πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ” Friday Five: 11/15 Edition πŸ”

Microsoft warns about BlueKeep - again, a real estate firm is fined $16M for violating GDPR, and more - catch up on the week's news with the Friday Five.

πŸ“– Read

via "Subscriber Blog RSS Feed ".
ATENTIONβ€Ό New - CVE-2009-5047

Jetty 6.x before 6.1.22 suffers from an escape sequence injection vulnerability from two different vectors: 1) "Cookie Dump Servlet" and 2) Http Content-Length header. 1) A POST request to the form at "/test/cookie/" with the "Age" parameter set to a string throws a "java.lang.NumberFormatException" which reflects binary characters including ESC. These characters could be used to execute arbitrary commands or buffer dumps in the terminal. 2) The same attack in 1) can be exploited by requesting a page using an HTTP request "Content-Length" header set to a letteral string.

πŸ“– Read

via "National Vulnerability Database".
❌ Lizard Squad Threatens UK’s Labour Leader with Cyberattacks Against His Family ❌

The threats follow a DDos attack bent on taking out the Labour Party's online presence.

πŸ“– Read

via "Threatpost".
❌ James Clapper: Lessons Learned in a Post-Snowden World ❌

Former national intelligence director James Clapper discusses lessons learned from the 2013 Snowden leak as well as the top cyberthreats that the U.S. is currently facing.

πŸ“– Read

via "Threatpost".
πŸ•΄ 12 Tips for Dealing with a Manipulative Security Manager πŸ•΄

Don't let yourself be stuck in an unhealthy work environment with a toxic manager who takes advantage of your talent.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Black Hat Europe Brings A Bevy of IoT Security Insights πŸ•΄

Attend this London event next month for the latest on how security researchers are finding (and solving) security vulnerabilities in all of your favorite Internet-connected devices.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Soft Skills: 6 Nontechnical Traits CISOs Need to Succeed πŸ•΄

Degrees, certifications, and experience are all important to career development, but mastering the people side of the equation may matter a whole lot more, CISOs say.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Bad Booter Brought to Justice With Sentence for Prison, Fine, and Parole πŸ•΄

The Illinois-based man operated a criminal service that launched millions of DDoS attacks and brought in hundreds of thousands of dollars.

πŸ“– Read

via "Dark Reading: ".
❌ Holiday Shoppers Beware: 100K Malicious Sites Found Posing as Well-Known Retailers ❌

The copycat sites are using valid certificates to be more convincing.

πŸ“– Read

via "Threatpost".
πŸ›  Faraday 3.9.3 πŸ› 

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.

πŸ“– Go!

via "Security Tool Files β‰ˆ Packet Storm".
⚠ Monday review – the hot 23 stories of the week ⚠

From a fake news generator to critical flaws in Medtronic equipment - it's weekly roundup time.

πŸ“– Read

via "Naked Security".
⚠ Wikipedia co-founder offers a Facebook/Twitter wannabe ⚠

Tired of being a tracked, ad-bedeviled product sold by social media companies? The cost to immediately join a network with no tracking/ads: $12.99/month.

πŸ“– Read

via "Naked Security".
⚠ Two men busted for hijacking victims’ phones and email accounts ⚠

Prosecutors allege that Meiggs and Harrington took over their targets' mobile phone and email accounts via SIM-swapping.

πŸ“– Read

via "Naked Security".
⚠ GitHub launches Security Lab to boost open source security ⚠

The idea is simple – create a global platform for reporting and fixing vulnerabilities in open source projects before they do damage.

πŸ“– Read

via "Naked Security".
⚠ NSA won’t collect phone location data, promises US government ⚠

US intelligence agencies won’t harvest US residents’ geolocation data in future investigations, revealed the US government this month.

πŸ“– Read

via "Naked Security".
πŸ•΄ New: Everything You Always Wanted to Know About Security at the Edge But Were Afraid to Ask πŸ•΄

The secure perimeter as we know it is dissolving. So how do you protect your crown jewels when the castle has no walls?

πŸ“– Read

via "Dark Reading: ".
❌ Tianfu Cup Round-Up: Safari, Chrome, D-Link Routers and Office 365 Successfully Hacked ❌

White-hat hackers using never-before-seen zero days against popular applications and devices against competed at two-day gathering in Chengdu.

πŸ“– Read

via "Threatpost".
πŸ•΄ 13 Security Pros Share Their Most Valuable Experiences πŸ•΄

From serving as an artillery Marine to working a help desk, a baker's dozen of security pros share experiences that had the greatest influence on their careers.

πŸ“– Read

via "Dark Reading: ".
❌ Pipka Card Skimmer Removes Itself After Infecting eCommerce Sites ❌

The web skimmer has been spotted on at least 17 popular eCommerce websites, a new Visa alert warns.

πŸ“– Read

via "Threatpost".
πŸ•΄ Quantum Computing Breakthrough Accelerates the Need for Future-Proofed PKI πŸ•΄

Public key infrastructure is a foundational security tool that has evolved to become a critical base for future advancements. Today's generation of PKI can be coupled with quantum-resistant algorithms to extend the lifespan of digital certificates for decades.

πŸ“– Read

via "Dark Reading: ".
❌ β€˜Wildly Different’ Privacy Regulations Causing Compliancy Chaos ❌

Threatpost talks to Anthony di Bello with OpenText, at ENFUSE 2019, about the successes and failures of security regulations, and how companies are changing as they struggle to keep up with compliancy issues.

πŸ“– Read

via "Threatpost".