🕴 Cybersecurity at the Core 🕴

For too long, cybersecurity has been looked at as one team's responsibility. If we maintain that mentality, we will fail.

📖 Read

via "Dark Reading: ".

🕴 Consumers Are Forgiving After a Data Breach, but Companies Need To Respond Well 🕴

A solid response and reputation management program will go a long way in surviving a major breach – and there’s software on the way that can help get you organized.

📖 Read

via "Dark Reading: ".

🕴 Report: Tens of Thousands of E-Commerce Sites at Heightened Security Risk 🕴

Report delivered at Payment Card Industry Security Standards Council meeting flags issues in deployments of Magento, a popular e-commerce platform.

📖 Read

via "Dark Reading: ".

❌ Gmail Glitch Enables Anonymous Messages in Phishing Attacks ❌

A glitch in the UX in Gmail allows the “from” field to be forged so there is no sender listed in the email's header.

📖 Read

via "Threatpost | The first stop for security news".

❌ Critical Adobe Flash Bug Impacts Windows, macOS, Linux and Chrome OS ❌

Adobe issues patch for a Flash Player vulnerability that could lead to an arbitrary code execution on targeted systems.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Microsoft Enables Account Sign-In via Security Key 🕴

Account holders can use a FIDO2-compatible key or Windows Hello to authenticate sans username or password.

📖 Read

via "Dark Reading: ".

❌ Sofacy APT Takes Aim with Novel ‘Cannon’ Trojan ❌

The Russian-speaking threat group is changing up its tactics.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Russia Linked Group Resurfaces With Large-Scale Phishing Campaign 🕴

APT29/Cozy Bear is targeting individuals in military, government, and other sectors via email purporting to be from US State Department.

📖 Read

via "Dark Reading: ".

⚠ Drone owner fined for putting police helicopter crew ‘in danger’ ⚠

It's the first ever prosecution under UK drone laws for a flight that could have turned deadly, as did a recent helicopter disaster in Leicester.

📖 Read

via "Naked Security".

⚠ Dark Web hosting provider hacked, 6,500 sites erased ⚠

The database of the popular Daniel's Hosting was wiped out and all accounts deleted, taking down 30% of all hidden services.

📖 Read

via "Naked Security".

⚠ Microsoft’s MFA is so strong, it locked out users for 8 hours ⚠

It's a long time for Office 365 and Azure AD users to be locked out of such an important business platform, but MFA remains a good idea.

📖 Read

via "Naked Security".

⚠ Big breach, Creep-O-Meter and Black Friday [PODCAST] ⚠

It's the latest Naked Security Podcast - you're welcome!

📖 Read

via "Naked Security".

🕴 2018 Hacker Kids Gift Guide 🕴

Fun gift choices that foster design thinking and coding skills in kids both young and old.

📖 Read

via "Dark Reading: ".

🔐 How to install fail2ban on Ubuntu Server 18.04 🔐

Your Ubuntu Server might be vulnerable to attacks. To prevent unwanted logins, Jack Wallen shows you how to install intrusion detection system, fail2ban.

📖 Read

via "Security on TechRepublic".

🕴 To Stockpile or Not to Stockpile Zero-Days? 🕴

As the debate rages on, there is still no simple answer to the question of whether the government should stockpile or publicly disclose zero-day vulnerabilities.

📖 Read

via "Dark Reading: ".

🔐 Why e-commerce is winning: Most Americans now trust online retailers with their data 🔐

Despite conflicting opinions about online privacy, customers choose to shop with companies that take reasonable security precautions.

📖 Read

via "Security on TechRepublic".

❌ Emotet’s Thanksgiving Campaign Delivers New Recipes for Compromise ❌

The crafty malware has departed from its usual cornucopia of tactics and tricks.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Amazon Low-Key Reveals Breach of Some Customer Data 🕴

'Technical error' exposed names and email addresses.

📖 Read

via "Dark Reading: ".

🔐 500K Android users hit with malware, and what to do if you're infected 🔐

13 malicious apps ended up on the Google Play store. Here's how to stay protected.

📖 Read

via "Security on TechRepublic".

ATENTION‼ New - CVE-2009-5153

In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allowed remote unauthenticated attackers to execute code, because a length field was incorrectly trusted.

📖 Read

via "National Vulnerability Database".

<b>&#9000; USPS Site Exposed Data on 60 Million Users &#9000;</b>

<code>U.S. Postal Service just fixed a security weakness that allowed anyone who has an account at usps.com to view account details for some 60 million other users, and in some cases to modify account details on their behalf.</code><code>Media</code><code>Image: USPS.com</code><code>KrebsOnSecurity was contacted last week by a researcher who discovered the problem, but who asked to remain anonymous. The researcher said he informed the USPS about his finding more than a year ago yet never received a response. After confirming his findings, this author contacted the USPS, which promptly addressed the issue.</code><code>The problem stemmed from an authentication weakness in a USPS Web component known as an “application program interface,” or API — basically, a set of tools defining how various parts of an online application such as databases and Web pages should interact with one another.</code><code>The API in question was tied to a Postal Service initiative called “Informed Visibility,” which according to the USPS is designed to let businesses, advertisers and other bulk mail senders “make better business decisions by providing them with access to near real-time tracking data” about mail campaigns and packages.</code><code>In addition to exposing near real-time data about packages and mail being sent by USPS commercial customers, the flaw let any logged-in usps.com user query the system for account details belonging to any other users, such as email address, username, user ID, account number, street address, phone number, authorized users, mailing campaign data and other information.</code><code>Many of the API’s features accepted “wildcard” search parameters, meaning they could be made to return all records for a given data set without the need to search for specific terms. No special hacking tools were needed to pull this data, other than knowledge of how to view and modify data elements processed by a regular Web browser like Chrome or Firefox.</code><code>Media</code><code>A USPS brochure advertising the features and benefits of Informed Visibility.</code><code>In cases where multiple accounts shared a common data element — such as a street address — using the API to search for one specific data element often brought up multiple records. For example, a search on the email addresses for readers who volunteered to help with this research turned up multiple accounts when those users had more than one user signed up at the same physical address.</code><code>“This is not good,” said one anonymous reader who volunteered to help with this research, after viewing a cut-and-paste of his USPS account details looked up via his email address. “Especially since we moved due to being threatened by a neighbor.”</code><code>Nicholas Weaver, a researcher at the International Computer Science Institute and lecturer at UC Berkeley, said the API should have validated that the account making the request had permission to read the data requested.</code><code>“This is not even Information Security 101, this is Information Security 1, which is to implement access control,” Weaver said. “It seems like the only access control they had in place was that you were logged in at all. And if you can access other peoples’ data because they aren’t enforcing access controls on reading that data, it’s catastrophically bad and I’m willing to bet they’re not enforcing controls on writing to that data as well.”</code><code>A cursory review by KrebsOnSecurity indicates the promiscuous API let any user request account changes for any other user, such as email address, phone number or other key details.</code><code>Fortunately, the USPS appears to have included a validation step to prevent unauthorized changes — at least with some data fields. Attempts to modify the email address associated with my USPS account via the API prompted a confirmation message sent to the email address tied to that account…