HP Security Research Blog
The HP Security Research blog provides a platform for security experts from across HP to discuss innovative research, industry observations, and updates on the threat landscape to help organizations proactively identify and manage risk.

Milestone today, good times ahead

zdi-small.pngIs today’s group of Zero Day Initiative disclosures the largest ever? We look at the numbers and analyze the trend – and what it means for the ZDI as we approach the program’s tenth anniversary.

Labels: HPSR

HP Security Research OSINT (OpenSource Intelligence) articles of interest – May 8, 2015

OSINT.jpgWelcome to the May 8th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

Cloud "shiny rocks" and your SOC

32380942_s.jpgIt’s easy to turn the heads of IT folk – or of their C-level execs – with promises of easy access and fast implementation. But the “shiny rock” of cloud security can easily block a clear view of the realities of working well within known security operations center (SOC) parameters. Fortunately, you already have the expertise; we have a bit of advice for minimizing the distraction.

Tags: HPSR| OpSec| siem| SOC
Labels: HPSR| OpSec| SIEM| SOC

HP Security Research OSINT (OpenSource Intelligence) articles of interest – May 1, 2015

field-logo.jpgWelcome to the May 1st edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

HP Security Research OSINT (OpenSource Intelligence) articles of interest – April 24, 2015

field-logo.jpgWelcome to the April 24th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

Crypto Manifesto 2015

Time marches on, and the cryptographic mojo that worked in 2009 isn’t equal to 2015’s security landscape. Our updated Manifesto sets forth guidelines for the wisest usage of cryptography within security-sensitive contexts.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – April 17, 2015

OSINT.jpgWelcome to the April 17th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

Welcome to OpSec Research

19237385_ml.jpg

HP Security Research expands its capabilities into the world of security defenders with the addition of a new team.

Tags: HPSR| OpSec| siem| SOC
Labels: OpSec| SecOps| SIEM| SOC

HP Security Research OSINT (OpenSource Intelligence) articles of interest – April 10, 2015

OSINT.jpgWelcome to the April 10th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

Adventures in PoSeidon genealogy: Tracking a malware family tree

Poseidon Square.jpgThe PoSeidon or Backoff family of malware – known by a plethora of other names – attacks Point-of-Sale (PoS) systems to steal credit card information. This analysis digs deeper into the multiple versions of this malware family and shows how to detect, and potentially remove, the unwanted software.

A brief history of privacy

privacy.jpgWith the rocketing rise in data breaches in the past 18 months, protection of personally identifiable information (PII) has been a frequent topic of discussion and worry. But privacy has been a concern for a very long time. If your privacy knowledge feels a bit thin, spend a few moments with a brief introduction to the landscape.

Tags: HPSR| privacy
Labels: HPSR| Privacy

HP Security Research OSINT (OpenSource Intelligence) articles of interest – April 3, 2015

OSINT.jpgWelcome to the April 3rd edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

Naming and graphic design services for bugs now available

ZDI is now offering vulnerability naming and graphic design services for researchers who reach Gold status. No longer will your bug suffer in anonymity; we’ll hook you up with our crack design team to give your bug the name and logo it deserves.

HPSR Software Security Content 2015 Update 1

HP Software Security Research is pleased to announce the immediate availability of updates to HP Application Defender, HP WebInspect SecureBase (available via SmartUpdate), the HP Fortify Secure Coding Rulepacks (English language, version 2015.1.0), and HP Fortify Premium Content. As of today, HPSR Software Security Content supports over 931 vulnerability categories across 22 programming languages and spans more than 825,000 individual APIs.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – March 27, 2015

OSINT.jpgWelcome to the March 27th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

A look back at Pwn2Own 2015

wrap.jpgFor two fantastic days in Vancouver, six researchers again demonstrated that when you enter Pwn2Own and are successful, you can count yourself among the best in the world. After a weekend’s worth of reflection, let’s step back and review the highlights.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – March 21, 2015

OSINT.jpgWelcome to the March 21st edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

Pwn2Own 2015: Day Two results

day2-titlecard.jpgThe second and final day of Pwn2Own 2015 saw successful exploits by both entrants against four products, with each going after multiple targets and collecting a total of $240,000. This brings the two-day payout total to $557,500, not including the value of the laptops, ZDI points, and other prizes given to winning researchers.

Pwn2Own 2015: Day One results

Researcher Winning.PNGThe first day of Pwn2Own 2015 saw successful attempts by four entrants against four products, with payouts of $317,500 to researchers in the main competition.

Pwn2Own 2015: The lineup

ZDI Logo_4Blog_200px.jpgThe competition order for Pwn2Own 2015 was assigned by random drawing in the Pwn2Own room on Wednesday morning. This year found seven contestants targeting the various products in the competition, with some handling multiple challenges – twelve competitions in all.

Pwn2Own 2015: The final contestants

welcome to vancouver.jpgPwn2Own begins tomorrow, but registrations have closed. A total of seven groups and individuals have signed up to attempt exploits on the available targets. Here are those competing.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – March 13, 2015

OSINT.jpgWelcome to the March 13th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix

zdi-small.pngIn accordance with the Zero Day Initiative’s disclosure policies, we are releasing full details on the CVE-2015-0096 issue patched today in MS15-020. This issue concerns a Stuxnet vulnerability first allegedly addressed by MS10-046. We track this issue as ZDI-15-086.

CVE-2015-0096 issue patched today involves failed Stuxnet fix

zdi-small.pngA vulnerability disclosed to Microsoft by the Zero Day Initiative demonstrates that fully patched machines have been vulnerable to the CVE-2010-2568 – the LNK vulnerability first widely reported in Stuxnet -- for nearly five years.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – March 6, 2015

field-logo.jpgWelcome to the March 6th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

HP Security Briefing, Episode 21: Security topics in Big Data

random-tree.PNGOur latest HPSR Security Briefing looks at the security issues raised by the frameworks and algorithms that power Big Data. We discuss four modes of effective Big Data analysis and hazard guesses as to what lies ahead.

Don’t FREAK out -- let us help

Our Software Security Research team examines the recently revealed Factoring RSA Export Key (FREAK) vulnerability and gives a brief recap of what you need to know.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – February 27, 2015

OSINT.jpgWelcome to the February 27th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.

Labels: HPSR

Infographic: HP Security Research Cyber Risk Report 2015

very teeny tiny chart.pngThe annual Cyber Risk Report from HP Security Research provides organizations with a better understanding of the threat landscape and supplies resources that can aid in minimizing security risk. This year, we’re including an infographic detailing some of the more interesting data points detailed in the report.

Search
Showing results for 
Search instead for 
Do you mean 
About the Author(s)
  • Head of OpSec Research
  • I am a senior security content developer with Hewlett-Packard Security Research (HPSR). In this role, I write and edit security analysis and supporting content from researchers, including those from HP’s Zero Day Initiative (ZDI) program. The ZDI program augments HP’s Enterprise Security Products with zero-day research through a network of over 3,000 independent researchers around the world. I am also responsible for providing insight into the threat landscape; competitive intelligence to the research team; and providing guidance on the social media roadmap. Part of my role includes speaking publicly and promoting the research and technology of the HPSR.
  • Kernelsmith is senior vulnerability researcher with Hewlett-Packard Security Research (HPSR). In this role, he analyzes and performs root-cause analysis on hundreds of vulnerabilities submitted to the Zero-Day Initiative (ZDI) program. He also tries to automate whenever he can, pulling from the devops and virtualization arenas. Josh is also a developer for the Metasploit Framework and has spoken at a few conferences and holds a few certifications. Prior to joining HP, Smith served in the U.S. Air Force for 10 years and subsequently became a security engineer at the John Hopkins University Applied Physics Laboratory. Smith performed research into weapons systems vulnerabilities as well as evasion and obfuscation techniques to add depth and realism to security device tests. Smith received a B.S. in Aeronautical Engineering from Rensselaer Polytechnic Institute and an M.A. in Management of Information Systems from the University of Great Falls.
  • Security Researcher, Software Security Research
  • Security Researcher, Zero Day Initiative
  • Steve Povolny manages the Digital Vaccine team at HP TippingPoint. The team is composed of security researchers and filter/signature developers for the Intrusion Prevention System.
HP Blog

HP Software Solutions Blog

Featured


Follow Us
Labels
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.