From The Blog
-
ConnectWise Slash and Grab Flaw Once Again Shows the Value of Input Validation We talk to Huntress About its Impact
Written by Sean KalinichAlthough the news of the infamous ConnectWise flaw which allowed for the creation of admin accounts is a bit cold, it still is one that…Written on Tuesday, 19 March 2024 12:44 in Security Talk Read 697 times Read more...
-
Social Manipulation as a Service – When the Bots on Twitter get their Check marks
Written by Sean KalinichWhen I started DecryptedTech it was to counter all the crap marketing I saw from component makers. I wanted to prove people with a clean…Written on Monday, 04 March 2024 16:17 in Editorials Read 1575 times Read more...
-
To Release or not to Release a PoC or OST That is the Question
Written by Sean KalinichThere is (and always has been) a debate about the ethics and impact of the release of Proof-of-Concept Exploit for an identified vulnerability and Open-Source…Written on Monday, 26 February 2024 13:05 in Security Talk Read 1109 times Read more...
-
There was an Important Lesson Learned in the LockBit Takedown and it was Not About Threat Groups
Written by Sean KalinichIn what could be called a fantastic move, global law enforcement agencies attacked and took down LockBit’s infrastructure. The day of the event was filled…Written on Thursday, 22 February 2024 12:20 in Security Talk Read 1080 times Read more...
-
NetSPI’s Offensive Security Offering Leverages Subject Matter Experts to Enhance Pen Testing
Written by Sean KalinichBlack Hat 2023 Las Vegas. The term offensive security has always been an interesting one for me. On the surface is brings to mind reaching…Written on Tuesday, 12 September 2023 17:05 in Security Talk Read 2131 times Read more...
-
Black Kite Looks to Offer a Better View of Risk in a Rapidly Changing Threat Landscape
Written by Sean KalinichBlack Hat 2023 – Las Vegas. Risk is an interesting subject and has many different meanings to many different people. For the most part Risk…Written on Tuesday, 12 September 2023 14:56 in Security Talk Read 1851 times Read more...
-
Microsoft Finally Reveals how they Believe a Consumer Signing Key was Stollen
Written by Sean KalinichIn May of 2023 a few sensitive accounts reported to Microsoft that their environments appeared to be compromised. Due to the nature of these accounts,…Written on Thursday, 07 September 2023 14:40 in Security Talk Read 2122 times Read more...
-
Mandiant Releases a Detailed Look at the Campaign Targeting Barracuda Email Security Gateways, I Take a Look at What this all Might Mean
Written by Sean KalinichThe recent attack that leveraged a 0-Day vulnerability to compromise a number of Barracuda Email Security Gateway appliances (physical and virtual, but not cloud) was…Written on Wednesday, 30 August 2023 16:09 in Security Talk Read 2097 times Read more...
-
Threat Groups Return to Targeting Developers in Recent Software Supply Chain Attacks
Written by Sean KalinichThere is a topic of conversation that really needs to be talked about in the open. It is the danger of developer systems (personal and…Written on Wednesday, 30 August 2023 13:29 in Security Talk Read 1890 times Read more...
Recent Comments
- Sean, this is a fantastic review of a beautiful game. I do agree with you… Written by Jacob 2023-05-19 14:17:50 Jedi Survivor – The Quick, Dirty, and Limited Spoilers Review
- Great post. Very interesting read but is the reality we are currently facing. Written by JP 2023-05-03 02:33:53 The Dangers of AI; I Think I Have Seen this Movie Before
- I was wondering if you have tested the microphone audio frequency for the Asus HS-1000W? Written by Maciej 2020-12-18 14:09:33 Asus HS-1000W wireless headset impresses us in the lab
- Thanks for review. I appreciate hearing from a real pro as opposed to the blogger… Written by Keith 2019-06-18 04:22:36 The Red Hydrogen One, Possibly One of the Most “misunderstood” Phones Out
- Have yet to see the real impact but in the consumer segment, ryzen series are… Written by sushant 2018-12-23 10:12:12 AMD’s 11-year journey to relevance gets an epic finish.
Most Read
- Microsoft Fail - Start Button Back in Windows 8.1 But No Start Menu Written on Thursday, 30 May 2013 15:33 in News Be the first to comment! Read 116522 times Read more...
- We take a look at the NETGEAR ProSafe WNDAP360 Dual-Band Wireless Access Point Written on Saturday, 07 April 2012 00:17 in Pro Storage and Networking Be the first to comment! Read 87469 times Read more...
- Synology DS1512+ Five-Bay NAS Performance Review Written on Tuesday, 12 June 2012 20:31 in Pro Storage and Networking Be the first to comment! Read 82026 times Read more...
- Gigabyte G1.Sniper M3 Design And Feature Review Written on Sunday, 19 August 2012 22:35 in Enthusiast Motherboards Be the first to comment! Read 80334 times Read more...
- The Asus P8Z77-M Pro Brings Exceptional Performance and Value to the Lab Written on Monday, 23 April 2012 13:02 in Consumer Motherboards Be the first to comment! Read 70986 times Read more...
Displaying items by tag: IoT
Crypto Mining Malware Targeting Linux and Linux Based IoT Devices Show How Little we have Progressed in IoT Security
IoT (Internet of Things) devices have long been a source of security concerns. Back in 2012-2014 we wrote a series of articles following the comedy of errors that is the IoT market. At the time I dubbed it the Internet of Fails simply because the companies making these internet connected devices were leaving them so open to compromise. Everything from a lack of encrypted communication with cloud services, to no passwords on administrative functions, to using images that had open files and folders in the firmware were found in popular connected products that were shipped to customers. Supply chain compromises were also found in generous quantities, making the mad rush to connect everything a serious concern.
Large numbers of Medical IoT Devices are Vulnerable to Attack According to Unit 42
IoT devices in general are the bane of most security teams. Typically, they lack basic security features and are complicated at best to keep patched. Much of this is due to the process needed to patch them and the rest of due to vendors being slow to push out the updated/patched images. To further complicate this, in the medical world you have the demand for 100% uptime and the ever-popular FDA exclusions that far too many vendors operate under. This usually means that on any given day Medical IoT devices are an attack surface waiting to be attacked.
We take a look at the Pico Pro Home Brewing Machine
Technology has brought us a ton of interesting and fun devices. We have smart phones, Smart TVs, Wireta… I mean home personal assistants and even home automated brewing systems. The latter is going to be the subject of our review toady. The concept of home brewing is not new at all. People have been spending lots of money to boil grain (and adding hops) to ferment it into the magnificent substance we call beer. However, boiling grain and inserting hops into your different mash stages can be both boring and time consuming for many. Enter IoT and the concept of the connected device. Beer enthusiasts realized that they could use a certain level of technology to pre-program temperature, mash time, bittering etc. all into a computer and push that information to the cloud. There are a few products on the market that fit this bill, today we will be looking at one of the more popular and efficient systems, the Pico Pro. The Pico Pro is not new technology, but I felt it was time to take look at this from both a “it makes beer” and a technology perspective.
Conumers have a blind spot when it comes to IoT and Security
The Internet of Things, or IoT, Connected Devices, Smart devices whatever you want to call them have become a fixture in most homes. It has gotten to the point where you have to look hard to find a device that is not “Smart”. Manufacturers love to push the marketing term smart onto the consumer as it becomes a value add proposal; hey this can do all of this and you can control it using your phone from anywhere. What they do not disclose is exactly how insecure these devices are and how much privacy you can end up giving up just by having them in your home.
Cyber Sex in the… well really anywhere you want now with VR and connected devices.
The “adult toy” has been around for a very, very long time. They have examples of them going back to the Egyptians and earlier. For thousands of years they were pretty much the same with a few add-ons to make them a little more fun. All of that changed in the 20th century when electronics got smaller along with motors and other items. In the 21st century the addition of small personal area networks and the connected device brought a whole new game to this multi-million dollar industry.
The Brewie auotmated brewing machine is a standout connected device for 2016
2016 is going to be a year where the connected device really explodes. We thought that IoT (Internet of Things) was bad in 2015, well that is just peanuts compared to what we are going to see in 2016. Everything from lightbulbs to sex toys are going to connect to something for remote control. We took a look at a sampling of products shown off at CES 2016 and will be covering them in a little more detail. We have already looked at some of the better connected adult toys and are now going to take a look at the adult beverage side of things.
In IoT security is less of a concern than locking out your competitors…
It seems that Phillips does not want you to use their hue application with just anyone. If you are not aware, hue is a system that allows you to control special light bulbs. You can turn them on and off, adjust the temp (color) and much more. To some this sounds like a great idea, and it is pretty cool. However, after a recent firmware update some people are finding that they are no longer able to use hue with just any light bulb.
When will enough be enough when it comes to IoT security? VTech and Hello Barbie
When things are not quite right you always hope for that “ah-ha” moment when everyone realizes the issue and will actually begin to work on a solution. For connected devices we have been hoping for that since they were first introduced and are still waiting for the industry to have that moment. We thought that perhaps it would happen when a host of connected cameras were compromised allowing people to spy on and even talk to children that were being monitored by them. However, while the hole was covered up with tape (not really fixed) there was no general outcry to have these connected devices secure properly.
The cloud, IoT, vendors and security: things that do not go together.
This is not the first time that I have spoken out about cloud computing (internet based, or the Internet of Things and the way they are impacting the ability to secure a network. It is also not going to be the last. Simply put, the concept that everything needs to be controlled by a computer and talk back to some sort of internet based cloud show a level of ignorance that should not still be out there. Sadly it is and companies are still trying to push the cloud and connected device mentality despite the inherent and known security flaws that exist.
Has the glut of IoT devices given the game to the Bad Guys?
For a while now (many years actually) I have argued that the rush to turn everything into a techno-gadget has been irresponsible and dangerous. However, companies that are looking into the “Internet of things” simply do not care. They see dollar signs and revenue streams in adding services to their devices that were a one-time purchase before. Because of this they are blindly rushing products to market that are open to attack on a massive scale. Consumers who are ignorant to these flaws are buying them up at a rapid pace leaving themselves exposed to data theft and worse.