ATENTION‼ New - CVE-2017-13889 (mac_os_x)

In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a logic error existed in the validation of credentials. This was addressed with improved credential validation.

📖 Read

via "National Vulnerability Database".

ATENTION‼ New - CVE-2017-13888 (iphone_os)

In iOS before 11.2, a type confusion issue was addressed with improved memory handling.

📖 Read

via "National Vulnerability Database".

ATENTION‼ New - CVE-2016-7576 (iphone_os)

In iOS before 9.3.3, a memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.

📖 Read

via "National Vulnerability Database".

🕴 'We Want IoT Security Regulation,' Say 95% of IT Decision-Makers 🕴

New global survey shows businesses are valuing IoT security more highly, but they are still challenged by IoT data visibility and privacy.

📖 Read

via "Dark Reading: ".

ATENTION‼ New - CVE-2017-13891 (iphone_os)

In iOS before 11.2, an inconsistent user interface issue was addressed through improved state management.

📖 Read

via "National Vulnerability Database".

ATENTION‼ New - CVE-2016-4642 (apple_tv, iphone_os, mac_os)

In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, proxy authentication incorrectly reported HTTP proxies received credentials securely. This issue was addressed through improved warnings.

📖 Read

via "National Vulnerability Database".

🔐 ​4 ways to prepare for GDPR and similar privacy regulations 🔐

Data privacy is no longer a nice-to-have security commodity, but a must-have commodity.

📖 Read

via "Security on TechRepublic".

🔐 How to connect to VNC using SSH 🔐

If your network doesn't allow connections into the default VNC port 5901, you can tunnel it through SSH.

📖 Read

via "Security on TechRepublic".

ATENTION‼ New - CVE-2016-4644 (apple_tv, iphone_os, mac_os)

In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was addressed by storing the authentication types with the credentials.

📖 Read

via "National Vulnerability Database".

🔐 Over 87GB of email addresses and passwords exposed in Collection 1 dump 🔐

An 87GB dump of email addresses and passwords containing almost 773 million unique addresses and just under 22 million unique passwords has been found.

📖 Read

via "Security on TechRepublic".

🕴 The Security Perimeter Is Dead; Long Live the New Endpoint Perimeter 🕴

The network no longer provides an air gap against external threats, but access devices can take up the slack.

📖 Read

via "Dark Reading: ".

🕴 Go Hands-On with New Security Tricks at Black Hat Asia 🕴

Get up close and personal with the latest tools and techniques for testing (and breaking) everything from HTTPS to deep neural networks to Microsoft Office!

📖 Read

via "Dark Reading: ".

❌ Apple CEO Demands Federal Data Privacy Legislation ❌

Apple CEO Tim Cook has called on the government to double down on data privacy regulation in 2019.

📖 Read

via "Threatpost | The first stop for security news".

🔐 4 strategies for your IT wearables policy 🔐

Without a formal plan or policy, wearables may introduce your company to a security breach​.

📖 Read

via "Security on TechRepublic".

<b>&#9000; 773M Password ‘Megabreach’ is Years Old &#9000;</b>

<code>My inbox and Twitter messages positively lit up today with people forwarding stories from Wired and other publications about a supposedly new trove of nearly 773 million unique email addresses and 21 million unique passwords that were posted to a hacking forum. A story in The Guardian breathlessly dubbed it “the largest collection ever of breached data found.” But in an interview with the apparent seller, KrebsOnSecurity learned that it is not even close to the largest gathering of stolen data, and that it is at least two to three years old.</code><code>The dump, labeled “Collection #1” and approximately 87GB in size, was first detailed earlier today by Troy Hunt, who operates the HaveIBeenPwned breach notification service. Hunt said the data cache was likely “made up of many different individual data breaches from literally thousands of different sources.”</code><code>KrebsOnSecurity sought perspective on this discovery from Alex Holden, CTO of Hold Security, a company that specializes in trawling underground spaces for intelligence about malicious actors and their stolen data dumps. Holden said the data appears to have first been posted to underground forums in October 2018, and that it is just a subset of a much larger tranche of passwords being peddled by a shadowy seller online.</code><code>Here’s a screenshot of a subset of that seller’s current offerings, which total almost 1 Terabyte of stolen and hacked passwords:</code><code>Media</code><code>The 87GB “Collection1” archive is one of but many similar tranches of stolen passwords being sold by a particularly prolific ne’er-do-well in the underground.</code><code>As we can see above, Collection #1 offered by this seller is indeed 87GB in size. He also advertises a Telegram username where he can be reached — “Sanixer.” So, naturally, KrebsOnSecurity contacted Sanixer via Telegram to find out more about the origins of Collection #1, which he is presently selling for the bargain price of just $45.</code><code>Sanixer said Collection#1 consists of data pulled from a huge number of hacked sites, and was not exactly his “freshest” offering. Rather, he sort of steered me away from that archive, suggested that — unlike most of his other wares — Collection #1 was at least 2-3 years old. His other password packages, which he said are not all pictured in the above screen shot and total more than 4 terabytes in size, are less than a year old, Sanixer explained.</code><code>By way of explaining the provenance of Collection #1, Sanixer said it was a mix of “dumps and leaked bases,” and then he offered an interesting screen shot of his additional collections. Click on the image below and notice the open Web browser tab behind his purloined password trove (which is apparently stored at Mega.nz): Troy Hunt’s published research on this 773 million Collection #1.</code><code>Media</code><code>Sanixer says Collection #1 was from a mix of sources. A description of those sources can be seen in the directory tree on the left side of this screenshot.</code><code>Holden said the habit of collecting large amounts of credentials and posting it online is not new at all, and that the data is far more useful for things like phishing, blackmail and other indirect attacks — as opposed to plundering inboxes. Holden added that his company had already derived 99 percent of the data in Collection #1 from other sources.</code><code>“It was popularized several years ago by Russian hackers on various Dark Web forums,” he said. “Because the data is gathered from a number of breaches, typically older data, it does not present a direct danger to the general user community. Its sheer volume is impressive, yet, by account of many hackers the data is not greatly useful.”</code><code>A core reason so many accounts get compromised is that far too many people have the nasty habit(s) of choosing poor passwords, re-using passwords and email addresses…

🕴 New Attacks Target Recent PHP Framework Vulnerability 🕴

Multiple threat actors are using relatively simple techniques to take advantage of the vulnerability, launching cryptominers, skimmers, and other malware payloads.

📖 Read

via "Dark Reading: ".

ATENTION‼ New - CVE-2016-4643 (apple_tv, iphone_os, mac_os)

In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a validation issue existed in the parsing of 407 responses. This issue was addressed through improved response validation.

📖 Read

via "National Vulnerability Database".

🕴 Microsoft Launches New Azure DevOps Bug Bounty Program 🕴

A new program will pay bounties of up to $20,000 for new critical bugs in the company's Azure DevOps systems and services.

📖 Read

via "Dark Reading: ".

🕴 Facebook Shuts Hundreds of Russia-Linked Pages, Accounts for Disinformation 🕴

Facebook says the accounts and pages were part of two unrelated disinformation operations aimed at targets outside the US.

📖 Read

via "Dark Reading: ".

❌ Microsoft Launches Azure DevOps Bug Bounty Program ❌

Microsoft is offering rewards of up to $20,000 for flaws in its Azure DevOps online services and the latest release of the Azure DevOps server.

📖 Read

via "Threatpost | The first stop for security news".

🕴 773 Million Email Addresses, 21 Million Passwords For Sale on Hacker Forum 🕴

Data appears to be from multiple breaches over past few years, says researcher who discovered it.

📖 Read

via "Dark Reading: ".