Device Take-Over (DTO) attacks are growing quickly now that hackers have found the Internet of Things. Using handy IoT search engines like Shodan.io, hackers easily get the recon to target the device type (usually one that has a known vulnerability already) and the IP addresses of their next victims. The IoT comprises webcams, home automation…
DetailsMatt Burgess’ October 2017 article in Wired, entitled “Captcha is dying. This is how it’s being reinvented for the AI age” is worth reading. A high level survey of the history and misadventures of the CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), the broken aspect of each evolution of the…
DetailsThe Verizon 2016 Data Breach Investigations Report (DBIR) is out, and the news is still bad, just like last year, the year before, and the ten years before those years. The DBIR states that 63% of data breaches in the past year involved weak, stolen, or default passwords. Notable too, the top attack pattern aimed…
DetailsThe “Internet of Things” (IoT) includes a class of devices known as automatic tank gauges (ATGs). ATGs play a critical role in monitoring and managing storage tanks, either underground or above-ground (USTs and ASTs respectively), which are used to store hazardous materials such as gasoline, diesel, jet fuel, and so on. ATGs continuously test for leaks, for…
DetailsSC Magazine reports that mobile devices were enlisted into a DDoS botnet and delivered a max hit rate of 275,000 HTTP GETS/minute to the target. The total hits were around 4.5B, so that works out to about 7 hits/mobile device. The theory is that an ad-serving network was used to deliver a malicious Javascript attack…
DetailsThe “Internet of Things” (IoT to the cognoscenti) has been around for a while, but is gaining prominence now as almost every technology-based product that can be integrated with Internet access is in fact being integrated for Internet access. The reasons for doing this are not always compelling…but ‘smart home’ tech has been around for decades (remember the X-10 home…
DetailsIn 1999 two colonels in the People’s Liberation Army (PLA) published their treatise, “Unrestricted Warfare” which details asymmetric strategies for defeating opponents that have technological or numerical superiority over your own forces. Cyberwarfare is explicitly called out, identifying the internet and computers in general as a new, fifth domain of warfare (in addition to land,…
DetailsTracy Kitten’s recent article on DDoS for Bitcoins (DD4BC) shows the evolution of DDoS attacks into a form of criminal extortion. The advice of law enforcement agencies is: “Don’t pay. File a complaint. Contact your ISP.” This is the online version of the classic protection racket, except that instead of Lewie the Leg Breaker visiting…
DetailsThis one popped up recently…a good example of the dangers in, and for criminals the advantages of, knowing something that few others know. In this case, newswire firms (not named, but firms like Reuters or Bloomberg) customarily receive embargoed press releases announcing companies’ quarterly earnings for general availability at a particular point in the future. This…
Details
