❌ SolarWinds Hack Potentially Linked to Turla APT ❌
📖 Read
via "Threat Post".
Researchers have spotted notable code overlap between the Sunburst backdoor and a known Turla weapon.📖 Read
via "Threat Post".
Threat Post
SolarWinds Hack Potentially Linked to Turla APT
Researchers have spotted notable code overlap between the Sunburst backdoor and a known Turla weapon.
⚠ Naked Security Live – HTTPS: do we REALLY need it? ⚠
📖 Read
via "Naked Security".
Here's the latest Naked Security Live video talk - watch now, and please share with your friends!📖 Read
via "Naked Security".
Naked Security
Naked Security Live – HTTPS: do we REALLY need it?
Here’s the latest Naked Security Live video talk – watch now, and please share with your friends!
❌ Researcher Builds Parler Archive Amid Amazon Suspension ❌
📖 Read
via "Threat Post".
A researcher scraped and archived public Parler posts before the conservative social networking service was taken down by Amazon, Apple and Google.📖 Read
via "Threat Post".
Threat Post
Researcher Builds Parler Archive Amid Amazon Suspension
A researcher scraped and archived public Parler posts before the conservative social networking service was taken down by Amazon, Apple and Google.
‼ CVE-2020-24027 ‼
📖 Read
via "National Vulnerability Database".
In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24025 ‼
📖 Read
via "National Vulnerability Database".
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-13559 ‼
📖 Read
via "National Vulnerability Database".
A denial-of-service vulnerability exists in the traffic-logging functionality of FreyrSCADA IEC-60879-5-104 Server Simulator 21.04.028. A specially crafted packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23631 ‼
📖 Read
via "National Vulnerability Database".
Cross-site request forgery (CSRF) in admin/global/manage.php in WDJA CMS 1.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via the tongji parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26298 ‼
📖 Read
via "National Vulnerability Database".
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.📖 Read
via "National Vulnerability Database".
❌ Millions of Social Profiles Leaked by Chinese Data-Scrapers ❌
📖 Read
via "Threat Post".
A cloud misconfig by SocialArks exposed 318 million records gleaned from Facebook, Instagram and LinkedIn.📖 Read
via "Threat Post".
Threat Post
Millions of Social Profiles Leaked by Chinese Data-Scrapers
A cloud misconfig by SocialArks exposed 318 million records gleaned from Facebook, Instagram and LinkedIn.
🦿 CES 2021: All of the business tech news you need to know 🦿
📖 Read
via "Tech Republic".
Don't miss TechRepublic's CES 2021 coverage, which includes product announcements from Lenovo, Samsung, LG, and Dell about PCs, laptops, software, robots, monitors, and TVs.📖 Read
via "Tech Republic".
TechRepublic
CES 2021: All of the business tech news you need to know
Don't miss TechRepublic's CES 2021 coverage, which includes product announcements from Lenovo, Samsung, LG, and Dell about PCs, laptops, software, robots, monitors, and TVs.
🦿 CES 2021: All of the business tech news you need to know 🦿
📖 Read
via "Tech Republic".
Don't miss TechRepublic's CES 2021 coverage, which includes product announcements from Lenovo, Samsung, LG, and Dell about PCs, laptops, software, robots, monitors, and TVs.📖 Read
via "Tech Republic".
TechRepublic
CES 2021: All of the business tech news you need to know
Don't miss TechRepublic's CES 2021 coverage, which includes product announcements from Lenovo, Samsung, LG, and Dell about PCs, laptops, software, robots, monitors, and TVs.
‼ CVE-2020-26050 ‼
📖 Read
via "National Vulnerability Database".
SaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low privileged users to SYSTEM via a crafted openssl configuration file. This issue is similar to CVE-2019-12572.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27637 ‼
📖 Read
via "National Vulnerability Database".
The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3📖 Read
via "National Vulnerability Database".
‼ CVE-2020-16146 ‼
📖 Read
via "National Vulnerability Database".
Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buffer Overflow in BluFi provisioning in btc_blufi_recv_handler function in blufi_prf.c. An attacker can send a crafted BluFi protocol Write Attribute command to characteristic 0xFF01. With manipulated packet fields, there is a buffer overflow.📖 Read
via "National Vulnerability Database".
🕴 Over-Sharer or Troublemaker? How to Identify Insider-Risk Personas 🕴
📖 Read
via "Dark Reading".
It's past time to begin charting insider risk indicators that identify risky behavior and stop it in its tracks.📖 Read
via "Dark Reading".
Dark Reading
Over-Sharer or Troublemaker? How to Identify Insider-Risk Personas
It's past time to begin charting insider risk indicators that identify risky behavior and stop it in its tracks.
🕴 US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security 🕴
📖 Read
via "Dark Reading".
How two traditionally disparate security disciplines can be united.📖 Read
via "Dark Reading".
Dark Reading
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
How two traditionally disparate security disciplines can be united.
🕴 New Tool Sheds Light on AppleScript-Obfuscated Malware 🕴
📖 Read
via "Dark Reading".
The AEVT decompiler helped researchers analyze a cryptominer campaign that used AppleScript for obfuscation and will help reverse engineers focused on other Mac OS malware.📖 Read
via "Dark Reading".
Dark Reading
New Tool Sheds Light on AppleScript-Obfuscated Malware
The AEVT decompiler helped researchers analyze a cryptominer campaign that used AppleScript for obfuscation and will help reverse engineers focused on other Mac OS malware.
🕴 Cartoon: Shakin' It Up at the Office 🕴
📖 Read
via "Dark Reading".
And the winner of our December cartoon caption contest is ...📖 Read
via "Dark Reading".
Dark Reading
Cartoon: Shakin' It Up at the Office
And the winner of our December cartoon caption contest is ...
🕴 SolarWinds Hack Lessons Learned: Finding the Next Supply Chain Attack 🕴
📖 Read
via "Dark Reading".
The SolarWinds supply chain compromise won't be the last of its kind. Vendors and enterprises alike must learn and refine their detection efforts to find the next such attack.📖 Read
via "Dark Reading".
Dark Reading
SolarWinds Hack Lessons Learned: Finding the Next Supply Chain Attack
The SolarWinds supply chain compromise won't be the last of its kind. Vendors and enterprises alike must learn and refine their detection efforts to find the next such attack.
🕴 Malware Developers Refresh Their Attack Tools 🕴
📖 Read
via "Dark Reading".
Cisco analyzes the latest version of the LokiBot malware for stealing credentials, finding that its developers have added more misdirection and anti-analysis features.📖 Read
via "Dark Reading".
Dark Reading
Malware Developers Refresh Their Attack Tools
Cisco analyzes the latest version of the LokiBot malware for stealing credentials, finding that its developers have added more misdirection and anti-analysis features.
🕴 When It Comes To Security Tools, More Isn't More 🕴
📖 Read
via "Dark Reading".
Organizations that focus on optimizing their tools, cutting down on tool sprawl, and taking a strategic approach to transitioning to the cloud are poised for success.📖 Read
via "Dark Reading".
Dark Reading
When It Comes To Security Tools, More Isn't More
Organizations that focus on optimizing their tools, cutting down on tool sprawl, and taking a strategic approach to transitioning to the cloud are poised for success.