Analytics
Positive Research is one of the largest information security research centers in Europe. More than 250 world-class experts in protection of SCADA, ERP, web apps, and bank and telecom systems perform research, pentests, and threat/vulnerability analysis.
Search for all time
Web application attack trends

Vulnerabilities in the Internet-connected software run by large organizations create a large security risk. A single successful exploit — which can be as short as a few characters typed in the wrong place — can abuse these flaws and set a breach in motion. The aim of this web application attack research was two-fold: to determine which attacks are most commonly used by hackers in the wild, and to find out which industries are being targeted and how

Cobalt—a new trend or an old 'friend'?

Following an extensive investigation, we reveal a detailed example of a real-life APT attack that could occur at any bank. To implement the attack, the criminal group used easily available software to target some of the most common shortcomings and vulnerabilities in corporate systems, in which regard the financial sector is no exception. The hackers were able to steal the equivalent of $35,000, overnight, from six ATMs of an Eastern European bank, and our findings confirm that the theft could have been far worse as the technique used in the scam fortunately "clashed" with the financial institutions existing NCR ATM software, preventing the attackers from withdrawing further funds.

Vulnerabilities in Industrial Control Systems 2016

Nearly half of the ICS vulnerabilities identified in 2015 are high-risk, and the majority of vulnerabilities were found in the products of well-known vendors: Siemens, Schneider Electric, Advantec, etc. Widespread poor security practices, such as default passwords and dictionary-guessable passwords, make it easy for outsiders to access the systems. The largest number of ICS components was detected in the U.S. (43%) and Germany (12%), followed by France, Italy, and Canada. These are findings from the research by Positive Technologies, which analyzed data on ICS vulnerabilities from 2012 to 2015.

Vulnerabilities in Online Banking Systems 2016

Bank-specific threats include theft of funds, unauthorized access to payment card data, personal data and bank secrets, denial of service, and many other attacks that can trigger significant financial and reputation losses. This report synthesizes statistics that were gathered during OLB security audits performed by Positive Technologies in 2015. Comparison with 2013-2014 data illustrates the dynamics of information security development in modern OLB systems.

Positive Research 2016

Each year, Positive Technologies experts conduct hundreds of studies analyzing security of networks, devices, and applications as real hackers would do. Security monitoring brings many discoveries too. Find the hottest security trends in our annual Positive Research publication prepared for the participants of Positive Hack Days, an international forum on practical security.

Vulnerabilities in Corporate Information Systems 2016

While many corporate infrastructures in 2015 were better protected externally, they were susceptible to internal attacks. A leading vulnerability in the perimeter was outdated software. Internal networks suffered from password management flaws. The number of employees who click on external web-links from e-mails has grown drastically. The security level of one third of wireless networks is below medium. These are some key findings from Positive Technologies research based on penetration testing.

Web Application Vulnerabilities 2016

Despite well documented incidents involving compromised security of web applications, developers and administrators still pay little attention to the security of their sites. This report provides a summary of statistics gathered during our penetration tests of web applications in 2015. It also compares 2015 results to those in 2013 and 2014 and tracks the dynamics of web application security.

Network Perimeter Life in Pictures

Even companies with advanced IT security still suffer from intrusions through network perimeter breaches. However, it is difficult to determine what should be done to prevent it. In this article, we give some recommendations based on our research of network perimeter security for 10 big companies (more than 130,000 unique IPs) in 2014-2015.

Primary Security Threats for SS7 Cellular Networks 2016

SS7 exploits can turn a cell phone into an open book, allowing an attacker to read messages, track a subscriber’s location, and eavesdrop on and redirect calls. This technique is now available not only to intelligence services, but to an average hacker as well. In 2014, we described in detail security issues in signaling networks. This report contains a security analysis of SS7 networks for various operators with a subscriber base of 10 to 70 million.

Security Trends & Vulnerabilities Review 2015

From 2013 to 2014, there was an increase in the vulnerability of the information systems of large enterprises. In about 60% of system attacks, the network perimeters were penetrated via web application vulnerabilities. Additionally in 2014, there was decreased awareness among employees regarding security issues.


Threatscape
April 2, 2017
Medium — (5.3) (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
PT-2017-11
March 16, 2017
Medium — (6.5) (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N)
PT-2017-10
March 16, 2017
Medium — (5.3) (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
PT-2017-09
Interesting Articles