Stuck in Traffic – Mediaget Gets Cryptocurrency

A look at supply chain attacks through the lens of Mediaget, a BitTorrent client, getting bundled with malicious cryptocurrency mining software.

Watch more videos on my YouTube channel.

InfoSec and CyberSecurity terms described as snakes and hiking. What is threat landscape and threat hunting, anyways?

Watch more videos on my YouTube channel.

An introduction to the CySAFE controls framework.

Watch more videos on my YouTube channel.

Distributed Denial of Service (DDoS) attacks reached 1.5 Tbps this week. Yes, Terabytes. That’s due, in part, from reflection attacks using unsecured memcached servers.

Watch more videos on my YouTube channel.

Stolen laptops. It happens. It happens a lot, actually, according to breach statistics. And this common incident provides a way to talk about security controls.

Watch more videos on my YouTube channel.

Tackling an tactic without the context of the overall scam leaves us with a false sense of security. We may even miss potential defenses outside IT. Example? Financial fraud that starts as phishing email.

Watch more videos on my YouTube channel.

While we’re all reading about world readable Amazon S3 buckets leaking data, (cough, FedEx), criminals were moving to compromise world writable S3s. It’s a good reminder on breach fatigue.

Watch more videos on my YouTube channel.

When’s the best time to hack a company? Or put differently, when do companies slide backwards in their compliance and slouch in their security posture?

Watch more videos on my YouTube channel.

One of Tesla’s Amazon cloud instances was hijacked to mine cryptocurrency. Weak creds on Kubernetes led to Amazon creds, which were used for the miner. Thing is, the instance credentials also had access to vehicle telemetry data in S3.

Watch more videos on my YouTube channel.

Here’s two things to monitor for, when it comes to insider threats.

Watch more videos on my YouTube channel.