Top all-time · #980
tripwire.com
Company blog · tripwire.com/state-of-securitysecurity
tripwire.com is the company blog at tripwire.com, writing about security. Since 2012, 69 different Hacker News readers have linked it 404 times, most often “Critical Git Vulnerability Allows for Remote Code Execution”. No feed was found, so read it on the site itself.
Rarely recommended · 1 of 31 sampled comments recommend it?
Why HN links it
HN readers link Tripwire's State of Security posts as references on security topics such as phishing, CVEs, kill chains, Mirai botnets, data brokers and Yahoo and Apple account breaches. Mostly cited as sources.
- Recommended for · 1 comments
- One commenter says a post covers the basics of operational security decently.1
Summarised by Claude from a sample of 31 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Critical Git Vulnerability Allows for Remote Code Execution2 people · 2 mentions · first linked 2014-12-19
- Debunking 15 of the Biggest Information Security Myths2 people · 2 mentions · first linked 2012-06-13
- /state-of-security/incident-detection/microsoft-windows-zero-day-exploit-sandworm-used-in-cyber-espionage-cve-2014-4114/2 people · 2 mentions · first linked 2014-10-14
What Hacker News says?
Legacy code... https://www.tripwire.com/state-of-security/featured/boeing-7...
Comment linking /state-of-security/featured/boeing-757-hacked/
on “A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts”Submitted Citibank IT guy deliberately wiped routers, shut down 90% of firm’s US networks as a story · 174 points
HN discussionI saw this article a few days ago which covers some good things email clients could do to help improve security around phishing: http://www.tripwire.com/state-of-security/security-awareness... The problem is that there is a lot of information which can help technical people figure out if something is suspicious but the email clients don't use that info to help non-technical people know if something is safe.
Comment linking /state-of-security/security-awareness/why-have-email-clients-left-us-to-deal-with-phishing/
on “MIT And Dropbox Alums Launch Inbox, a Next-Generation Email Platform”Submitted Air-Gapped Computers Can Be Compromised Using EM Side-Channel Attacks as a story · 93 points
HN discussionOk, so that example maybe was not perfect. So what? Many apps nowadays talk with remote APIs. Imagine a twitter client, a SCADA app, pretty much anything nowadays, instead of nitpicking. Btw when you use libraries written in C that very much the same as communicating over the network from your app. Same process, same address space. Also note: local files may also be rigged... Other languages protect for whole classe…
Comment linking /state-of-security/latest-security-news/critical-git-vulnerability-allows-for-remote-code-execution/
on “Libui: GUI library in C”Submitted Efficient Wi-Fi Phishing Attacks as a story · 86 points
HN discussiontl;tr Fuck these cards. Go team Depot. Walmart is suing too. [0] As someone with one foot in retail, I can honestly say these cards are not doing anyone any favors. Fraud is rampant and there are shoppers that travel the world [0.5] with stolen cards just to spend stolen cards and gift cards [1]. During the transition to chip, Square had liability shift for non-chip cards [2], but we failed to meet the requirements…
Comment linking /state-of-security/risk-based-security-for-executives/risk-management/gift-card-fraud-how-its-committed-and-why-its-so-lucrative/
on “Home Depot Files Antitrust Lawsuit Against Visa, MasterCard”Submitted IoT Smart Lock Vulnerability Spotlights Bigger Issues as a story · 52 points
HN discussion> The last time they worried me was when "Microsoft shut down a million-strong Tor botnet, by uninstalling Tor from the computers" They did not uninstall Tor. They disabled it. More importantly, this Tor was NOT installed by the user of the computer. It was installed by the malware for its own use, without the knowledge of the computer user [1]. > I don't want Microsoft to have that kind of power, let alone use it A…
Comment linking /state-of-security/top-security-stories/microsoft-remotely-removes-tor-2-million-systems-kill-zeroaccess/
on “Microsoft takes down No-IP.com domains”Submitted Exploiting WPA2 in a City Wide Wi-Fi as a story · 39 points
HN discussion> I believe in defense in depth. ... While I appreciate OSX having a strong security model, secondary solutions are desirable too me. You might want to check out mtree(8) then. It's serves well as the FreeBSD/OS-X Tripwire[1] equivalent. 1 - http://www.tripwire.com
Comment linking /
on “OS X sudoers exploit found in the wild”Submitted Excel pivot table data leak leads to £120k fine for London council as a story · 30 points
HN discussionYes, OSes are a service. Do you expect the consumer to patch security bugs in the OS as they are discovered? Doesn't a steady, predictable, stream of regular "OS Updates" entrench the fact that OSes are indeed services? Honestly, tech was depressing in those days when NHS was running on Windows XP. Oh wait; yes, you're right. "These" days are still around today :( https://www.tripwire.com/state-of-security/healthcar…
Comment linking /state-of-security/healthcare/nhs-computers-running-windows-xp/
on “Apple countersues Epic, seeks punitive damages”Submitted Prodigy Email Vulnerability Puts Millions of Accounts at Risk as a story · 23 points
HN discussionmirror: http://www.tripwire.com/state-of-security/incident-detection...
Comment linking /state-of-security/incident-detection/microsoft-windows-zero-day-exploit-sandworm-used-in-cyber-espionage-cve-2014-4114/
on “iSIGHT discovers vulnerability used in Russian cyber-espionage campaign”Submitted Does dropping malicious USB sticks really work? Yes, worryingly well… as a story · 21 points
HN discussionSeems like isightpartners is down atm. Here are some more details: http://www.tripwire.com/state-of-security/incident-detection...
Comment linking /state-of-security/incident-detection/microsoft-windows-zero-day-exploit-sandworm-used-in-cyber-espionage-cve-2014-4114/
on “iSIGHT discovers vulnerability used in Russian cyber-espionage campaign”Submitted 117M LinkedIn email addresses and passwords put up for sale as a story · 21 points
HN discussionThey can be security issues since the compiler is allowed to optimize stuff. The compiler can check, that some checks the user added "don't make sense" since those only would be hit if something undefined happens. An example is shown in https://www.tripwire.com/state-of-security/vulnerability-man... but there are many more.
Comment linking /state-of-security/vulnerability-management/compiler-undermining-secure-coding/
on “Signed Integers Are Two’s Complement”Submitted Elaborate Email Hoax Causes Company’s Shares to Drop as a story · 17 points
HN discussionThe NHS is particularly incompetent in this respect. edit: Here are some sources to support my point: NHS patient data breached at least 1,395 times in two years ( https://www.bbc.co.uk/news/technology-44682369 ) NHS data breach affects 150,000 patients in England ( https://www.bbc.co.uk/news/technology-44682369 ) Over 18K COVID-19 Patients’ Data Mistakenly Exposed by NHS Trust ( https://www.tripwire.com/state-of-se…
Comment linking /state-of-security/security-data-protection/over-18k-covid-19-patients-data-mistakenly-exposed-by-nhs-trust/
on “Nearly 200K Medical Records of US Military Veterans Leaked”Submitted USPS Reports Healthcare Breach for 485K Employees as a story · 9 points
HN discussionStop believing the marketing, they can say message is end to end encrypted even if they encrypt it twice, once with apple key and once with "end" key (actually it is more complicated, but for the sake of this debate it is good enough, for a simple algorithm, check bellow) Before you start downvoting spree, read this: For Apple: https://mashable.com/2013/10/17/apple-nsa-imessage http://bgr.com/2015/08/06/iphone-fbi-i…
Comment linking /state-of-security/latest-security-news/apple-imessage-vulnerable-eavesdropping-mitm-attacks/
on “Google has started the global roll-out of its new Chat messaging service”Submitted 73,000 Security Cameras Viewable Online Due to Use of Default Passwords as a story · 8 points
HN discussionI don't think it's a new hack it's just that the internal investigation has lead to more findings of the already talked about cookie hack: https://www.tripwire.com/state-of-security/featured/more-yah...
Comment linking /state-of-security/featured/more-yahoo-users-warned-of-malicious-account-access-via-forged-cookies/
on “Yahoo hack warning: What happened and should you be worried?”Submitted Once Every Four Days, the US Power Grid Is Under Attack as a story · 7 points
HN discussionIt's likely that these are mass-reused passwords from bots. See: https://www.tripwire.com/state-of-security/featured/so-just-...
Comment linking /state-of-security/featured/so-just-why-is-18atcskd2w-such-a-popular-password/
on “Where the Apple accounts that hackers are threatening to wipe came from”Submitted The Pirate Bay Back Online as a story · 7 points
HN discussionI'm not a fan of victim-blaming ("She was wearing a miniskirt in a sketchy part of town" is never an excuse!). But yeah - this was negligence. (Also, #1 is not necessarily true - WannaCry spreads via USB too - https://www.tripwire.com/state-of-security/featured/wannacry... )
Comment linking /state-of-security/featured/wannacry-ransomware-infects-australian-traffic-cameras-human-error-blamed/
on “Boeing hit by WannaCry virus – could cripple some jet production”Submitted Stolen credit cards and the Black Market: How the digital underground works as a story · 7 points
HN discussion
