We get used to working around limitations in our tools, because that's what we have to work with. If you’re considering migrating your email, Customer Relationship Management (CRM) or Enterprise Resource Planning (ERP) package to a new platform, it’s like buying a new family car- planning for a new future while minimizing your existing expenses.
It’s nerve-racking to read that a product that your company relies upon has a critical zero day vulnerability. Do you scramble for a new solution, wait for a patch or just panic? Making important application decisions based on social-media rumblings isn't usually the best way to run an IT shop. In some ways, this is like driving down the road when your car starts making an unusual sound. It might not be time to consider buying a new car, but you do need to assess the situation.
Hello from the Lotan team at Leviathan!
We recently looked at a sample set of 80,000 crashdumps from a production environment and decided it was time to look at some data we have in aggregate. Lotan's core focus is detecting stage one attacks (shellcode) in crashed processes. To achieve this goal Lotan has to process the bulk of the data contained within a memory image. One of the most interesting components of these process images is the information about loaded modules from Windows processes.
I’m reminded of the saying ‘The Cobbler’s children have no shoes’. We consider our customer facing products more important than our internal ones.
During the Hacking Team breach which came to light earlier this week, a large quantity of Hacking Team's internal data was posted online. Some of this data pertained to a 0-day (a vulnerability which the vendor is not aware of) in Adobe Flash (versions 9 through to 126.96.36.199) (CVE-2015-5119) which allows an attacker to execute code on a victims computer if they browse to a website with a malicious flash file embedded.
This morning, OpenSSL released details of a vulnerability (CVE-2015-1793) affecting OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n and 1.0.1 for client connections; listening servers are unaffected unless they validate client certificates. Anyone can issue themselves a certificate for any domain and the OpenSSL library will not notice, allowing someone to impersonate a server and pass TLS/SSL based checks. The vulnerability allows an attacker to use a leaf certificate as if they were a Certificate Authority and issue rogue certificates to themselves.
CBS Sunday Morning came to Leviathan in February to discuss how security research and consulting can strengthen both the private and public sector against external security threats with Frank Heidt, our Chief Executive Officer.
Like many others in the security industry I sat down last night to watch the first episode of CSI: Cyber, the latest of the CSI franchises, following the work of special agent Avery Ryan and her team. Special agent Ryan is a CyberPsychologist who heads up the Cyber Crime Division of the FBI.