Automatically remediating poorly implemented security groups

During a performance evaluation, an unfortunate interaction of the STACKLEAK plugin with the RAP plugin was noticed that lead to unnecessary bloat. This blog post highlights the steps that have been taken to resolve the source of the problem.

Partially driven by the upcoming inclusion of Cyber Security by the IMO (International Maritime Organisation), 2019 was a really busy year for maritime security

Posted in r/netsec by u/RedditGeneralUser • 0 points and 0 comments

Automating regular expression denial-of-service detection

We engaged Doyensec to perform a security assessment of our firmware, v3.0.1 at the time of testing. During a 10 person/days project, Doyensec discovered and reported 3 vulnerabilities in our firmware. While two of the issues are considered informational…

Posted in r/netsec by u/kamic • 2 points and 0 comments

The casino and hotel giant said “it was confident that no financial, payment card or password data was involved in this matter.”

Email is unsafe and cannot be made safe. The tools we have today to encrypt email are badly flawed. Even if those flaws were fixed, email would remain unsafe. Its problems cannot plausibly be mitigated. Avoid encrypted email.
Technologists hate this argument.…

Cybersecurity’s Fastest Growing Platform Now Valued at Over $1 Billion

Last October I dived into the world of Jira Software (version 8.4.1) in the hope of discovering new vulnerabilities. Initially, I came…

Posted in r/netsec by u/HanSolo71 • 4 points and 0 comments

Posted by Sweaty_Butterscotch - 11 votes and no comments

Seytonic is a YouTube creator who makes security content and Arduino-based hacking tools. We talk about what it's like to create content for hackers, his experience making hacker hardware, and why he chose to make low-cost hacking tools using Arduino IDE.

Posted in r/netsec by u/arcticnixadm • 3 points and 1 comment

Django, Flask remote code execution (RCE) via enabling debug mode. Werkzeug debug mode enables anonymous command shell execution via the web.

Written by Cedric Halbronn On Saturday 15th February, I gave a talk titled “How CVE-2018-8611 Can be Exploited to Achieve Privilege Escalation on Windows 10 1809 (RS5) and Earlier”. Thi…

Starting Sept. 1, Safari will no longer trust SSL/TLS certificates with validity periods longer than 398 days Starting Sept. 1, Apple’s Safari browser will no longer trust SSL/TLS leaf certificates...