Pulsedive is a cyber threat intelligence platform (TIP) with many free features. It includes millions of IP addresses, URLs, and domains, and links them to related malware, threat groups, and reports. It ingests data from 30 sources. Pulsedive Tour If you don’t like the default dark theme, click Account > Change Theme…

Keeping software updated is one of the most important ways to keep systems secure, because updates often include security improvements. On a Mac (like many other systems), many apps check for software updates, but only when they’re opened. If you have apps you don’t open often, they may not be…

If someone stole your phone, would you wish you had more or less personal data stored on it? If a company you use suffered a data breach, would you wish they stored more or less of your personal data? As the amount of data about us has increased, so have…

Infostealers (aka info stealers, info-stealers, information stealers, and stealers) are malware that exfiltrate data, especially credentials, from compromised devices. They’re available as malware-as-a-service (MaaS) on dark web markets for as little as $50–300/month, enabling unsophisticated threat actors to deploy them. What Infostealers Steal Infostealers steal usernames, passwords, names, email addresses, phone numbers, physical…

Shodan is a search engine for objects connected to the Internet, including servers, routers, websites, databases, cameras, industrial control systems (ICS), cameras, network attached storage (NAS), and IoT devices. Shodan indexes service banners (metadata about software running on a device) and makes it searchable. …

I’ve been learning as much as I can about cyber threat intelligence (CTI). Although there are CTI courses and certifications for hundreds or thousands of dollars, I’ve tried to learn as much as possible from free and low-cost resources. Here are the best I’ve found. If you know of others…

A false-flag cyber operation in one in which a threat actor seeks to mislead its target into thinking it’s been attacked by a third party. The name false-flag operation comes from the World War I practice of British and German ships deceptively flying the flags of other countries. Threat actors…

The Common Vulnerability Scoring System (CVSS) rates vulnerabilities by severity, assigning a numeric score. There are 3 metric groups: Base, Temporal, and Environmental. Only the Base score is published in vulnerability databases; organizations are supposed to calculate their own Temporal and Environmental scores based on their own situations. However, many…

Red teams use legitimate software for penetration testing and adversarial simulation. This software is often used by threat actors for malicious purposes. Rather than using the tools to test network defenses in order to improve them, threat actors use them to exploit networks. …