Last week, Imperva discovered a new crypto-jacking attack, which they named RedisWannaMine. According to Imperva, the malware’s initial attack vector used a well-known web application vulnerability involving Apache Struts, affecting both database servers and application servers. Imperva, however, does not reveal the scope or numbers of vulnerable systems that have been … [Read more...]
Wi-Fi Hacking at the Hotel Pool
While making breakfast for our kids this morning, my wife sent me a few second video of the Today Show with the message “I think I know what you do for work now” with a smiley emoji. In the segment, host Jeff Rossen gives his audience a warning around using public Wi-Fi this spring break and tips to keep themselves safe. Rossen goes onsite to the pool at a hotel resort, … [Read more...]
GitHub DDoS – How Did They Handle the Traffic?
On Wednesday, GitHub survived the largest DDoS attack to date, with the traffic at about 1.3 Tbps (Terabits per second). The previous largest recorded attack took place in 2016 when the Mirai Botnet launched a 1.2 Tbps DDoS against DYN DNS, bringing down their site, and much of the internet along with it. What caused these most recent attacks? Was this another botnet … [Read more...]
With Certificates, Who Do We Actually Trust?
A cryptographic certificate tells us if a website or program is trusted and from a valid company. This trust model only works if we trust that the issuers of certificates have taken appropriate steps to verify ownership before issuing a certificate for a company. This verification allows us to believe that a certificate for any given company name was legitimately created for … [Read more...]
When Big Tech Leave Open Access
Tesla is known not just as a car company but as a technology company, as is evident by their heavy presence in Amazon AWS. Hackers recently took advantage of this reliance on tech by gaining access to and using Tesla’s AWS account to run their own cryptocurrency mining operation. According to a recent report from RedLock, hackers gained access to a Tesla management console, … [Read more...]
