third, strategic adversaries can manipulate Internet routing via BGP hijacks to discover the users using specific Tor guard nodes and interceptions to perform traffic analysis We demonstrate the feasibility of Raptor attacks by analyzing historical BGP data and Traceroute data as well as performing real-world attacks on the live Tor network, while ensuring that we do not harm real users In addition, we outline the design of two monitoring frameworks to counter these attacks BGP monitoring to detect control-plane attacks, and Traceroute monitoring to detect data-plane anomalies Overall, our work motivates the design of anonymity systems that are aware of the dynamics of Internet routing For More Information Please Visit - https wwwusenixorg conference usenixsecurity15 http://www.secuobs.com/revue/news/597736.shtmlhttp://www.secuobs.com/revue/news/597736.shtml