πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
⚠ Gone phishing: workplace email security in five steps ⚠

David Mitchell, Senior Director of Email Product Management at Sophos, shares his top tips to optimize workplace email security.

πŸ“– Read

via "Naked Security".
❌ Unpatched Apple T2 Chip Flaw Plagues Macs ❌

A researcher claims that the issue can be exploited by attackers in order to gain root access.

πŸ“– Read

via "Threat Post".
πŸ•΄ 6 Best Practices for Using Open Source Software Safely πŸ•΄

Open source software is critical yet potentially dangerous. Here are ways to minimize the risk.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-25613 β€Ό

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-23832 β€Ό

A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthenticated remote attackers to harvest an admin login session cookie and steal an admin session upon an admin login.

πŸ“– Read

via "National Vulnerability Database".
🦿 How to defend your organization against the surge in ransomware attacks 🦿

Ransomware attacks doubled in the US over the last three months, says Check Point Research.

πŸ“– Read

via "Tech Republic".
❌ APT Attack Injects Malware into Windows Error Reporting ❌

The fileless attack uses a phishing campaign that lures victims with information about a worker’s compensation claim.

πŸ“– Read

via "Threat Post".
❌ COVID-19 Clinical Trials Slowed After Ransomware Attack ❌

The attack on eResearchTechnology potentially slowed down coronavirus research worldwide, and researchers suggest a nation-state actor could be behind the incident.

πŸ“– Read

via "Threat Post".
πŸ” What is ITAR Compliance? 2020 ITAR Regulations, Fines, Certifications & More πŸ”

Learn about ITAR compliance in Data Protection 101, our series on the fundamentals of information security.

πŸ“– Read

via "Digital Guardian".
πŸ•΄ Malware for Ad Fraud Gets More Sophisticated πŸ•΄

Facebook says SilentFade campaign disabled notifications that could have warned users that their accounts had been compromised.

πŸ“– Read

via "Dark Reading".
⚠ Naked Security Podcast – we’re back for Series 3! ⚠

Join us weekly for the Naked Security Podcast - back for Series 3 and available wherever good podcasts are found!

πŸ“– Read

via "Naked Security".
❌ Microsoft Zerologon Flaw Under Attack By Iranian Nation-State Actors ❌

Microsoft warns that the MERCURY APT has been actively exploiting CVE-2020-1472 in campaigns for the past two weeks.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-25742 β€Ό

pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-25803 β€Ό

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.

πŸ“– Read

via "National Vulnerability Database".
🦿 Wi-Fi security: FBI warns of risks of using wireless hotel networks 🦿

Wi-Fi networks in hotels typically favor guest convenience over strong security practices, says the FBI.

πŸ“– Read

via "Tech Republic".
πŸ›  Lynis Auditing Tool 3.0.1 πŸ› 

Lynis is an auditing tool for Unix (specialists). It scans the system and available software to detect security issues. Beside security related information it will also scan for general system information, installed packages and configuration mistakes. This software aims in assisting automated auditing, software patch management, vulnerability and malware scanning of Unix based systems.

πŸ“– Read

via "Packet Storm Security".
❌ Boom! Mobile Customer Data Lost to Fullz House/Magecart Attack ❌

The Magecart spinoff group targeted the wireless service provider in an odd choice of victim.

πŸ“– Read

via "Threat Post".
🦿 How to boost the effectiveness of your cybersecurity operations 🦿

Data breaches occur despite tight security. Arctic Wolf explains how to increase your security effectiveness.

πŸ“– Read

via "Tech Republic".
πŸ•΄ 10 Years Since Stuxnet: Is Your Operational Technology Safe? πŸ•΄

The destructive worm may have debuted a decade ago, but Stuxnet is still making its presence known. Here are steps you can take to stay safer from similar attacks.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-26582 β€Ό

D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the IP JSON value for ping (aka res_config_action=3&res_config_id=18).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2019-4725 β€Ό

IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172131.

πŸ“– Read

via "National Vulnerability Database".