Resecurity's blog publishes threat intelligence on data breaches, ransomware, phishing kits, and dark web sales of stolen data.
HN commenters are skeptical of the firm, calling its site a red flag, noting vague 'dark web' claims and an exposed uploads directory.
1 Resecurity's wordpress site has directory listing turned on. Most content on the website seems to have been uploaded in february.
2 The services that does the press releases looks suspicious.
3 The second service also looks suspicious
4 Golden Bridge Silver and Gold Award winners... Anyone heard of this? Seems they sell thophies
[1] https://resecurity.com/wp-content/uploads/
[2] https://www.prnewswire.com/news-releases/resecurity-names-ian-cook-as-strategic-adviser-300705772.html
[3] https://www.businesswire.com/news/home/20190226005414/en/Resecurity-Recognized-Cybersecurity-Excellence-Awards-Forensics-Risk/
[4] https://goldenbridgeawards.com/store/
Looks like a fish, smells like a fish
They also seem to have stolen a number of graphics on their website. If you check their filenames, they have the default filename of when you take a screenshot on OSX. Then take this one for example:
https://resecurity.com/wp-content/uploads/2019/03/Screen-Shot-2019-03-07-at-1.14.07-PM.png
Throw it into Google's reverse image search and you'll find the graphic if was cut out of:
https://www.incimages.com/uploaded_files/image/970x450/Finance_Blockchain_364306.jpg
> have been made available for free on the dark web
where on the dark web? that's the same as saying "on the internet" or "on social media"
edit: source article states Breach Forum
https://www.resecurity.com/blog/article/massive-dump-of-hacked-salvadorean-headshots-and-pii-highlights-growing-threat-actor-interest-in-biometric-data
It was linked from https://resecurity.com/wp-content/uploads/, which is a common and public URL, and anything uploaded there is intended to be public. Of course, whoever uploaded it either wasn't aware or didn't think it through--maybe they thought nobody would ever visit that page.
As you can see, the link is gone now.
Thanks for finding that. This image from their directory listing (maybe on their site somewhere but I couldn't find it) shows me at least something about their offering - looks like another dark web breach alerting service.
https://resecurity.com/wp-content/uploads/2019/02/slide-3.png
The text on the site alone is a red flag. It might as well be Latin gibberish. And the "awards" aren't linked to anything. Some of them are just silly, like this one: https://resecurity.com/wp-content/uploads/2019/02/award-4.png
which was apparently uploaded last month...