πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ” Election hacking: The myths vs. realities πŸ”

Cris Thomas, space rogue, global strategy lead at IBM X-Force Red, discusses the myths and realities of hacking election machines with CNET's Dan Patterson.

πŸ“– Read

via "Security on TechRepublic".
⚠ Self driving cars learn (from us) about who to sacrifice in a cash ⚠

It's bad news for overweight, elderly, male jaywalkers.

πŸ“– Read

via "Naked Security".
ATENTIONβ€Ό New - CVE-2018-0735

The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2016-10734

ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2016-10733

ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2016-10732

ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2016-10731

ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ AppSec is Dead, but Software Security Is Alive & Well πŸ•΄

Application security must be re-envisioned to support software security. It's time to shake up your processes.

πŸ“– Read

via "Dark Reading: ".
πŸ” How cybersecurity is developing to combat Russian hackers πŸ”

Leo Taddeo, chief information security officer at Cyxtera Technologies, discusses phishing and Russia's involvement in the 2016 US presidential election with CNET's Dan Patterson.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ Windows Defender: First Full Antivirus Tool to Run in a Sandbox πŸ•΄

Sandboxed version now available to Windows Insiders and anyone else who force-enables it in Windows 10 version 1703 and above.

πŸ“– Read

via "Dark Reading: ".
❌ X.Org Flaw Allows Privilege Escalation in Linux Systems ❌

The issue impacts many large distros with GUI interfaces.

πŸ“– Read

via "The first stop for security news | Threatpost ".
❌ Nation-State Phishing: A Country-Sized Catch ❌

Sophisticated nation-state groups now integrate phishing as a core component of their statecraft.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ•΄ 7 Ways an Old Tool Still Teaches New Lessons About Web AppSec πŸ•΄

Are your Web application secure? WebGoat, a tool old enough to be in high school, continues to instruct.

πŸ“– Read

via "Dark Reading: ".
❌ Girl Scouts Issues Data Breach Warning to 2,800 Members ❌

Someone gained access to an email account for the Orange County chapter, which was rife with personal data.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ•΄ Protect DNS, Protect business πŸ•΄

DNS plays a critical role in every network. However, it is often overlooked by many security solutions and not integrated into cyber hygiene programs, leaving an easily-accessed back door open for criminals into many networks.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2017-18281

A bool variable in Video function, which gets typecasted to int before being read could result in an out of bound read access in all Android releases from CAF using the linux kernel

πŸ“– Read

via "National Vulnerability Database".
❌ IoT Flaw Allows Hijacking of Connected Construction Cranes ❌

An attacker can send spoofed commands to the crane's controller.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ•΄ New Report: IoT Now Top Internet Attack Target πŸ•΄

IoT devices are the top targets of cyberattacks -- most of which originate on IoT devices, new report finds.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Security Implications of IBM-Red Hat Merger Unclear πŸ•΄

But enterprises and open source community likely have little to be concerned about, industry experts say.

πŸ“– Read

via "Dark Reading: ".
⚠ China hijacking internet traffic using BGP, claim researchers ⚠

Researchers claim that unusual BGP routing changes are actually man-in-the-middle surveillance.

πŸ“– Read

via "Naked Security".
πŸ” How cybersecurity is developing to combat Russian hackers πŸ”

Leo Taddeo, chief information security officer at Cyxtera Technologies, discusses phishing and Russia's involvement in the 2016 US presidential election with CNET's Dan Patterson.

πŸ“– Read

via "Security on TechRepublic".