🕴 After Colonial Pipeline, Critical Infrastructure Operators Remain Blind to Cyber-Risks 🕴
📖 Read
via "Dark Reading".
In her keynote address at Black Hat USA 2022, Kim Zetter gives scathing rebuke of Colonial Pipeline attack.📖 Read
via "Dark Reading".
Dark Reading
After Colonial Pipeline, Critical Infrastructure Operators Remain Blind to Cyber-Risks
In her keynote address at Black Hat USA 2022, Kim Zetter gives a scathing rebuke of Colonial Pipeline for not foreseeing the attack.
🕴 Microsoft: We Don't Want to Zero-Day Our Customers 🕴
📖 Read
via "Dark Reading".
The head of Microsoft's Security Response Center defends keeping its initial vulnerability disclosures sparse -- it is, she says, to protect customers.📖 Read
via "Dark Reading".
Dark Reading
Microsoft: We Don't Want to Zero-Day Our Customers
The head of Microsoft's Security Response Center defends keeping its initial vulnerability disclosures sparse — it is, she says, to protect customers.
‼ CVE-2022-2779 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical was found in SourceCodester Gas Agency Management System. Affected by this vulnerability is an unknown functionality of the file /gasmark/assets/myimages/oneWord.php. The manipulation of the argument shell leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206173 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2390 ‼
📖 Read
via "National Vulnerability Database".
Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2503 ‼
📖 Read
via "National Vulnerability Database".
Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38179 ‼
📖 Read
via "National Vulnerability Database".
JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38180 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases📖 Read
via "National Vulnerability Database".
🗓️ GoTestWAF adds API attack testing via OpenAPI support 🗓️
📖 Read
via "The Daily Swig".
CI/CD support is next for WAF security tool📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
GoTestWAF adds API attack testing via OpenAPI support
CI/CD support is next for WAF security tool
❌ Facebook’s In-app Browser on iOS Tracks ‘Anything You Do on Any Website’ ❌
📖 Read
via "Threat Post".
Researcher shows how Instagram and Facebook’s use of an in-app browser within both its iOS apps can track interactions with external websites.📖 Read
via "Threat Post".
Threat Post
Facebook’s In-app Browser on iOS Tracks ‘Anything You Do on Any Website’
Researcher shows how Instagram and Facebook’s use of an in-app browser within both its iOS apps can track interactions with external websites.
⚠ S3 Ep95: Slack leak, Github onslaught, and post-quantum crypto [Audio + Text] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now! (Or read the transcript if you prefer.)📖 Read
via "Naked Security".
Naked Security
S3 Ep95: Slack leak, Github onslaught, and post-quantum crypto [Audio + Text]
Latest episode – listen now! (Or read the transcript if you prefer.)
🕴 How to Clear Security Obstacles and Achieve Cloud Nirvana 🕴
📖 Read
via "Dark Reading".
Back-end complexity of cloud computing means there's plenty of potential for security problems. Here's how to get a better handle on SaaS application security.📖 Read
via "Dark Reading".
Dark Reading
How to Clear Security Obstacles and Achieve Cloud Nirvana
Back-end complexity of cloud computing means there's plenty of potential for security problems. Here's how to get a better handle on SaaS application security.
🗓️ BHUSA: Make sure your security bug bounty program doesn’t create a data leak of its own 🗓️
📖 Read
via "The Daily Swig".
Researchers, organizations, and bug disclosure platforms can all make improvements to help protect user data📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
BHUSA: Make sure your security bug bounty program doesn’t create a data leak of its own
Researchers, organizations, and bug disclosure platforms can all make improvements to help protect user data
🔏 Friday Five 8/12 🔏
📖 Read
via "".
Twitter’s latest security incident, ransomware gangs, and state-sponsored hackers have taken over the news this past week. Catch up on all the latest with this week’s Friday Five!
📖 Read
via "".
🗓️ IT industry guilty of ‘lack of imagination’ in failure to anticipate cyber-attack evolution 🗓️
📖 Read
via "The Daily Swig".
‘We have a habit of reacting to threats after they occur, rather than preparing for them,’ journalist Kim Zetter tells Black Hat📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
IT industry guilty of ‘lack of imagination’ in failure to anticipate cyber-attack evolution
‘We have a habit of reacting to threats after they occur, rather than preparing for them,’ journalist Kim Zetter tells Black Hat
🛠 GNUnet P2P Framework 0.17.4 🛠
📖 Read
via "Packet Storm Security".
GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP (IPv4 and IPv6), TCP (IPv4 and IPv6), HTTP, or SMTP messages. GNUnet supports accounting to provide contributing nodes with better service. The primary service build on top of the framework is anonymous file sharing.📖 Read
via "Packet Storm Security".
Packetstormsecurity
GNUnet P2P Framework 0.17.4 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🕴 Novel Ransomware Comes to the Sophisticated SOVA Android Banking Trojan 🕴
📖 Read
via "Dark Reading".
Unusually, SOVA, which targets US users, now allows lateral movement for deeper data access. Version 5 adds an encryption capability.📖 Read
via "Dark Reading".
Dark Reading
Novel Ransomware Comes to the Sophisticated SOVA Android Banking Trojan
Unusually, SOVA, which targets US users, now allows lateral movement for deeper data access. Version 5 adds an encryption capability.
♟️ Sounding the Alarm on Emergency Alert System Flaws ♟️
📖 Read
via "Krebs on Security".
The Department of Homeland Security (DHS) is urging states and localities to beef up security around proprietary devices that connect to the Emergency Alert System -- a national public warning system used to deliver important emergency information, such as severe weather and AMBER alerts. The DHS warning came in advance of a workshop to be held this weekend at the DEFCON security conference in Las Vegas, where a security researcher is slated to demonstrate multiple weaknesses in the nationwide alert system.📖 Read
via "Krebs on Security".
Krebs on Security
Sounding the Alarm on Emergency Alert System Flaws
The Department of Homeland Security (DHS) is urging states and localities to beef up security around proprietary devices that connect to the Emergency Alert System -- a national public warning system used to deliver important emergency information, such as…
‼ CVE-2022-20314 ‼
📖 Read
via "National Vulnerability Database".
In KeyChain, there is a possible spoof keychain chooser activity request due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-191876118📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20309 ‼
📖 Read
via "National Vulnerability Database".
In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-194694094📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20262 ‼
📖 Read
via "National Vulnerability Database".
In ActivityManager, there is a possible way to check another process's capabilities due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-218338453📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20295 ‼
📖 Read
via "National Vulnerability Database".
In ContentService, there is a possible way to check if an account exists on the device due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-202160584📖 Read
via "National Vulnerability Database".