πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
26K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ 6 Security Tips Before You Put a Digital Assistant to Work πŸ•΄

If you absolutely have to have Amazon Alexa or Google Assistant in your home, heed the following advice.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2016-1000276

Audacity version 2.1.2 is vulnerable to DLL Hijack, it tries to load avformat-55.dll without supplying the absolute path, thus relying upon the presence of such DLL on the system directory. This behavior results in an exploitable DLL Hijack vulnerability, even if the SafeDllSerchMode flag is enabled.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2016-1000271

Joomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in "/index.php?controller=calendar&format=raw&cat[0]=SQLi&task=events". This attack appears to be exploitable if the attacker can reach the web server.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ New Botnet Shows Evolution of Tech and Criminal Culture πŸ•΄

Cayosin brings together multiple strands of botnet tech and hacker behavior for a disturbing new threat.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Exposed Consumer Data Skyrocketed 126% in 2018 πŸ•΄

The number of data breaches dropped overall, but the amount of sensitive records exposed jumped to 446.5 million last year, according to the ITRC.

πŸ“– Read

via "Dark Reading: ".
⚠ Kids’ GPS watches are still a security β€˜train wreck’ ⚠

Anyone could have accessed the entire database, including a child's location, on Gator watches and other models that share its back end.

πŸ“– Read

via "Naked Security".
ATENTIONβ€Ό New - CVE-2017-18362

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

πŸ“– Read

via "National Vulnerability Database".
⚠ Crypto exchange in limbo after founder dies with password ⚠

The only person who knew the password is dead, leaving customers unable to access around $190million in fiat and virtual currency.

πŸ“– Read

via "Naked Security".
❌ The APT Name Game: How Grim Threat Actors Get Goofy Monikers ❌

How do advanced persistent threat groups such as Double Secret Octopus and Anchor Panda get their ridiculous names?

πŸ“– Read

via "Threatpost | The first stop for security news".
⚠ Half of IoT devices let down by vulnerable apps ⚠

Half of the apps used to control a range of Internet of Things devices are insecure in a variety of ways, researchers found.

πŸ“– Read

via "Naked Security".
⚠ Home DNA kit company says it’s working with the FBI ⚠

FamilyTreeDNA has disclosed that it's opened up more than 1m DNA profiles to the FBI to help find suspects of violent crime.

πŸ“– Read

via "Naked Security".
❌ Remote Desktop Protocol Clients Rife with Remote Code-Execution Flaws ❌

Several flaws in both open-source RDP clients and in Microsoft's own proprietary client make it possible for a malicious RDP server to infect a client computer – which could then allow for an intrusion into the IT network as a whole.

πŸ“– Read

via "Threatpost | The first stop for security news".
πŸ•΄ Black Hat USA 2019 Offers a Boatload of New Training Opportunities πŸ•΄

Led by top infosec talent, these cutting-edge courses are an efficient way to get practical, hands-on training in everything from blockchain security to machine learning.

πŸ“– Read

via "Dark Reading: ".
❌ EU Recalls Children’s Smartwatch That Leaks Location Data ❌

The children's smartwatch allows bad actors to track their location and communicate with them, according to the alert.

πŸ“– Read

via "Threatpost | The first stop for security news".
πŸ•΄ Taming the Wild, West World of Security Product Testing πŸ•΄

The industry has long needed an open, industry-standard testing framework. NetSecOPEN is working to make that happen.

πŸ“– Read

via "Dark Reading: ".
❌ Google Patches Critical .PNG Image Bug ❌

Eleven critical bugs will be patched as part of the February Android Security Bulletin.

πŸ“– Read

via "Threatpost | The first stop for security news".
πŸ” Why your business needs to work with the government to fight cyber warfare πŸ”

The US government will not be able to mitigate a cyber-enabled economic warfare attack without help from the private sector, according to a report from FDD and the Chertoff Group.

πŸ“– Read

via "Security on TechRepublic".
⚠ Ep. 018 – Home invasions, snoopy apps and Android versus iOS [PODCAST] ⚠

Here's the latest Naked Security podcast - give it a listen!

πŸ“– Read

via "Naked Security".
ATENTIONβ€Ό New - CVE-2017-1202

IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 123677.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-1200

IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host. IBM X-Force ID: 123675.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-1198

IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 123673.

πŸ“– Read

via "National Vulnerability Database".