🕴 The 7 Habits of Highly Effective Security Teams 🕴
📖 Read
via "Dark Reading: ".
Security requires smart people, processes, and technology. Too often, the "people" portion of the PPT equation is neglected.📖 Read
via "Dark Reading: ".
Dark Reading
The 7 Habits of Highly Effective Security Teams
Security requires smart people, processes, and technology. Too often, the people portion of the PPT equation is neglected.
❌ CSS-Based Attack Causes iOS, macOS Devices to Crash ❌
📖 Read
via "The first stop for security news | Threatpost ".
The attack stems from a glitch in WebKit, an HTML layout browser engine in Apple’s Safari browser.📖 Read
via "The first stop for security news | Threatpost ".
Threat Post
CSS-Based Attack Causes iOS, macOS Devices to Crash
The attack stems from a glitch in WebKit, an HTML layout browser engine in Apple’s Safari browser.
ATENTION‼ New - CVE-2017-15705
📖 Read
via "National Vulnerability Database".
A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2016-9045
📖 Read
via "National Vulnerability Database".
A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
🕴 Ransomware Takes Down Airport's Flight Information Screens 🕴
📖 Read
via "Dark Reading: ".
The attack left airport staff to post flight times and gates on whiteboards at Bristol Airport in Britain.📖 Read
via "Dark Reading: ".
Darkreading
Ransomware Takes Down Airport's Flight Information Screens
The attack left airport staff to post flight times and gates on whiteboards at Bristol Airport in Britain.
❌ Old WordPress Plugin Being Exploited in RCE Attacks ❌
📖 Read
via "The first stop for security news | Threatpost ".
Old instances of the popular WordPress Duplicator Plugin are leaving sites open to remote code execution attacks.📖 Read
via "The first stop for security news | Threatpost ".
Threat Post
Old WordPress Plugin Being Exploited in RCE Attacks
Old instances of the popular WordPress Duplicator Plugin are leaving sites open to remote code execution attacks.
❌ Facebook Now Offers Bounties For Access Token Exposure ❌
📖 Read
via "The first stop for security news | Threatpost ".
The newly expanded Facebook bug bounty program sniffs out access token exposure flaws.📖 Read
via "The first stop for security news | Threatpost ".
Threat Post
Facebook Now Offers Bounties For Access Token Exposure
The newly expanded Facebook bug bounty program sniffs out access token exposure flaws.
ATENTION‼ New - CVE-2017-2777
📖 Read
via "National Vulnerability Database".
An exploitable heap overflow vulnerability exists in the ipStringCreate function of Iceni Argus Version 6.6.05. A specially crafted pdf file can cause an integer overflow resulting in heap overflow. An attacker can send file to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-14443
📖 Read
via "National Vulnerability Database".
An exploitable information leak vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly checks the number of GET parameters supplied, leading to an arbitrarily controlled information leak on the whole device memory. An attacker can send an authenticated HTTP request to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
🕴 Yahoo Class-Action Suits Set for Settlement 🕴
📖 Read
via "Dark Reading: ".
Altaba tells SEC it will incur $47 million to settle consumer litigation for massive Yahoo data breaches.📖 Read
via "Dark Reading: ".
Darkreading
Yahoo Class-Action Suits Set for Settlement
Altaba tells SEC it will incur $47 million to settle consumer litigation for massive Yahoo data breaches.
🔐 How to use the Android Pie lockdown mode 🔐
📖 Read
via "Security on TechRepublic".
Jack Wallen walks you activating and enabling Android Pie's new lockdown mode and shows why you should use it.📖 Read
via "Security on TechRepublic".
TechRepublic
How to use the Android Pie lockdown mode
Jack Wallen walks you activating and enabling Android Pie's new lockdown mode and shows why you should use it.
ATENTION‼ New - CVE-2017-2874
📖 Read
via "National Vulnerability Database".
An information disclosure vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted request on port 10001 can allow for a user to retrieve sensitive information without authentication.📖 Read
via "National Vulnerability Database".
🕴 RDP Ports Prove Hot Commodities on the Dark Web 🕴
📖 Read
via "Dark Reading: ".
Remote desktop protocol access continues to thrive in underground markets, primarily to hackers who lack expertise to find exposed ports themselves.📖 Read
via "Dark Reading: ".
Darkreading
RDP Ports Prove Hot Commodities on the Dark Web
Remote desktop protocol access continues to thrive in underground markets, primarily to hackers who lack expertise to find exposed ports themselves.
❌ Zero-Day Bug Allows Hackers to Access CCTV Surveillance Cameras ❌
📖 Read
via "The first stop for security news | Threatpost ".
Firmware used in up to 800,000 CCTV cameras open to attack thanks to buffer overflow zero-day bug.📖 Read
via "The first stop for security news | Threatpost ".
Threat Post
Zero-Day Bug Allows Hackers to Access CCTV Surveillance Cameras
Firmware used in up to 800,000 CCTV cameras open to attack thanks to buffer overflow zero-day bug.
🕴 New Xbash Malware a Cocktail of Malicious Functions 🕴
📖 Read
via "Dark Reading: ".
The new malware tool targeting Windows and Linux systems combines cryptomining, ransomware, botnet, and self-propagation capabilities.📖 Read
via "Dark Reading: ".
Darkreading
New Xbash Malware a Cocktail of Malicious Functions
The new malware tool targeting Windows and Linux systems combines cryptomining, ransomware, botnet, and self-propagation capabilities.
ATENTION‼ New - CVE-2017-2872
📖 Read
via "National Vulnerability Database".
Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A HTTP request can allow for a user to perform a firmware upgrade using a crafted image. Before any firmware upgrades in this image are flashed to the device, binaries as well as arguments to shell commands contained in the image are executed with elevated privileges.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-2857
📖 Read
via "National Vulnerability Database".
An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating a rogue HTTP server.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-2856
📖 Read
via "National Vulnerability Database".
An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating a rogue HTTP server.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-2854
📖 Read
via "National Vulnerability Database".
An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating a rogue HTTP server.📖 Read
via "National Vulnerability Database".
⚠ State Department scores an F on 2FA security ⚠
📖 Read
via "Naked Security".
Senators have discovered that the State Department is breaking the law by not using multi-factor authentication in its emails.📖 Read
via "Naked Security".
Naked Security
State Department scores an F on 2FA security
Senators have discovered that the State Department is breaking the law by not using multi-factor authentication in its emails.
⚠ 91 “child friendly” Android apps accused of exploitation ⚠
📖 Read
via "Naked Security".
New Mexico's AG filed a lawsuit accusing a popular app maker, plus Google's and Twitter's ad platforms, of illegally collecting kids' data.📖 Read
via "Naked Security".
Naked Security
91 “child friendly” Android apps accused of exploitation
New Mexico’s AG filed a lawsuit accusing a popular app maker, plus Google’s and Twitter’s ad platforms, of illegally collecting kids’ data.