πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
26.1K subscribers
89.3K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
⚠ Police can’t compel biometric phone unlocking, rules judge ⚠

The landmark decision asserts the same legal protection for biometrics that we're given for passcodes.

πŸ“– Read

via "Naked Security".
⚠ Beware buying Fortnite’s V-Bucks, you could be funding organised crime ⚠

Credit card thieves are laundering money by purchasing the in-game currency V-Bucks, then selling it back at a discount to players.

πŸ“– Read

via "Naked Security".
⚠ Intel patches another security flaw in SGX technology ⚠

Of the six advisories Intel released last week, the most interesting is a flaw discovered in the company’s Software Guard Extensions (SGX).

πŸ“– Read

via "Naked Security".
⚠ Are you sure those WhatsApp messages are meant for you? ⚠

Abby Fuller got a shock when she logged into WhatsApp using a new telephone number. She found someone else’s messages waiting for her.

πŸ“– Read

via "Naked Security".
❌ VOIPO Database Exposes Millions of Texts, Call Logs ❌

VOIPO acknowledged that a development server had been accidentally left publicly accessible, and took the server offline.

πŸ“– Read

via "Threatpost | The first stop for security news".
❌ Magecart Returns with Advertising Library Tactic ❌

The threat group also has a new subsidiary, Magecart Group 12.

πŸ“– Read

via "Threatpost | The first stop for security news".
πŸ” Top 10 app vulnerabilities: Unpatched plugins and extensions dominate πŸ”

Despite the existence of patches, the proliferation of unpatched installations are enticing targets for malicious actors, according to a WhiteHat report.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ Triton/Trisis Attack Was More Widespread Than Publicly Known πŸ•΄

Signs of the attack first showed up two months before it was identified as a cyberattack, but they were mistaken for a pure equipment failure by Schneider Electric, security expert reveals at S4x19.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2016-9651 (chrome, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation)

A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

πŸ“– Read

via "National Vulnerability Database".
❌ Fortnite Hacked Via Insecure Single Sign-On ❌

Leaky Fortnite single sign-on mechanism could have allowed hackers to access game accounts.

πŸ“– Read

via "Threatpost | The first stop for security news".
πŸ•΄ Are You Listening to Your Kill Chain? πŸ•΄

With the right tools and trained staff, any organization should be able to deal with threats before information is compromised.

πŸ“– Read

via "Dark Reading: ".
❌ U.S. Issues Multiple Charges For 2016 SEC Hack ❌

The two were able to hack into the SEC's computer systems due to phishing attacks that stole credentials and spread malware.

πŸ“– Read

via "Threatpost | The first stop for security news".
πŸ” To stay competitive, MSSPs need to grow and evolve πŸ”

​Managed Security Service Providers can alleviate many of the headaches suffered by in-house security, but they need to remain nimble and focused to retain their edge.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ Fortnite Players at Risk Via Epic Games Vulnerability πŸ•΄

Bugs in Epic Games' platform could let intruders take over players' accounts, view personal data, and/or buy in-game currency.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2015-9280

MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2015-9279

MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2015-9278

MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2015-9277

MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2015-9276

SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2016-10403 (chrome)

Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ BEC Groups Ramp Up Payroll Diversion Attacks πŸ•΄

Criminals are increasingly trying to defraud businesses by diverting payrolls of CEOs, other senior executives, Agari says.

πŸ“– Read

via "Dark Reading: ".