All Blog Posts (1,243)

Banking Trojans Dyre or Dridex Retooled for Data Mining

The evolution of malware is garnering attention from security researchers and law enforcement, as the off-the-shelf banking Trojans known as Dyre and Dridex have now been linked to the theft of massive amounts of corporate and personal data.

DRIDEX or DYRE had become one of the leading banking Trojans, targeting over 240 financial institutions. DRIDEX/DYRE malware is descended from the ZEUS Banking Trojan, developed by…

Continue

Added by T.D.Virwani on October 6, 2015 at 5:30pm — No Comments

Threat Intelligence Workshop

Threat Intelligence Workshop by Bikash Barai:

  • Key Components (People,Process and Technology)
  • Threat Intelligence Maturity Model
  • Threat Collection & Analysis
  • Integrating Actionable Intelligence
  • Technology & Vendor Landscape 

( Read More:…

Continue

Added by Gireesh Kumar on October 5, 2015 at 6:00pm — No Comments

PeopleSoft Security Part 3: PeopleSoft SSO & TokenChpoken Attack

In the third part of the PeopleSoft Security series,we will describe on how to log-in any account and gain full access to the PeopleSoft system.

What is PeopleSoft SSO and how does it work?

Like many other enterprise business applications, PeopleSoft supports various Single Sign-On technologies. SSO enables authentication into several systems by a single action: a user logs into one system manually and into others automatically.

PeopleSoft supports its own…

Continue

Added by Alexander Polyakov on October 1, 2015 at 8:30pm — No Comments

PeopleSoft Security Part 2: “Decrypting” AccessID

Now that we have covered PeopleSoft Architecture, it is time to continue with PeopleSoft security and describe some attack vectors against PeopleSoft system discovered by ERPScan researchers. The first one is an attack on back-end systems.

First, we should clarify some essential terms:

  • User ID – a PeopleSoft user account.
  • Connect ID – a special account with minimal DBMS privileges.
  • Access ID – a special account with a high level of DBMS…
Continue

Added by Alexander Polyakov on October 1, 2015 at 8:00pm — No Comments

First Death by Internet

The quickly evolving Internet of Things or call it Internet of Everything will leave us more vulnerable to the cyber criminals. Government agencies are not prepared to combat the upcoming threat of “Online Murder”. Sounds Strange!!.. but we are heading towards this.

The upcoming IoT is an open source for the cyber criminals to exploit internet technology to target victims, the forensic techniques needs to address the danger posed by the cyber criminals.

"Internet of Everything"…

Continue

Added by Anubhav Bathla on October 1, 2015 at 7:31pm — No Comments

Webinar on "Defusing Cyber Threats Using Malware Intelligence"

Webinar on "Defusing Cyber Threats Using Malware Intelligence" Video by Arun Lakhotia.

  • How a Malware can be source of intelligence about the attacker
  • How Large scale, automated malware analysis to extract intelligence is feasible
  • How Malware intelligence can aid defuse targeted attacks

( Read more:  …

Continue

Added by Gireesh Kumar on September 29, 2015 at 2:30pm — No Comments

Workshop: CASB - Part 1

CASB Workshop Part 1 by Bikash Barai:

  • Technology Taxonomy For Cloud Security
  • Key Components of Cloud Security Architecture
  • Blue Print To Build Your Cloud Security Program
  • Basics of Cloud Security Access Brokers…

Continue

Added by Gireesh Kumar on September 28, 2015 at 5:30pm — No Comments

Webinar on "Front Door Access to Pwning Millions of Android Devices"

Webinar on  "Front Door Access to Pwning Millions of Android Devices" Video by Avi Bashan.

  • Learn about Android certificate & permission framework including the roles of Google, OEMs, & mobile carriers. 
  • Overview of the Mobile Remote Support Tools Architecture (mRST) implementation and flaws & how it correlates to the Android architecture. 
  • Explain how these certifi-gate vulnerabilities can be exploited, the implications on enterprise…
Continue

Added by Gireesh Kumar on September 22, 2015 at 3:30pm — No Comments

Wargame : Dashboard & Metrics For The Management

Wargame : Dashboard & Metrics For The Management Video by Renu Rajani,Sridhar Govardhan,Raghu Kumar Paruchuri,Tamaghna Basu.

Added by Gireesh Kumar on September 11, 2015 at 7:00pm — No Comments

Workshop: Application Security - Part 2

Application Security Workshop Part 2 by Nilanjan De:

  • Web Attack Chaining
  • Understanding IAST/RASP
  • Realtime Polymorphism…

Continue

Added by Gireesh Kumar on September 11, 2015 at 6:30pm — No Comments

Workshop: Application Security-Part 1

Application Security Workshop Part 1 by Jitendra Chauhan:

  • Web Attack Chaining
  • Understanding IAST/RASP
  • Realtime Polymorphism

Application Security Workshop Part 1 Video by Jitendra Chauhan:…

Continue

Added by Gireesh Kumar on September 9, 2015 at 7:30pm — No Comments

Workshop: Network Forensic Tools & Techniques

Network Forensic Tools & Techniques Workshop by Tamaghna Basu:  

  • Introduction,Basic Protocol Analysis,
  • Forensic Analysis Network/Web/Malware,
  • Basic Packet Analysis Challenges…

Continue

Added by Gireesh Kumar on September 9, 2015 at 7:00pm — No Comments

Analysis Report: Cyber Attack & Incident Data, 2015

IBM Managed Security Services continuously monitors billions of events per year, as reported by more than 8,000 client devices in over 100 countries. This report is based on data IBM collected between 1 January 2014 and 31 December 2014 in the course of monitoring client security devices as well as data derived from responding to and performing analysis on cyber attack incidents. Because our client profiles can differ significantly across industries and company…

Continue

Added by CISO Platform on September 9, 2015 at 4:30pm — No Comments

Securing SAP Systems from XSS vulnerabilities Part 4: Defense for SAP HANA XS

Today’s post is the last in the series of articles about XSS vulnerabilities in SAP systems. The previous parts describe how to prevent XSS in SAP NetWeaver ABAP and SAP NetWeaver J2EE.

XSS is one of the most popular vulnerabilities and its effect can range from a petty nuisance to a significant security risk, depending on the sensitivity of the data. In SAP products, 628 XSS vulnerabilities were discovered that is almost 22%…

Continue

Added by Alexander Polyakov on August 25, 2015 at 5:48pm — No Comments

Securing SAP Systems from XSS vulnerabilities Part 3: Defense for SAP NetWeaver J2EE

From the developer’s perspective

For AS Java, the encoding is available as tc_sec_csi.jar. There is a static class and an interface which provides the encodings for HTML/XML, JavaScript, CSS and URL. Also it is available to use methods of public class StringUtils (com.sap.security.core.server.csi.util.StringUtils):

  • escapeScriptEndTag(String pStr) - Prepare a string to be used for a javascript…
Continue

Added by Alexander Polyakov on August 25, 2015 at 5:47pm — No Comments

Securing SAP Systems from XSS vulnerabilities Part 2: Defense for SAP NetWeaver ABAP

We continue our series of posts giving a review of one of the most frequent vulnerability which affects a lot of SAP modules: cross-site scripting, or XSS. Today's post describes how to protect SAP NetWeaver ABAP from XSS.

From the developer’s perspective

For all generic Web applications where you accept input parameters, you must use encoding methods provided by the ICF handler. The implementation of the encoding is…

Continue

Added by Alexander Polyakov on August 25, 2015 at 5:46pm — No Comments

PeopleSoft Security Part 1: Overview of architecture

Oracle PeopleSoft applications are quite complex and consist of many components, so does their security. While there is almost no research on PS security, successful attacks against such systems happen from time to time. That’s why we decided to start a series of articles about some aspects of PS security.

These applications are designed to address the most complex business requirements. They…

Continue

Added by Alexander Polyakov on August 24, 2015 at 6:44pm — No Comments

Oracle Security: Researchers' response to the post by Oracle CSO Mary Ann Davidson

Hello, dear readers! Today I would like to talk about Oracle Security.

On August 11, Mary Ann – Oracle's CSO - published an incredibly shocking post about security researchers which was promptly deleted (either by herself or somebody else). The post was discussed by multiple resources such as…

Continue

Added by Alexander Polyakov on August 24, 2015 at 6:38pm — No Comments

Ponemon Report: Cost of Data Breach in India, 2015

This year’s study examines the costs incurred by 36 Indian companies in 12 industry sectors after those companies experienced the loss or theft of protected personal data and then had to notify breach victims and/or regulators as required by laws and business…

Continue

Added by CISO Platform on August 20, 2015 at 10:30pm — No Comments

Major components of IT GRC solutions

Governance, Risk and Compliance is sometimes a managerial step or a mandatory step to adhere with regulations & maintain compliant systems. It widely helps in Risk Management.

Some of the major components of IT GRC are:

  1. IT Policy Management
  2. IT Risk Management
  3. Compliance Management
  4. Threat & Vulnerability Management
  5. Vendor Risk Management
  6. Incident…
Continue

Added by pritha on August 18, 2015 at 4:30pm — No Comments

Monthly Archives

2020

2019

2018

2017

2016

2015

2014

2013

2012

1999

© 2020   Created by CISO Platform.   Powered by

Badges  |  Report an Issue  |  Privacy Policy  |  Terms of Service