πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ Facebook Announces Formal Vulnerability Disclosure Policy for Third-Party Bugs πŸ•΄

The social media giant has also launched a new website for sharing information on WhatsApp security.

πŸ“– Read

via "Dark Reading: ".
πŸ” How project managers can help companies better navigate security risks from COVID-19 πŸ”

Social distancing and remote working during COVID-19 have increased cybersecurity risks for companies worldwide, increasing the need for project managers to work on more security-related efforts.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2019-11928

An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link from a specially crafted live location message.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ The Hidden Costs of Losing Security Talent πŸ•΄

One person's exit can set off a chain of costly events.

πŸ“– Read

via "Dark Reading: ".
❌ India Blocks High-Profile Chinese Apps on Political, Privacy Concerns ❌

Technology minister bans, Baidu, WeChat Work, AliPay and 115 others for capturing using data and transmitting it to servers outside of the country without authorization.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2020-12248

In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can execute arbitrary code via a heap-based buffer overflow because dirty image-resource data is mishandled.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-12247

In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information from an out-of-bounds read because a text-string index continues to be used after splitting a string into two parts. A crash may also occur.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-11493

In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information about an uninitialized object because of direct transformation from PDF Object to Stream without concern for a crafted XObject.

πŸ“– Read

via "National Vulnerability Database".
❌ WhatsApp Discloses 6 Bugs via Dedicated Security Site ❌

The company also committed to more transparency about app flaws, with an advisory page aimed at keeping the community better informed of security vulnerabilities.

πŸ“– Read

via "Threatpost".
πŸ” Friday Five 9/4 πŸ”

Owning an "OG" email account, lessons from the Garmin ransomware attack, and Emotet's new 'Red Dawn' attachment - catch up on the week’s news with the Friday Five.

πŸ“– Read

via "Subscriber Blog RSS Feed ".
⚠ Phishing tricks – the Top Ten Treacheries of 2020 ⚠

Here's the Top Ten - or perhaps we mean The Worst Ten. How many would you fall for?

πŸ“– Read

via "Naked Security".
πŸ•΄ The Hidden Security Risks of Business Applications πŸ•΄

Today's enterprises depend on mission-critical applications to keep them productive, help better serve customers, and keep up with demand. It's important that they also know the risks.

πŸ“– Read

via "Dark Reading: ".
πŸ” Phishing attack baits victims by promising access to quarantined emails πŸ”

This campaign tries to steal account credentials by convincing users that their email service has quarantined three messages, says Cofense.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2019-3881

Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.

πŸ“– Read

via "National Vulnerability Database".
❌ Attackers Steal Outlook Credentials Via Overlay Screens on Legitimate Sites ❌

A phishing campaign uses overlay screens and email 'quarantine' policies to steal targets' Microsoft Outlook credentials.

πŸ“– Read

via "Threatpost".
πŸ•΄ Strategic Cyber Warfare Heats Up πŸ•΄

It's "anything goes," according to renowned hacker the Grugq, who drew a bright line between cyberwar and cyber warfare at this week's virtual Disclosure Conference.

πŸ“– Read

via "Dark Reading: ".
πŸ” New Python-based trojan targets financial tech firms to steal sensitive data πŸ”

Dubbed PyVil, the new remote access trojan goes after passwords, documents, browser cookies, and email credentials, says Cybereason.

πŸ“– Read

via "Security on TechRepublic".
❌ Facebook Debuts Third-Party Vulnerability Disclosure Policy ❌

If the social-media behemoth finds a bug in another platform's code, the project has 90 days to remediate before Facebook goes public.

πŸ“– Read

via "Threatpost".
❌ Vulnerability Disclosure: Ethical Hackers Seek Best Practices ❌

Cybersecurity researchers Brian Gorenc and Dustin Childs talk about the biggest vulnerability disclosure challenges in IoT and the industrial vertical.

πŸ“– Read

via "Threatpost".
πŸ•΄ Ad Fraud: The Multi-Billion Dollar Cybercrime CISOs Might Overlook πŸ•΄

Marketing officers may have accepted ad fraud as a cost of doing business, but infosec pros take heed -- fraud can be a step to more significant attacks. Here's what to know and how to take action.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Collection of Metadata -- as Done by the NSA -- Likely Unconstitutional, US Court Suggests πŸ•΄

A ruling in an appeal by four men convicted of material support for terrorism finds that the National Security Agency's metadata collection program not only violated the prevailing law at the time but was also likely unconstitutional.

πŸ“– Read

via "Dark Reading: ".