The freshest blend of the latest security news
|
IT Security News Security in Mainstream Media Social Media |
Tools Exploits Vulnerabilities |
Security Videos & Podcasts Security Blogs Other Stuff |
Colour scheme |
IT Security News
PacketStorm
Russian Unit, GRU Officer Linked To 2014 Shoot-Down Of Airliner Over Ukraine
FBI Agents Take Aim At VPNFilter Botnet, Point Finger At Russians
Apple Reveals Latest Government Data Demand Figures
Google And Facebook Accused Of Breaking GDPR Laws
Federal Court Rules Trump Can't Block People On Twitter
FBI Seeks To Thwart Cyber Attack On Ukraine
GDPR In Real Life: Transparency, Innovation, And Adoption Across Borders And Organizations
FBI Seizes Domain Russia Allegedly Used To Infect 500,000 Routers
Police Are Using Amazon's Face Recognition Service
Zuckerberg's European Parliament Testimony Criticized
The Register
Starbucks site slurped, Z-Wave locks clocked, mad Mac Monero mining malware and much more
Starbucks site slurped, Z-Wave locks clocked, mad Mac Monero mining malware and much more
Researchers crack open AMD's server VM encryption
Epyc fail? We can defeat AMD's virtual machine encryption, say boffins
Electron patches patch after security researcher bypassed said patch
Zimmerman and friends: 'Are you listening? PGP is not broken'
Trio indicted after police SWAT prank call leads to cops killing bloke
FBI agents take aim at VPNFilter botnet, point finger at Russia, yell 'national security threat'
London's Met Police: We won't use facial recognition at Notting Hill Carnival
Advanced VPNFilter malware menacing routers worldwide
Security Bloggers Network
The Power of Standards and Consistency
Luke Kingma & Lou Patrick-Mackay’s, ‘Self-Driving Crowd Sourced Tech Support’
BSides Detroit 2018, Brian Martinez’ ‘GRC – “What Would You Say You Do Here?”‘
Avast updates privacy policy at GDPR launch | Avast
Why Is Your Location Data No Longer Private?
Proof(s)
Mac and Android updates 26th May 2018
GDPR E-Mail Scam – How to Stop and Remove It from Your PC
The FBI Makes Accidental Argument for Why We Should All Be on Blackberry Phones
Emsisoft scores “Advanced” rating in new AV-Comparatives Performance Test
ThreatPost
Millions of IoT Devices Vulnerable to Z-Wave Downgrade Attacks, Researchers Claim
Pet Trackers Open to MITM Attacks, Interception
Alexa Eavesdropping Flub Re-Sparks Voice Assistant Privacy Debate
Attackers Cashing In On Cryptocurrency With Increased Scams
What Will GDPR’s Impact Be On U.S. Consumer Privacy?
Intel’s ‘Virtual Fences’ Spectre Fix Won’t Protect Against Variant 4
Amazon Comes Under Fire for Facial Recognition Platform
Schneider Electric Patches XXE Vulnerability In Software
James Comey: FBI Faces Deep Tech-Related Questions
Ahead of GDPR, Information Governance Comes into Its Own
ISC SANS
Antivirus Evasion? Easy as 1,2,3, (Fri, May 25th)
ISC Stormcast For Friday, May 25th 2018 https://isc.sans.edu/podcastdetail.html?id=6013, (Fri, May 25th)
"Blocked" Does Not Mean "Forget It", (Thu, May 24th)
ISC Stormcast For Thursday, May 24th 2018 https://isc.sans.edu/podcastdetail.html?id=6011, (Thu, May 24th)
Track naughty and nice binaries with Google Santa, (Wed, May 23rd)
ISC Stormcast For Wednesday, May 23rd 2018 https://isc.sans.edu/podcastdetail.html?id=6009, (Wed, May 23rd)
Malware Distributed via .slk Files, (Tue, May 22nd)
VMware Workstation and Fusion updates address signature bypass and multiple denial-of-service vulnerabilities https://www.vmware.com/security/advisories/VMSA-2018-0013.html, (Tue, May 22nd)
ISC Stormcast For Tuesday, May 22nd 2018 https://isc.sans.edu/podcastdetail.html?id=6007, (Tue, May 22nd)
VMware updates enable Hypervisor-Assisted Guest Mitigations for Speculative Store Bypass issue - https://www.vmware.com/security/advisories/VMSA-2018-0012.html, (Tue, May 22nd)
digitalmunition
AutoNSE: Massive NSE AutoSploit and AutoScanner
Deserialization vulnerabilities
Salt-Scanner – Linux Vulnerability Scanner Based On Salt Open And Vulners Audit API
Amazon Alexa eavesdropped on my private conversation and randomly shared it with your contact
Sn1per v4.4 – Automated Pentest Recon Scanner
Hacker attacked Verge Blockchain and steal $1.65 million in tokens
Archerysec – Open Source Vulnerability Assessment And Management Helps Developers And Pentesters To Perform Scans And Manage Vulnerabilities
Avast found pre-installed Cosiloon malware in devices from manufacturers like ZTE, Archos and myPhone
15 things to do to prevent DDOS attacks
Galileo – Web Application Audit Framework
eHacking News
Amazon's Alexa recorded a family’s conversation and sent it to random people
An app that uncovers privacy
Cisco Warns Of a Suspected Russian Plan to Attack Ukraine
Pirate Bay to be blocked by ISP Telenor
Facebook Wants Your Naked Photos To Combat 'Revenge Porn'
Intel finds another chip exploit
BMW preparing to counter security threats
3 new attacks by Wicked Mirai botnet
Multilingual Malware Targets Android Devices for Phishing Attacks
Beware of ZipperDown
Wired - Security
T-Mobile Web Portal Exposed 74 Million Accounts, and and More Security News This Week
Former Trump Campaign Aide: My Russia Ties Are Not Nefarious!
Don’t Freak Out About That Amazon Alexa Eavesdropping Situation
‘Significant’ FBI Error Reignites Data Encryption Debate
Stealthy, Destructive Malware Infects Half a Million Routers
Facebook Is Beefing Up Its Two-Factor Authentication
How the LAPD Uses Data to Predict Crime
After Meltdown and Spectre, Another Scary Chip Flaw Emerges
You Can Send Invisible Messages With Subtle Font Tweaks
A Mugshots.com Indictment, Lost Grenades, and More Security News This Week
Security in Mainstream Media
Google News Hacking
Elections remain vulnerable to hacking, experts say
French Teens Arrested for Hacking Vevo, Defacing Despacito Music Video
NASA is basically trying to get hacked
Hacking Marketing Teaches How Adopting the Right Software Can Grow Your Customer Base
Assange willing to testify on alleged Russian hacking
Hacked.com Weekly Webinar: May 26
Afghan diplomats in Pakistan targeted by 'state-backed hackers'
How to Get Fit Fast review – hacking your lunchbox, one tomato at a time
What do hackers know about you? AZ company will tell you for free
Two French teens arrested for hacking Taylor Swift's and Drake's music videos
Google Cyber Security
Cyber security firm brings jobs to West Michigan
AI in Cyber Security Market to Grow at an Exorbitant Pace in the Foreseeable Future: P&S Market Research
Demand for cyber security professionals was high in 2017: Indeed
5 ways deception tech is disrupting cybersecurity
Colleges unite to advance cybersecurity awareness
Trump fundraiser adds cyber security firm to Qatar lawsuit
Cybersecurity roundup: May 20 to 26, 2018
Cisco weighs cybersecurity, cloud technology deals
Social Media
Digg - Hack
Digg - Security
Slashdot - Rights
Ask Slashdot: Did Baby Boomers Break America?
Two 18-Year-Olds Charged With Hacking YouTube's Most Popular Videos
Amazon Explains Why Alexa Recorded And Emailed A Private Conversation
Gamers Behind Fatal 'SWAT' Call Now Face Life In Prison
U.S. Passes 'Right to Try' Law Allowing Experimental Medical Treatments
Microsoft Wins A Big Cloud Deal With America's Intelligence Community
Tesla Agrees To Settle Class Action Over Autopilot Billed As 'Safer'
FBI Tells Router Users To Reboot Now To Kill Malware Infecting 500,000 Devices
Zimbabwe is Introducing a Mass Facial Recognition Project With Chinese AI Firm CloudWalk
Apple Will Report Government Requests To Remove Apps From the App Store
DZone Security
Identity-as-a-Service (IDaaS) : Okta and ASP.Net Core
Kubernetes Security Best Practices
Web Application Security: Fighting Yourself or Finding the Edge of Sanity
Introduction to Hyperledger Sawtooth
Identity-as-a-Service (IDaaS) : AWS Cognito and Okta
The GDPR Is Coming! What That Means for DZone (And You)
Build a React Native Application and Authenticate With OAuth 2.0
Flux Networks
GDPR Tips and Best Practices
Domain Name Generation
Social Media > Reddit
Reddit - NetSec
mquery: Blazingly fast Yara queries for malware analysts
Announcing CERT Tapioca 2.0 for Network Traffic Analysis
Exploiting an Unsecured Dell Foglight Server
TR-069: IoT before it was cool! Analysis of TR-069 (TCP 7547) exposure and attacks over time
Electron Windows Protocol Handler MITM/RCE (bypass for CVE-2018-1000006 fix)
Z-Shave - a downgrade attack against the latest Z-Wave security standard
CVE-2018-5175: Universal CSP strict-dynamic bypass in Firefox
SSRF in Exchange leads to ROOT access in all instances
Compromising Thousands of Websites Through a CDN
Quick Manual Parse Against Known VPNFilter IP's
Reddit - AskNetSec
Reddit - Cyberpunk
Enjoy the sci-fi webcomic "Log off :: episode 18-1"
Old and new, Saigon 2018
RMIT Melbourne
Future Retro ( x-post from /r/cars )
Fragment Fiction - A crazy animation
Has anyone played Observer? What'd you guys think?
Hubrid & Billy Mays - Overdrive
This sub has become a meta circlejerk.
Is thus cyberpunk?
Backbone is a noir adventure set in dystopian retrofuturistic Vancouver
Reddit - Crypto
Can people hack based one reddit info
How to build a 8 GPU password cracker
Unlocking The Crypto Crypts
Which archive format are best suited for creating a strong encrypted archive
padding oracle
SEVered: Subverting AMD's Virtual Machine Encryption
Researchers crack open AMD's server VM encryption
SCALE, MPC successor to SPDZ, has been released
Has anyone tried to offload crypto operations to a GPU? Specifically, RSA2048-bit signatures and AES256 block encryptions.
AllSpark
Reddit - Lockpicking
Geeze /u/supallama, get a room!
6 pin ultinate adversary lock
6 pin ultimate adversary lock
Looking for challenge locks!!
I need some advice on a couple old locks
Old CL Pinned by Bobby Keyz Picked & Gutted :>
My first American picked!!! Stay tuned for the video 🙌🏻
SentrySafe X055
Made in the RSA
Canadian Pickers LockShop War!
Reddit - Malware
The Hill: FBI issues formal warning on massive malware network linked to Russia
How does one achieve this?
Unusual malware command and control examples?
An In-Depth Analysis of Samsam Ransomware and BOSS SPIDER
Windows Process Genealogy - Update (X-Post)
.net malware?
CONFICKER/ DOWNAD, 9 years and still around. Who and Why? Any ideas?
How to safely grab malware from a download site?
Brutal cryptocurrency mining malware crashes your PC when discovered
Where could I find, "Rogue Antivirus" malware samples?
Reddit - Netsec Students
[video] Learn Security - Where to start a career
The Complete Guide to Cyber Security by Nathan House
Hands-on practice with Drupalgeddon2, plus many more real-world vulnerabilities and techniques to learn from
How I Prepared for the OSCP!
[video] Learn Security - Back Sliding
Added section for certification advice to my site
Поле труд любит.
Changing Lanes
[video] Learn Security - Simplifying Disaster Recovery
Is an Information Systems / Management of Information Systems degree a viable path into netsec / infosec career?
Reddit - Onions
High Grade Cannabis
What is the real Silk Road link
I Made a New Deep Web Video. I love you guys so much.
Looking to get Incriminate stuff on politicians
Searching for programming/coding chat rooms
Buy Original,Passport,id cards,Visa,Drivers License,Toefl,Ielts,Toeic,Celta, GRE,GMAT,PTE certificates(whatsapp --- +237676237534)
Cheap consoles
The most trusted online bulk seller in the world
High Grade Cannabis
Pickle Engine Link As Requested
Reddit - Privacy
#20: Fridge, meet GDPR
Maidsafe announces new consensus mechanism called PARSEC
Privacy Policy Protection
Ultrasound-firewall for mobile phones: Defence against unwanted audio tracking by acoustic cookies
Ghostery Email Incident Update
Newsagents to sell ‘porn passes’ to visit X-rated websites anonymously under new government plans [UK]
FBI To America: Reboot Your Routers, Right Now
OATH's (Verizon/Yahoo/AOL) list of advertising partners not participating in the IAB's Transparency & Consent Framework
Privacy Badger update
Google is recording and storing audio from up to seconds BEFORE you say the "Ok Google" key word. See for yourself in My Activity in your Google account.
Reddit - Pwned
A teen phone spying app has leaked thousands of user passwords [x-post: /r/privacy]
The SEC created its own scammy ICO to teach investors a lesson
ZooPark, Iranian APT leaked data, Please Mirror.
Cyber attack may have exposed the personal information of 8000 Family Planning NSW clients
Card Breach Announced at Chili’s Restaurant Chain
Multiple Vulnerabilities In The Portuguese Government's "Secure" Authentication System
Hackers break into Fredericksburg school system's emails, file system
Someone Allegedly Hacked Grades at an Alabama High School and Now There's No Valedictorian
FLEETCOR Reveals Gift Card Data Breach
Twitter urges users to change passwords after computer glitch
Reddit - Reverse Engineering
Reddit - Security CTF
Safe Pass Android App CTF writeup
NorthSec 2018 - MarsAnalytica Writeup
What scripting language for CTF scripts?
Linux Offsec Club Video Walkthrough
Hacky Easter 2018 write-up
Mr-Robot: 1 ~ VulnHub - Walkthrough / blaksec.com
Online attack/defense CTF platforms? CTF365?
Stuck in Bandit level 0. (overthewire.org)
What libraries/frameworks do you use for CTFs and exploit development?
The Ether: EvilScience ~ Vulnhub CTF Walkthrough
Reddit - Social Engineering
How to Gauge When Someone’s Pushing an Agenda
How do you say "no I really don't want dinner" when group of people asked you "it's fine if you're busy now, we will wait until you're free, so when are you free?"
Anti child porn activists bust a Telegram group using social engineering
Sweden Scares Population with War Pamphlets amid Push to Join NATO
What To Do When A Coworker Dobs You In To The Boss
How to find whos been calling me?
Here is a good way that I don't recommend but a good way to get info using social authority.
Unconscious Membership in Group Structures Leads to Adoption of False Goals and Values
The Amazing Psychology of Japanese Train Stations - CityLab
Why am i addicted to my own opinion?
Reddit - Sysadmin
Looking for Unicorn: 38 certifications and 4-6 years experience required.
(Two Post) Rack Mountable PC
File Server Question Regarding VHDs
Replaced a raid card now win server wont boot
Google Drive and SMB Server
Hp EX490 with Windows Home Server
How I Work: its all about user confidence.. even if you are right!
New fiber circuit in NYC, all google results come back from google.com.mx.
Excel Specs
Degree requirements
Reddit - Bitcoin
Reddit - CryptoCurrency
Daily Discussion Megathread - May 27, 2018
Am I Doing This Right?
Tea leaves reading the crypto way
A taste of things still to come...
H O D L G A N G 💪💪💪🚀🚀🚀
Why does my flair automatically get changed here?
When the next bullrun starts, what do you think will happen?
Cryptocurrency Trading App Taylor Loses 2,500 ETH in $1.5M Hack
For the First Time, Blockchain Technology Endorsed by the U.S. Congress As “Revolutionizing”
BTC chart becoming more Bartish
Reddit - VPN
Setting a VPN for my home network.
How do u look at certain pages with a VPN?
Is this test sufficient for determining whether my killswitch works?
Visiting China for 1 Month
Set up my own vpn server using DO, but some services are still blocked. Help please
How does someone get protected by linking vpn/cloud to his own VPS?
VPNs with Proxies
Assuming a VPN is not storing your data, is there any way for them to enforce a policy banning sharing of accounts?
How to create a VPN server for commercial use?
Unsure if I have a DNS leak?
Tools
CyberPunk nowhere.net
Open Source Deception Framework: DejaVU
OWASP Joomla Vulnerability Scanner Project: JoomScan
Windows Packer Project for Defenders: DARKSURGEON
SQL Injection Discovery Tool: SleuthQL
The Empire Multiuser GUI: Empire GUI
Web Application Penetration Testing Tool: Tracy
MITM RDP Connections: Seth
Exploitation Framework for Embedded Devices: RouterSploit
Real-Time Two-Factor Phishing Tool: ReelPhish
Binary Whitelisting Blacklisting System for macOS: Santa
Exploits
Packet Storm Exploits
Exploit-DB Webapps
[webapps] Employee Work Schedule 5.9 - 'cal_id' SQL Injection
[webapps] EasyService Billing 1.0 - 'q' SQL Injection
[webapps] Ajax Full Featured Calendar 2.0 - 'search' SQL Injection
[webapps] EasyService Billing 1.0 - Cross-Site Request Forgery
[webapps] EasyService Billing 1.0 - Cross-Site Scripting
[webapps] mySurvey 1.0 - 'id' SQL Injection
[webapps] easyLetters 1.0 - 'id' SQL Injection
[webapps] Oracle WebCenter Sites 11.1.1.8.0/12.2.1.x - Cross-Site Scripting
[webapps] KomSeo Cart 1.3 - 'my_item_search' SQL Injection
[webapps] MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting
Exploit-DB Local and Privilege Escalation
[local] GNU glibc < 2.27 - Local Buffer Overflow
[local] FTPShell Server 6.80 - Buffer Overflow (SEH)
[local] Dell EMC RecoverPoint boxmgmt CLI < 5.1.2 - Arbitrary File Read
[local] MakeMyTrip 7.2.4 - Information Disclosure
[local] Linux 4.4.0 < 4.4.0-53 - AF_PACKET chocobo_root Privilege Escalation (Metasploit)
[local] Microsoft Windows - 'POP/MOV SS' Privilege Escalation
[local] Linux 2.6.30 < 2.6.36-rc8 - Reliable Datagram Sockets (RDS) Privilege Escalation (Metasploit)
[local] R 3.4.4 - Local Buffer Overflow (DEP Bypass)
[local] Microsoft Internet Explorer 11 (Windows 7 x64/x86) - vbscript Code Execution
[local] Easy MPEG to DVD Burner 1.7.11 - Local Buffer Overflow (SEH) (DEP Bypass)
Exploit-DB Shellcode
[shellcode] Linux/x86 - Reverse (10.10.2.4:4444/TCP) Shell Shellcode (68 bytes)
[shellcode] Linux/x86 - Reverse (10.0.7.17:4444/TCP) Shell (/bin/sh) Shellcode (101 Bytes)
[shellcode] Linux/x86 - Bind (4444/TCP) Shell (/bin/sh) + IPv6 Shellcode (113 bytes)
[shellcode] Linux/x86 - Reverse TCP (127.0.0.1:4444/TCP) Shell (/bin/sh) Shellcode (96 Bytes)
[shellcode] Linux/x86 - Read /etc/passwd Shellcode (62 bytes)
[shellcode] Linux/x86 - Bind TCP (9443/TCP) Shell + fork() + Null-Free Shellcode (113 bytes)
[shellcode] Linux/x86 - execve(/bin/sh) + NOT Encoded Shellcode (27 bytes)
[shellcode] Linux/x86 - Bind TCP (1337/TCP) Shell + Null-Free Shellcode (92 bytes)
[shellcode] Linux/x86 - execve(cp /bin/sh /tmp/sh; chmod +s /tmp/sh) + Null-Free Shellcode (74 bytes)
[shellcode] Linux/x86 - Edit /etc/sudoers (ALL ALL=(ALL) NOPASSWD: ALL) For Full Access + Null-Free Shellcode (79 bytes)
Exploit-DB Papers
[papers] Deserialization Vulnerability
[papers] Code review steps and methodologies
[papers] [Vietnamese] Web Forensics
[papers] Linux Restricted Shell Bypass Guide
[papers] Windows Kernel Exploitation Tutorial Part 8: Use After Free
[papers] Building a Proxy Fuzzer for MQTT with Polymorph Framework
[papers] Nintendo Switch/Nvidia: Vulnerability Disclosure: Fusée Gelée
[papers] Polymorph: A Real-Time Network Packet Manipulation Framework
[papers] Sony Playstation 4 (PS4) - PS4 4.55 BPF Race Condition Kernel Exploit Writeup
[papers] Error based SQL Injection in "Order By" clause (MSSQL)
Exploit-DB Remote
[remote] D-Link DSL-2750B - OS Command Injection (Metasploit)
[remote] mySCADA myPRO 7 - Hard-Coded Credentials
[remote] HPE iMC 7.3 - Remote Code Execution (Metasploit)
[remote] Nanopool Claymore Dual Miner 7.3 - Remote Code Execution
[remote] Jenkins CLI - HTTP Java Deserialization (Metasploit)
[remote] Apache Struts 2 - Struts 1 Plugin Showcase OGNL Code Execution (Metasploit)
[remote] Inteno IOPSYS 2.0 < 4.2.0 - 'p910nd' Remote Command Execution
[remote] Microsoft Windows 2003 SP2 - 'RRAS' SMB Remote Code Execution
[remote] Mantis 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit)
[remote] FTPShell Client 6.7 - Buffer Overflow
Vulnerabilities
Security Focus Vulnerabilities
More rss feeds from SecurityFocus
Bugtraq: Android OS Didnt use FLAG_SECURE for Sensitive Settings [CVE-2017-13243]
Bugtraq: [SECURITY] [DSA 4210-1] xen security update
Bugtraq: [SECURITY] [DSA 4209-1] thunderbird security update
Bugtraq: Ruckus (Brocade) ICX7450-48 Reflected Cross Site Scripting
Bugtraq: [slackware-security] procps-ng (SSA:2018-142-03)
Bugtraq: [CVE-2018-8013] Apache Batik information disclosure vulnerability
Bugtraq: [security bulletin] MFSBGN03808 rev.1 - Micro Focus UCMDB, Cross-Site Scripting
Bugtraq: PHP Login & User Management <= 4.1.0 - Arbitrary File Upload (CVE-2018-11392)
Vuln: Multiple CPU Hardwares CVE-2018-3640 Information Disclosure Vulnerability
Bugtraq
[SECURITY] [DSA 4209-1] thunderbird security update
[SECURITY] [DSA 4210-1] xen security update
Ruckus (Brocade) ICX7450-48 Reflected Cross Site Scripting
Android OS Didnt use FLAG_SECURE for Sensitive Settings [CVE-2017-13243]
PHP Login & User Management <= 4.1.0 - Arbitrary File Upload (CVE-2018-11392)
[security bulletin] MFSBGN03808 rev.1 - Micro Focus UCMDB, Cross-Site Scripting
[CVE-2018-8013] Apache Batik information disclosure vulnerability
[slackware-security] mozilla-thunderbird (SSA:2018-142-02)
K2 smartforms runtime application - 4.6.11 SSRF
[SECURITY] [DSA 4208-1] procps security update
Full Disclosure
CVE-2018-11101: Signal-desktop HTML tag injection variant 2
Privilege escalation on Windows10/x by shortcut alteration.
PDFParser vulnerability
vcftools 0.1.15 vuln bugs
SEC Consult SA-20180516-0 :: XXE & XSS vulnerabilities in RSA Authentication Manager
Keeper Commander
Re: Buffer overflow in xls2csv (xlsparse.c:716) - catdoc
CVE-2018-10994: HTML tag injection in Signal-desktop
Multiple Arris Touchstone Gateway Vulnerabilities
Calamp.com Incorrect privilege assignment could lead to full user and vehicle compromise
Security Videos & Podcasts
Security Tube
[News] Apple Breached by Facebook Hackers Using Java Exploit
[News] New Mac malware opens secure reverse shell
[News] US: China hacking 'repeatedly raised at highest level'
[News] Biometric USB password key worthy of 'Mission: Impossible'
[News] Apple patches the Java hole its own developers fell into - eventually
[News] Firefox 19 Fixes HTTPS Phishing Issue, Adds Built-In PDF Viewer
[News] Apple, Facebook, Twitter hacks said to hail from Eastern Europe
[News] Botnet master abuses Facebook for pocket money, researchers reveal
GrrCon 2017 - Threat Intelligence: Zero to Basics in presentation
[News] McAfee finds sophisticated attacks targeting other 'critical sectors' of the economy
Hak5
Security Weekly
Steven Bellovin, Columbia University – Paul’s Security Weekly #561
Skybox, McAfee, & Thales – Enterprise Security Weekly #92
Building Your Purple Team – Enterprise Security Weekly #92
Capital One, TransUnion, & Tanium Business Security Weekly #86
Red Hat, Google, iOmega, and University of Greenwich – Hack Naked News #174
Corey Thuen and Kristopher Watts, Gravwell – Business Security Weekly #86
Terry Mason, Head of Information Risk & Technology Governance – Business Security Weekly #86
Nest, Node.js, & F.Secure – Application Security Weekly #
James Wickett, Signal Sciences – Application Security Weekly #17
Project Zero, Securus, and CIA’s “Vault 7” Mega-Leak – Paul’s Security Weekly #560
Risky.Biz
Risky Business #500 -- Web asset discovery is getting useful
Risky Business feature interview: Hacking PUBG
Risky Business #499 -- Is PGP actually busted and Signal pwnt? Noooope
Risky Business #498 -- There sure is a lot of Microsoft Defender out there these days
Risky Biz Soap Box: Root9b on agentless threat hunting
Risky Business #497 -- Silvio's greatest hits
Risky Business #496 -- The China supply chain problem
Risky Business #495 -- Russian Internet users are having a bad time
Risky Business #494 -- Cisco customers have a bad week, plus a deep dive on WebAuthn
Risky Business #493 -- SWIFT, pipeline attacks, Chrome's AV feature and more
The CyberWire
UPnProxy infiltrates home routers — Research Saturday
VPNFilter takedown. Low-cost Android phones with preloaded adware. Alexa's selective attention. BMW patches connected cars. Cryptocurrency crimes. New swatting charges. GDPR is here.
VPNFilter and battlespace preparation. XENOTIME may be back, and after industrial systems. GDPR updates. Following Presidential Tweets.
Variant 4 and other chipset vulnerabilities. Confucius and Patchwork. Turla goes two-stage. Misconfigured not-for-profit bucket. ZTE's fraying lifeline. Facebook and the EU. Brain Food.
Speculative Store Bypass. GPON-based botnet. Customer data exposures. Roaming Mantis gets more capable. Nation-state threats.
DPRK's Sun Team works from three apps in Google Play. PII for sale in Zheijiang. SPEI theft. Jihadist content in social media. SEA charges. DDoS-for-hire sentencing. ZipperDown bug.
Threat actors hijack Lojack — Research Saturday
Something Wicked this way comes. Automating wallet pilferage. Office 365 phsihing scams. DPRK hackers remain active. Recognizing alt-coin investment frauds.
Competing for terrorist mindshare. ICS threat group update. AnonPlus vandalizes US state sites. GDPR's disclosure timeline. Congressional hearings. DarkOverlord collared.
Spyware campaigns: phishing and watering holes. Signal patches (fast). DHS cyber strategy. Russian election hacking. Cyber Investing Summit. Do smart people pick better passwords?
Rapid7 Whiteboard Wednesday
Security Blogs
Krebs on Security
Why Is Your Location Data No Longer Private?
3 Charged In Fatal Kansas ‘Swatting’ Attack
Mobile Giants: Please Don’t Share the Where
T-Mobile Employee Made Unauthorized ‘SIM Swap’ to Steal Instagram Account
Tracking Firm LocationSmart Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site
Detecting Cloned Cards at the ATM, Register
Think You’ve Got Your Credit Freezes Covered? Think Again.
Microsoft Patch Tuesday, May 2018 Edition
Study: Attack on KrebsOnSecurity Cost IoT Device Owners $323K
Twitter to All Users: Change Your Password Now!
Naked Security
Ghostery’s goofy GDPR gaffe – someone’s in trouble come Monday!
FBI issues VPNFilter malware warning, says “REBOOT NOW” [PODCAST]
Facebook 2FA no longer needs a phone number: here’s how to set it up
Facebook’s counterintuitive way to combat nonconsensual porn
Does your BMW need a security patch?
Trump’s blocking of Twitter users declared unconstitutional
2 million stolen identities used to make fake net neutrality comments
Office 365 will automatically block Flash and Silverlight
FBI admits to inflating number of crime-related devices it can’t crack
VPNFilter router malware – what to do? [VIDEO]
Schneier on Security
Linux Security
Dark Reading
Android Malware Comes Baked into Some New Tablets, Phones
GDPR Oddsmakers: Who, Where, When Will Enforcement Hit First?
Privacy Survey Says: Americans Don't Want to Sell Their Data
Privacy Group: Facebook, Google Policies Break GDPR Laws
Wicked Mirai Brings New Exploits to IoT Botnets
10 Free DevOps-Friendly Security Tools Developers Will Love
Bridging the Cybersecurity Talent Gap
Most Expensive Data Breaches Start with Third Parties: Report
DOJ Sinkholes VPNFilter Control Servers Found in US
GDPR, WHOIS & the Impact on Merchant Risk Security Monitoring
Securing the Human
Darknet
Acunetix v12 – More Comprehensive More Accurate & 2x Faster
CloudFrunt – Identify Misconfigured CloudFront Domains
Airbash – Fully Automated WPA PSK Handshake Capture Script
XXEinjector – Automatic XXE Injection Tool For Exploitation
Yahoo! Fined 35 Million USD For Late Disclosure Of Hack
Drupwn – Drupal Enumeration Tool & Security Scanner
MyEtherWallet DNS Hack Causes 17 Million USD User Loss
StaCoAn – Mobile App Static Analysis Tool
snallygaster – Scan For Secret Files On HTTP Servers
Portspoof – Spoof All Ports Open & Emulate Valid Services
Securelist
HITB News
This futuristic pill senses signs of disease inside the body, then sends a wireless alert to a phone
Russian unit, GRU officer linked to 2014 shoot-down of airliner over Ukraine
Eric Schmidt says Elon Musk is ‘exactly wrong’ about AI
Court docs show Apple knew about the bendiness of the iPhone 6, 6 Plus
FBI tells router users to reboot now to kill malware infecting 500k devices
Bug on T-Mobile's website left customer data unprotected
Uber's Self-Driving Car Saw the Woman It Killed, Report Says
Gamers involved in December’s “swatting” death just got indicted
Don’t Freak Out About That Amazon Alexa Eavesdropping Situation
As EU Privacy Law Looms, Debate Swirls on Cybersecurity Impact
TAO Security
Securiteam
SSD Advisory – Linux AF_LLC Double Free
SSD Advisory – TrustPort Management Unauthenticated Remote Code Execution
SSD Advisory – TerraMaster TOS Unauthenticated Remote Command Execution
SSD Advisory – Vigor ACS Unsafe Flex AMF Java Object Deserialization
SSD Advisory – Western Digital My Cloud Pro Series PR2100 Authenticated RCE
SSD Advisory – AppWeb Authentication Bypass (Digest, and Basic)
SSD Advisory – VK Messenger (VKontakte) vk:// URI Handler Commands Execution
beVX Conference Challenge – OffensiveCon
The RISKS Digest
Alexa and Siri Can Hear This Hidden Command Audio Attacks
Meant to Monitor Inmates' Calls Could Track You Too
Email Encryption Tools Are No Longer Safe, Researchers Say
Once Again, Activists Must Beg the Government to Preserve the Right to Repair
Dozens of security cameras hacked in Japan
The Digital Vigilantes Who Hack Back
Software bug led to death in Uber's self-driving crash
Russia Tried to Undermine Confidence in Voting Systems, Senators Say
Self-driving cars' shortcomings revealed in DMV reports
VW bugs: "Unpatchable" remote code pwnage
Forbes - Security
Kaspersky Blog
GDPR: What it is, and what businesses should do
What will voice-assistant ads “look” like?
What is the cost of a data breach?
Transatlantic Cable podcast, episode 38
Never share verification codes
Secure Element — securing contactless payments in smartphones
Roaming Mantis infects smartphones through Wi-Fi routers
Transatlantic Cable podcast, episode 37
Our first Transparency Center will be in Switzerland
How to avoid turning your smartphone into a spyware zoo
Adam Shostack & friends
NTSB on Uber (Preliminary)
Threat Model Thursday: Google on Kubernetes
4 Common Missteps in Threat Modeling
Joining the Continuum Team
Just Culture and Information Security
Redzone Podcast on threat modeling
TESS Launch Closeup
Best Cyber News Blogs, thanks!
Threat Model Thursday: Q&A
$35M for Covering up A Breach
Graham Cluley
Woman says Alexa recorded and shared the private conversation she was having with her husband
VPNFilter botnet has hacked 500,000 routers. Reboot and patch now!
Smashing Security #079: Mugshots, mobile mania, and back end gurus
800,000 DrayTek routers at risk of DNS hijacking attack - update your firmware!
£120,000 fine for university after details of 20,000 staff and students exposed in data breach
Donald Trump’s smartphone security: an inconvenient truth
See me speak at the Sunny Side Up Security breakfast event in London next month
Best Security Podcast: “Smashing Security” up for top award
12 Common Threat Intelligence Use Cases
Suspected Syrian Electronic Army hackers indicted for conspiracy and identity theft
Rapid7
Metasploit Wrapup
How to Build Your Own Caller ID Spoofer: Part 1
Whiteboard Wednesday: Your 6-Minute Recap of Q1 2018’s Threat Landscape
Metasploit Wrapup
Diving Deep and Finding Vulnerabilities in Modern Web Applications
Whiteboard Wednesday: The Two Components of Phishing Protection Your Security Strategy Needs
Rapid7 Quarterly Threat Report: 2018 Q1
No More Tears? WannaCry, One Year Later
Metasploit Wrapup
Unifying Security Data: How to Streamline Endpoint Detection and Response
Help Wanted
Stack Overflow
Stack Exchange
Other Stuff
YCombinator
Fullstack Academy is looking for developers who love teaching
The Silence of the Bugs
ICANN files legal action in Germany to continue collecting WHOIS data under GDPR
Drones that can haul a 20-pound load for 500 miles and land on a moving target
Mainframe on the Macbook
Benchling (YC S12) Is Hiring Software Engineers to Accelerate Biotech Research
There Are 101 Americans with Over $1M in Student Loans
Publishers stop Facebook ad over policy treating them as political advertisers
USB Reverse Engineering: Down the Rabbit Hole
Seeking Engineering Leader- Foodies Welcome
Lobste.rs
Hackaday
Flash your Libre Firmware with a Libre Programmer
DIY Submersible Aims for Low Cost, Ease of Operation
A Oscilloscope For The Nuclear Age
Disaster Area Communications With Cloud Gateways
A Custom Keypad with Vision
Watch the Honeycomb Clock Gently Track Time
Their Battery is Full of Air
Hackaday Belgrade is On: Join LiveStream and Chat!
Wireless Charger Gives a Glimpse into Industrial Design Process
This Robot Barfs Comics!
Ars Technica
Alan Bean, the fourth human to walk on the Moon, has died
From Win32 to Cocoa: A Windows user’s would-be conversion to Mac OS X
DropMix review: Unleash your inner DJ
Doctor slammed by med board for selling $5 homeopathic sound waves for Ebola
Dealmaster: Memorial Day sales on TVs, laptops, and more are underway [Updated]
The Millennium Falcon is OK, but these pop culture ships make Ars hearts race
Dinosaur-killing impact + volcanoes kept the Earth hot for 100,000 years
Russian unit, GRU officer linked to 2014 shoot-down of airliner over Ukraine
FBI tells router users to reboot now to kill malware infecting 500k devices
This capsule of glowing E. coli will probe your gut for signs of trouble
Wired
Space Photos of the Week: Meet TESS, the Exoplanet Hunter
VR Headsets That Will Transport You, Wherever the Destination
What Would Mind-Reading Really Be Like?
5 Longreads For a Long Weekend
Suunto 3 Fitness Review: Attractive and Versatile
A Classical Math Problem Gets Pulled Into Self-Driving Cars
How Social Media Became a Pink Collar Job
Israel's Self-Flying 'Cormorant' Whisks Soldiers to Safety
Gadget Lab Podcast: The Very Human Element of Self-Driving Cars
Slashdot
A Star Wars Boba Fett Movie Is In the Works
Facebook Accused of Conducting Mass Surveillance Through Its Apps
Is Cockroach Milk the Ultimate Superfood?
Samsung Must Pay Apple $539 Million For Infringing iPhone Design Patents, Jury Finds
Vevo To Shut Down Site, Giving In To YouTube Empire
Android Creator Puts Essential Up For Sale, Cancels Next Phone
Newest NOAA Weather Satellite Suffers Critical Malfunction
StumbleUpon Is Shutting Down After 16 Years of Service
First Cuba, Now China? A Worker In US Embassy In China Experienced 'Abnormal' Sounds, Brain Damage
YouTube Is Messing With the Order of Videos In Some User Feeds
DZone
Capturing the Mindshare of AR and VR Developers
How to Run a Simple Load Test With Gatling
How to Setup Zookeeper Cluster
Overview of MCUXpresso IDE v10.2.0
Microservices Communication: Feign as REST Client
Exception Handling in Spring Boot REST Web Services: A Real-World Pattern
Identity-as-a-Service (IDaaS) : Okta and ASP.Net Core
Web Caching Strategy
Will Kubernetes Collapse Under the Weight of Its Complexity?
Design Patterns Explained: Adapter Pattern With Code Examples