MongoDB Ransomware Hack – What Did We Learn?

Early on Jan. 9, about 12,000 MongoDB database servers were compromised. Later the number rose to 28,000 servers.  As many as 46,000 servers are vulnerable to this attack.

A cyber-criminal using the alias “Harak1r1” exploited a weakness in the default installation of the popular database solution, MongoDB.  He demanded a 0.2BTC ransom ($220) to return the data he exfiltrated from thousands of victim systems.  Older installations of MongoDB that were deployed via cloud hosting services in an insecure default configuration were ...

Continue Reading →
0

FTC Sues D-Link Over Poor Security

We have complained in this blog about the plethora of Internet connected IoT devices that are being sold without anything approaching meaningful security to an unsuspecting public. A notable exploitation of IoT devices was behind the Mirai botnet, which shut down significant parts of the Internet for a couple of days.

But other disasters await, for instance, the easy access of web cams from the Internet ...

Continue Reading →
0

Beyond the Kill Chain – Active Defense

I have been working my way through a Cybrary course titled ” Incident Response and Advanced Forensics.”  In it I came across the following slide, and what interested me was how it juxtaposed the Lockheed-Martin Cyber Kill Chain against a lower row of defensive tactics.  The last option, hidden beneath the instructor’s image, is “Destroy.”

Where did this intriguing six ...

Continue Reading →
0

The Best Defense

Is a good offense?  If you or your company has been a victim of cyber-crime, I am sure you have had fantasies about back-hacking the perpetrators back to the stone age.  Or having some sort of magic button phone app that would do the same thing.

Currently, the bad guys are running the offense, 24/7/365.  The good guys are limited to defense only.  There is ...

Continue Reading →
0

New European Regulations Could Affect Your Business.

On May 25 2018, new regulations will go into effect in the European Union called the General Data Protection Regulation (GDPR).  If you are doing business in Europe, this will affect your business.  If your website collects personal information and other data from European site visitors or customers, this will affect your business.

The Europeans take personal privacy, especially online privacy, much more ...

Continue Reading →
0

Why The Bad Guys Love Ransomware

Crypto-ransomware continues to be one of the most popular money making exploits for cyber criminals.  The reason for this is simple; its works, and the return on investment is quite high.  According to a recent article in Naked Security, the score will reach $1 billion in 2017.

A poll by the IBM company found that nearly 50% of the businesses polled had been hit by ransomware, and of those 70% paid ...

Continue Reading →
0

Netgear Routers Will Need Firmware Update.

If you own a Netgear wireless router, especially the R6200, R6250, R6400, R6700, R6900, R7000, R7100LG, R7300, R7900, R8000, D6220, and D6400 routers and possibly other models are vulnerable to arbitrary command injection.  This is a security bug that could allow a remote attacker to access your router.  This vulnerability was announced by US-CERT on December 9th, and reported in Naked Security on December 12th.

Vulnerabilities such as this one ...

Continue Reading →
1

Start Your Cybersecurity Plan

There are a number of great frameworks for developing your cybersecurity plan.  Two of our favorites are the NIST-CSF and the 20 CIS Controls.  We have written about these excellent tools before here (CIS Controls) and here (NIST-CSF).

Back in December we received an email from Pete Herzog of ISECOM about a new, open-source methodology manual for cybersecurity defense. ...

Continue Reading →
0

Watch Out For Fake Mobile Apps

The Federal Trade Commission recently released an warning about fraudulent mobile apps.  These apps are designed to steal personal information such as user names, passwords, credit card numbers, and other personal information.

My advise is to always get your app from an authorized app store, such as the Apple Store or the Google Store.  These apps have been tested for the most part.

Another idea to ...

Continue Reading →
0
Page 5 of 33 «...34567...»