πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
⚠ DHS policies allow unlimited, warrantless device search ⚠

Newly revealed policies show border agents can search devices for pretty much any reason, including if some other agency asked them to.

πŸ“– Read

via "Naked Security".
πŸ” Companies are still failing to effectively manage passwords πŸ”

Though most businesses have complex password requirements in place, many are falling into other traps of poor password management, according to a survey from OneLogin.

πŸ“– Read

via "Security on TechRepublic".
πŸ” How to protect your business from account takeover attacks: 3 tips πŸ”

Account takeovers are one of the fastest-growing email security threats hitting Office 365 accounts, according to Barracuda.

πŸ“– Read

via "Security on TechRepublic".
⚠ World Password Day – what (NOT!) to do ⚠

Yeah, yeah, yeah... we really ought to get around to picking proper passwords for everything - and here's why!

πŸ“– Read

via "Naked Security".
πŸ” Digital transformation increases cyber risk for 8 out of 10 companies πŸ”

Organizations are not prepared to handle cyber breaches due to gaps in IT security and basic operations, according to a 1E survey.

πŸ“– Read

via "Security on TechRepublic".
πŸ” Hackers impersonate Microsoft more than any other brand in phishing attacks πŸ”

Phishers tend to focus on business during the week, social media and finance on the weekend, according to a Vade Secure report.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ World Password Day or Groundhog Day? πŸ•΄

Despite decades trying to fortify our passwords with bolt-on solutions, attackers have always found ways to defeat them. Here are four reasons why.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Why Are We Still Celebrating World Password Day? πŸ•΄

Calls to eliminate the password abound on this World Password Day - and the technology to change is ready. So why can't we get off our password habit?

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Facebook, Instagram Are Phishers' Favorite Social Platforms πŸ•΄

Cloud companies continue to represent the most phishing URLs, but social media saw the most growth in Q1 2019.

πŸ“– Read

via "Dark Reading: ".
❌ Cisco Warns of Critical Nexus 9000 Data Center Flaw ❌

Part of a slew of patches from the networking vendor, the CVSS 9.8 bug allows remote takeover of a vulnerable device.

πŸ“– Read

via "Threatpost".
πŸ” 6 ways to strengthen your password πŸ”

Make an effort to secure your digital life with these helpful, easy-to-follow password tips.

πŸ“– Read

via "Security on TechRepublic".
πŸ” NIST Sets New Standard for Data Encryption Testing πŸ”

NIST has updated the Federal Information Processing Standard, or FIPS, to align with the international standard, ISO 19790 for the first time,

πŸ“– Read

via "Subscriber Blog RSS Feed ".
ATENTIONβ€Ό New - CVE-2018-14559 (ac10_firmware, ac7_firmware, ac9_firmware)

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A buffer overflow vulnerability exists in the router's web server (httpd). When processing the list parameters for a post request, the value is directly written with sprintf to a local variable placed on the stack, which overrides the return address of the function, causing a buffer overflow.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-14557 (ac10_firmware, ac7_firmware, ac9_firmware)

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A buffer overflow vulnerability exists in the router's web server (httpd). When processing the page parameters for a post request, the value is directly written with sprintf to a local variable placed on the stack, which overrides the return address of the function, a causing buffer overflow.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-12244 (endpoint_protection)

SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula injection) vulnerability, which is a type of issue whereby an application or website allows untrusted input into CSV files.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Real-World Use, Risk of Open Source Code πŸ•΄

Organizations are using more open source software than ever before, but managing that code remains a challenge.

πŸ“– Read

via "Dark Reading: ".
❌ Dell Security Support Tool Harbors High-Severity Flaws ❌

Dell has patched two high-severity vulnerabilities in its SupportAssist software meant to aid security issues for customers.

πŸ“– Read

via "Threatpost".
❌ Ladders, SkyMed Leak Employment, Medical Data for Millions ❌

One of the misconfigured Elasticsearch databases showed evidence of a ransomware attack.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2017-18374

The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passwords, including a hardcoded service account with the username true and password true. These accounts can be used to login to the web interface, exploit authenticated command injections and change router settings for malicious purposes.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18373

The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username user3 and and a long password consisting of a repetition of the string 0123456789. These accounts can be used to login to the web interface, exploit authenticated command injections, and change router settings for malicious purposes.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18372

The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user. The vulnerability is in the tools_time.asp page and can be exploited through the uiViewSNTPServer parameter. Authentication can be achieved by exploiting CVE-2017-18373.

πŸ“– Read

via "National Vulnerability Database".