Wednesday, January 31, 2018

Security Theater and the Watch Effect in Third-party Assessments

By: Daniel Miessler
Before the facts were in, nearly every journalist and salesperson in infosec was thinking about how to squeeze lemonade from the Equifax breach. Let’s be honest – it was and is a big breach. There are lessons to be learned, but people seemed to have the answers before the facts were available. 

Wednesday, January 24, 2018

Cryptocurrency and the Interconnected Home

By: Neil Haskins
There are many tiny elements to cryptocurrency that are not getting the awareness time they deserve. To start, the very thing that attracts people to cryptocurrency is also the very thing that is seemingly overlooked as a challenge. Cryptocurrencies are not backed by governments or institutions. The transactions allow the trader or investor to operate with anonymity. We have seen a massive increase in the last year of cyber bad guys hiding behind these inconspicuous transactions - ransomware demanding payment in bitcoin; bitcoin ATMs being used by various dealers to effectively clean money.

Wednesday, January 17, 2018

Easy SSL Certificate Testing

By: Enrique Nissim
tl;dr: Certslayer allows testing of how an application handles SSL certificates and whether or not it is verifying relevant details on them to prevent MiTM attacks:

Thursday, January 11, 2018

SCADA and Mobile Security in the IoT Era

By: Alexander Bolshev (dark_k3y) Security Consultant, IOActive
Ivan Yushkevich (Steph) Information Security Auditor, Embedi

Two years ago, we assessed 20 mobile applications that worked with ICS software and hardware. At that time, mobile technologies were widespread, but Internet of Things (IoT) mania was only starting. Our research concluded the combination of SCADA systems and mobile applications had the potential to be a very dangerous and vulnerable cocktail. In the introduction of our paper, we stated “convenience often wins over security. Nowadays, you can monitor (or even control!) your ICS from a brand-new Android [device].”

Tuesday, November 21, 2017

Hidden Exploitable Behaviors in Programming Languages

By Fernando Arnaboldi

In February 28th 2015 Egor Homakov wrote an article[1] exposing the dangers in the open() function from Ruby. The function is commonly used when requesting URLs programmatically with the open-uri library. However, instead of requesting URLs you may end up executing operating system commands.

Tuesday, November 14, 2017

Treat the Cause, not the Symptoms!

By Neil Haskins

With the publication of the National Audit Office report on WannaCry fresh off the press, I think it’s important that we revisit what it actually means. There are worrying statements within the various reports around preventative measures that could have been taken. In particular, where the health service talks about treating the cause, not the symptom, you would expect that ethos to cross functions, from the primary caregivers to the primary security services.