🛠 Faraday 3.14.1 🛠
📖 Read
via "Packet Storm Security".
Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Faraday 3.14.1 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
❌ Microsoft: SolarWinds Attackers Downloaded Azure, Exchange Code ❌
📖 Read
via "Threat Post".
However, internal products and systems were not leveraged to attack others during the massive supply-chain incident, the tech giant said upon completion of its Solorigate investigation.📖 Read
via "Threat Post".
Threat Post
Microsoft: SolarWinds Attackers Downloaded Azure, Exchange Code
However, internal products and systems were not leveraged to attack others during the massive supply-chain incident, the tech giant said upon completion of its Solorigate investigation.
🕴 How to Fine-Tune Vendor Risk Management in a Virtual World 🕴
📖 Read
via "Dark Reading".
Without on-site audits, many organizations lack their usual visibility to assess risk factors and validate contracts and SLA with providers.📖 Read
via "Dark Reading".
Dark Reading
How to Fine-Tune Vendor Risk Management in a Virtual World
Without on-site audits, many organizations lack their usual visibility to assess risk factors and validate contracts and SLA with providers.
🔏 Friday Five 2-19 🔏
📖 Read
via "Digital Guardian".
Indictments of North Korean hackers, cybersecurity in the stimulus bill, and the growing popularity of Python - catch up on all of the week's infosec news with the Friday Five!📖 Read
via "Digital Guardian".
‼ CVE-2021-3210 ‼
📖 Read
via "National Vulnerability Database".
components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3204 ‼
📖 Read
via "National Vulnerability Database".
SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server.📖 Read
via "National Vulnerability Database".
🦿 Linux 101: How to block users from setting up their own cron jobs 🦿
📖 Read
via "Tech Republic".
Jack Wallen shows you how to gain a bit more security on your Linux servers by blocking users from adding cron jobs.📖 Read
via "Tech Republic".
TechRepublic
Linux 101: How to block users from setting up their own cron jobs
Jack Wallen shows you how to gain a bit more security on your Linux servers by blocking users from adding cron jobs.
🦿 Forrester report highlights Zero Trust Edge model for networking and security infrastructure 🦿
📖 Read
via "Tech Republic".
According to Forrester, ZTE will be most helpful with securing and enabling remote workers while removing the difficult user VPNs.📖 Read
via "Tech Republic".
TechRepublic
Forrester report highlights Zero Trust Edge model for networking and security infrastructure
According to Forrester, ZTE will be most helpful with securing and enabling remote workers while removing the difficult user VPNs.
⚠ The massive coronavirus pandemic IT blunder with a funny side ⚠
📖 Read
via "Naked Security".
He was either the smallest person who has ever lived, by an order of magnitude, or the heaviest person ever known, by two of them.📖 Read
via "Naked Security".
Naked Security
The massive coronavirus IT blunder with a funny side
He was either the smallest person who has ever lived, by an order of magnitude, or the heaviest person ever known, by two of them.
🦿 IRS issues urgent notice on scams aimed at tax professionals 🦿
📖 Read
via "Tech Republic".
Scammers are impersonating the IRS with emails carrying the subject line "Verifying your EFIN before e-filing."📖 Read
via "Tech Republic".
TechRepublic
IRS issues urgent notice on scams aimed at tax professionals
Scammers are impersonating the IRS with emails carrying the subject line "Verifying your EFIN before e-filing."
🦿 Linux 101: How to block users from setting up their own cron jobs 🦿
📖 Read
via "Tech Republic".
Jack Wallen shows you how to gain a bit more security on your Linux servers by blocking users from adding cron jobs.📖 Read
via "Tech Republic".
TechRepublic
Linux 101: How to block users from setting up their own cron jobs
Jack Wallen shows you how to gain a bit more security on your Linux servers by blocking users from adding cron jobs.
‼ CVE-2021-22701 ‼
📖 Read
via "National Vulnerability Database".
A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause a user to perform an unintended action on the target device when using the HTTP web interface.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22702 ‼
📖 Read
via "National Vulnerability Database".
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts Telnet network traffic between a user and the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-12374 ‼
📖 Read
via "National Vulnerability Database".
Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow a privileged user to potentially enable escalation of privilege via local access.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22703 ‼
📖 Read
via "National Vulnerability Database".
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts HTTP network traffic between a user and the device.📖 Read
via "National Vulnerability Database".
🕴 Attackers Already Targeting Apple's M1 Chip with Custom Malware 🕴
📖 Read
via "Dark Reading".
A proof-of-concept program infects systems with ARM64-compiled binaries and then reaches out to download additional functionality.📖 Read
via "Dark Reading".
Dark Reading
Attackers Already Targeting Apple's M1 Chip with Custom Malware
A proof-of-concept program infects systems with ARM64-compiled binaries and then reaches out to download additional functionality.
🦿 How to find details about user logins on Linux 🦿
📖 Read
via "Tech Republic".
If you need to gather information on user logins for your Linux servers, Jack Wallen has just the tool for you.📖 Read
via "Tech Republic".
TechRepublic
How to find details about user logins on Linux
If you need to gather information on user logins for your Linux servers, Jack Wallen has just the tool for you.
🦿 New malformed URL phishing technique can make attacks harder to spot 🦿
📖 Read
via "Tech Republic".
Hackers are now sending messages that hide fake links in the HTTP prefix, bypassing email filters, says security firm GreatHorn.📖 Read
via "Tech Republic".
TechRepublic
New malformed URL phishing technique can make attacks harder to spot
Hackers are now sending messages that hide fake links in the HTTP prefix, bypassing email filters, says security firm GreatHorn.
❌ Mysterious Silver Sparrow Malware Found Nesting on 30K Macs ❌
📖 Read
via "Threat Post".
A second malware that targets Macs with Apple's in-house M1 chip is infecting machines worldwide -- but it's unclear why.📖 Read
via "Threat Post".
Threat Post
Mysterious Silver Sparrow Malware Found Nesting on 30K Macs
A second malware that targets Macs with Apple's in-house M1 chip is infecting machines worldwide — but it's unclear why.
❌ Credential-Stuffing Attack Targets Regional Internet Registry ❌
📖 Read
via "Threat Post".
RIPE NCC, the regional Internet registry for Europe, West Asia, and the former Soviet Union, said attackers attempted a credential-stuffing attack against its single-sign on service.📖 Read
via "Threat Post".
Threat Post
Credential-Stuffing Attack Targets Regional Internet Registry
RIPE NCC, the regional Internet registry for Europe, West Asia, and the former Soviet Union, said attackers attempted a credential-stuffing attack against its single-sign on service.