Threats, Cyberattacks & Vulnerabilities

Risk & Repeat: More Equation Group cyberweapons leaked

In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the latest round of Equation Group cyberweapons and how Microsoft patched them. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

How can enterprises stop the Flip Feng Shui exploit from hijacking VMs?

The Flip Feng Shui attack can target virtual machines. Expert Judith Myerson explains the exploit and describes how to prevent it from hijacking enterprise VMs. Continue Reading

By

• Judith Myerson

Hajime worm fights the forces of evil IoT malware, maybe

News roundup: The Hajime worm is the nicer, sneakier brother of Mirai malware. Plus, the FBI and CIA hunt for the Vault 7 whistleblower, Symantec adds to Zscaler lawsuit, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Oracle patches Apache Struts exploits, Equation Group vulnerability

There were 299 Oracle patches in the April Critical Patch Update, including a fix for the Apache Struts exploits found in the wild and a vulnerability from the Equation Group dump. Continue Reading

By

• Michael Heller, TechTarget

How does Exaspy spyware disguise itself on Android devices?

Exaspy spyware, which can access messages, video chats and more, was found on Android devices owned by executives. Expert Nick Lewis explains how Exaspy is able to avoid detection. Continue Reading

By

• Nick Lewis

Shadow Brokers' Windows exploits target unsupported systems

A new release of NSA cyberweapons falls flat, as Windows exploits from the Shadow Brokers have mostly been patched. But unsupported systems are still at risk. Continue Reading

By

• Michael Heller, TechTarget

Shadow Brokers release SWIFT banking and Windows exploits

The Shadow Brokers released another cache of cyberweapons linked to the Equation Group, including Windows exploits and attack details for the SWIFT banking system. Continue Reading

By

• Michael Heller, TechTarget

U.S. election hacking not an act of cyberwarfare, experts say

The government needs a better definition for an act of cyberwarfare, says ex-CIA Director Michael Hayden, because he doesn't think the U.S. election hacking applies. Continue Reading

By

• Michael Heller, TechTarget

CIA Vault 7 tools attributed to hacking group for years

Security researchers said the CIA Vault 7 tools and techniques are linked to cyberattacks over the past six years targeting various foreign entities. Continue Reading

By

• Michael Heller, TechTarget

State Department hack and APT29 prove attacker resilience

News Roundup: 'Hand-to-hand' combat in State Department hack, APT29 has a stealth backdoor, the creator of the internet backs strong encryption, and more. Continue Reading

By

• Michael Heller, TechTarget

How have ARM TrustZone flaws affected Android encryption?

Android encryption on devices using Qualcomm chips can be broken due to two vulnerabilities. Expert Michael Cobb explains how these flaws affect encryption. Continue Reading

By

• Michael Cobb

Chinese hacking group APT10 linked to global trade target

Evidence points to Chinese hacking group APT10 conducting economic espionage in the breach of a trade policy group prior to U.S.-China trade summit talks in Florida. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Pegasus malware expands from iOS to Android

One of the more malicious iOS threats -- Pegasus malware -- has made its way to Android devices and it has some dangerous new tricks in its arsenal. Continue Reading

By

• Michael Heller, TechTarget

Symantec certificate authority issues listed by Mozilla developers

Mozilla developers respond to questionable Symantec certificate authority practices, as the security provider questions Google's proposed solutions. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Chenxi Wang discusses DEF CON hacking conference, 'Equal Respect'

Grassroots efforts to shift cultural thinking in information security have had a positive effect, the former professor of computer engineering says. Continue Reading

By

• Marcus J. Ranum

How did firmware create an Android backdoor in budget devices?

An Android backdoor was discovered in the Ragentek firmware used in almost three million low-cost devices. Expert Michael Cobb explains how to prevent attacks on affected devices. Continue Reading

By

• Michael Cobb

Google's Project Zero Prize uncovers zero Android remote exploits

After six months, Google's Project Zero Prize competition uncovered zero Android remote exploits: no bugs, no prizes, no entries. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

How did vulnerabilities in AirWatch Agent and Inbox work?

Flaws in AirWatch Agent and AirWatch Inbox allowed rooted devices to bypass the software's security measures. Expert Matthew Pascucci explains how these vulnerabilities worked. Continue Reading

By

• Matthew Pascucci

Potential SSL API flaw could reveal private keys

A researcher claims to have found Symantec SSL API issues with extremely dangerous consequences, but a lack of evidence causes confusion. Continue Reading

By

• Michael Heller, TechTarget

Cisco issues fix for Vault 7 vulnerability without help from WikiLeaks

News roundup: Cisco fixes a Vault 7 flaw unaided, despite WikiLeaks' pledge to work with vendors. Plus, LastPass flaws leak user data; Apple held hostage by hackers; and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Hajime malware: How does it differ from the Mirai worm?

Hajime malware was discovered to have links to the Mirai botnet that launched powerful DDoS attacks last year. Expert Nick Lewis explains how Hajime differs from Mirai. Continue Reading

By

• Nick Lewis

How does the Drammer attack exploit ARM-based mobile devices?

Drammer, or a deterministic Rowhammer attack, was found to be more effective on ARM-based mobile devices. Expert Nick Lewis explains the issue with ARM processors. Continue Reading

By

• Nick Lewis

Risk & Repeat: Accused Yahoo hackers indicted

In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the indictments of the alleged Yahoo hackers and how the attackers minted Yahoo authentication cookies. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

HTTPS interception, middlebox models under fire

HTTPS interception in security products and services may be reducing security rather than improving it, according to US-CERT, which puts middleboxes in a precarious position. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Pork Explosion Android flaw: How is it used to create a backdoor?

The Pork Explosion vulnerability present in some Foxconn-created app bootloaders can be used to create an Android backdoor. Expert Nick Lewis explains how the flaw works. Continue Reading

By

• Nick Lewis

Will the Yahoo breach indictments be an effective hacker deterrent?

The Department of Justice indicted suspects in the 2014 Yahoo breach, but experts are unsure if this will prove to be an effective hacker deterrent moving forward. Continue Reading

By

• Michael Heller, TechTarget

DOJ indicts suspected Yahoo hackers from Russia; extradition unclear

The U.S. Department of Justice indicted four men -- including two Russian Federal Security Service officers -- accused of being the Yahoo hackers, but only one person was arrested. Continue Reading

By

• Michael Heller, TechTarget

Risk & Repeat: Leak of CIA hacking tools creates confusion

In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the confusion around WikiLeaks' release of government documents regarding CIA hacking tools. Continue Reading

Deprecated SHA-1 certificates trip up SAP Ariba

SHA-1 certificates are still in play, despite browser deprecation, as SAP Ariba advises legacy users to use unpatched browsers to avoid error messages, blocked access. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Android ransomware and more pre-installed on devices

Security researchers found Android ransomware and malware pre-installed on popular devices, putting users at risk for information theft, tracking and more. Continue Reading

By

• Michael Heller, TechTarget

Attack by TIFF images: What are the vulnerabilities in LibTIFF?

Attackers using crafted TIFF images can exploit flaws in the LibTIFF library to carry out remote code execution. Expert Michael Cobb explains how these vulnerabilities work. Continue Reading

By

• Michael Cobb

Operation Rosehub patches Java vulnerabilities in open source projects

Google employees recently completed Operation Rosehub, a grass roots effort that patches a set of serious Java vulnerabilities in thousands of open source projects. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Vault 7 CIA hacking weapons include iOS, Android and Windows zero days

WikiLeaks released a massive dump of files it claims to be CIA hacking tools, codenamed Vault 7, which includes iOS and Android zero-day exploits. Continue Reading

By

• Michael Heller, TechTarget

How can attacks bypass ASLR protection on Intel chips?

An Intel chip flaw lets attackers bypass ASLR protection on most operating systems. Expert Michael Cobb explains the vulnerability and how to prevent attacks. Continue Reading

By

• Michael Cobb

How can the Dirty COW vulnerability be used to attack Android devices?

A copy-on-write vulnerability known as 'Dirty COW' was found in the Linux kernel of Android devices. Expert Michael Cobb explains the risks of this attack. Continue Reading

By

• Michael Cobb

FBI chooses to protect Tor vulnerability and dismiss child porn case

The Department of Justice dropped a child pornography case in order to avoid disclosing a Tor vulnerability; dozens more cases potentially affected. Continue Reading

By

• Michael Heller, TechTarget

New cybersecurity report gets the hacker perspective

A new cybersecurity report used a hacker survey to offer a perspective on IT that can often be overlooked and found there may not be any easy answers. Continue Reading

By

• Michael Heller, TechTarget

Employees knew about Yahoo security breach years ago, per new SEC filing

A new SEC filing details who knew about the major Yahoo security breach in 2014, but experts are confused by the repercussions of the announcement. Continue Reading

By

• Michael Heller, TechTarget

Microsoft: Nation-state cyberattacks have changed the security game

Microsoft's Brad Smith spoke at RSA Conference 2017 about the effects of nation-state cyberattacks and what businesses and governments can do about them. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Nation-state cyberattacks rising, warns former NSA director

Speaking at RSA Conference 2017, former NSA Director Keith Alexander warned of increased nation-state cyberattacks and called for an overhaul of U.S. government cybersecurity. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Ransomware threat continues to evolve, defense needs to catch up

With the rapid expansion of the ransomware threat landscape, defenders are scrambling to find ways to fight back. RSAC 2017 dedicated a full day for a ransomware seminar. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Corero: Telecom carriers have fallen behind on DDoS defense

Corero Network Security's Dave Larson talks with SearchSecurity about how DDoS defense has changed and why telecom service providers have struggled to keep up with new threats. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

NSA contractor indicted for stealing elite cyberweapons over 20 years

The NSA contractor accused of stealing elite cyberweapons over the course of 20 years, but his connection to the Shadow Brokers auction of similar hacking tools is still unclear. Continue Reading

By

• Michael Heller, TechTarget

Is the Ticketbleed flaw the new Heartbleed vulnerability?

News roundup: F5 virtual server flaw, dubbed Ticketbleed, is similar to Heartbleed. Plus, DHS is considering requiring social media passwords on visa applications, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

IoT security threat to become real post-Mirai at RSA Conference 2017

IoT security tops the list of RSA Conference 2017 submissions after IoT devices were abused by threat actors, but the topics experts worry about are much more far-reaching. Continue Reading

By

• Michael Heller, TechTarget

How did a Signal app bug let attackers alter encrypted attachments?

The Signal app, used for end-to-end encrypted mobile messaging, contained a bug that allowed data to be added to attachments. Expert Michael Cobb explains the flaw. Continue Reading

By

• Michael Cobb

SQL Slammer worm makes a comeback 14 years later

The SQL Slammer worm returned to take down systems that have been left unpatched for the past 14 years, but experts are unsure if the attacks will continue. Continue Reading

By

• Michael Heller, TechTarget

Microsoft delays Windows zero-day patch; researcher drops exploit code

Microsoft decided to delay a Windows zero-day patch by two months, prompting the researcher who found it to post the proof-of-concept exploit code. Continue Reading

By

• Michael Heller, TechTarget

Pentagon hack possible due to bad vulnerability management

A researcher finds unpatched flaws in DOD systems that may have already allowed a Pentagon hack, and the government is doing nothing to remediate the issue. Continue Reading

By

• Michael Heller, TechTarget

In 2017, cybersecurity attacks will follow your data

Thanks to a polarizing election, the potential ramifications of cybersecurity attacks are front and center. Your friends and relatives probably have some concept of what it is that you actually do and its importance. But the daily challenges of protecting most enterprise environments is less like The Americans than they might think. Still, it's exciting. In this issue of Information Security magazine, we look at the incoming threats in 2017 and some countermeasures that can help your organization bolster its defenses.

Last year, we saw the internet of things used as a beachhead in larger cybersecurity attacks. Many devices now use cloud-based systems to communicate. They regularly send status updates to the cloud server and retrieve new commands to execute. Weak and incorrectly implemented authentication between device and cloud is often the point of failure that can be exploited to either attack the cloud infrastructure or the device. So far, destructive attacks are not common and are mostly limited to distributed denial-of-service attacks, which do not cause permanent damage. But future attacks, if they are combined with ransom demands, may destroy devices intentionally.

Breaches of cloud storage that modify data instead of just "stealing" it and vulnerabilities in microservices environments are other areas in which attackers may get more leverage. With the emergence of cloud-based microservices, this problem will only become worse. Instead of including a library in software shipped to clients, the software now relies on cloud-based web services to perform certain functions. We look at what is coming next and ways to mitigate these cybersecurity attacks. Continue Reading

Hacked CCTV cameras in DC before inauguration leave unanswered questions

The Washington, D.C., Police Department spotted hacked CCTV cameras before the inauguration and has remediated the ransomware, but questions still surround the attack. Continue Reading

By

• Michael Heller, TechTarget

How does a Netgear vulnerability enable command injection attacks?

A Netgear vulnerability exposed a number of wireless router models to command injection attacks. Expert Judith Myerson explains how the attack works and how to stop it. Continue Reading

By

• Judith Myerson

Americans split on federal government security, encryption attitudes

News roundup: Half of Americans don't trust federal government security. Plus, a Kaspersky Lab manager was arrested; an internal DOD network was found vulnerable; and more. Continue Reading

By

• Madelyn Bacon, TechTarget

More than 200 vulnerabilities found in Trend Micro security products

Researchers uncovered more than 200 vulnerabilities across Trend Micro products, but experts said the company brand won't take a hit. Continue Reading

By

• Michael Heller, TechTarget

Heartbleed bug still found to affect 200,000 services on the web

Researchers found the infamous Heartbleed bug is still unpatched on as many as 200,000 services connected to the internet and experts don't expect that number to change. Continue Reading

By

• Michael Heller, TechTarget

Project Zero finds Cisco WebEx vulnerability in browser extensions

A critical Cisco WebEx vulnerability in the service's browser extensions was discovered and patched, though some disagree the patch goes far enough to protect against attack. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Certificate Transparency snags Symantec CA for improper certs

Symantec CA could be in for more trouble after a security researcher, using Certificate Transparency logs, discovered more than 100 improperly issued certificates. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

How does Stampado ransomware spread to external drives?

The Stampado ransomware is a low-cost threat to networks and external drives. Expert Matthew Pascucci explains how Stampado works and how enterprises should handle it. Continue Reading

By

• Matthew Pascucci

How serious are the flaws in St. Jude Medical's IoT medical devices?

MedSec and Muddy Waters Capital revealed serious flaws in IoT medical devices manufactured by St. Jude Medical. Expert Nick Lewis explains the severity of these vulnerabilities. Continue Reading

By

• Nick Lewis

Carbanak gang using Google services for command and control

Researchers find the Carbanak gang has evolved its attacks on financial institutions to use Google services for command and control infrastructure in malware. Continue Reading

By

• Michael Heller, TechTarget

Vulnerable Adobe extension downloads covertly to Chrome

News roundup: A flawed Adobe extension was secretly installed on 30 million Chrome browsers. Plus, the Mirai author has been identified; Google releases security details; and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Windows 10 security tackles exploits, while Windows 7 gets a warning

As Microsoft touted its Windows 10 security features defeating unpatched zero-day vulnerabilities, it also warned customers about security issues with Windows 7. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

How does RIPPER ATM malware use malicious EMV chips?

RIPPER malware has been found responsible for the theft of $378,000 from ATMs in Thailand. Expert Nick Lewis explains how this ATM malware works. Continue Reading

By

• Nick Lewis

St. Jude Medical finally patches vulnerable medical IoT devices

News roundup: St. Jude Medical patches vulnerable medical IoT devices after a five-month controversy. Plus, the Email Privacy Act is reintroduced; Juniper warns of a firewall flaw; and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Insecure MongoDB configuration leads to boom in ransom attacks

Poor authentication in MongoDB configurations has led to a sharp increase in ransom attacks, and experts say tens of thousands of databases could be at risk. Continue Reading

By

• Michael Heller, TechTarget

Doxware: New ransomware threat, or just extortionware rebranded?

The threat of ransomware continues to evolve, with a new spin on extortionware, called doxware, that's designed to target and potentially expose sensitive data of ransomware victims. Continue Reading

By

• Michael Heller, TechTarget

Decades-old bug in the libpng open source graphics library patched

A low-severity vulnerability dating back to 1995 in libpng, the official reference library implementation for PNG, may have enabled remote DoS attacks. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Hacking Web Intelligence

In this excerpt from chapter 8 of Hacking Web Intelligence, authors Sudhanshu Chauhan and Nutan Panda discuss how to be anonymous on the internet using proxy. Continue Reading

By

• SearchSecurity and Syngress

Chinese company caught preinstalling Android spyware on budget devices

A Chinese company was found to be preinstalling Android spyware on budget smartphones and collecting phone call and messaging data without consent. Continue Reading

By

• Michael Heller, TechTarget

How can users protect mobile devices from SandJacking attacks?

Attackers can use the SandJacking attack to access sandboxed data on iOS devices. Expert Nick Lewis explains how to protect your enterprise from this attack. Continue Reading

By

• Nick Lewis

Planning for an IPv6 attack: DDoS, neighbor discovery threats and more

An IPv6 DDoS attacks are imminent, and your network security tools may not be configured for it. Expert Michael Cobb explains how enterprises can prepare its defenses. Continue Reading

By

• Michael Cobb

Pegasus iOS exploit uses three zero days to attack high-value targets

A new remote iOS exploit called Pegasus leverages three zero days in what appear to be state-sponsored targeted attack campaigns against political dissidents. Continue Reading

By

• Michael Heller, TechTarget

Environment variables: Should they be considered harmful?

In the wake of the httpoxy vulnerability, should environment variables be considered harmful? Perhaps, but they are just so useful. Continue Reading

By

• Peter Loshin

How can the AirDroid app phone hijacking be prevented?

A vulnerability in the AirDroid device manager app left users at risk of phone hijacking. Expert Michael Cobb explains how the exploit works, and what can be done to prevent it. Continue Reading

By

• Michael Cobb

How does the banking Trojan Dyreza exploit Windows 10?

A variant of banking Trojan Dyreza has begun to target Windows 10. Expert Nick Lewis explains the new attack functionalities, and Windows 10 and user vulnerabilities. Continue Reading

By

• Nick Lewis

Breaking down the DROWN attack and SSLv2 vulnerability

A DROWN attack can occur through more than a third of all HTTPS connections. Expert Michael Cobb explains how DROWN enables man-in-the-middle attacks and mitigation steps to take. Continue Reading

By

• Michael Cobb

How does the M-Pesa service work and what are the risks?

How does mobile microfinancing service M-Pesa allow users to make transactions without a bank account? Expert Michael Cobb explains how it works and M-Pesa security measures. Continue Reading

By

• Michael Cobb

How to protect an origin IP address from attackers

Cloud security providers protect enterprises from DDoS attacks, but attackers can still find the origin IP addresses. Expert Rob Shapland explains why that's a significant threat. Continue Reading

By

• Rob Shapland

How does the new voicemail phishing scam work?

A new phishing scam uses voicemail notification emails to spread malware. Expert Nick Lewis explains how this attack works and how enterprises can prevent it. Continue Reading

By

• Nick Lewis

Old Microsoft Kerberos vulnerability gets new spotlight

A new blog post detailed authentication vulnerabilities in Microsoft Kerberos that cannot be patched and could lead to attackers having free rein over systems. Continue Reading

By

• Michael Heller, TechTarget

Moose worm: How can enterprises stop social media fraud?

A Linux-based Moose worm causes social media fraud through infected routers. Expert Nick Lewis explains how the Moose worm works and how to avoid it. Continue Reading

By

• Nick Lewis

Amex credit card hack predicts replacement card number

Samy Kamkar found a weakness in the algorithm American Express uses to generate replacement card information and created a credit card hack as a proof-of-concept. Continue Reading

By

• Michael Heller, TechTarget

WMI tools make the perfect crime 'malware-free'

Security researchers claim that attackers are abusing a longstanding administrative tool in the Windows operating system. With no telltale signs of malware, how can you stop it? Continue Reading

By

• Robert Richardson

'Going dark': Weighing the public safety costs of end-to-end encryption

'Going dark' -- or the FBI's inability to access data because of encryption -- could put public safety at risk, intelligence officials say. But tech companies argue that strong encryption is needed to protect corporate and customer data. Continue Reading

By

• Francesca Sales

Getting to the bottom of the software vulnerability disclosure debate

The vulnerability disclosure debate rages on: Enterprises should know they are at risk, but vendors need time to patch flaws. Which side should prevail? Expert Michael Cobb discusses. Continue Reading

By

• Michael Cobb

How can power consumption-tracking malware be avoided?

Malware authors are using power consumption tracking-malware to eavesdrop on and attack mobile devices. Expert Nick Lewis explains the threat and how to defend against it. Continue Reading

By

• Nick Lewis

How can I mitigate the risks of alternative Android browsers?

Expert Michael Cobb explains the security risks surrounding alternative Web browsers, as well as approaches enterprises can take to prevent BYOD employees from using them. Continue Reading

By

• Michael Cobb

Six criteria for purchasing unified threat management appliances

Expert Ed Tittel explores key criteria for evaluating unified threat management (UTM) appliances to determine the best choice for your organization. Continue Reading

By

• Ed Tittel

Understanding and mitigating a FREAK vulnerability attack

After the discovery that the FREAK vulnerability can affect a wide variety of OSes, enterprises should amp up mitigation efforts. Here's some background on the attack and how to stop it. Continue Reading

By

• Randall Gamby, HP

Social engineering: You got nailed!

Move beyond prevention to fast detection to combat a stealthy social engineering attack. Continue Reading

By

• Sally Johnson

Amid Apple Pay fraud, banks scramble to fix Yellow Path process

Banks are rushing to fix sloppy authentication processes at the heart of rising Apple Pay fraud. Experts also worry about potential fraud with other mobile payment systems. Continue Reading

By

• Michael Heller, TechTarget

Detecting backdoors: The Apple backdoor that never was?

The debate over the purported Apple backdoor leaves enterprises asking, "When is a backdoor not a backdoor?" Application security expert Michael Cobb explains the difference. Continue Reading

By

• Michael Cobb

Targeted Cyber Attacks

In this excerpt of Targeted Cyber Attacks, authors Aditya Sood and Richard Enbody outline the cyberattack model and different vectors used to attack targets. Continue Reading

By

• SearchSecurity and Syngress

Understanding security flaws in IPv6 addressing schemes

Expert Fernando Gont explains why underlying characteristics of IPv6 address-generation schemes may enable nodes to be targeted in IPv6 address-scanning attacks. Continue Reading

By

• Fernando Gont, SI6 Networks

How vulnerable is Silverlight security?

Microsoft Silverlight has been in the spotlight due to an increase in the number of exploit kits it is included in. Expert Nick Lewis explains the threat's severity and how to mitigate it. Continue Reading

By

• Nick Lewis

Command-and-control servers: The puppet masters that govern malware

Are there shadow networks within your enterprise? Stop malware by shutting down command-and-control communication channels. Continue Reading

By

• Adam Rice
• James Ringold, Westinghouse Electric Company

Stop attackers hacking with Metasploit

Metasploit attacks may not be sexy, but they can stab through enterprise defenses. Learn how basic security controls can thwart Metasploit hacking. Continue Reading

By

• Nick Lewis

Amid Microsoft MD5 deprecation, experts warn against SHA-1 algorithm

With Microsoft's MD5 deprecation set for next week, experts say companies must be careful to avoid other weak protocols, like SHA-1. Continue Reading

By

• Brandan Blevins

Femtocell security: Defending against a femtocell hack

The risk of a femtocell hack is a real enterprise concern. Nick Lewis explains why and explores how to defend against an attack. Continue Reading

By

• Nick Lewis

Heap spray attacks: Details and mitigations for new techniques

Expert Nick Lewis details a new heap spray attack technique and provides mitigations for both new and old heap spray attacks. Continue Reading

By

• Nick Lewis