ASD Strategies to Mitigate Targeted Cyber Intrusions

In Australia, the government provides formal guidance regarding cyber security in the form of the ‘Strategies to Mitigate Targeted Cyber Intrusions’ document, issued by the Department of Defence. This ties with the statutory information security compliance which anyone handling Australian Government data is subject to. They also rank these in order of importance from ‘essential’ […]

Read More →

UK 2015 information security breaches survey

The UK 2015 information security breaches survey has just been published, showing as anticipated that just about every aspect of security breaches is on the increase. A staggering 90% of large organisations surveyed admitted to having experienced at least one breach within the last year, up 9% from the previous year. Similarly small business breaches […]

Read More →

The What, Why and How of Wassenaar

If you work in the realm of cyber security and monitor its goings-on then you will probably have come across this hashtag lately; #wassenaar. Here we’re going to explain what’s happening, what exactly it means and how it might affect you. Wassenaar is the name of the town in the Netherlands where, in 1996, 41 […]

Read More →

In the headlines: mSpy, Friend Finder and more

mSpy surveillance service hacked In a somewhat ironic turn of events, mSpy, a provider of software allowing people to track others such as their children or spouses, has admitted to suffering a data breach. The news emerged through the Krebs on Security blog by security expert Brian Krebs, who was anonymously directed to the data […]

Read More →

Telstra reveals Pacnet succumbs to SQLi attack

Telstra, Australia’s largest telephone operating company, revealed yesterday that its internal corporate network Pacnet had been compromised via an SQL Injection attack. So far it is not yet known what exactly was taken from the network, but it is clear that the perpetrators had complete access to the corporate network, including email and admin systems. […]

Read More →

Genericons DOM-based XSS Vulnerability

Hundreds of WordPress themes and plugins that make use of the Genericons package, could be vulnerable to a DOM-based XSS vulnerability affecting millions of WordPress installations. Genericons are versatile vector icons embedded in a webfont from Automattic (the creators of WordPress). The vulnerability resides in the examples.html file included in the Genericons package by default. […]

Read More →

What the Verizon Report 2015 tells us about web app attacks

Verizon’s annual report, now in its eighth year, analyzes breach intelligence and data from multiple sources, including customers of Verizon’s forensics response division and customers of FireEye, the firm that investigated the recent hack of Sony Pictures Entertainment. It also examines data from cases investigated by law enforcement agencies, and from government and industry computer […]

Read More →

WordPress 4.2.1 Security Release addresses yet another XSS vulnerability

Yesterday, WordPress announced another security release, urging all users to update all WordPress installations immediately. WordPress Security Release 4.2.1 fixes yet another Stored Cross Site Scripting (XSS) vulnerability, which allows an unauthenticated user to inject JavaScript in WordPress comments. The injected script can be affect both WordPress users and WordPress administrators, and therefore this vulnerability is […]

Read More →