One of the questions I get from clients is how I stay on top of so much stuff all the time. If you read this blog, you know we track emerging threats, identify new vulnerabilities, develop software, oversee our HoneyPoint deployments and run the whole security services company. That can be a lot of detail [...]
MSI continues to see increasing scans for vulnerabilities associated with port 4899/TCP. These scans are attempting to identify a particular product and gain access to the system through a known exploit. Please verify that you have eliminated all traffic from the public Internet destined for this port. The original vulnerability has been around a while, [...]
I have been toying with lock bumping since it became a national hot item a few months back. If you have not heard about it yet, check out the basics here. OK, so a lot of this is overblown and the hype is pretty high to cause Mom and Pop to panic and buy some [...]
As an exercise last week, 5 members of the MSI penetration testing team got together for a lunch hour exercise. The results were well worth noting. In just under 1 hour, the team set forth to find out how many web-based application security issues they could identify in public sites. The rules were that they [...]
If you have not seen this yet, it is a pretty funny piece about just how stupid some of the TSA travel rules are. I have been railing against the security through theater of the TSA routines and the seeming madness of some of their decisions, bad moves and general practices for some time now. [...]
Please feel free to comment and give feedback on the blog. The comment and feedback system was repaired yesterday. Sorry for the issues.
I have been paying attention to the way the US Government has been managing their cyber-security lately. I guess, since they have such a large responsibility to maintain security that I continue to be amazed at the poor examples that they set for others. How in the world can they expect organizations and businesses to [...]
A security researcher has revealed the details and mechanisms for a technique to circumvent multi-factor authentication on some banking and other web-applications. The attack depends on the fallback to a secret question type of authentication when no cookie or token is available for the user. The researcher has demonstrated using the technique to perform successful [...]
ISS and TippingPoint seem to be battling it out publicly over the ethics of hacking contests, buying exploits and responsible disclosure. This is a discussion that has been a long time coming. Companies like TippingPoint and others who buy zero-day exploits and sponsor hacking for money contests and the like seem to be very shortly [...]
I have been hearing a lot of questions lately about how to create effective awareness programs inside your organization. To most companies, this is a very difficult task. Here are three strategies to make this easier for everyone and a whole lot more effective than what you are likely using now: 1) Ask your employees. [...]