A collection of articles and posts pulled from some of our favorite bloggers across the Internet.
Do you have an IT/Infosec Security blog that we can display here? Suggest a Link, otherwise Contact Us about getting blogging rights here on the Island!
Latest From the Web
From the Web
Hackers Use Custom PoS Malware to Target Retailers
March 31, 2016 from: SecurityWeek
A cybercriminal group has been using a custom-build point-of-sale (PoS) malware family to steal payment card data, which it sells on underground forums.
Comments (0)
From the Web
Mod_Security and Slowloris
December 10, 2010 from: Rsnake's blog at ha.ckers.org
After all the press around Wong Onn Chee and Tom Brennan’s version of a HTTP DoS attack, I think people started taking HTTP DoS a tad more seriously. Yes, there are lots of variants of HTTP based DoS attack, and I’m sure more tools will surface over time. The really interesting part is how both Apache and IIS has disagreed that it is their problem to fix. So we are left to fend for ourselves. ...
Comments (0)
From the Web
Cheating Part 2
December 07, 2010 from: Rsnake's blog at ha.ckers.org
It would have been fun to create a contest to see which strategies are the most effective in a bot on bot scenario. Is an all defensive strategy better, or an all offensive (always opportunistically taking the highest value word)? Or maybe a hybrid of both where you play defensively at some points or offensively when you know it’s better in the long run.
Comments (0)
From the Web
Cheating Part 1
December 01, 2010 from: Rsnake's blog at ha.ckers.org
I just thought I’d write a few vaguely amusing posts having just come back from Abu Dhabi (Blackhat) and Brazil (OWASP). A few weeks back my Wife was having a rather fancy soiree work party that also had a casino night attached to it. I was pretty annoyed about the whole work party thing, having rarely had a good time at these things in the past. So immediately I start looking for ways to entert...
Comments (0)
From the Web
FireSheep
November 16, 2010 from: Rsnake's blog at ha.ckers.org
I [Rsnake] go back and forth on whether I think FireSheep is interesting or not. Clearly, it’s old technology re-hashed. But it is interesting not because it works, but that it surprises people that it works. We’ve been talking about these problems forever, and now companies are scrambling to protect themselves. I guess the threat isn’t real until every newbie on earth has access to the hack...
Comments (0)
From the Web
Website Security Statistics Report (2010) - Industry Bechmarks
November 08, 2010 from: Jeremiah Grossman's Blog
"How are we doing?" That's the question on the mind of many executives and security practitioners whether they have recently implemented an application security program, or already have a well-established plan in place. The executives within those organizations want to know if the resources they have invested in source code reviews, threat modeling, developer training, security tools, etc. are mak...
Comments (0)
From the Web
Cooling Down the Firesheep
November 06, 2010 from: Mozilla Security Blog
There have been a number of reports about a new Firesheep tool that exposes a weakness in website security, letting attackers snoop on people using public networks, steal their cookies, access their accounts and pose as them on sites such as Facebook and Twitter. While the developers chose to use the Firefox add-on API, the tool could have just as easily been written and distributed as a stand-alo...
Comments (0)
From the Web
Least Common Denominator
October 23, 2010 from: Rsnake's blog at ha.ckers.org
While at Bluehat Jeremiah got a question from someone (I believe he worked at Opera) saying that even something as simple as turning off third party cookies will break things like Yandex. Jer had an amusing response which was, “What’s that?” followed by, “So you’re telling me I need to be less secure because someone else wants to go to a site that I’ve never heard of?”
Comments (0)
From the Web
Performance Primatives
October 21, 2010 from: Rsnake's blog at ha.ckers.org
Intel, Mozilla and Adobe. How are these companies related, you may ask? Well all of them care about performance. A year or so ago I was hanging out with the Intel guys and they informed me that they have a series of low level performance primitives that they surface through APIs. At the time I wasn't quite sure what to make of it.
Comments (0)
From the Web
Obfuscated URLs within iframes
October 06, 2010 from: Mozilla Security Blog
Issue There has been discussion today about a Firefox feature that warns users when a site’s URL is deceptive. When a Firefox user visits a site with a url that might be deceptive (e.g. http://www.good.com@evil.com/) , Firefox will stop the load and confirm with the user that they are really visiting the site they expected to visit (in this example, evil.com is the ...
Comments (0)
From the Web
HTTP Strict Transport Security
October 06, 2010 from: Mozilla Security Blog
A while ago, we talked about Force-TLS that lets sites say “hey, only access me over HTTPS in the future” and the browser listens. Well, this idea has been solidifed into a draft spec for HTTP Strict Transport Security (HSTS) and we’ve landed support for it into our source tree. This means that HSTS will be shipped with Firefox 4, and will be deployed as soon as the next beta release.
Comments (0)
From the Web
Super Nuclear Worm Invades Kazakhstan
October 03, 2010 from: AEON Security Blog
When I first heard about Stuxnet, it made me shrug my shoulders just as much as I shrugged when hearing about Aurora – the “(un)Advanced Persistent Threat.” Outside from all the hype, the entire concept of “Stuxnet” being a “highly weaponized targeted” threat is way out of tune with reality. From everything I have read so far, everyone seems to be repeating what everyone else is repe...
Comments (2)
From the Web
Odds, Disclosure, Etc…
September 18, 2010 from: Rsnake's blog at ha.ckers.org
I went to Data Loss DB the other day and I noticed an interesting downward trend over the last two years. It could be due to a lot of things. Maybe people are losing their laptops less or maybe hackers have decided to slow down all that hacking they were doing. No, I suspect it’s because in the dawn of social networking and collective thinking, companies fear disclosure more than ever before.
Comments (0)
From the Web
Browser Differences, Minutia Et Al…
September 10, 2010 from: Rsnake's blog at ha.ckers.org
Browser security often turns into a religious war amongst technologists, instead of thinking about it pragmatically. What are the real motives of the companies that are developing the browsers? In most cases they care primarily about market share because market share makes them money (through search engine agreements, and so on).
Comments (0)
From the Web
The Effect of Snakeoil Security
September 10, 2010 from: Rsnake's blog at ha.ckers.org
Bad security isn’t just bad because it allows you to be exploited. It’s also a long term cost center. But more interestingly, even the most worthless security tools can be proven to “work” if you look at the numbers. Here’s how.
Comments (1)
From the Web
Prior Knowledge Of Users Cert Warning Behavior
September 02, 2010 from: Rsnake's blog at ha.ckers.org
One of the issues Josh and I talked about at Blackhat was how the SSL certificate warning message can be used to gain information about a user’s behavior and how that can be used against the user. Let’s say a man in the middle causes an error via proxying a well-known owner/subsidiary.
Comments (0)
- Through the Executive Lens: Prioritizing Application Security Vulnerabilities
- Next Generation Firewalls are Old News in the Cloud
- Trojan Horses for the Mind, Part 2 of Building Impactful Security Awareness Messaging
- Internet-Exposed IBM BigFix Relays May Lead to Full Remote Compromise
- Google Chrome Zero-Day: What Are The Risks?
- 1 Million Apps Patched in Android Security Improvement Program
- The Role of Analytics in Protecting Healthcare Data Privacy and Security
- WINDSHIFT Hackers Target Government Agency in the Middle East
- The Rise of Ransomware and the Consequences for SMBs
- Trump Administration Starts the Ball Rolling with the National Cyber Strategy