πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-43350 β€Ό

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.

πŸ“– Read

via "National Vulnerability Database".
πŸ—“οΈ Zero tolerance: How infosec’s online β€˜cancel culture’ is stunting industry growth πŸ—“οΈ

Fear of Twitter fallout is stopping vital information from being shared Social media backlash and online squabbling is stopping the information security industry from learning from its mistakes, Black

πŸ“– Read

via "The Daily Swig".
🦿 This pre-Black Friday sale lets you save an extra 15% off cybersecurity certification training courses 🦿

Receive over 100 hours of expert instruction on globally recognized cybersecurity skills that will help you become an in-demand IT professional.

πŸ“– Read

via "Tech Republic".
🦿 How to easily transfer files between computers with croc 🦿

If you're looking for an easy command-line tool to transfer files between systems on the same LAN, Jack Wallen believes croc is the tool for the job.

πŸ“– Read

via "Tech Republic".
πŸ—“οΈ GoCD bug chain provides second springboard to supply chain attacks πŸ—“οΈ

Follow-up to recent GoCD disclosure provides additional path to infiltrating build environments

πŸ“– Read

via "The Daily Swig".
⚠ S3 Ep58: Faces on Facebook, scams that pose as complaints, and a Kaseya bust [Podcast] ⚠

Latest epsiode - listen now!

πŸ“– Read

via "Naked Security".
πŸ•΄ Third-Party Software Risks Grow, but So Do Solutions πŸ•΄

Enterprises are more dependent than ever on open source software and need to manage the risk posed by vulnerabilities in components and third-party vendors.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Insider IP Theft Is Surging β€” and Most Can't Stop It πŸ•΄

The Great Resignation is upon us, and insider IP theft is surging as a result. But it is a solvable problem.

πŸ“– Read

via "Dark Reading".
❌ Congress Mulls Ban on Big Ransom Payouts ❌

A bill introduced this week would regulate ransomware response by the country's critical financial sector.

πŸ“– Read

via "Threat Post".
🦿 Research: Supply chain and COVID-19 challenges forces companies to shift their security strategies 🦿

64% of survey respondents reported that their companies have concerns about security risks for supply chains.

πŸ“– Read

via "Tech Republic".
πŸ•΄ What Happens If Time Gets Hacked πŸ•΄

Renowned hardware security expert raises alarm on the risk and dangers of cyberattackers targeting the current time-synchronization infrastructure.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Cloud Attack Analysis Unearths Lessons for Security Pros πŸ•΄

Researchers detail their investigation of a cryptomining campaign stealing AWS credentials and how attackers have evolved their techniques.

πŸ“– Read

via "Dark Reading".
❌ Cyber-Mercenary Group Void Balaur Attacks High-Profile Targets for Cash ❌

A Russian-language threat group is available for hire, to steal data on journalists, political leaders, activists and from organizations in every sector.

πŸ“– Read

via "Threat Post".
❌ Back-to-Back PlayStation 5 Hacks Hit on the Same Day ❌

Cyberattackers stole PS5 root keys and exploited the kernel, revealing rampant insecurity in gaming devices.

πŸ“– Read

via "Threat Post".
❌ Invest in These 3 Key Security Technologies to Fight Ransomware ❌

Ransomware volumes are up 1000%. Aamir Lakhani, cybersecurity researcher and practitioner at FortiGuard Labs , discusses secure email, network segmentation and sandboxing for defense.

πŸ“– Read

via "Threat Post".
🦿 Learn how to become an ethical hacker for only $21 during this pre-Black Friday sale 🦿

You don't need to break the bank to get the training required for an exciting new career, especially when you've got the right coupon code.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2002-20001 β€Ό

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ How Do I Know It's Time to Consider a SASE Migration? πŸ•΄

The rapid shift to a hybrid workplace and accelerated adoption of new technologies means it's time to rethink networking security approaches.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-3908 β€Ό

OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-3909 β€Ό

OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-3910 β€Ό

OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).

πŸ“– Read

via "National Vulnerability Database".