Subscribe

Archive | Cyber Attribution

Call to Microsoft to release information about MS17-010

After delaying the release of Windows updates, Microsoft mysteriously released a patch for a group of vulnerabilities addressed by MS17-010 after canceling Patch Tuesday in February.  This patch was released immediately before the release of a set of Windows exploits by the Shadow Brokers hacking group.  Although Shadow Brokers purports to have stolen these exploits […]

The “Digital Geneva Convention” – without attribution, it’s smoke and mirrors

Microsoft released their idea of a “Digital Geneva Convention” to help normalize behavior on the cyber battlefield.  The document, linked here, is generally well written and documents the need for a document of its type. The problems start by the second paragraph where a “Digital Geneva Convention” is compared to other non-proliferation treaties, such as those […]

Corporate Business Impact of Newest Shadow Brokers Dump

Yesterday, the Shadow Brokers released the password for the encrypted zip file they seeded last year (link). This release gives threat intelligence teams unprecedented insight into the capabilities of the Equation Group Hackers.  The dump appears to contain only Linux and Unix tools and exploits, so organizations running only Windows don’t need to react to […]

Wikileaks and the Marble Framework

This week, Wikileaks released CIA’s Marble framework.  As Rendition Infosec works with many organizations on security and threat intelligence, we have been fielding calls asking what the release means for businesses. WikiLeaks suggests that the Marble framework can be used to confuse analysts into attributing CIA malware to Russia or China.  Many of our customers […]