Administration flaws and insecure use of corporate Wi-Fi networks pose a security threat. An intruder can hack a Wi-Fi network to intercept sensitive information, attack wireless network users, and gain access to a company's internal network. Attacks against wireless networks are diverse. This article provides an overview of the most common vulnerabilities detected during security testing of wireless networks carried out by Positive Technologies in 2016

Successful attacks on corporate information systems can result in substantial financial and reputational losses for enterprises. To prevent these threats, the experts at Positive Technologies perform numerous penetration tests each year for major organizations worldwide. This testing attempts to answer the question “What would a real attacker do?” The techniques evaluate the true level of security and identifies specific flaws in security mechanisms, including vulnerabilities that are not readily discoverable by other audit methods. From its testing, Positive Technologies has identified six key attack techniques that can be employed by outsiders to breach the network perimeter and obtain corporate network access. The scenarios described allow control to be obtained for critical corporate resources in almost all penetration tests when performed as an insider, resulting in total control of the CIS in over 70% of cases; adopting the role of an outside attacker, the network perimeter was breached in 80% of cases.

With the same technology products used within critical infrastructure facilities as well as enterprises generally, an intruder who finds an ICS vulnerability at one company can use the same vulnerability against targets all over the world. Of greater concerns is that vendors and users often neglect ICS security. Because of the need for uninterrupted uptime of critical systems (such as industrial protocols, operating systems, and database management systems), ICS software often goes years without updates. The combination of these factors has created a dangerous situation with an evolving threat landscape. This whitepaper details the results of Positive Technologies’ analysis of vulnerabilities and Internet-accessible ICS components.

Vulnerabilities in the Internet-connected software run by large organizations create a large security risk. A single successful exploit — which can be as short as a few characters typed in the wrong place — can abuse these flaws and set a breach in motion. The aim of this web application attack research was two-fold: to determine which attacks are most commonly used by hackers in the wild, and to find out which industries are being targeted and how

Following an extensive investigation, we reveal a detailed example of a real-life APT attack that could occur at any bank. To implement the attack, the criminal group used easily available software to target some of the most common shortcomings and vulnerabilities in corporate systems, in which regard the financial sector is no exception. The hackers were able to steal the equivalent of $35,000, overnight, from six ATMs of an Eastern European bank, and our findings confirm that the theft could have been far worse as the technique used in the scam fortunately "clashed" with the financial institutions existing NCR ATM software, preventing the attackers from withdrawing further funds.

Nearly half of the ICS vulnerabilities identified in 2015 are high-risk, and the majority of vulnerabilities were found in the products of well-known vendors: Siemens, Schneider Electric, Advantec, etc. Widespread poor security practices, such as default passwords and dictionary-guessable passwords, make it easy for outsiders to access the systems. The largest number of ICS components was detected in the U.S. (43%) and Germany (12%), followed by France, Italy, and Canada. These are findings from the research by Positive Technologies, which analyzed data on ICS vulnerabilities from 2012 to 2015.

Bank-specific threats include theft of funds, unauthorized access to payment card data, personal data and bank secrets, denial of service, and many other attacks that can trigger significant financial and reputation losses. This report synthesizes statistics that were gathered during OLB security audits performed by Positive Technologies in 2015. Comparison with 2013-2014 data illustrates the dynamics of information security development in modern OLB systems.

Each year, Positive Technologies experts conduct hundreds of studies analyzing security of networks, devices, and applications as real hackers would do. Security monitoring brings many discoveries too. Find the hottest security trends in our annual Positive Research publication prepared for the participants of Positive Hack Days, an international forum on practical security.

While many corporate infrastructures in 2015 were better protected externally, they were susceptible to internal attacks. A leading vulnerability in the perimeter was outdated software. Internal networks suffered from password management flaws. The number of employees who click on external web-links from e-mails has grown drastically. The security level of one third of wireless networks is below medium. These are some key findings from Positive Technologies research based on penetration testing.

Despite well documented incidents involving compromised security of web applications, developers and administrators still pay little attention to the security of their sites. This report provides a summary of statistics gathered during our penetration tests of web applications in 2015. It also compares 2015 results to those in 2013 and 2014 and tracks the dynamics of web application security.