By William Knowles @c4i
Senior Editor
InfoSec News
October 18, 2018
Adrian/@irongeek_adc has uploaded all the presentations from DerbyCon VIII here and at Archive.org to download. DerbyCon was held at the Marriott Louisville on October 3rd thru the 7th, 2018. Dates for DerbyCon 9 have been announced, Training dates are September 18th and 19th 2019, with the conference again to be held at the Marriott Louisville September 20th to 22nd 2019.
By William Knowles @c4i
Senior Editor
InfoSec News
August 11, 2018
After nearly a 30 month break from running InfoSec News continuously for fourteen years, I will be doing a soft re-opening in the next week or so as we hammer out all the little fixes (like forcing https!) that have been hounding the site. A future post will go into greater detail about the sabbatical from running InfoSec News and what lies in the future. In the meantime, I am handing out InfoSec News stickers and globe beach balls around DEF CON 26, as you ‘might’ have received one at the DEF CON 26 Hacker Jeopardy finals tonight and was curious what this site is about.
By William Knowles @c4i
Senior Editor
InfoSec News
January 17, 2015
President Obama just unveiled a number of proposals to crack down on hackers. It’s great that the government is working on this but we need to do a better job of protecting ourselves. So Jimmy Kimmel sent a camera out onto Hollywood Boulevard to help people by asking them to tell us their password.
It’s too bad there’s no legislation planned for poor password choice.
By William Knowles @c4i
Senior Editor
InfoSec News
January 16, 2015
Bob Greifeld, CEO of The NASDAQ Stock Market explains in a promotional video “that NASDAQ is a technology-based company, those businesses that we’re in have a unifying theme that are built upon our technology.”
Top technology companies such as Google, Tesla, Amazon, and GoPro to name a few use NASDAQ as their trading exchange.
When NASDAQ “goes to a developing market and provide to them our technology, its not just the software code, its all the best practices that have been developed on a global basis that they to integrate into their operations.”
With this information in mind, it doesn’t explain why a security researcher named analfabestia was able to discover and report a new XSS (Cross-Site Scripting) vulnerability on NASDAQ.com on January 14, 2015, The sixth such vulnerability in nearly seven years.
The vulnerability reported to XSSposed (XSS exposed) is still unpatched putting NASDAQ users, visitors and administrators at risk of being compromised by malicious hackers. Theft of cookies, personal data, authentication credentials and browser history are probably the less dangerous consequences of XSS attacks.
NASDAQ was previously hacked back in 2010, Bloomberg BusinessWeek covered this in July 2014.
Nasdaq (NASDAQ: NDAQ) is a leading provider of trading, exchange technology, information and public company services across six continents. Through its diverse portfolio of solutions, Nasdaq enables customers to plan, optimize and execute their business vision with confidence, using proven technologies that provide transparency and insight for navigating today’s global capital markets.
Photo: Marc van der Chijs via Compfight
By William Knowles @c4i
Senior Editor
InfoSec News
October 10, 2014
Last month a web server at ARRL Headquarters was breached by an unknown party. ARRL IT Manager Mike Keane said that League members have no reason to be concerned about sensitive personal information being leaked, and assures members that there’s nothing of financial value on the compromised server.
Some ARRL servers were taken offline and isolated from the Internet when the hack was discovered. Some web functions were temporarily disabled. The ARRL expects to restore service by close of business, on Wednesday, October 8, 2014
ARRL’s Mike Keane stressed that it is highly unlikely that any sensitive information was compromised. Any information the hacker might have been able to glean from the ARRL server, he said, is already publicly available — data such as names, addresses, and call signs that appear in the FCC database.
The hacker may have been able to obtain site usernames and passwords that were established prior to April 2010, and that has not been changed since then. ARRL members who have not changed their ARRL website passwords since early 2010 should do so at this as soon as possible.
Keane said that in addition to reporting the security breach to federal law enforcement authorities, his department is working to increase the League’s Internet security posture.
Photo by C-Serpents via Compfight
