πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ Cisco Buys Sentryo πŸ•΄

Cisco is adding the French company's network visibility products to its IoT network lineup.

πŸ“– Read

via "Dark Reading: ".
⚠ The FBI is sitting on more than 641m photos of people’s faces ⚠

Its already massive facial recognition databases have ballooned, and government watchdog GAO found that the FBI isn't checking accuracy.

πŸ“– Read

via "Naked Security".
⚠ Researchers eavesdrop on smartphone finger taps ⚠

Researchers have been experimenting with a novel way to eavesdrop on what you're typing on your smartphone - by listening to the taps of your fingers.

πŸ“– Read

via "Naked Security".
πŸ•΄ The Minefield of Corporate Email πŸ•΄

Email security challenges CISOs as cybercriminals target corporate inboxes with malware, phishing attempts, and various forms of fraud.

πŸ“– Read

via "Dark Reading: ".
⚠ What’s the best approach to patching vulnerabilities? ⚠

Researchers ask: with only 1 in 20 vulnerabilities exploited, what's the best approach to patching?

πŸ“– Read

via "Naked Security".
⚠ Action required! Exim mail servers need urgent patching ⚠

Researchers have discovered another dangerous security hole hiding in recent, unpatched versions of the internet’s most popular mail server, Exim.

πŸ“– Read

via "Naked Security".
πŸ” Friday Five: 6/7 Edition πŸ”

The latest trade secret case, a more strict privacy bill for New York State, and the European Data Protection Supervisor's warning - catch up on the week's news with this recap!

πŸ“– Read

via "Subscriber Blog RSS Feed ".
πŸ•΄ Learn the Latest Hacking Techniques at Black Hat Trainings Virginia πŸ•΄

At Black Hat's upcoming Trainings-only October event you'll have opportunities to get up to speed on the newest hacking tricks for operating systems and cloud providers.

πŸ“– Read

via "Dark Reading: ".
❌ Troy Hunt: β€˜Messy’ Password Problem Isn’t Getting Better ❌

Poor password hygiene continues to plague the security industry, Troy Hunt said during Infosecurity Europe.

πŸ“– Read

via "Threatpost".
❌ Threatlist: Targeted Espionage-as-a-Service Takes Hold on the Dark Web ❌

One in four underground merchants offer advanced hacking services, once reserved for APTs and well-funded organized crime gangs.

πŸ“– Read

via "Threatpost".
πŸ•΄ End User Lockdown: Dark Reading Caption Contest Winners πŸ•΄

Phishing, cybersecurity training, biometrics and casual Fridays. And the winners are ...

πŸ“– Read

via "Dark Reading: ".
❌ News Wrap: Infosecurity Europe Highlights and BlueKeep Anxiety ❌

The Threatpost editors discuss the highlights from Infosecurity Europe, which took place in London this week.

πŸ“– Read

via "Threatpost".
πŸ” Autonomous versus automated: What each means and why it matters πŸ”

The terms autonomous and automated often get mixed up. When designing security strategies, knowing the distinctions between the two has its perks.

πŸ“– Read

via "Security on TechRepublic".
❌ SandboxEscaper Debuts ByeBear Windows Patch Bypass ❌

SandboxEscaper is back, with a second bypass for the recent CVE-2019-0841 Windows patch.

πŸ“– Read

via "Threatpost".
❌ Forget BlueKeep: Beware the GoldBrute ❌

A botnet has appeared that has attempted to brute-force 1.5 million RDP connections to Windows systems in the last few days β€” and counting.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2018-6185

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for these commands are keytrustee.kms.acl.PURGE and keytrustee.kms.acl.UNDELETE respectively. The default value for the ACLs in Key Trustee KMS 5.12.0 and 5.13.0 is "*" which allows anyone with knowledge of the name of an encryption zone key and network access to the Key Trustee KMS to make those calls against known encryption zone keys. This can result in the recovery of a previously deleted, but not purged, key (undelete) or the deletion of a key in active use (purge) resulting in loss of access to encrypted HDFS data.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-5798

This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-5265

Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the 'alias' or 'ips' parameter for shell metacharacters.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-20135

Samsung Galaxy Apps before 4.4.01.7 allows modification of the hostname used for load balancing on installations of applications through a man-in-the-middle attack. An attacker may trick Galaxy Apps into using an arbitrary hostname for which the attacker can provide a valid SSL certificate, and emulate the API of the app store to modify existing apps at installation time. The specific flaw involves an HTTP method to obtain the load-balanced hostname that enforces SSL only after obtaining a hostname from the load balancer, and a missing app signature validation in the application XML. An attacker can exploit this vulnerability to achieve Remote Code Execution on the device. The Samsung ID is SVE-2018-12071.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-20091

An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW's internal database. The database contains user contact information, encrypted CDSW passwords (in the case of local authentication), API keys, and stored Kerberos keytabs.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Massive Changes to Tech and Platforms, But Cybercrime? Not So Much πŸ•΄

The still-relevant recommendation is to invest more in law enforcement, concludes an economic study of cybercrime.

πŸ“– Read

via "Dark Reading: ".