πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ Microsoft Takes Down 99 Hacker-Controlled Websites πŸ•΄

A judge granted Microsoft the injunction allowing them to disrupt a network of sites operated by an Iranian-linked group of hackers.

πŸ“– Read

via "Dark Reading: ".
⚠ Companies will stop storing data in Australia, Microsoft warns ⚠

Australia's controversial anti-encryption laws came under independent scrutiny this week as tech leaders criticized the proposed rules.

πŸ“– Read

via "Naked Security".
⚠ FTC slams the phone down on quartet of robocallers ⚠

Wrist slaps and paltry fines may not be what most of us were hoping for in retribution for billions of robocalls and countless scams.

πŸ“– Read

via "Naked Security".
⚠ Grindr up for sale amid US fears for Chinese-owned data ⚠

A US national security panel told Kunlun, that its ownership of Grindr constitutes a national security risk.

πŸ“– Read

via "Naked Security".
πŸ•΄ UK Watchdog Criticizes Huawei for Lax Software Security, Development πŸ•΄

Calling the company's software development practices chaotic and unsustainable, a UK government oversight group calls on the company to make measurable progress toward more secure and sustainable code.

πŸ“– Read

via "Dark Reading: ".
πŸ” Dell encryption console breaks after installing March 2019 Windows Update πŸ”

Following the latest round of updates from Microsoft, the Dell Encryption Console used for securing data on enterprise-deployed laptops stops working, but data remains secure.

πŸ“– Read

via "Security on TechRepublic".
⚠ As drones fill the skies, cybercriminals won’t be far behind ⚠

Putting these toys back in the box after a decade of hype isn’t going to be easy, but these researchers are exploring the options.

πŸ“– Read

via "Naked Security".
πŸ” 90% of large tech companies vulnerable to email spoofing πŸ”

Most companies have not implemented standards for authenticating emails and preventing hackers from successful phishing attacks, according to Valimail.

πŸ“– Read

via "Security on TechRepublic".
❌ Critical Rockwell Automation Bug in Drive Component Puts IIoT Plants at Risk ❌

A critical Rockwell Automation flaw could be exploited to manipulate an industrial drive’s physical process and or even stop it.

πŸ“– Read

via "Threatpost".
πŸ•΄ 20 Years of STRIDE: Looking Back, Looking Forward πŸ•΄

The invention of STRIDE was the key inflection point in the development of threat modeling from art to engineering practice.

πŸ“– Read

via "Dark Reading: ".
❌ Zero-Day Bug Lays Open TP-Link Smart Home Router ❌

However, an attacker would need to already be on the local network to be successful.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2017-18110

The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18109

The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18108

The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI injection.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18106

The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain access to another user's session provided they can make their identifier hash collide with another user's session identifier hash.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18105

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation vulnerability.

πŸ“– Read

via "National Vulnerability Database".
❌ Magento Patches Critical SQL Injection and RCE Vulnerabilities ❌

Magento patched 37 flaws Thursday, including a stored cross-site scripting (XSS) vulnerability that could have let an attacker take over a site.

πŸ“– Read

via "Threatpost".
πŸ•΄ 7 Malware Families Ready to Ruin Your IoT's Day πŸ•΄

This latest list of Internet of Things miscreants doesn't limit itself to botnets, like Mirai.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Toyota Customer Information Exposed in Data Breach πŸ•΄

The attackers hit dealer sales systems in Japan, according to the automaker.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ NDSU Offers Nation's First Ph.D. in Cybersecurity Education πŸ•΄

The new program focuses on training university-level educators in cybersecurity.

πŸ“– Read

via "Dark Reading: ".
❌ Critical Bug in Cisco WebEx Browser Extensions Allows Remote Code-Execution ❌

Users of the conferencing platform should update immediately.

πŸ“– Read

via "Threatpost".