πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
ATENTIONβ€Ό New - CVE-2016-9040

An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when used with a 32 bit model. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploit this will result in memory exhaustion, resulting in a full system denial of service.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ The Role of Incident Response in ICS Security Compliance πŸ•΄

The data-driven nature of IR can provide many of the reporting requirements governing industrial control system safety, finance, consumer privacy, and notifications.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ British Airways Issues Apology for Severe Data Breach πŸ•΄

The airline "is deeply sorry" for its worst-ever cyberattack, which has affected 380,000 customers.

πŸ“– Read

via "Dark Reading: ".
❌ British Airways Website, Mobile App Breach Compromises 380k ❌

The airline said information like name, address and bank card details like CVC code were compromised.

πŸ“– Read

via "The first stop for security news | Threatpost ".
ATENTIONβ€Ό New - CVE-2017-1115

IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 121153.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-1114

IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121152.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Palestinian, Middle East Targets Hit with New Surveillance Attacks πŸ•΄

'Big Bang' group returns with new campaign after last year's RAT attacks.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2016-9044

An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1 . A specially crafted web parameter can cause a command injection. An authenticated attacker can send a crafted web request to trigger this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
❌ Open .Git Directories Leave 390K Websites Vulnerable ❌

An exhaustive scan shows hundreds of thousands of websites potentially exposing sensitive data such as database passwords, API keys and so on.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ•΄ 8 Attack Vectors Puncturing Cloud Environments πŸ•΄

These methods may not yet be on your security team's radar, but given their impact, they should be.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ TLS 1.3 Won't Break Everything πŸ•΄

The newest version of TLS won't break everything in your security infrastructure, but you do need to be prepared for the changes it brings.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Apple (Finally) Removes MacOS App Caught Stealing User Browser Histories πŸ•΄

The fact that the app likely has been exfiltrating data for years is "rather f#@&'d" up, says the security researcher who reported the issue to Apple one month ago.

πŸ“– Read

via "Dark Reading: ".
❌ β€˜Domestic Kitten’ Mobile Spyware Campaign Aims at Iranian Targets ❌

Spreading via fake Android apps, the malware lifts a range of sensitive information from victims' devices.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ•΄ Foreshadow, SGX & the Failure of Trusted Execution πŸ•΄

Trusted execution environments are said to provide a hardware-protected enclave that runs software and cannot be accessed externally, but recent developments show they fall far short.

πŸ“– Read

via "Dark Reading: ".
☒ Standard to protect against BGP hijack attacks gets first official draft ☒

NIST and DHS project publishes first draft of new BGP Route Origin Validation (ROV) standard that will help ISPs and cloud providers protect against BGP hijack attacks.

πŸ“– Read

via "Latest topics for ZDNet in Security".
☒ Australia's anti-encryption law will merely relocate the backdoors: Expert ☒

If the Assistance and Access Bill becomes law as it stands, it could affect 'every website that is accessible from Australia' with relatively few constraints in the government's powers.

πŸ“– Read

via "Latest topics for ZDNet in Security".
☒ Popular VPNs contain code execution security flaws, despite patches ☒

ProtonVPN and NordVPN contain severe bugs which impact Windows users and threaten their privacy.

πŸ“– Read

via "Latest topics for ZDNet in Security".
⚠ Monday review – the hot 24 stories of the week ⚠

From Google buying Mastercard card records and Google warning users of FBI snooping to Chrome making it harder to use Flash, and more!

πŸ“– Read

via "Naked Security".
☒ Mirai, Gafgyt IoT botnets stab systems with Apache Struts, SonicWall exploits ☒

The IoT botnets are back with a new arsenal containing a vast array of vulnerabilities.

πŸ“– Read

via "Latest topics for ZDNet in Security".
⚠ β€˜Only paper ballots by 2020!’ call experts after election tampering ⚠

The National Academy of Sciences says the US election system uses insecure technology and is fighting off attempts to destabilize it.

πŸ“– Read

via "Naked Security".
⚠ Google Chrome will now generate unique passwords for you ⚠

Chrome will now generate a unique password for users as a part of the everyday credential creation process.

πŸ“– Read

via "Naked Security".