ATENTION‼ New - CVE-2020-15114
📖 Read
via "National Vulnerability Database".
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-11937
📖 Read
via "National Vulnerability Database".
In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.📖 Read
via "National Vulnerability Database".
❌ Black Hat 2020: Influence Campaigns Are a Cybersecurity Problem ❌
📖 Read
via "Threatpost".
An inside look at how nation-states use social media to influence, confuse and divide -- and why cybersecurity researchers should be involved.📖 Read
via "Threatpost".
Threat Post
Black Hat 2020: Influence Campaigns Are a Cybersecurity Problem
An inside look at how nation-states use social media to influence, confuse and divide — and why cybersecurity researchers should be involved.
🕴 Getting to the Root: How Researchers Identify Zero-Days in the Wild 🕴
📖 Read
via "Dark Reading: ".
Google Project Zero researcher Maddie Stone explains the importance of identifying flaws exploited in the wild and techniques used to do it.📖 Read
via "Dark Reading: ".
Dark Reading
Getting to the Root: How Researchers Identify Zero-Days in the Wild
Google Project Zero researcher Maddie Stone explains the importance of identifying flaws exploited in the wild and techniques used to do it.
❌ Augmenting AWS Security Controls ❌
📖 Read
via "Threatpost".
Appropriate use of native security controls in AWS and other CSPs is fundamental to managing cloud risk and avoiding costly breaches.📖 Read
via "Threatpost".
Threat Post
Augmenting AWS Security Controls
Appropriate use of native security controls in AWS and other CSPs is fundamental to managing cloud risk and avoiding costly breaches.
⚠ Business Email Compromise – fighting back with machine learning ⚠
📖 Read
via "Naked Security".
Machine learning models are immune to blandishments, threats, flattery and so - so why not set them against social engineers?📖 Read
via "Naked Security".
Naked Security
Business Email Compromise – fighting back with machine learning
Machine learning models are immune to blandishments, threats, flattery and so – so why not set them against social engineers?
❌ Hackers Dump 20GB of Intel’s Confidential Data Online ❌
📖 Read
via "Threatpost".
Chipmaker investigates a leak of intellectual property from its partner and customer resource center.📖 Read
via "Threatpost".
Threat Post
Hackers Dump 20GB of Intel’s Confidential Data Online
Chipmaker investigates a leak of intellectual property from its partner and customer resource center.
🕴 IoT Security During COVID-19: What We've Learned & Where We're Going 🕴
📖 Read
via "Dark Reading: ".
Vigilance and ongoing training combined with an integrated security framework are key aspects of a successful strategy in the fight against the latest crop of pandemic opportunists.📖 Read
via "Dark Reading: ".
Dark Reading
IoT Security During COVID-19: What We've Learned & Where We're Going
Vigilance and ongoing training combined with an integrated security framework are key aspects of a successful strategy in the fight against the latest crop of pandemic opportunists.
🔐 Report: Two new encryption standards will soon sweep away security controls 🔐
📖 Read
via "Security on TechRepublic".
Security professionals must act before TLS 1.3 and DNS-over-HTTPS (DoH) are implemented or they won't be able to analyze network traffic and detect cyberthreats, warns Forrester Research.📖 Read
via "Security on TechRepublic".
TechRepublic
Report: Two new encryption standards will soon sweep away security controls
Security professionals must act before TLS 1.3 and DNS-over-HTTPS (DoH) are implemented or they won't be able to analyze network traffic and detect cyberthreats, warns Forrester Research.
🕴 BEC Campaigns Target Financial Execs via Office 365 🕴
📖 Read
via "Dark Reading: ".
A series of business email compromise campaigns has been targeting executives of more than 1,000 companies, most recently in the US and Canada.📖 Read
via "Dark Reading: ".
Dark Reading
BEC Campaigns Target Financial Execs via Office 365 - Dark Reading
A series of business email compromise campaigns has been targeting executives of more than 1,000 companies, most recently in the US and Canada.
🕴 Researcher Finds New Office Macro Attacks for MacOS 🕴
📖 Read
via "Dark Reading: ".
Building successful macro attacks means getting past several layers of security, but a Black Hat speaker found a way through.📖 Read
via "Dark Reading: ".
Darkreading
Researcher Finds New Office Macro Attacks for MacOS
Building successful macro attacks means getting past several layers of security, but a Black Hat speaker found a way through.
🔐 How to limit file upload size on NGINX to mitigate DoS attack 🔐
📖 Read
via "Security on TechRepublic".
If you have an NGINX site that must allow users to upload files, try this configuration to help prevent possible Denial-of-Service attacks.📖 Read
via "Security on TechRepublic".
TechRepublic
How to limit file upload size on NGINX to mitigate DoS attacks
If you have an NGINX site that must allow users to upload files, try this configuration to help prevent possible Denial-of-Service attacks.
🔏 Friday Five: 8/7 Edition 🔏
📖 Read
via "Subscriber Blog RSS Feed ".
Telstra suffers a DoS attack, the hackers behind last month's Twitter breach are arrested, and an NSA advisory warns mobile users about the dangers of location data - catch up on the week's news with the Friday Five.📖 Read
via "Subscriber Blog RSS Feed ".
Digital Guardian
Friday Five: 8/7 Edition
Telstra suffers a DoS attack, the hackers behind last month's Twitter breach are arrested, and an NSA advisory warns mobile users about the dangers of location data - catch up on the week's news with the Friday Five.
ATENTION‼ New - CVE-2020-11993
📖 Read
via "National Vulnerability Database".
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-11985
📖 Read
via "National Vulnerability Database".
IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-11984
📖 Read
via "National Vulnerability Database".
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-11852
📖 Read
via "National Vulnerability Database".
DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command.📖 Read
via "National Vulnerability Database".
❌ Have I Been Pwned Set to Go Open-Source ❌
📖 Read
via "Threatpost".
Fully opening the door to allow people to contribute to – and notably, tinker with – the code for the data-breach information service will be an entirely next-level effort, according to founder Troy Hunt.📖 Read
via "Threatpost".
Threat Post
Have I Been Pwned Set to Go Open-Source
Fully opening the door to allow people to contribute to – and notably, tinker with – the code for the data-breach information service will be an entirely next-level effort, according to founder Troy Hunt.
🕴 400+ Qualcomm Chip Vulnerabilities Threaten Millions of Android Phones 🕴
📖 Read
via "Dark Reading: ".
Security researchers found hundreds of pieces of vulnerable code in the Qualcomm Snapdragon chips powering Android phones.📖 Read
via "Dark Reading: ".
Dark Reading
400+ Qualcomm Chip Vulnerabilities Threaten Millions of Android Phones
Security researchers found hundreds of pieces of vulnerable code in the Qualcomm Snapdragon chips powering Android phones.
❌ Attackers Horn in on MFA Bypass Options for Account Takeovers ❌
📖 Read
via "Threatpost".
Legacy applications don't support modern authentication -- and cybercriminals know this.📖 Read
via "Threatpost".
Threat Post
Attackers Hone in on MFA Bypass Options for Account Takeovers
Legacy applications don't support modern authentication — and cybercriminals know this.
🕴 Hacking the PLC via Its Engineering Software 🕴
📖 Read
via "Dark Reading: ".
Researcher will demonstrate at DEF CON an emerging threat to industrial control networks.📖 Read
via "Dark Reading: ".
Darkreading
Hacking the PLC via Its Engineering Software
Researcher will demonstrate at DEF CON an emerging threat to industrial control networks.