πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ 10 Notable Security Acquisitions of 2019 (So Far) πŸ•΄

In a year when security companies have been snapped up left and right, these deals stand out from the chaos.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2013-7472

The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.

πŸ“– Read

via "National Vulnerability Database".
⚠ Monday review – the hot 21 stories of the week ⚠

From the GoldBrute botnet to Microsoft's battle with irresponsibly disclosed bugs - and everything in between. It's your weekly roundup.

πŸ“– Read

via "Naked Security".
⚠ Widely used medical infusion pump can be remotely hijacked ⚠

These vulnerable infusion pumps can be remotely hacked to alter the delivery of IV fluids and medications such as painkillers or insulin.

πŸ“– Read

via "Naked Security".
⚠ I’d like to add you to my professional network of people to spy on ⚠

A deepfake was reportedly spotted in the wild: LinkedIn's well-connected, young, attractive Eurasia/Russia expert "Katie Jones."

πŸ“– Read

via "Naked Security".
⚠ Privacy foul for soccer league app that eavesdropped on users ⚠

The LaLiga app used phones' GPS and microphones to sniff out bars that were broadcasting soccer matches illegally.

πŸ“– Read

via "Naked Security".
⚠ Yubico recalls FIPS Yubikey tokens after flaw found ⚠

Security token maker Yubico has issued an important advisory affecting high-end versions of its YubiKey authentication key.

πŸ“– Read

via "Naked Security".
πŸ•΄ Find Your Next Favorite Cybersecurity Tool at the Black Hat USA Arsenal πŸ•΄

Learn new enterprise-grade techniques for identifying vulnerabilities, improving Active Directory security, and building trust with customers at Black Hat USA this summer.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ The Life-Changing Magic of Tidying Up the Cloud πŸ•΄

Most companies' cloud security operations would benefit significantly from clean-up, alignment, and organization.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Utilities, Nations Need Better Plan Against Critical Infrastructure Attackers πŸ•΄

The attackers behind the Triton, or Xenotime, intrusions into critical infrastructure (CI) safety systems are testing their skills against electric power companies. Options for defense are still limited, however.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2009-5157 (wag54g2_firmware)

On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable.

πŸ“– Read

via "National Vulnerability Database".
❌ Microsoft Pushes Azure Users to Patch Linux Systems ❌

Microsoft is urging users to patch every Exim installation in their organization and make sure that they are updated to the most recent version, Exim version 4.92.

πŸ“– Read

via "Threatpost".
πŸ” Business travelers, beware: Hackers looking over your shoulder can cause data breaches πŸ”

Some 80% of business travelers say visual hacking is a threat, according to a 3M report.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2018-10239

A privilege escalation vulnerability in the "support access" feature on Infoblox NIOS 6.8 through 8.4.1 could allow a locally authenticated administrator to temporarily gain additional privileges on an affected device and perform actions within the super user scope. The vulnerability is due to a weakness in the "support access" password generation algorithm. A locally authenticated administrative user may be able to exploit this vulnerability if the "support access" feature is enabled, they know the support access code for the current session, and they know the algorithm to generate the support access password from the support access code. "Support access" is disabled by default. When enabled, the access will be automatically disabled (and support access code will expire) after the 24 hours.

πŸ“– Read

via "National Vulnerability Database".
❌ A Spate of University Breaches Highlight Email Threats in Higher Ed ❌

Students at Oregon State University, Graceland University and Southern Missouri State have all been impacted by email attacks against school employees.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2017-9388

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as proxy.sh which allows the device to proxy a specific request to and from from another website. This is primarily used as a method of communication between the device and Vera website when the user is logged in to the https://home.getvera.com and allows the device to communicate between the device and website. One of the parameters retrieved by this specific script is "url". This parameter is not sanitized by the script correctly and is passed in a call to "eval" to execute "curl" functionality. This allows an attacker to escape from the executed command and then execute any commands of his/her choice.

πŸ“– Read

via "National Vulnerability Database".
πŸ” How to create an administrator IAM user and group in AWS πŸ”

AWS best practices dictate that you should not use root user credentials for everyday admin tasks. Proper data security requires the use of special administrator account.

πŸ“– Read

via "Security on TechRepublic".
πŸ” Nevada Beats California With New Privacy Law πŸ”

Nevada's new law, which will require website operators to honor opt-out procedures, goes into effect on October 1, three months before the CCPA's compliance deadline, January 1, 2010.

πŸ“– Read

via "Subscriber Blog RSS Feed ".
πŸ•΄ New Decryptor Unlocks Latest Versions of Gandcrab πŸ•΄

The decryptor neutralizes GandCrab versions 5.0 through 5.2 and lets victims unlock their files for free.

πŸ“– Read

via "Dark Reading: ".
❌ 5,000 Twitter Accounts Linked to Disinformation Campaigns ❌

The social platform has suspended six sets of accounts across four jurisdictions for running alleged influence campaigns, including Iran.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2017-9384

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as relay.sh which allows the device to create relay ports and connect the device to Vera servers. This is primarily used as a method of communication between the device and Vera servers so the devices can be communicated with even when the user is not at home. One of the parameters retrieved by this specific script is "remote_host". This parameter is not sanitized by the script correctly and is passed in a call to "eval" to execute another script where remote_host is concatenated to be passed a parameter to the second script. This allows an attacker to escape from the executed command and then execute any commands of his/her choice.

πŸ“– Read

via "National Vulnerability Database".