Tenable Blog

The second episode of Mr. Robot finds Elliot starting his new job at E-Corp. As he joins his new team and is looking to find a way to delay the shipment of all the paper data to New York facility, Elliott runs into the normal corporate middle management delays. He quickly realizes his first obstacle, William the Technology Manager, is up to no good and is deploying Rootkits on phones and selling the personal data collected. To circumvent this first obstacle, Elliot breaks out a good tool called theHarvester, and then promptly calls the feds.

We are at a critical inflection point in technology and business today. On one hand, we are on the cusp of realizing the transformative impact of innovations like IoT and Artificial Intelligence. And yet we continue to see crippling cybersecurity breaches within organizations of all kinds. Large, small, retail, finance, government, healthcare—no organization or industry is immune from the threat of cyber attack.

The United States Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI) have detected a coordinated effort by malicious actors at compromising the country’s critical infrastructure. These infrastructures include those involved in government, aviation, power production, energy production, and some critical manufacturing sectors. Typically, part of these infrastructures include Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems that control the physical processes.

A new weakness in WPA2 protocol could allow an attacker to read information that was previously assumed to be encrypted, provided the attacker is within the range of the victim.

The weakness was discovered by researchers Mathy Vanhoef and Frank Piessens, from the University of Leuven and has been dubbed KRACK (Key Reinstallation Attack).

As a companion to another post on hardening network devices and creating baseline configurations, I wanted to look at another area where standardizing configurations can pay off in a big way. While there is plenty of fertile ground out there, I decided to focus on some specific aspects of databases. As I started reviewing recent research, I noticed a couple of interesting things from the world of finance that likely aren’t radically different from most environments.