π Friday Five: 11/15 Edition π
π Read
via "Subscriber Blog RSS Feed ".
Microsoft warns about BlueKeep - again, a real estate firm is fined $16M for violating GDPR, and more - catch up on the week's news with the Friday Five.π Read
via "Subscriber Blog RSS Feed ".
Digital Guardian
Friday Five: 11/15 Edition
Microsoft warns about BlueKeep - again, a real estate firm is fined $16M for violating GDPR, and more - catch up on the week's news with the Friday Five.
ATENTIONβΌ New - CVE-2009-5047
π Read
via "National Vulnerability Database".
Jetty 6.x before 6.1.22 suffers from an escape sequence injection vulnerability from two different vectors: 1) "Cookie Dump Servlet" and 2) Http Content-Length header. 1) A POST request to the form at "/test/cookie/" with the "Age" parameter set to a string throws a "java.lang.NumberFormatException" which reflects binary characters including ESC. These characters could be used to execute arbitrary commands or buffer dumps in the terminal. 2) The same attack in 1) can be exploited by requesting a page using an HTTP request "Content-Length" header set to a letteral string.π Read
via "National Vulnerability Database".
β Lizard Squad Threatens UKβs Labour Leader with Cyberattacks Against His Family β
π Read
via "Threatpost".
The threats follow a DDos attack bent on taking out the Labour Party's online presence.π Read
via "Threatpost".
Threat Post
Lizard Squad Threatens UKβs Labour Leader with Cyberattacks Against His Family
The threats follow an DDos attack bent on taking out the Labour Party's online presence.
β James Clapper: Lessons Learned in a Post-Snowden World β
π Read
via "Threatpost".
Former national intelligence director James Clapper discusses lessons learned from the 2013 Snowden leak as well as the top cyberthreats that the U.S. is currently facing.π Read
via "Threatpost".
Threat Post
James Clapper: Lessons Learned in a Post-Snowden World
Former national intelligence director James Clapper discusses lessons learned from the 2013 Snowden leak as well as the top cyberthreats that the U.S. is currently facing.
π΄ 12 Tips for Dealing with a Manipulative Security Manager π΄
π Read
via "Dark Reading: ".
Don't let yourself be stuck in an unhealthy work environment with a toxic manager who takes advantage of your talent.π Read
via "Dark Reading: ".
Dark Reading
12 Tips for Dealing with a Manipulative Security Manager - Dark Reading
Don't let yourself be stuck in an unhealthy work environment with a toxic manager who takes advantage of your talent.
π΄ Black Hat Europe Brings A Bevy of IoT Security Insights π΄
π Read
via "Dark Reading: ".
Attend this London event next month for the latest on how security researchers are finding (and solving) security vulnerabilities in all of your favorite Internet-connected devices.π Read
via "Dark Reading: ".
Dark Reading
Black Hat Europe Brings A Bevy of IoT Security Insights
Attend this London event next month for the latest on how security researchers are finding (and solving) security vulnerabilities in all of your favorite Internet-connected devices.
π΄ Soft Skills: 6 Nontechnical Traits CISOs Need to Succeed π΄
π Read
via "Dark Reading: ".
Degrees, certifications, and experience are all important to career development, but mastering the people side of the equation may matter a whole lot more, CISOs say.π Read
via "Dark Reading: ".
Dark Reading
Soft Skills: 6 Nontechnical Traits CISOs Need to Succeed
Degrees, certifications, and experience are all important to career development, but mastering the people side of the equation may matter a whole lot more, CISOs say.
π΄ Bad Booter Brought to Justice With Sentence for Prison, Fine, and Parole π΄
π Read
via "Dark Reading: ".
The Illinois-based man operated a criminal service that launched millions of DDoS attacks and brought in hundreds of thousands of dollars.π Read
via "Dark Reading: ".
Darkreading
Illegal Booter Connected with DDoSes Sentenced to Prison, Fine
The Illinois-based man operated a criminal service that launched millions of DDoS attacks and brought in hundreds of thousands of dollars.
β Holiday Shoppers Beware: 100K Malicious Sites Found Posing as Well-Known Retailers β
π Read
via "Threatpost".
The copycat sites are using valid certificates to be more convincing.π Read
via "Threatpost".
Threat Post
Holiday Shoppers Beware: 100K Malicious Sites Found Posing as Well-Known Retailers
The copycat sites are using valid certificates to be more convincing.
π Faraday 3.9.3 π
π Go!
via "Security Tool Files β Packet Storm".
Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.π Go!
via "Security Tool Files β Packet Storm".
Packetstormsecurity
Faraday 3.9.3 β Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
β Monday review β the hot 23 stories of the week β
π Read
via "Naked Security".
From a fake news generator to critical flaws in Medtronic equipment - it's weekly roundup time.π Read
via "Naked Security".
Naked Security
Monday review β the hot 23 stories of the week
From a fake news generator to critical flaws in Medtronic equipment β itβs weekly roundup time.
β Wikipedia co-founder offers a Facebook/Twitter wannabe β
π Read
via "Naked Security".
Tired of being a tracked, ad-bedeviled product sold by social media companies? The cost to immediately join a network with no tracking/ads: $12.99/month.π Read
via "Naked Security".
Naked Security
Wikipedia co-founder offers a Facebook/Twitter wannabe
Tired of being a tracked, ad-bedeviled product sold by social media companies? The cost to immediately join a network with no tracking/ads: $12.99/month.
β Two men busted for hijacking victimsβ phones and email accounts β
π Read
via "Naked Security".
Prosecutors allege that Meiggs and Harrington took over their targets' mobile phone and email accounts via SIM-swapping.π Read
via "Naked Security".
Naked Security
Two men busted for hijacking victimsβ phones and email accounts
Prosecutors allege that Meiggs and Harrington took over their targetsβ mobile phone and email accounts via SIM-swapping.
β GitHub launches Security Lab to boost open source security β
π Read
via "Naked Security".
The idea is simple β create a global platform for reporting and fixing vulnerabilities in open source projects before they do damage.π Read
via "Naked Security".
Naked Security
GitHub launches Security Lab to boost open source security
The idea is simple β create a global platform for reporting and fixing vulnerabilities in open source projects before they do damage.
β NSA wonβt collect phone location data, promises US government β
π Read
via "Naked Security".
US intelligence agencies wonβt harvest US residentsβ geolocation data in future investigations, revealed the US government this month.π Read
via "Naked Security".
Naked Security
NSA wonβt collect phone location data, promises US government
US intelligence agencies wonβt harvest US residentsβ geolocation data in future investigations, revealed the US government this month.
π΄ New: Everything You Always Wanted to Know About Security at the Edge But Were Afraid to Ask π΄
π Read
via "Dark Reading: ".
The secure perimeter as we know it is dissolving. So how do you protect your crown jewels when the castle has no walls?π Read
via "Dark Reading: ".
Dark Reading
The Edge
The secure perimeter as we know it is dissolving. So how do you protect your crown jewels when the castle has no walls?
β Tianfu Cup Round-Up: Safari, Chrome, D-Link Routers and Office 365 Successfully Hacked β
π Read
via "Threatpost".
White-hat hackers using never-before-seen zero days against popular applications and devices against competed at two-day gathering in Chengdu.π Read
via "Threatpost".
Threat Post
Tianfu Cup Round-Up: Safari, Chrome, D-Link Routers and Office 365 Successfully Hacked
White-hat hackers using never-before-seen zero days against popular applications and devices against competed at two-day gathering in Chengdu.
π΄ 13 Security Pros Share Their Most Valuable Experiences π΄
π Read
via "Dark Reading: ".
From serving as an artillery Marine to working a help desk, a baker's dozen of security pros share experiences that had the greatest influence on their careers.π Read
via "Dark Reading: ".
Darkreading
13 Security Pros Share Their Most Valuable Experiences
From serving as an artillery Marine to working a help desk, a baker's dozen of security pros share experiences that had the greatest influence on their careers.
β Pipka Card Skimmer Removes Itself After Infecting eCommerce Sites β
π Read
via "Threatpost".
The web skimmer has been spotted on at least 17 popular eCommerce websites, a new Visa alert warns.π Read
via "Threatpost".
Threat Post
Pipka Card Skimmer Removes Itself After Infecting eCommerce Sites
The web skimmer has been spotted on at least 17 popular eCommerce websites, a new Visa alert warns.
π΄ Quantum Computing Breakthrough Accelerates the Need for Future-Proofed PKI π΄
π Read
via "Dark Reading: ".
Public key infrastructure is a foundational security tool that has evolved to become a critical base for future advancements. Today's generation of PKI can be coupled with quantum-resistant algorithms to extend the lifespan of digital certificates for decades.π Read
via "Dark Reading: ".
Dark Reading
Quantum Computing Breakthrough Accelerates the Need for Future-Proofed PKI
Public key infrastructure is a foundational security tool that has evolved to become a critical base for future advancements. Today's generation of PKI can be coupled with quantum-resistant algorithms to extend the lifespan of digital certificates for decades.
β βWildly Differentβ Privacy Regulations Causing Compliancy Chaos β
π Read
via "Threatpost".
Threatpost talks to Anthony di Bello with OpenText, at ENFUSE 2019, about the successes and failures of security regulations, and how companies are changing as they struggle to keep up with compliancy issues.π Read
via "Threatpost".
Threat Post
βWildly Differentβ Privacy Regulations Causing Compliance Chaos
Threatpost talks to Anthony di Bello with OpenText, at ENFUSE 2019, about the successes and failures of security regulations, and how companies are changing as they struggle to keep up with compliance issues.