Earlier this year Kaseya, who provides IT management software to service providers that support tens of thousands of organizations from schools to hospitals, was involved in a ransomware attack fueled by a compromise of their VSA Remote Monitoring and Management (RMM) software. While the ransomware only impacted a small percentage of their customer base, thousands of companies … [Read more...]
Half of Respondents Admitted to Sharing Their Passwords
We often write about passwords and password policies from the IT/security administrator side, usually after a password becomes compromised. We recently found a survey that looked at compromised passwords from the user’s side to better understand how users feel about them. The survey shows a few key points that shed light on the social side of passwords. We suspect the … [Read more...]
Mobile Carriers Leak 123 million Customer Records in One Week
Over the last week we saw 70 million AT&T customers and 53 million T-Mobile customers have their personal data leaked to hackers. While we didn’t find any connections between these two breaches the timing of the incidents is strange. AT&T has so far denied the breach involving their customers. While we don't have confirmation from the hackers who breached AT&T, … [Read more...]
Supply Chain Attacks Through an IDE
David Dworken, a Google security researcher, presented a recent Defcon talk about how he found over 30 vulnerabilities in various Integrated Development Environments (IDEs) over the course of a few months of research. Many believe that source code on its own is benign as long as you don’t compile and run it, but as Dworken proved, simply loading code into an IDE can cause … [Read more...]
Defcon Talk Timeless-Timing-Attacks
A recent Defcon talk by Tom Van Goethem and Mathy Vanhoef, "Timeless Timing Attacks" made significant progress on ways to create timing attacks over a network. Timing attacks work by extracting data form devices based on how long it takes to respond. To successfully run a timing attack, the attacker usually must be directly connected to the computer since the smallest … [Read more...]
