πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
⚠ Supermicro servers fixed after insecure firmware updating discovered ⚠

Researchers have sounded a warning about the security of Baseboard Management Controllers (BMCs) - a critical component that datacentres depend on to manage servers.

πŸ“– Read

via "Naked Security".
⚠ Apple’s new tool will make it easier for law enforcement to request data ⚠

Apple is planning to create an online portal that will allow law enforcement officials around the world to request information about its users more easily.

πŸ“– Read

via "Naked Security".
πŸ” The secret to successful cybersecurity programs? Training and automation πŸ”

Cybersecurity programs have drastically improved since 2017, according to a recent DomainTools survey. Here's how you can improve your cybersecurity GPA.

πŸ“– Read

via "Security on TechRepublic".
☒ LuckyMouse uses malicious NDISProxy Windows driver to target gov't entities ☒

The hacking group is covertly infecting Windows machines with Trojans by way of stolen certificates belonging to a Chinese security company.

πŸ“– Read

via "Latest topics for ZDNet in Security".
☒ Exploit vendor drops Tor Browser zero-day on Twitter ☒

A company that sells exploits to government agencies drops Tor Browser zero-day on Twitter after recent Tor Browser update renders exploit less valuable.

πŸ“– Read

via "Latest topics for ZDNet in Security".
☒ iPhone XS: The one reason I won't buy in ☒

One of the most highly touted breakthroughs of the iPhone X--and soon to be the iPhone XS--is also its biggest drawback in usability and productivity.

πŸ“– Read

via "Latest topics for ZDNet in Security".
❌ Mirai, Gafgyt Botnets Return to Target Infamous Apache Struts, SonicWall Flaws ❌

By implementing the "Equifax bug," it's the first known time a Mirai IoT botnet variant has targeted an Apache Struts vulnerability.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ•΄ DevOps Demystified: A Primer for Security Practitioners πŸ•΄

Key starting points for those still struggling to understand the concept.

πŸ“– Read

via "Dark Reading: ".
πŸ” Why that email from your boss could be a scam waiting to happen πŸ”

Impersonation fraud is on the rise, and SMBs lose an average of $35,000 to these attacks, according to Lloyds Bank.

πŸ“– Read

via "Security on TechRepublic".
πŸ” How to improve citizen communication with state governments? Digital interaction πŸ”

Americans need more individualized and accessible digital services from their government agencies, according to a Conduent report.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ Russian National Extradited for 2014 JP Morgan Hack πŸ•΄

Andrei Tyurin was arrested for his involvement in a hacking campaign targeting US financial institutions, financial news publishers, brokerage firm, and other companies.

πŸ“– Read

via "Dark Reading: ".
☒ Ransomware campaign targets businesses with fake invoice message ☒

Locky ransomware was once of the most prolific forms of ransomware - a new 'PyLocky' ransomware campaign by attempting to piggyback on its past success.

πŸ“– Read

via "Latest topics for ZDNet in Security".
ATENTIONβ€Ό New - CVE-2016-7078

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2016-7077

foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2016-7075

It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2016-7071

It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2016-7067

Monit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host or disable/enable monitoring for a specific service.

πŸ“– Read

via "National Vulnerability Database".
❌ Apple Finally Boots Sneaky Adware Doctor App from Mac App Store ❌

Hours after researchers publicly disclosed an app that was caught stealing and uploading browser history data, Apple removed it from the Mac App Store.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ•΄ The Equifax Breach One Year Later: 6 Action Items for Security Pros πŸ•΄

The Equifax breach last September was the largest consumer breach in history. We talked to experts about lessons learned and steps companies can take to prevent and minimize future breaches.

πŸ“– Read

via "Dark Reading: ".
❌ Tor Brings Onion Browser to Android Devices ❌

In parts of the developing world, dissidents and journalists face hostile governments and other threats -- and mobile is their only access to the internet.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ” Top 5 riskiest airport Wi-Fi πŸ”

Whatever you do, try to avoid connecting to free wifi at these airports, begs TechRepublic's Tom Merritt

πŸ“– Read

via "Security on TechRepublic".