News of a new destructive cyberattack targeting Saudi interests was published on January 7, 2020. The attack, likely from the government of Iran, took place in the Kingdom on December 29, 2020. The Saudi National Cybersecurity Authority published a technical analysis of the malware, Dustman, that was used for file wiping. In this video, we […]
Archive | Cyber Threat Intelligence
Updating The Iranian Cyber Threat Assessment
Cyber Threat Intelligence IranIn this video, Rendition founder Jake Williams (@MalwareJake) and Brandon McCrillis (@13M4C) discuss how the launch of ballistic missiles from Iran into Iraq changes the cyber threat picture. In short, we don’t think much has changed. It is possible that the risk from hacktivists not controlled or directed by the Iranian government has increased, but […]
Assessing the Iran Cyber Threat
Cyber Threat Intelligence IranAt Rendition Infosec, we’ve fielded a number of calls from clients asking about the Iranian cyber threat in the wake of the Soleimani killing. In this video, we walk through likely targeting as well as action steps you can take to respond to the threat. It should go without saying, but any assessments made are […]
PHP PEAR Backdoor Discovered
Software Supply Chain Supply Chain SecurityOn January 19th, the maintainers of the popular PHP package management system disclosed that they had discovered a backdoor in an installer component named go-pear.phar. The PEAR website is still down as of today and maintainers state that they have no ETA for when a clean site will be on line. Although initial indications were […]
Super Micro Hardware Backdoors
Hardware Backdoors Network Monitoring Supply Chain Security Threat ModelToday, Bloomberg published an article claiming that at least some Super Micro motherboards contained hardware backdoors. While we don’t have any inside information, we’ve been fielding several calls from clients about actions they should take and wanted to expand our thoughts on this outside our existing customer base. To begin, it’s important to note that […]
Should Antivirus software be part of your threat model?
Antivirus Cyber Threat Intelligence Kaspersky Software Supply Chain Threat ModelShould Antivirus (AV) software be part of your threat model? Strictly speaking, yes it probably should be. AV is potentially dangerous to an organization and should be tested thoroughly before being deployed. As argued in the recent WSJ article about Kaspersky (note that the article is behind a pay wall), AV software could threaten the […]
Equifax Breach – Early lessons learned and six point action plan
C-Suite Cyber Threat Intelligence Network Monitoring Penetration Testing Security Monitoring TableTop Exercises Technology Threat Model Web Application Penetration TestingIn this post, we’ll discuss a few early lessons learned from the Equifax breach announced yesterday. We’ll also recommend a six point plan to avoid becoming “the next Equifax” based on what we know today about the breach. Rendition is in no way involved with the breach assessment for Equifax and we have no inside […]
The need for cyber security in law firms
Cyber Threat Intelligence Law Firms Network Monitoring Threat ModelAn interesting article came through our feed today mentioning the need for cyber security in law firms. As an information security company that works with law firms, we couldn’t agree more. The article makes a number of points, but leaves a couple of critical things out, and we’d like to cover those here. It’s worth […]
The need for dump analysis in Cyber Threat Intelligence (CTI)
Cyber Threat Intelligence Shadow Brokers Threat Model WikiLeaksOver the last year, there have been numerous dumps of stolen classified data posted on the Internet for all to see. The damage from these dumps has obviously been huge to the US intelligence community. In this post, we won’t discuss the actual damage of the dumps to the intelligence community (many others have already […]
Software plugins/extensions should be part of your threat model
Cyber Threat Intelligence Security Monitoring Software Supply Chain Threat ModelOver the last few months we’ve seen multiple cases of warnings about plugins and extensions for various software packages threatening the security of users. We’ve recently seen the Copyfish and and Web Developer Chrome plugins compromised and used to push malware to users. While Chrome is likely safe and should probably not be considered a […]