The freshest blend of the latest security news
|
IT Security News Security in Mainstream Media Social Media |
Tools Exploits Vulnerabilities |
Security Videos & Podcasts Security Blogs Other Stuff |
Colour scheme |
IT Security News
PacketStorm
Hacker Banner Ads Are Totally Wild
70% Of Americans Worried About Holiday Shopping Identity Theft
Were Taylor Swift Fans Tracked At Her Gig?
Ebola Outbreak Reaches City Of 1 Million Residents
Electric Vehicle Charging Stations Open To IoT Attacks
Special Counsel Slams Michael Flynn's Criticism Of FBI Interview
Facebook Could Face Billion Dollar Fine For Data Breaches
Sextortion Gang Found To Be Behind Email Bomb Threat Spree
Facebook Exposed Up To 6.8 Million Users' Private Photos
Logitech App Security Flaw Allowed Keystroke Injection Attacks
The Register
Brazil bested by hackers, Virgin plugs hub bugs, and France surrenders… records
'Bomb threat' scammers linked to earlier sextortion campaign
Scumbag hackers lift $1m from children's charity
Stop us if you've heard this one: Facebook apologizes for bug leaking private photos
ZipRecruiter has been flying low: User email addresses exposed to unauthorised accounts
US bitcoin bomb threat ransom scam looks like a hoax say FBI, cops
US elections watchdog says it's OK to spend surplus campaign cash on cybersecurity gear
Fraudster convicted of online banking thefts using… whatever the hell this thing is
The fastest, most secure browser? Microsoft Edge apparently
'Exclusive swag' up for grabs as GitLab flings bug bounty scheme open to world+dog
Security Bloggers Network
DerbyCon 2018, Adam Compton’s ‘Hillbilly Storytime: Pentest Fails’
Bogus Bomb Threats Demand Bitcoin Disrupt Businesses
Hackers are our society’s immune system – Keren Elazari on the future of Cybersecurity
The Joy of Tech®’s ‘Ask A Stupid Question’
DerbyCon 2018, Adam Reiser’s ‘Living Off The Land: Enterprise Post-Exploitation’
Want a More Secure, More Effective Cloud? Watch Your Machine Identities.
APKLAB.io Discovers Patche Netflix Fake App Scam | Avast
Next Generation Microsoft® Active Directory®
Elinor Mills on Security 20 Years After L0pht Heavy Industries Testified Before Congress
WordPress 5.0 Gets Security Patch a Week After Release
ThreatPost
Electric Vehicle Charging Stations Open to IoT Attacks
WordPress 5.0 Patched to Fix Serious Bugs
Facebook Flaw Exposes Private Photos for 6.8M Users
Logitech Keystroke Injection Flaw Went Unaddressed for Months
Save the Children Federation Duped in $1M Scam
Bomb Threat Bitcoin Demands Cause Disruption, Evacuations
Grammarly Launches Public Bug Bounty Program
Secure Critical Infrastructure Top of Mind for U.S.
Google Beefs Up Android Key Security for Mobile Apps
Shamoon Reappears, Poised for a New Wiper Attack
ISC SANS
Bombstortion?? Boomstortion??, (Fri, Dec 14th)
ISC Stormcast For Friday, December 14th 2018 https://isc.sans.edu/podcastdetail.html?id=6294, (Fri, Dec 14th)
Phishing Attack Through Non-Delivery Notification, (Thu, Dec 13th)
ISC Stormcast For Thursday, December 13th 2018 https://isc.sans.edu/podcastdetail.html?id=6292, (Thu, Dec 13th)
Yet Another DOSfuscation Sample, (Wed, Dec 12th)
ISC Stormcast For Wednesday, December 12th 2018 https://isc.sans.edu/podcastdetail.html?id=6290, (Wed, Dec 12th)
Microsoft December 2018 Patch Tuesday, (Tue, Dec 11th)
Announcing the Security Awareness Survey, find it at https://survey.sans.org/jfe/form/SV_4UZfNorPzzXlfr7, (Tue, Dec 11th)
ISC Stormcast For Tuesday, December 11th 2018 https://isc.sans.edu/podcastdetail.html?id=6288, (Tue, Dec 11th)
ISC Stormcast For Monday, December 10th 2018 https://isc.sans.edu/podcastdetail.html?id=6286, (Mon, Dec 10th)
digitalmunition
Seedworm APT Group targeted more than 130 victims in 30 organizations since Sept
Celerystalk – An Asynchronous Enumeration and Vulnerability Scanner
Group-IB identifies leaked credentials of 40,000 users of government websites in 30 countries
Knock v.4.1.1 – Subdomain Scan
Security Culture
Jackhammer – One Security Vulnerability Assessment/Management Tool To Solve All The Security Team Problems
Experts at Yoroi – Cybaze Z-Lab analyzed MuddyWater Infection Chain
Osweep – Don’t Just Search OSINT, Sweep It
Fileless malware surge, warns Malwarebytes report
Hayat – Auditing & Hardening Script For Google Cloud Platform
eHacking News
Trade Secrets of GM, Tesla, Volkswagen,Toyota Out In Open
DNS rebinding rerun haunts cyber world
A Botnet Compromises 18,000 Huawei Routers
Ukraine Police Detain Hacker Who Distributed A Crypto-Mining Malware
Hackers account for 90% of login attempts at online retailers
Tech titan discloses new vulnerabilities
Child sex abuse inquiry fined £200,000 for disclosing victims
Ubisoft games hit by DDoS atacks
US' Largest Medical Laboratory Shut Down Its System Over Data Breach Fear
DanaBot Trojan steals sensitive information of bank customers
Wired - Security
Taylor Swift's Facial Recognition, the Year's Worst Passwords, and More Security News This Week
Facebook Exposed 6.8 Million Users' Photos to Cap Off a Terrible 2018
At a New York Privacy Pop-Up, Facebook Sells Itself
Nationwide Bomb Threats Look Like New Spin on an Old Bitcoin Scam
Facebook Bug Bounty Program Makes Biggest Reward Payout Yet
9 Trumpworld Figures Who Should Fear Mueller the Most
If China Hacked Marriott, 2014 Marked a Full-on Assault
Google+ Exposed Data of 52.5 Million Users and Will Shut Down in April
Quora Hacked, Moscow Ransomware, and More Security News This Week
Manafort and Cohen Sentencing Documents Put Donald Trump in Spotlight
Security in Mainstream Media
Google News Hacking
One vital step you must take now to protect your online accounts from hackers and scammers - Komando
Tokyo Based BTC Exchange CFO Sentenced - Cyber Security News
Brazil bested by hackers, Virgin plugs hub bugs, and France surrenders… records - The Register
Teesside is prime hotspot for computer hackers as police struggle to fight cybercrime - Gazette Live
Mandi Bahauddin man loses quarter of a million in alleged ATM hacking incident - DAWN.com
W-B man gets probation for hacking Leighton's emails - Citizens Voice
Anonymous Hackers Expose UK Plans to Mine Sevastopol Days Before Crimea Vote - Sputnik International
Become a Hacking Expert With This Bundle - Inverse
How to Protect Your Instagram Account from Being Hacked - The Frisky
Security of French government websites challenged after webpage hacked - Big News Network
Google Cyber Security
Become a Cybersecurity Expert with This Extensive Bootcamp Bundle - XDA Developers
T-Hub, Merck invite applications for IoT, cybersecurity hackathon ‘Hack2Hire’ - The News Minute
JMU launches cybersecurity basics course designed for managers - Augusta Free Press
Aramco and Raytheon to set up cyber-security joint venture - The National
Saudi Aramco, Raytheon in deal to set up cybersecurity JV - Trade Arabia
Future Trends in Cybersecurity Industry - CIOReview
Seven South Dakota National Guard Soldiers are leaving for over a year-long cybersecurity mission - Kotatv
KIDS AND MONEY: Cyber-security lessons are vital for children - Herald & Review
Audit finds cyber vulnerabilities in US missile defense system - NavyTimes.com
Chinese Hackers Breach U.S. Navy Contractors - Wall Street Journal
Social Media
Digg - Hack
Digg - Security
Slashdot - Rights
Saint Louis University Is Outfitting Student Living Spaces With Thousands of Echo Dots
'Americans Own Less Stuff, and That's Reason To Be Nervous'
Stolen Android Anti-Piracy Software Dumped On Github
Volkswagen's CEO Was Told About Emissions Software Months Before Scandal, Says Report
Does Gmail's 'Confidential Mode' Go Far Enough?
HUD Files Complaint Alleging Facebook Ad Tools Allow Housing Discrimination
Egypt Fights Terrorism By Censoring Web Sites, Threatening Jail Time For Accessing Them
Australians Who Won't Unlock Their Phones Could Face 10 Years In Jail
H-1B Visa Use Soared Last Year At Major Tech Firms
EU Accepts Resolution Abolishing Planned Obsolescence, Making Devices Easier to Repair
DZone Security
5 Reasons Why SSL Certificate Is Important for Your Website
An Avoidable Breach That Could Happen to Any Organization
Top Global Security Threats for 2019
Using OpenSSL With libuv
How AppSec Reduces Unplanned Work
Security 2019 Predictions (Part 8)
What Is SNI and How Does It Work?
Security 2019 Predictions (Part 7)
How to Configure Passwords With Spring Security
OpenSSL Moves to Apache 2.0 Software License
Social Media > Reddit
Reddit - NetSec
Crash Chrome 70 with the SQLite Magellan bug
Hosting malicious payloads on Youtube
Magellan - SQLite Remote Code Execution Vulnerability
SQLite and Chromium RCE
phpMyAdmin (AllowArbitraryServer) Arbitrary File Read Vulnerability
NoNameCon 2019 Call for Talks and Workshops
Bypassing Firebase client-side authorization to create custom app.goo.gl subdomains
How I got a $3k bug bounty from Twitter
Exploiting XXE with local DTD files. Get output from your blind XXE.
Binder transactions in the bowels of the Linux Kernel
Reddit - AskNetSec
Reddit - Cyberpunk
I need a name for my cyber punk character. She’s a cyborg that only loves her tamagotchi and smoking meth.
For Those Looking For Wearable Display, Vufine Wearable Display Is On Sale at Lowest Price Ever
[fan art] Blade Runner 2049: N8PSD32974 - Nowhere To Run
I think this belongs here, it's called "light pillars". (Qinghai, China)
Anyone know what magazine this is? (From Hackers 1995)
Putting together an Employee Orientation for our first gaming session
317?????? Where did u SHIT fuckers come from
ARA - Bridge Work by fluffkevlar
Made this AI logo for the great East Asian corporation chain
Diabetics Are Hacking Their Own Insulin Pumps
Reddit - Crypto
I really need some help
Is it correct that quantum computers could break Ed25519 using Shor's?
secp256k1 benchmark on Mac OS
Join first time mega Airdrops
What type of Cipher is this? (Key of Skeleton, Steven Wilson's Hand. Cannot. Erase.)
Decryption that can be done only in a finite amount of time.
How to best deal with crypto volatility
[Q] Solve a*x = b (mod N) with GCD(a,N)≠1 and GCD(a,N) divides b
Reddit - Lockpicking
First open with a gun 🙂
1100 done and done. Now to get her on film...used a home made TOK wrench with it as well
White Belt....here I come. 2 locks/2 opens
I counter-counter-raise your car key. here's my truck key
Security Pin Series Ep.8 - "Kerberos" Security Pin
9th Annual Lancaster Lock Show (July 13-14, 2018)
Kwikset Smartkey (Generation 3) Pick and Gut + Tool
Reddit - Malware
Crypto Illegal Mining Beating Ransomware as Top Cyber Threat
Magellan RCE flaw in SQLite potentially affects billions of apps
AZORult: A deep dive into how the information-stealing malware works
Cybercriminals Use Malicious Memes that Communicate with Malware
Logitech app security flaw allowed keystroke injection attacks
Endpoint detection and response for dummies
Cobalt Group: 2018 Threadkit Updates
Popular JavaScript Library for Node.JS Infected With Malware to Empty Bitcoin Wallets
Can you predict which Windows PC will be infected with malware?
Defending against zero-day malware attacks
Reddit - Netsec Students
Free 80-page PDF eBook on pivoting/tunneling/port forwarding for students - 50% off discount code for non-students through 2018
Reposted: Anybody buy a Shodan account for Black Friday?
Is the OSCP outdated?
I finally finished my latest video... sorry for the delay! This ones on SQL Injection... Hope you find it useful!
Anybody buy a Shodan account for First Friday?
Weekly Progress Thread
Another Free PDF eBook: Applied Network Security (registration required)
What are some good security sites/blogs to read daily?
Integer Overflow - How Does it work?
CBC Web Auth
Reddit - Onions
Its for the memes man!
What would you look for in a marketplace?
Mhm, any carding sites?
Was Tapiin taken down?
RUSSIAN SITES EVERYWHERE (DARK WEB BROWSING)
Deposit your coins, for new ones
My country opens all mail unless it's only paper, strict customs and intelligence
help me
Downloaded something while using tor, first time browsing, what do I do now?
Newbie Tuesdays - Don't know where to start? Worried about your security? Other questions? Post in here!
Reddit - Privacy
Signal Devs aren't afraid.
Looking for an email provider for 2 custom domains, "+" aliases ala gmail, and calDAV. Any recommendations?
Is there any way that I can make and receive GSM phone calls without a SIM card using a computer connected to the internet?
Guide: Protect against mouse movement and typing speed tracking
Stable and Good Password Manger except Dashlane?
is this web based video calling website safe?
Guaranteed Guides {Updated}
Guaranteed Guides{Update!}
Facebook's privacy problems: a roundup
Let's have some good news in here – The Correspondent, a privacy-conscious journalism platform, just raised a record-shattering $2.6 million!
Reddit - Pwned
Getting nutmeg
Companies with data breaches in 2018
Ususjsjd
Australian Government National Health Practitioner Ombudsman and Privacy Commissioner leaks database
"Have I been Pwned" V3 passwords 95% cracked on Hashes.org
MyEtherWallet HOLA VPN Compromised
Hackers caught selling access to airport security systems for $10
Macy’s, Bloomingdales Alert Online Customers of Data Breach
Compromising User Account- ”How I was able to compromise user account via HTTP Parameter Pollution(HPP) in Indian Online Shopping Website”
I think I experienced a cyber crime while employed in a major sports league and need help understanding what happened.
Reddit - Reverse Engineering
Reddit - Security CTF
machine learning model, game boy and obfuscated powershell
Newly Published CTF writeups
Recently Published CFTs Writeup
LazySysAdmin: 1 Walkthrough
Reddit - Social Engineering
Using touch to make someone like you?
The ONE Secret To Getting Any Girl
How to Influence Group Behavior in a Practical Manner
What's the best way to approach any kind of workplace when anyone can just get fired just like a switch?
How to Influence Group Behavior in a Practical Manner
How to Influence Group Behavior in a Practical Manner
Is Technology Too Easy To Use?
What’s the best way to prevent my friend from telling the same story again?
How to Defend Yourself Against Malicious Video Edits
How will society change in the next ten years?
Reddit - Sysadmin
How do you secure your private keys?
Bitlocker on Hyper V VM - how to move?
Windows Server 2029
How do you prevent Candy Crush on Windows 10 Pro 1803 from installing if the app is never provisioned in the first place on first logon?
Reddit - Bitcoin
Reddit - CryptoCurrency
Binance Labs Launches 8 New Blockchain Projects
New way to spread adoption
This crash is will kill crypto... hmmm ... where have I heard that before?
Bitcoin Scammers Are Threatening to Set Off Bombs Around the World
Everyone is screamig 1k 2k btc price, doesnt this sound the same when everyone was screaming above 20k during ath?
MY Crypto Story
BCH is swirling the toilet bowl
This guy posted 3 months ago, nobody took him seriously, and now hes caking with a 25x short.
What the hell does this mean
Ethereum [ETH] is not dying, Consensys reveals numbers behind Ethereum
Reddit - VPN
Can it be safe to pirate without a VPN?
Zattoo Restrictions Abroad
VPN at work?
watching Netflix with VPN question (updated)
Online winnings
Can VPN admin see my geographical location from where I've started VPN?
VPN to Secure Hotel and Public Wifi
Is X-VPN Legit?
OK to buy VPN with Credit Card for Simple Compartmentalization
Looking for current ways to purchase non-US VPN service anonymously while in the US.
Tools
CyberPunk nowhere.net
Framework for Rogue Wi-Fi Access Point Attack: WiFi-Pumpkin
A Post-Exploitation Scanning/Mapping Tool: Scavenger
Kernel-Mode Rootkit Hunter: Tyton
Tools for capturing and analyzing keyboard input paired with microphone capture
Powershell Script for Enumerating Vulnerable DCOM Applications: DCOMrade
VPN Connection Types and Security Checkups
Track People on the Internet: trape
The Incident Response Tracking Application: DFIRTrack
Endpoint for Out-of-Band Exfiltration: Arecibo
Asynchronous Target Enumeration Tool: bscan
Exploits
Packet Storm Exploits
Exploit-DB Webapps
[webapps] Zimbra 8.6.0_GA_1153 - Cross-Site Scripting
[webapps] MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting
[webapps] MyBB Like Plugin 3.0.0 - Cross-Site Scripting
[webapps] TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Remote Reboot)
[webapps] TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Information Disclosure)
[webapps] LG-Ericsson iPECS NMS 30M - Directory Traversal
[webapps] osTicket 1.10.1 - Arbitrary File Upload
[webapps] OpenEMR < 5.0.1 - Remote Code Execution
Exploit-DB Local and Privilege Escalation
[local] ADB Broadband Gateways / Routers - Local Root Jailbreak
[local] ADB Broadband Gateways / Routers - Privilege Escalation
[local] Boxoft WAV to MP3 Converter 1.1 - Buffer Overflow (Metasploit)
[local] Enhanced Mitigation Experience Toolkit (EMET) - XML External Entity Injection
[local] Dell EMC RecoverPoint < 5.1.2 - Local Root Command Execution
[local] Nikto 2.1.6 - CSV Injection
[local] Pale Moon Browser < 27.9.3 - Use After Free (PoC)
[local] Audiograbber 1.83 - Local Buffer Overflow (SEH)
[local] Redis-cli < 5.0 - Buffer Overflow (PoC)
Exploit-DB Shellcode
[shellcode] Linux/x86 - Bind (4444/TCP) Shell (/bin/sh) + IPv6 Shellcode (100 bytes)
[shellcode] Linux/x64 - Reverse (::1:1337/TCP) Shell (/bin/sh) + IPv6 + Password (pwnd) Shellcode (115 bytes)
[shellcode] Linux/ARM - Bind (1234/TCP) Shell (/bin/sh) Shellcode (104 bytes)
[shellcode] Linux/x86 - Kill Process Shellcode (20 bytes)
[shellcode] Linux/x86 - Execve /bin/cat /etc/passwd Shellcode (37 bytes)
[shellcode] Linux/ARM - Egghunter (0x50905090) + execve('/bin/sh') Shellcode (60 bytes)
[shellcode] Linux/x86 - Egghunter (0xdeadbeef) + access() + execve(/bin/sh) Shellcode (38 bytes)
[shellcode] Linux/x86 - Bind (4444/TCP) Shell (/bin/sh) Shellcode (105 bytes)
[shellcode] Linux/ARM - Egghunter (x50x90x50x90) + execve('/bin/sh') Shellcode (32 bytes)
[shellcode] Linux/x86 - Bind (5555/TCP) Shell Shellcode (98 bytes)
Exploit-DB Papers
[papers] [Hebrew] Digital Whisper Security Magazine #93
[papers] [Hebrew] Digital Whisper Security Magazine #92
[papers] [Hebrew] Digital Whisper Security Magazine #95
[papers] [Hebrew] Digital Whisper Security Magazine #94
[papers] [Hebrew] Digital Whisper Security Magazine #97
[papers] [Hebrew] Digital Whisper Security Magazine #96
[papers] Protecting apps against Jailbreaking and Rooting
[papers] File Upload Restrictions Bypass
[papers] VLAN Hopping Attack
[papers] Abusing Kerberos - Kerberoasting
Exploit-DB Remote
[remote] WebKit - not_number defineProperties UAF (Metasploit)
[remote] CyberArk < 10 - Memory Disclosure
[remote] Git < 2.17.1 - Remote Code Execution
[remote] CloudMe Sync < 1.11.0 - Buffer Overflow (SEH) (DEP Bypass)
[remote] Bitmain Antminer D3/L3+/S9 - Remote Command Execution
[remote] D-Link DSL-2750B - OS Command Injection (Metasploit)
[remote] mySCADA myPRO 7 - Hard-Coded Credentials
[remote] HPE iMC 7.3 - Remote Code Execution (Metasploit)
[remote] Nanopool Claymore Dual Miner 7.3 - Remote Code Execution
[remote] Jenkins CLI - HTTP Java Deserialization (Metasploit)
Vulnerabilities
Security Focus Vulnerabilities
More rss feeds from SecurityFocus
Bugtraq: [CVE-2018-12584] Heap overflow vulnerability in reSIProcate through 1.10.2
Bugtraq: [SECURITY] [DSA 4267-1] kamailio security update
Bugtraq: [SECURITY] [DSA 4269-1] postgresql-9.6 security update
Bugtraq: [SECURITY] [DSA 4268-1] openjdk-8 security update
Vuln: Geutebrück GmbH E2 Series IP Cameras CVE-2018-19007 OS Command Injection Vulnerability
Vuln: Google Chrome Prior to 71.0.3578.80 Multiple Security Vulnerabilities
Vuln: FreeBSD Network File System Multiple Security Vulnerabilities
Vuln: QEMU CVE-2018-16867 Directory Traversal Vulnerability
Vuln: Pixar Tractor CVE-2018-5411 HTML Injection Vulnerability
Bugtraq
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0009
[SECURITY] [DSA 4354-1] firefox-esr security update
[security bulletin] MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access
[security bulletin] MFSBGN03837 rev.1 - Network Node Manager i, Multiple Vulnerabilities
[slackware-security] mozilla-firefox (SSA:2018-345-01)
Zoho ManageEngine OpManager 12.3 before Build 123237 has XSS via the domainController API.
[SECURITY] [DSA 4353-1] php7.0 security update
[slackware-security] php (SSA:2018-341-01)
[SECURITY] [DSA 4352-1] chromium-browser security update
[SECURITY] [DSA 4351-1] libphp-phpmailer security update
Full Disclosure
Tracking Linux Kernel Vulnerabilities
YSTS 13th Edition - CFP
GNU inetutils <= 1.9.4 telnet.c multiple overflows
Mikrotik RouterOS telnet arbitrary root file creation 0day
CVE-2018-7691 | The SSC REST API contains Insecure Direct Object Reference (IDOR) vulnerabilities
CVE-2018-7690 | The SSC REST API contains Insecure Direct Object Reference (IDOR) vulnerabilities
Zoho ManageEngine OpManager 12.3 before Build 123237 has XSS via the domainController API.
Dynamic Loader Oriented Programming - Wiedergaenger PoC (Proof of Concept) on Ubuntu 16.04.5 LTS - 2018
Vmware airwatch feature
[CFP] Security BSides Ljubljana 0x7E3 | March 16, 2019
Security Videos & Podcasts
Security Tube
[News] Apple, Facebook, Twitter hacks said to hail from Eastern Europe
[News] Botnet master abuses Facebook for pocket money, researchers reveal
[News] Apple Breached by Facebook Hackers Using Java Exploit
[News] New Mac malware opens secure reverse shell
[News] US: China hacking 'repeatedly raised at highest level'
[News] Why encryption doesn't solve the data sovereignty debate
[News] Biometric USB password key worthy of 'Mission: Impossible'
[News] Apple patches the Java hole its own developers fell into - eventually
[News] Firefox 19 Fixes HTTPS Phishing Issue, Adds Built-In PDF Viewer
GrrCon 2017 - Threat Intelligence: Zero to Basics in presentation
Hak5
Security Weekly
Taylor Swift, KringleCon, & 3D Head – Paul’s Security Weekly #586
Don Murdoch, Regent University Cyber Range – Paul’s Security Weekly #586
Ed Skoudis, Counter Hack Challenge – Paul’s Security Weekly #586
Minerva, Rapid7, & Venafi – Enterprise Security Weekly #119
John Bradshaw, Acalvio – Enterprise Security Weekly #119
Kubernetes, Firefox, & WordPress – Application Security Weekly #43
NotPetya, Phishing, & Google+ – Hack Naked News #200
Leadership & Communication – Business Security Weekly #110
Brian Carey, Rapid7 – Business Security Weekly #110
Chris Elgee, Counter Hack Challenge – Application Security Weekly #43
Risky.Biz
Risky Business #524 -- Huawei CFO arrested, US Government dumps on Equifax
Snake Oilers 8 part 2: Forticode's Cipherise, device features from Exabeam and SentinelOne on "active EDR"
Risky Business #523 -- So many breaches
Snake Oilers 8 part 1: Rapid7's InsightAppSec, WhiteSource and Virus Total Enterprise
Risky Business #522 -- Alex Stamos co-hosts the show, reflects on Snowden disclosures
Risky Biz Soap Box: MITRE ATT&CK Matrix, misconfigured security controls, attack sim and more!
Risky Business #521 -- Bears everywhere
Risky Business #520 -- Tanya Janca talks security in the curriculum
Risky Biz Soap Box: Duo's Olabode Anise recap's his Black Hat talk on Twitter bots
Risky Business #519 -- '90s IRC war between US and Russia intensifies
The CyberWire
Fancy Bear bogus sites taken down. Some in the US Congress think they want hack-back laws. Cyber and sanctions. Operation Red Signature. Doxing Chinese Intelligence. Buggy medical devices.
Beers with Talos — Live from the RiRa at Black Hat
DarkHotel is back. So is Necurs, and it's distributing a modular malware dropper. Industrial espionage follows international trade. Election meddling. The use and abuse of data.
Stealthy ad fraud campaign evades detection. — Research Saturday
Election risks—hacking and influence. Chinese industrial espionage spike. Misconfigured project management. Necurs appears briefly. Bogus Fortnite downloads. What they heard in the banya.
Hacking Old Man River. Nation-state cyber conflict: objectives and norms of behavior. Australia's new cyber laws. ATM campaign. Lawsuits, and the Dread Pirate Robert asks for pardon.
Notes on patching. Foreshadow speculative execution vulnerability. Influence operations. The FBI's new cyber chief. Are stickers a temptation to thieves, hackers, and customs officers?
Cryptowars notes. DDoS in Finland. Bears aren't under the beds; they're in the routers. Smart city attack surfaces. Sanction notes. Training through puzzle-solving .
Spyware for states and spouses. Election hacking demos. New ransomware strains, and a clipper for Android. Airline Wi-Fi is not only irritating, but insecure as well.
Rapid7 Whiteboard Wednesday
Security Blogs
Krebs on Security
Spammed Bomb Threat Hoax Demands Bitcoin
Scanning for Flaws, Scoring for Security
Patch Tuesday, December 2018 Edition
How Internet Savvy are Your Leaders?
Bomb Threat Hoaxer, DDos Boss Gets 3 Years
A Breach, or Just a Forced Password Reset?
Jared, Kay Jewelers Parent Fixes Data Leak
What the Marriott Breach Says About Security
Marriott: Data on 500 Million Guests Stolen in 4-Year Breach
Half of all Phishing Sites Now Have the Padlock
Naked Security
YouTube is reading text in users’ videos
Facebook has filed patents to predict our future locations
Kanye West tops the charts for year’s worst password pratfall
Update now! WordPress 5.0.1 release fixes seven flaws
Border agents are copying travelers’ data, leaving it on USB drives
Supermicro: We told you the tampering claims were false
WordPress worms, Android fraud and Flash fails [PODCAST]
Update now! Microsoft and Adobe’s December 2018 Patch Tuesday is here
Samsung fixes flaws that could have let attackers hijack your account
Google+ to power down early after second security hole found
Schneier on Security
Linux Security
Dark Reading
Email Bomb Threats Follow Sextortion Playbook
Iranian Hackers Target Nuclear Experts, US Officials
Who Are You, Really? A Peek at the Future of Identity
Retailers: Avoid the Hackable Holidaze
2019 Attacker Playbook
Cybercriminals Change Tactics to Outwit Machine-Learning Defense
Despite Breaches, Many Organizations Struggle to Quantify Cyber-Risks to Business
Universities Get Schooled by Hackers
Cybercrime Is World's Biggest Criminal Growth Industry
Setting the Table for Effective Cybersecurity: 20 Culinary Questions
Securing the Human
Darknet
Malcom – Malware Communication Analyzer
WepAttack – WLAN 802.11 WEP Key Hacking Tool
Eraser – Windows Secure Erase Hard Drive Wiper
Web Security Stats Show XSS & Outdated Software Are Major Problems
CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
Four Year Old libssh Bug Leaves Servers Wide Open
CHIPSEC – Platform Security Assessment Framework For Firmware Hacking
How To Recover When Your Website Got Hacked
HTTrack – Website Downloader Copier & Site Ripper Download
Securelist
Whitehat Security Blog
HITB News
Cyber-threats need smart tactics
Was your phone imaged by border agents? They may still have the data
If China Hacked Marriott, 2014 Marked a Full-on Assault
Microsoft adds Dark Mode support and more to Office 365 for Mac
A look at the Apple Watch’s ECG, from someone who needs it
Dubai to become 'global centre for innovation in cybersecurity'
China is about to launch a mission to explore the far side of the moon
Taking crypto’s pulse: ‘Price’ alone is a deceptive metric
Decision time: Choosing between the 11-inch versus the 12.9-inch iPad Pros
Microsoft says it is time for government regulation of facial recognition
TAO Security
Securiteam
SSD Advisory – iOS/macOS Safari Sandbox Escape via QuartzCore Heap Overflow
SSD Advisory – Symfony Framework forward() Remote Code Execution
SSD Advisory – Chrome AppCache Subsystem SBX by utilizing a Use After Free
SSD Advisory – Chrome Type Confusion in JSCreateObject Operation to RCE
SSD Advisory – Firefox JavaScript Type Confusion RCE
SSD Advisory – Firefox Information Leak
SSD Advisory – Cisco Prime Infrastructure File Inclusion and Remote Command Execution to Privileges Escalation
SSD Advisory – Android Printing Man in the Middle Attack
SSD Advisory – IRDA Linux Driver UAF
SSD Advisory – ASUSTOR NAS Devices Authentication Bypass
The RISKS Digest
Screen Time Changes Structure of Kids' Brains: Groundbreaking study
Re: Teen electrocuted while using headphones on plugged-in mobile phone
Starwood Hotels
Why I'm done with Chrome / A Few Thoughts on Cryptographic Engineering
U.S. border officers don't always delete collected traveler data
Marriott Data Breach Is Traced to Chinese Hackers as U.S. Readies Crackdown on Beijing
Taylor Swift tracked stalkers with facial recognition tech at her concert
The War on Truth Spreads
Barclays customers can now 'switch off' spending
Ships infected with ransomware, USB malware, worms
Forbes - Security
Kaspersky Blog
Why you should never use someone else’s Apple ID on your iPhone
Vulnerability detected in Kernel Transaction Manager
Transatlantic Cable podcast, episode 68
Online fraud: 5 most common spammer tricks
How to delete your Twitter account (and back up your tweets)
DarkVishnya attacks from inside
Transatlantic Cable podcast, episode 67
Printers gone mad
Transatlantic Cable podcast, episode 66
Why you should never reuse passwords
Adam Shostack & friends
Resources for Infosec Skillbuilding
House Oversight Committee on Equifax
Structures, Engineering and Security
Gavelblocken, 2018
Books which are worth your time: Q4
Threat Modeling in 2018 (video release)
Change in the Weather
Airline Safety
Podcast with Ron Woerner
Privacy Extension to Elevation of Privilege game
Graham Cluley
Hackers phish Butlin’s holiday camp chain, access customers’ personal data
Flaw exposed Comcast Xfinity customers’ partial home addresses and SSNs
Smashing Security #090: Fortnite for Android, and the FCC’s DDoS BS
Snapchat’s source code leaked out, and was published on GitHub
Twitter CEO says they’re taking no action against InfoWars and Alex Jones
No, Michael J Fox isn’t dead
Making millions out of prisoners’ email
You’ll have to disable a recommended Android security setting to install Fortnite
Free eBook: If your friend was put in charge of a cyber budget, what advice would you give them?
Reddit hacked - but don’t give up on 2FA just yet
Rapid7
Metasploit Wrapup
Securing Buckets with Amazon S3 Block Public Access
Q3 Threat Report: Analyzing Three Key Detection Trends
How Rapid7 Researchers Used Data Science to Wrangle Messy WHOIS Data
Patch Tuesday - December 2018
Rapid7 Introduces Industry Cyber-Exposure Report: Fortune 500
Metasploit Wrapup
Single-Page Applications: The Journey So Far
Seeing Security Scale: Rapid7’s Recap of AWS re:Invent 2018
Did You Remediate That? New InsightVM Executive Report Provides Key Details on Team Progress
Help Wanted
Stack Overflow
Stack Exchange
Other Stuff
YCombinator
When you talk about a country you never visited, consider Paris syndrome
Today is Esperanto Day – here’s why I learned it
Pictures from the Eastern Bloc in the 80s
Streak (YC S11) Is Hiring a Site Lead for Our Vancouver Office
Fun with Unicode in Swift
String tokenization in C
Baby Gene Edits Could Affect a Range of Traits
Open source confronts its midlife crisis
Close.io Is Hiring Inbound Account Managers and a Head of Inbound Sales (remote)
Crash Chrome 70 with the SQLite Magellan Bug
Lobste.rs
Hackaday
Young Entrepreneurs Learn What Really Goes Into Making a Product
Bust A Move Doesn’t Have To Be Such A Grind
Reflex Trainer Puts Athletes To The Test
Build Your Own Anechoic Chamber
A Lecture By A Fun Guy
Lessons Learned From A 1-Day RTL-SDR Enclosure Project
Vintage Plotter Turned Fruit Spectrometer
Arduino-Powered Rocket Test Stand
Scott Swaaley On High Voltage
Dexterity Hand is a Configurable Prosthetic Hand
Ars Technica
Signal app to Australia: Good luck with that crypto ban
Computing pioneer Evelyn Berezin died this week—she should be remembered
KeyForge: The red-hot card game where every deck is unique—and unchangeable
Ebola outbreak reaches city of 1 million residents
Hyundai finally gives us a price for the 2019 Kona EV—$29,995
Formula E starts season 5 in Saudi Arabia with a faster electric race car
“We’re sorry,” Facebook says, again—new photo bug affects millions
Get your binge on: Season 3 of sci-fi gem Travelers is out now
Discord Store to offer developers 90 percent of game revenues
Blizzard shifts developers away from Heroes of the Storm
Wired
Space Photos of the Week: It’s Love vs. Hate in Star vs. Star
‘The Endless’ Is a Masterful Low-Budget Sci-Fi Movie
Amazon Echo Review: Which Echo or Alexa Speaker is Best?
Barry Jenkins' New Movie and the Future of Black Filmmaking
The Best Sales on Xbox, PS4, and Switch for Christmas 2018
Zoox's Maddening Struggle to Make Robo-Cars Safe—and Prove It
Amazon Came to the Bargaining Table—But Workers Want More
Lin-Manuel Miranda's Hogwarts House? Slytherin, Naturally
Gadget Lab Podcast: Climate Change and Cognitive Dissonance
Slashdot
To Gain Foothold in India, Apple Plans To Open Stores, Offer Deals All Year Around, and Fix Services: Report
Children Learn Best When Their Bodies Are Engaged in the Living World. We Must Resist the Ideology of Screen-Based Learning
'Why Liberal Arts and the Humanities Are as Important as Engineering'
Security Researchers Express Concerns Over Mozilla's New DNS Resolution For Firefox
Vint Cerf on Differential Traceability on the Internet
Security World Hits Las Vegas For a Week of Hacking, Cracking, Fun
Nonmonetary Incentives and the Implications of Work as a Source of Meaning
Traders Are Talking Up Cryptocurrencies, Then Dumping Them, Costing Others Millions
Wells Fargo Says Hundreds of Customers Lost Homes After Computer Glitch
Have Smartphones Killed the Art of Conversation?
DZone
Domain-Driven Design in JavaScript
This Week in Spring: Tutorials, Releases, and the Return of Spring Tips
What Is Blazor? Your Guide to Getting Started
Divide and Conquer Creates Need for Management Control
5 Free eBooks to Help You Learn Machine Learning in 2019
Creating Magic with the CLI
5 Reasons Why SSL Certificate Is Important for Your Website
Customer Churn Analysis: Using Logistic Regression to Predict At-Risk Customers
Money Talks: A Tale of Two Change Programs
Spotlight on Helm