Month: March 2017

InfoSec Reading Weekly Roundup – 13 March 2017

The weekly InfoSec reading roundup is a collection of the most interesting news and articles that I read in the past week. Note that if you are reading this at work, some of the links below might be blocked by the corporate web proxy or gateway. Please don’t try to bypass them. Read them on your phone or at home! 10 ways to ruin a cybercriminal’s day 50 Shades of FIM 7 universal rules of threat intelligence 7 Facts: ‘Vault 7’ CIA Hacking Tool Dump by WikiLeaks 9 popular password manager apps found leaking your secrets 9 Security Tips That Go Outside the Box   A Real-Life Look into Responsible Disclosure for Security Vulnerabilities Abuse of Privileges: Common Barriers to Managing Privileged Accounts After CIA leak, Intel Security releases detection tool for EFI rootkits An Insight into Virtual Private Networks and IP Tunneling Another example of maldoc string obfuscation, with extra bonus: UAC bypass AntiVirus Evasion Reconstructed – Veil 3.0 Apple pushing two-factor authentication for iOS 10.3 users Are you ready for a ransomware attack? ARE WE LEADING BY EXAMPLE? Attackers using cracked builder to duplicate and spread Betabot Avoid Lengthy Pit Stops Along the Road to the Data Protection Finish Line   Bletchley Park: Training the next generation of cybersecurity codebreakers Bots: Biggest player on the cybercrime block Bye Empire, Hello Nebula Exploit Kit.   CIA-made malware? Now...

Read More

InfoSec Reading Weekly Roundup – 6 March 2017

The weekly InfoSec reading roundup is a collection of the most interesting news and articles that I read in the past week. Note that if you are reading this at work, some of the links below might be blocked by the corporate web proxy or gateway. Please don’t try to bypass them. Read them on your phone or at home! CISO Perspective on RSA 2017 – Top 10 Takeaways (AlienVault) “All access to services must be authenticated, authorized and encrypted.” “Within 60 seconds of connecting it to the Internet, the device was compromised.” “In order to save the Internet, I’ll have to kill it.” “90% of intrusions begin with a phishing email …every company has at least one person who will click on anything.” Maturing Your Security Ecosystem (McAfee) “Compliance alone has never been a guarantee of security or privacy; it is a necessary but not sufficient level of defense.” “Stopping 100% of threats 100% of the time is currently 100% unrealistic.” The Anatomy of a Malvertising Sequence (RiskIQ) MUST READ. A simple example of how you can get infected without clicking on any links. “…from the publisher to a legitimate rotator network, to a pornographic session hijack, to a malicious rotator network, to a malicious exploit kit payload, all without requiring a single click from the user.” Anomali Weekly Threat Intelligence Briefing – February 28, 2017 (Anomali) Covert Channels and...

Read More

Recent Tweets