-
Mengxue Ni posted a new activity comment 7 years, 10 months ago
This two terms are always used together, so people forget that there are differences between them.
What is BCP?
Identify contingencies and alternatives for continuing business, and allow the business to define key parameters for the development of DRP. Concerned with keeping business operations running after disaster has struck.
What is…[Read more] -
Mengxue Ni posted a new activity comment 7 years, 10 months ago
Is Your Access Control System a Gateway for Hackers?
With access control systems being prime entry points to hacking IT and OT systems, security professionals need to stress protecting security systems. In order to get into IT and critical infrastructure operational technology systems, hackers look for the easiest path in leveraging many…[Read more]
-
Mengxue Ni wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 7 years, 10 months ago
The top 15 safest nations are:
Switzerland (Data risk score – 1.6 percent)
Singapore (1.9)
Iceland (2.3)
Luxembourg (2.6)
Hong Kong (3.6)
Taiwan (3.9)
Austria (5.2)
New Zealand (5.2) […] -
Mengxue Ni commented on the post, Yahoo Built a Secret Tool to Scan Your eMail Content for US Spy Agency, on the site 7 years, 10 months ago
Thanks for sharing this new, Scott! Yahoo is suffering from the data breach crisis now. If this is confirmed to be true, I think they won’t be able to get through it, they may become bankruptcy. I know there are couple companies interested in making an acquisition of Yahoo.
-
Mengxue Ni posted a new activity comment 7 years, 10 months ago
An electromagnetic pulse is an extremely powerful burst of electromagnetic energy capable of causing damage and/or disruption to electrical and electronic equipment.
What can cause and EMP? 1. Detonation of a nuclear bomb 2. A solar flare 3. A device intended to cause and EMP 4. A close lighting stroke 5. A massive powerline short circuit.…[Read more] -
Mengxue Ni posted a new activity comment 7 years, 10 months ago
Police Bust Multi-Million Dollar Indian Vishing Ring
Mumbai police have smashed an international vishing operation which could have netted ringleaders as much as $7.5 million from US victims who thought they were calling from the IRS. Police have detained over 700 staff at several call centers in the Thane and seized hundreds of servers, hard…[Read more]
-
Mengxue Ni wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 7 years, 10 months ago
Many organizations no longer view cybersecurity as a barrier to change, nor as an IT cost. PwC conducted an information security survey 2017 that found there is a distinct shift in how organizations view […]
-
Better late than never. This is encouraging to see big companies like PwC finally realizes that cyber security should be an embedded element of their business. With 59% of organizations that participated in PwC’s information survey said they have increased cyber security spending as a result of digitization of their business ecosystem, slowly but surely this will increasingly become a problem against hacking attacks and render attackers’ jobs more difficult.
-
-
Mengxue Ni wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 7 years, 10 months ago
WordPress is a popular target because majority or the web uses it to manage and publish their content. According to the 2016 Sucuri report on WordPress continues to lead the number of infected websites at 74%. […]
-
I wanna share some snippet from Wikipedia regarding how famous is the security breached and vulnerability in WordPress
Many security issues have been uncovered in the software, particularly in 2007, 2008, and 2015. According to Secunia, WordPress in April 2009 had 7 unpatched security advisories (out of 32 total), with a maximum rating of “Less Critical”. Secunia maintains an up-to-date list of WordPress vulnerabilities.In January 2007, many high-profile search engine optimization (SEO) blogs, as well as many low-profile commercial blogs featuring AdSense, were targeted and attacked with a WordPress exploit. A separate vulnerability on one of the project site’s web servers allowed an attacker to introduce exploitable code in the form of a back door to some downloads of WordPress 2.1.1. The 2.1.2 release addressed this issue; an advisory released at the time advised all users to upgrade immediately.
In May 2007, a study revealed that 98% of WordPress blogs being run were exploitable because they were running outdated and unsupported versions of the software. In part to mitigate this problem, WordPress made updating the software a much easier, “one click” automated process in version 2.7 (released in December 2008). However, the filesystem security settings required to enable the update process can be an additional risk.
In a June 2007 interview, Stefan Esser, the founder of the PHP Security Response Team, spoke critically of WordPress’ security track record, citing problems with the application’s architecture that made it unnecessarily difficult to write code that is secure from SQL injection vulnerabilities, as well as some other problems.
In June 2013, it was found that some of the 50 most downloaded WordPress plugins were vulnerable to common Web attacks such as SQL injection and XSS. A separate inspection of the top-10 e-commerce plugins showed that 7 of them were vulnerable.
In an effort to promote better security, and to streamline the update experience overall, automatic background updates were introduced in WordPress 3.7
Individual installations of WordPress can be protected with security plugins that prevent user enumeration, hide resources and thwart probes. Users can also protect their WordPress installations by taking steps such as keeping all WordPress installation, themes, and plugins updated, using only trusted themes and plugins,[82] editing the site’s .ht-access file to prevent many types of SQL injection attacks and block unauthorized access to sensitive files. It is especially important to keep WordPress plugins updated because would-be hackers can easily list all the plugins a site uses, and then run scans searching for any vulnerabilities against those plugins. If vulnerabilities are found, they may be exploited to allow hackers to upload their own files (such as a PHP Shell script) that collect sensitive information.
Developers can also use tools to analyze potential vulnerabilities, including WPScan, WordPress Auditor and WordPress Sploit Framework developed by 0pc0deFR. These types of tools research known vulnerabilities, such as a CSRF, LFI, RFI, XSS, SQL injection and user enumeration. However, not all vulnerabilities can be detected by tools, so it is advisable to check the code of plugins, themes and other add-ins from other developers.
In March 2015, it was reported by many security experts and SEOs including Search Engine Land that a SEO plugin for WordPress called WordPress SEO by Yoast which is used by more than 14 million users worldwide has a vulnerability which can lead to an exploit where hackers can do a Blind SQL injection.
To fix that issue they immediately introduced a newer version 1.7.4 of the same plugin to avoid any disturbance on web because of the security lapse that the plugin had.
WordPress’ minimum PHP version requirement is PHP 5.2,which was released on January 6, 2006, 10 years ago, and which has been unsupported by the PHP Group and not received any security patches since January 6, 2011, 5 years ago
-
Mengxue and Vaibhav, thank you for your valuable and informative points about WordPress’ threats. Apparently, WordPress has a lot of work to do and I hope they are paying attention and take this seriously. Major academic and media organizations, including CNN and Temple, use the WordPress platform for their website. You are right Mengxue when you mention that it would be catastrophic if our school falls under WordPress’ victim list. As a recommendation, I would suggest the Content Management System to review in-house enterprise architecture, policies and technology to align itself with the best cyber security capabilities. This is something WordPress should not take lightly as the CMS leading the number of infected websites with 74%.
-
-
Mengxue Ni posted a new activity comment 7 years, 10 months ago
White list and black list can be both used in an organization if necessary. Based on situation, most organizations would choose one applications. To simply explain whitelist vs blacklist:
Whitelist:
• Default-deny
• uses a list of approved apps, software, emails, domains, etc.
• Items not on the approved list are restricted or denied, depen…[Read more] -
Mengxue Ni posted a new activity comment 7 years, 10 months ago
Yahoo Mobile Mail Wide Open Even After Password Reset
Yahoo announced that at least 500 million Yahoo accounts were stolen from the company in 2014. Trend Micro Zero Day Initiative (ZDI) researchers are warning that a password reset still leaves mobile mail wide open to criminals. ZDI’s Simon Zuckerbraun said that he received a notification t…[Read more]
-
Mengxue Ni commented on the post, Biometric Skimmers Pose Emerging Threat To ATMs, on the site 7 years, 10 months ago
Marcus,
I used to think biometric authentication could be a better way to help people secure their asset. After I read this new, I changed my mind because the point that once criminals obtained your biometric information, you can not even change it as passwords. If the data was breached, what can we do to protect ourselves?
-
Mengxue Ni commented on the post, Student legally hacks airline and earns $300,000 of miles, on the site 7 years, 10 months ago
Jason, thank you for posting this new. I think the story behind the student is very interesting. I know many organizations started to use bounty program to encourage people to help them find vulnerabilities in their systems. Few weeks ago, Yelp offered up to 15K award for people who find fatal vulnerabilities.
-
Mengxue Ni commented on the post, 97% of Top 1,000 Orgs Suffer Credential Compromise, on the site 7 years, 10 months ago
Jason, thank you for asking the question. I do think companies should take the responsibility since it relates to their own benefits. I believe they are eager to find a solution to protect all the passwords. There are many software that help store password but self awareness of employees is also very important.
-
Mengxue Ni posted a new activity comment 7 years, 11 months ago
What are the security challenges in online banking?
Online banking has become a trend as we can see in exhibit 2, millions of people are using internet today. Usually, when you open a bank account, it will come with an online account. Online banking had two components: net banking and mobile banking.
Therefore, we can analyze some major…[Read more] -
Mengxue Ni wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 7 years, 11 months ago
Digital Shadows has found that, for the largest 1,000 organizations in the world, there are more than 5 million leaked credentials. The company said in blog-for companies that were the victims of breaches, there […]
-
These password breaches are not just a risk to internal employee credentials, but also a risk to companies that have customer facing websites. With the hacks referenced in these articles, many companies are seeing a rise in brute force password attacks on their sites with hackers attempting to use the same or similar passwords associated with credentials that were hacked.
I think companies should have a responsibility to prevent these brute force attempts (e.g. locking accounts out after a number of invalid attempts and monitoring for abnormal login activity). Anyone else have any thoughts on this?
-
Jason, thank you for asking the question. I do think companies should take the responsibility since it relates to their own benefits. I believe they are eager to find a solution to protect all the passwords. There are many software that help store password but self awareness of employees is also very important.
-
-
-
Mengxue Ni posted a new activity comment 7 years, 11 months ago
Hackers Leak Michelle Obama’s Passport Online
A scan of First Lady Michelle Obama’s passport has been published online, the feds are investigating the breach now. The scan appeared on a site with suspected ties to Russia, DCLeaks.com. The hacking group also published other confidential information like travel details, names, social security num…[Read more]
-
Mengxue Ni wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 7 years, 11 months ago
Created by Mengxue Ni and Mengqi He
Executive summary
PowerPoint (PDF version)
PowerPoint (PPT Version)
Presentation video
-
Mengxue Ni commented on the post, "Uber, Dropbox, Other Tech Leaders Team Up To Boost Vendor Security", on the site 7 years, 11 months ago
One weeks ago, I saw that Yelp was providing a big bounty for people who could find vulnerability in their system. I am glad to see these companies can form an alliance to encourage people who have computer skills. Also, this is a sign of that companies started to value and pay more attentions on cyber security.
-
Mengxue Ni commented on the post, Cyberattacks on Athletes May Be Russian Distraction Tactic, on the site 7 years, 11 months ago
Shain,
I read article that related to Fancy Bear as well. They also leaked American athletes–Simone Biles and Serena Williams’ medical records. Both reports indicated that they were doped during the Olympic game but the anti-doping agency didn’t mention it. They had to explained to the public that those medicines didn’t count for prohibited…[Read more]
-
Mengxue Ni commented on the post, Volkswagen and former members of Israeli intelligence agency form automotive cyber security firm, on the site 7 years, 11 months ago
Josh, thank you for sharing this article!
It is sounds interesting and new. I didn’t know any cyber crime that related to automotive. But I think since now many cars can also connect on internet, there will be some cyber security problems that need people to notice. If there is a example, I think it will be perfect.
- Load More
There are a lot of factors to consider when thinking about the physical location of data storage. This chart seems to combine three factors; infrastructure, politics, and natural disasters. The problem with an overall score like this is that it is only a good starting place to understand good locations. The real challenge is understanding how infrastructure, politics, and natural disaster risk weighs on the minds of your company’s board. If your company absolutely can’t take any political risks, such as a government peeking into your servers, there are certain countries that may receive very low overall scores for your needs.