🕴 Citrix Breach Underscores Password Perils 🕴

Attackers used a short list of passwords to knock on every digital door to find vulnerable systems in the vendor's network.

📖 Read

via "Dark Reading: ".

🕴 Web Apps are Becoming Less Secure 🕴

Critical vulnerabilities in web applications tripled in 2018, according to a new study.

📖 Read

via "Dark Reading: ".

🕴 There May be A Ceiling on Vulnerability Remediation 🕴

Most organizations are doing all they can to keep up with the release of vulnerabilities, new research shows.

📖 Read

via "Dark Reading: ".

⚠ New bill would give parents an ‘Eraser Button’ to delete kids’ data ⚠

The COPPA overhaul would ban targeting ads at kids under 13 and ad targeting based on race, socioeconomics or geolocation on kids under 15.

📖 Read

via "Naked Security".

<b>&#9881;&#65039; Judging Facebook's Privacy Shift &#9881;&#65039;</b>

<code>Facebook is making a new and stronger commitment to privacy. Last month, the company hired three of its most vociferous critics and installed them in senior technical positions. And on Wednesday, Mark Zuckerberg wrote that the company will pivot to focus on private conversations over the public sharing that has long defined the platform, even while conceding that "frankly we don't currently have a strong reputation for building privacy protective services."</code><code>There is ample reason to question Zuckerberg's pronouncement: The company has made -- and broken -- many privacy promises over the years. And if you read his 3,000-word post carefully, Zuckerberg says nothing about changing Facebook's surveillance capitalism business model. All the post discusses is making private chats more central to the company, which seems to be a play for increased market dominance and to counter the Chinese company WeChat.</code><code>In security and privacy, the devil is always in the details -- and Zuckerberg's post provides none. But we'll take him at his word and try to fill in some of the details here. What follows is a list of changes we should expect if Facebook is serious about changing its business model and improving user privacy.</code><code>How Facebook treats people on its platform</code><code>Increased transparency over advertiser and app accesses to user data. Today, Facebook users can download and view much of the data the company has about them. This is important, but it doesn't go far enough. The company could be more transparent about what data it shares with advertisers and others and how it allows advertisers to select users they show ads to. Facebook could use its substantial skills in usability testing to help people understand the mechanisms advertisers use to show them ads or the reasoning behind what it chooses to show in user timelines. It could deliver on promises in this area.</code><code>Better -- and more usable -- privacy options. Facebook users have limited control over how their data is shared with other Facebook users and almost no control over how it is shared with Facebook's advertisers, which are the company's real customers. Moreover, the controls are buried deep behind complex and confusing menu options. To be fair, some of this is because privacy is complex, and it's hard to understand the results of different options. But much of this is deliberate; Facebook doesn't want its users to make their data private from other users.</code><code>The company could give people better control over how -- and whether -- their data is used, shared, and sold. For example, it could allow users to turn off individually targeted news and advertising. By this, we don't mean simply making those advertisements invisible; we mean turning off the data flows into those tailoring systems. Finally, since most users stick to the default options when it comes to configuring their apps, a changing Facebook could tilt those defaults toward more privacy, requiring less tailoring most of the time.</code><code>More user protection from stalking. "Facebook stalking" is often thought of as "stalking light," or "harmless." But stalkers are rarely harmless. Facebook should acknowledge this class of misuse and work with experts to build tools that protect all of its users, especially its most vulnerable ones. Such tools should guide normal people away from creepiness and give victims power and flexibility to enlist aid from sources ranging from advocates to police.</code><code>Fully ending real-name enforcement. Facebook's real-names policy, requiring people to use their actual legal names on the platform, hurts people such as activists, victims of intimate partner violence, police officers whose work makes them targets, and anyone with a public persona who wishes to have control over how they identify to the public. There are many ways Facebook can improve…

⚠ Misconfigured Box accounts leak terabytes of companies’ sensitive data ⚠

Easily guessable URLs led to what should have been big companies' very private data. Even Box itself was found to be exposing folders.

📖 Read

via "Naked Security".

⚠ “FINAL WARNING” email – have they really hacked your webcam? ⚠

In the last 24 hours, SophosLabs received 1,700 samples of just one new sextortion campaign. Good news? It's all a pack of lies. Don't reply. Don't engage.

📖 Read

via "Naked Security".

⚠ Update now! WordPress abandoned cart plugin under attack ⚠

Hackers have been spotted targeting websites running unpatched versions of the WordPress plugin Abandoned Cart for WooCommerce.

📖 Read

via "Naked Security".

🔐 How to secure IoT devices: 6 factors to consider 🔐

While Internet of Things devices can unlock great insights and value from the data collected, cybersecurity must be built in from the start, according to a report from the Indiana IoT Lab.

📖 Read

via "Security on TechRepublic".

⚠ Chrome will soon block drive-by-download malvertising ⚠

A new Chrome feature hopes to choke off one of the most malicious forms of malware infection: drive-by advertising downloads.

📖 Read

via "Naked Security".

🔐 How to wipe your USB drive before throwing it away 🔐

Data was found on 68% of secondhand flash drives sold in the US, according to a Comparitech report. Here's how to secure your data for disposal.

📖 Read

via "Security on TechRepublic".

❌ Threat Groups SandCat, FruityArmor Exploiting Microsoft Win32k Flaw ❌

Newly patched CVE-2019-0797 is being actively exploited by two APTs, FruityArmor and SandCat.

📖 Read

via "Threatpost".

🕴 The Case for Transparency in End-User License Agreements 🕴

Why it behooves technology companies to consider EULAs as an opportunity to accurately inform customers about privacy issues and other important information.

📖 Read

via "Dark Reading: ".

❌ Three Ways DNS is Weaponized and How to Mitigate the Risk ❌

Why are hackers using the DNS infrastructure against us? The answer is more complex than you might think.

📖 Read

via "Threatpost".

🔐 How to generate SSH keys on macOS Mojave 🔐

macOS is capable of working with SSH keys. Jack Wallen shows you how to generate the necessary keys and copy them to a server.

📖 Read

via "Security on TechRepublic".

❌ MAGA ‘Safe Space’ App Developer Threatens Security Researcher ❌

The mobile app, dubbed a "Yelp for Conservatives," was found with an open API leaking reams of user data.

📖 Read

via "Threatpost".

ATENTION‼ New - CVE-2018-17937

gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code on embedded platforms via traffic on Port 2947/TCP or crafted JSON inputs.

📖 Read

via "National Vulnerability Database".

ATENTION‼ New - CVE-2015-2254

Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to capture and change patch loading information resulting in the deletion of directory files and compromise of system functions when loading a patch.

📖 Read

via "National Vulnerability Database".

❌ Intel Windows 10 Graphics Drivers Riddled With Flaws ❌

Intel has patched several high-severity vulnerabilities in its graphics drivers for Windows 10, which could lead to code code execution.

📖 Read

via "Threatpost".

🕴 'SimBad': Android Adware Hits 210 Apps with 150M Downloads 🕴

Google has removed infected applications from the Google Play store after a form of adware potentially affected millions of users.

📖 Read

via "Dark Reading: ".

🕴 IoT Anomaly Detection 101: Data Science to Predict the Unexpected 🕴

Yes! You can predict the chance of a mechanical failure or security breach before it happens. Part one of a two-part series.

📖 Read

via "Dark Reading: ".