πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ Attunity Data Leak Exposes Sensitive Files at Ford, TD Bank πŸ•΄

Three unsecured Amazon S3 storage buckets compromised more than 1TB of data belonging to Attunity and its high-profile clients.

πŸ“– Read

via "Dark Reading: ".
❌ Finding Beauty In The Architecture ❌

I have a confession to make. I’m a sucker for good architecture. Visiting places like Singapore, London, Rome, Bueno Aires, and New York City, I quickly find myself gravitating towards beautiful archways, spires, and even the voids used in designing some of the world’s most amazing buildings. I also found myself with a similar sense […]

πŸ“– Read

via "Threatpost".
πŸ” Why WPA3 is necessary to secure Wi-Fi 6 / 802.11ax networks πŸ”

Following the disclosure of the KRACK vulnerability, WPA3 was developed to prevent "session replay" attacks. Aruba's Jeff Lipton explains the importance of WPA3 to Wi-Fi 6.

πŸ“– Read

via "Security on TechRepublic".
⚠ Relatives’ DNA in geneology database leads to murder conviction ⚠

Privacy advocates may question the use of genealogy data in forensics, but defense attorneys in this case did not.

πŸ“– Read

via "Naked Security".
⚠ Medtronic rushes to replace insulin pumps after flaws found ⚠

Medtronic is immediately recalling of all MiniMed 508 & Paradigm insulin pumps after researchers uncovered serious security flaws.

πŸ“– Read

via "Naked Security".
πŸ‘1
⚠ Dating app Jack’d fined $240K for leaving private photos up for a year ⚠

The company behind the gay dating app left users' private photos online for a year in spite of knowing about the security bugs.

πŸ“– Read

via "Naked Security".
⚠ Scary Granny zombie game slurps credentials, spawns phishing attack ⚠

Halloween came a little early for some Android users this year after a horror-themed computer game was found stealing their account credentials and displaying potentially malicious ads.

πŸ“– Read

via "Naked Security".
πŸ•΄ Thousands of Facebook Users Hit in Malware Distribution Campaign πŸ•΄

'Operation Tripoli' is another reminder why users cannot trust every link they see on social media sites.

πŸ“– Read

via "Dark Reading: ".
πŸ” Why WPA3 is necessary to secure Wi-Fi 6 / 802.11ax networks πŸ”

Following the disclosure of the KRACK vulnerability, WPA3 was developed to prevent "session replay" attacks. Aruba's Jeff Lipton explains the importance of WPA3 to Wi-Fi 6.

πŸ“– Read

via "Security on TechRepublic".
πŸ” 1 in 10 tech employees plan to steal company information before leaving a job πŸ”

Insider threats are more difficult to detect and prevent than external attacks, and are a major threat to businesses, according to Gurucul.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ Ransomware Hits Georgia Court System πŸ•΄

The court's IT department is meeting with external agencies to determine the scope and severity of the cyberattack.

πŸ“– Read

via "Dark Reading: ".
πŸ” Cyberwar risk: Utilities fail to patch critical security vulnerabilities often enough πŸ”

The potential risks associated with compromised systems are severe. Given the prospects of a potential cyberwar, utilities should place a greater emphasis on security.

πŸ“– Read

via "Security on TechRepublic".
πŸ” How organizations can better protect themselves against supply chain security threats πŸ”

Running regular anti-malware scans and blocking malicious IP addresses are two strategies. But organizations need to do more to defend themselves against security risks from supply chain partners, according to (ISC)2.

πŸ“– Read

via "Security on TechRepublic".
❌ Mac Malware Pushed via Google Search Results, Masquerades as Flash Installer ❌

A new malware is targeting Macs with new tactics to sniff out antivirus and virtual machines.

πŸ“– Read

via "Threatpost".
πŸ•΄ Lake City Employee Fired Following Ransom Payment πŸ•΄

The Florida city approved its insurer to pay $460,000 in ransom for a cyberattack that shut down servers, email, and phone.

πŸ“– Read

via "Dark Reading: ".
πŸ” New Bill Could Ease HIPAA Enforcement πŸ”

A bill passed by a Senate Committee last week could ease Health Insurance Portability and Accountability Act (HIPAA) enforcements by incentivizing healthcare entities to adopt cybersecurity policies.

πŸ“– Read

via "Subscriber Blog RSS Feed ".
πŸ•΄ Toyota's Car-Hacking Tool Now Available πŸ•΄

'PASTA' hardware and software kit now retails for $28,300.

πŸ“– Read

via "Dark Reading: ".
❌ Google July Android Security Bulletin Fixes 3 Critical RCE Bugs ❌

Google fixed several critical and high-severity vulnerabilities in its Android operating system.

πŸ“– Read

via "Threatpost".
πŸ•΄ Poor Communications Slowing DevOps Shift πŸ•΄

Existing functional silos are standing in the way of building a DevOps culture.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ In Cybercrime's Evolution, Active, Automated Attacks Are the Latest Fad πŸ•΄

Staying ahead can feel impossible, but understanding that perfection is impossible can free you to make decisions about managing risk.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2017-8408

An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "cgibox" is the one that has the vulnerable function "sub_7EAFC" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter "user" is extracted in function sub_7E49C which is then passed to the vulnerable system API call.

πŸ“– Read

via "National Vulnerability Database".