For 20 years a small two person firm in Ohio has licensed their TCP/IP software stack for use in embedded systems and IoT devices – from printers to medical devices. In June a collection of 19 vulnerabilities in this software was disclosed – affecting millions of devices from 50 different vendors. The collection of vulnerabilities […]
Ripple20 vulnerability affects millions of devices Read More »
Security Awareness Training is an essential component of any organisation’s information security. Even though it is mandated by frameworks such as PCI-DSS or ISO 27001, Security Awareness Training should be more than just a compliance exercise. A good security awareness training programme will drive changes in behaviour amongst staff, suppliers and customers that will improve
What is Security Awareness Training Read More »
Cable Haunt is a vulnerability in millions of cable modems which allows an attacker to execute arbitrary code on the modem. This vulnerability is interesting for two reasons – firstly the scale due to the number of vulnerable devices and secondly how the vulnerability came about. Cable Haunt is a buffer overflow defect in the
What is Cable Haunt? Read More »
Reading about the latest hacks by alleged nation state sponsored groups from China or Russia may make for interesting lunchtime reading. But do these groups pose a real threat to the typical business? Many security managers ask themselves: Do I really need to worry about nation state actors? In this article, we will answer that
The risks of nation state actors to your business Read More »
Anti-virus company Avast has revealed they were breached over several months, after identifying the suspicious activity on their network on 23rd September according to a blog post by their CISO. Avast think their CCleaner software was the target of a supply chain attack – with the hackers attempting to repeat the 2017 insertion of malicious
Avast breached via insecure VPN profile Read More »
Webmin, the web-based interface for system administration for Unix and Linux, had a remote code execution vulnerability deliberately introduced into its source code in April 2018. It was only publicised in August 2019 when a zero day exploit was published at DefCon 27. Webmin has been installed over a million times worldwide. The malicious code
Webmin utility compromised with deliberate RCE Read More »
Software Supply chain attacks – do you know what you are importing? Many websites and applications routinely import additional code modules from external repositories. These could be javascript libraries for a webpage or source code for an application. Two recent incidents illustrate the risks of supply chain attacks against the code of your applications and
What are software supply chain attacks? Read More »