-
Guest Appearance on the Cyberwire Research Saturday Podcast
On December 14, 2018, I was a guest on Dan Bittner’s podcast, and the topic was the Sony data breach. Show Notes Researchers at Risk Based Security took a detailed look back at the 2014 Sony hack, comparing analysis that occurred while the facts were still unfolding with what we know, today. There are interesting…
-
Case Study: Third-Party Plugins
[This was originally published on RiskBasedSecurity.com in the 2018 Q3 Vulnerability QuickView Report.] Many people are familiar with content management systems (CMS), which are used in a variety of roles. Millions of people use them via hosted software such as WordPress.com and companies use them for blogging and knowledgebase systems. Historically, despite their wide deployment,…
-
New libssh Vulnerability – No Logo But Plenty Of Attention
[This was originally published on RiskBasedSecurity.com.] Earlier this week, Andreas Schneider announced the release of a new version of libssh, covering “an important security” that addressed “an authentication bypass vulnerability in the server code”. Pretty quickly we saw several news articles published that covered this issue, as well as third-party blogs that added commentary on the technical side of the vulnerability. Since we were following…
-
You Didn’t Think the Sony Saga Was Over, Did You?
[This was originally posted to the Risk Based Security blog. Unfortunately, no copy made it to the Internet Archive. A re-imagined version appeared on the Flashpoint Blog. The original is below.] On November 24th, 2014 a Reddit post appeared stating that Sony Pictures had been breached and that their complete internal network, nationwide, had signs…
-
The Attrition DC26 Badge Challenge Post Mortem
This year, which was my final trip to DEF CON, I made up one last round of Attrition DEF CON badges. In prior years they were typically engraved luggage tags a bit more specific to the year: Since #BadgeLife has become a big thing, especially this year as far as I can tell, I decided…
-
Our Reports Clickbait? No. Click Here To Find Out Why…
[This was originally posted to the Risk Based Security blog (now 404 and no IA copy), with contributions from Jake Kouns.] Last week, we published our 2018 mid-year report that included an overview of the vulnerabilities that we have tracked and included in VulnDB. We highlighted a key takeaway from the report in the title:…
-
The Uncertain Future of Necco Wafers and the Logical Response
Recently, the Necco wafer factory abruptly shut down after the company sold it to an “unknown buyer”. The footer to that image reads: “Necco, the oldest candy company in the country, abruptly shut down its Revere, Mass. factory on July 26, and left about 230 workers jobless. (Reuters)” Yes, the oldest candy company in the…
-
Case Study: Not A Vulnerability (NAV)
[This was originally published on RiskBasedSecurity.com in the 2018 Vulnerability Mid-year Report.] As stated earlier in this report, “incomplete information, constant updates and revisions, misinterpretation, and errors in reporting can all contribute to a level of confusion regarding the impact, severity and risk a vulnerability represents.” One way that this manifest is in vulnerability reports…
-
Jericho in Vegas Next Week… (for real)
Hi! Given my occasional good-natured trolling on Twitter, and since many have asked me the last few weeks, I want to set the record straight. I will be in Las Vegas next week, for real. I arrive tomorrow evening and leave the following Sunday. This is the first time at BH/DC in several years for…
-
DC26 Attrition Badge Round-up
This is the first DEF CON I am attending after a long break. For kicks I decided to make up a run of DC26 Attrition badges like prior years and conferences. Depending on who you ask, the badge is a decoration only, or it gets you into fabulous parties and amazing events. Anyone with a…