❌ Data Breach Lessons from the Trenches ❌
📖 Read
via "Threatpost".
How companies can identify their own insecure data, remediate data breaches and proactively secure data against future attacks.📖 Read
via "Threatpost".
Threat Post
Data Breach Lessons from the Trenches
How companies can identify their own insecure data, remediate data breaches and proactively secure data against future attacks.
⚠ Monday review – the hot 23 stories of the week ⚠
📖 Read
via "Naked Security".
From RDP BlueKeep's message for admins to Medtronic's recall of hackable insulin pumps - and everything in between.📖 Read
via "Naked Security".
Naked Security
Monday review – the hot 23 stories of the week
From RDP BlueKeep’s message for admins to Medtronic’s recall of hackable insulin pumps – and everything in between.
⚠ New Year’s eve gaming DDoSer lulz himself into a 27-month sentence ⚠
📖 Read
via "Naked Security".
Back in 2014, @DerpTrolling said he attacked sites simply based on requests from people who tweeted suggested targets.📖 Read
via "Naked Security".
Naked Security
New Year’s eve gaming DDoSer lulz himself into a 27-month sentence
Back in 2014, @DerpTrolling said he attacked sites simply based on requests from people who tweeted suggested targets.
⚠ ISPs call Mozilla ‘Internet Villain’ for promoting DNS privacy ⚠
📖 Read
via "Naked Security".
ISPA has shortlisted Mozilla for the sort of award that, on the face of it, no tech company should be keen to win - 2019’s Internet Villain.📖 Read
via "Naked Security".
Naked Security
ISPs call Mozilla ‘Internet Villain’ for promoting DNS privacy
ISPA has shortlisted Mozilla for the sort of award that, on the face of it, no tech company should be keen to win – 2019’s Internet Villain.
🕴 7 Hot Cybersecurity Trends to Be Highlighted at Black Hat 🕴
📖 Read
via "Dark Reading: ".
Just some of the research and ideas worth checking out at this year's 'security summer camp.'📖 Read
via "Dark Reading: ".
Dark Reading
Slideshows - Dark Reading
Dark Reading: Connecting The Information Security Community. Explore our slideshows.
⚠ Privacy and security risks as Sign In with Apple tweaks Open ID protocol ⚠
📖 Read
via "Naked Security".
An open letter from the OpenID Foundation says that Apple introduced potential risks when it diverged from the OpenID Connect protocol.📖 Read
via "Naked Security".
Naked Security
Privacy and security risks as Sign In with Apple tweaks Open ID protocol
An open letter from the OpenID Foundation says that Apple introduced potential risks when it diverged from the OpenID Connect protocol.
🔐 How to use multiplexing to speed up the SSH 🔐
📖 Read
via "Security on TechRepublic".
Improve the speed SSH can run commands on remote servers with the help of multiplexing.📖 Read
via "Security on TechRepublic".
TechRepublic
How to use multiplexing to speed up the SSH login process
Improve the speed SSH can run commands on remote servers with the help of multiplexing.
⚠ Researchers hack VR worlds ⚠
📖 Read
via "Naked Security".
Hackers just infiltrated virtual reality, enabling them to manipulate users' immersive 3D worlds.📖 Read
via "Naked Security".
Naked Security
Researchers hack VR worlds
Hackers just infiltrated virtual reality, enabling them to manipulate users’ immersive 3D worlds.
🔐 British Airways hit with £183M GDPR fine—could your business be next? 🔐
📖 Read
via "Security on TechRepublic".
GDPR fines are finally coming down, and companies must be prepared to comply with the regulations or pay up.📖 Read
via "Security on TechRepublic".
TechRepublic
British Airways hit with £183M GDPR fine—could your business be next?
GDPR fines are finally coming down, and companies must be prepared to comply with the regulations or pay up.
❌ Post-Data Breach, British Airways Slapped With Record $230M Fine ❌
📖 Read
via "Threatpost".
A proposed $230 million fine on British Airways after a data breach would be the biggest GDPR penalty yet.📖 Read
via "Threatpost".
Threat Post
Post-Data Breach, British Airways Slapped With Record $230M Fine
A proposed $230 million fine on British Airways after a data breach would be the biggest GDPR penalty yet.
🔐 Why Apple should follow Microsoft's move to get rid of passwords 🔐
📖 Read
via "Security on TechRepublic".
Apple is testing biometric authentication as a new way of signing in to iCloud.com.📖 Read
via "Security on TechRepublic".
🕴 Smash-and-Grab Crime Threatens Enterprise Security 🕴
📖 Read
via "Dark Reading: ".
Getting your company smartphone or laptop stolen from your car isn't just a hassle; it can have large regulatory ramifications, too. Visibility is the answer.📖 Read
via "Dark Reading: ".
ATENTION‼ New - CVE-2018-11563
📖 Read
via "National Vulnerability Database".
An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary stylesheet or JavaScript code in a logged in customer's browser in the context of the OTRS customer panel application.📖 Read
via "National Vulnerability Database".
❌ Apple Patches iMessage Bug That Bricks iPhones with Out-of-Date Software ❌
📖 Read
via "Threatpost".
Google Project Zero finds Apple iMessage bug that bricks iPhones running older versions of the company's iOS software.📖 Read
via "Threatpost".
Threat Post
Apple Patches iMessage Bug That Bricks iPhones with Out-of-Date Software
Google Project Zero finds Apple iMessage bug that bricks iPhones running older versions of the company's iOS software.
🕴 Broadcom Moves Forward on Symantec Acquisition 🕴
📖 Read
via "Dark Reading: ".
Reports indicate a deal could be made by mid-July as Broadcom secures financing for the purchase.📖 Read
via "Dark Reading: ".
Dark Reading
Broadcom Moves Forward on Symantec Acquisition
Reports indicate a deal could be made by mid-July as Broadcom secures financing for the purchase.
ATENTION‼ New - CVE-2017-8408 (dcs-1130_firmware)
📖 Read
via "National Vulnerability Database".
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "cgibox" is the one that has the vulnerable function "sub_7EAFC" that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter "user" is extracted in function sub_7E49C which is then passed to the vulnerable system API call.📖 Read
via "National Vulnerability Database".
❌ GoBotKR Targets Pirate Torrents to Build a DDoS Botnet ❌
📖 Read
via "Threatpost".
The authors have tweaked a known piece of malware to specifically target Korean TV fans.📖 Read
via "Threatpost".
Threat Post
GoBotKR Targets Pirate Torrents to Build a DDoS Botnet
The authors have tweaked a known piece of malware to specifically target Korean TV fans.
🕴 NIST Sets Draft Guidelines for Government AI 🕴
📖 Read
via "Dark Reading: ".
This is the first formal step in writing the standards that will guide the implementation of AI technologies within the federal government.📖 Read
via "Dark Reading: ".
Dark Reading
NIST Sets Draft Guidelines for Government AI
This is the first formal step in writing the standards that will guide the implementation of AI technologies within the federal government.
🕴 Britain Looks to Levy Record GDPR Fine Against British Airways 🕴
📖 Read
via "Dark Reading: ".
The penalty is a sign of things to come, say experts.📖 Read
via "Dark Reading: ".
Darkreading
Britain Looks to Levy Record GDPR Fine Against British Airways
The penalty is a sign of things to come, say experts.
❌ Rules-Based Policy Approaches Need to Go ❌
📖 Read
via "Threatpost".
A zero-trust model is the only way to keep up with today's digital complexities.📖 Read
via "Threatpost".
Threat Post
Rules-Based Policy Approaches Need to Go
A zero-trust model is the only way to keep up with today's digital complexities.
ATENTION‼ New - CVE-2017-8417 (dcs-1100_firmware, dcs-1130_firmware)
📖 Read
via "National Vulnerability Database".
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third party to retrieve the device's password without any authentication by sending just 1 UDP packet with custom base64 encoding. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.📖 Read
via "National Vulnerability Database".