The freshest blend of the latest security news
|
IT Security News Security in Mainstream Media Social Media |
Tools Exploits Vulnerabilities |
Security Videos & Podcasts Security Blogs Other Stuff |
Colour scheme |
IT Security News
PacketStorm
Security Review: A Counterfeit, $100 iPhone X
Roblox Blames Gang Rape On Hacker Adding Code To Game
Cisco Patches Critical Vulnerabilities In Policy Suite
Movistar Exposes Call Records Details Of Users
The SIM Hijackers
Thousands Of US Voters' Data Exposed By Robocall Firm
Password Stealing Spying Malware Targets Ukrainian Government
PayPal's Venmo Found Leaking Transaction Details
007 Code Helps Stop Spectre Exploits Before They Exist
Trump Wants To Work With Russia On Infosec. Security Experts: Lol No.
The Register
Declassified files reveal how pre-WW2 Brits smashed Russian crypto
Declassified files reveal how pre-WW2 Brits smashed Russian crypto
Brit tech forges alliance to improve cyber security as MPs moan over 'acute scarcity' of experts
Adobe on internal systems security hole: Panic not. It isn't critical
Airbus UK infosec gros fromage: Yep, we work with arch-rivals Boeing
Bloke accused of netting $5m on inside info about Lattice Semiconductor
Who's leaving Amazon S3 buckets open online now? Cybercroooks, US election autodialers
Will this biz be poutine up the cash? Hackers demand dosh to not leak stolen patient records
So long and thanks for all the fixes: ERPScan left out of credits on Oracle bug-bash list
Brit watchdog fines child sex abuse inquiry £200k over mass email blunder
Security Bloggers Network
Key Traits Employers Seek from Information Security Professionals
Decision Analysis Applications in Threat Analysis Frameworks
Better Cybersecurity Job Descriptions: A Matter of Degrees?
AWS Cloud Security for Beginners — Part 2
How Much Does a Data Breach Cost? Reading the 2018 Cost of a Data Breach Study
AWS Cloud Security for Beginners — Part 1
Threat Hunting vs. SIEM
Threat Hunting as an Active Defense
Types of Threats That Can Be Hunted
10 Benefits of Threat Hunting
ThreatPost
ThreatList: Sizing Up The Scourge of Credential-Stuffing
Stealthy Malware Hidden in Images Takes to GoogleUserContent
IoT Robot Vacuum Vulnerabilities Let Hackers Spy on Victims
GangWang GPS Navigation Attack Leads Unsuspecting Drivers Astray
How Cyber Insurance Changes the Conversation Around Risk
Critical Authentication Flaws in Cisco Policy Suite Patched
Privacy Advocates Say Kelsey Smith Act Gives Police Too Much Power
ThreatList: Popular Apps Get Enterprise Blacklisted
Thousands of U.S. Voter Personal Records Leaked by Robocall Firm
LabCorp Investigates a Potential Breach that Could Affect Millions
ISC SANS
ISC Stormcast For Friday, July 20th 2018 https://isc.sans.edu/podcastdetail.html?id=6088, (Fri, Jul 20th)
Reporting Malicious Websites in 2018, (Thu, Jul 19th)
ISC Stormcast For Thursday, July 19th 2018 https://isc.sans.edu/podcastdetail.html?id=6086, (Thu, Jul 19th)
Request for Packets: Port 15454, (Wed, Jul 18th)
Oracle Critical Patch Update Release, (Tue, Jul 17th)
ISC Stormcast For Wednesday, July 18th 2018 https://isc.sans.edu/podcastdetail.html?id=6084, (Wed, Jul 18th)
Searching for Geographically Improbable Login Attempts, (Tue, Jul 17th)
ISC Stormcast For Tuesday, July 17th 2018 https://isc.sans.edu/podcastdetail.html?id=6082, (Tue, Jul 17th)
ISC Stormcast For Monday, July 16th 2018 https://isc.sans.edu/podcastdetail.html?id=6080, (Mon, Jul 16th)
Extracting BTC addresses from emails, (Sun, Jul 15th)
digitalmunition
Seeker – Find GeoLocation With High Accuracy
QUASAR, SOBAKEN AND VERMIN RATs involved in espionage campaign on Ukraine
Scan your exposure to domain and subdomain hijacking over 10’s of cloud providers
memrepl: Memory inspection REPL interface
DanaBot Bank Trojan Targets Bank Customers through Phishing Scam
Neofetch – A Command-Line System Information Tool
Road navigation systems can be spoofed using $223 equipment
ipv4Bypass – Using IPv6 To Bypass Security
Director of National Intelligence warns of devastating cyber threat to US infrastructure
Introducing A New Way To Become Anonymous
eHacking News
Child sex abuse inquiry fined £200,000 for disclosing victims
Ubisoft games hit by DDoS atacks
US' Largest Medical Laboratory Shut Down Its System Over Data Breach Fear
DanaBot Trojan steals sensitive information of bank customers
Magniber ransomware spreads in other Asian countries
Amazon’s Website Crashed Within Minutes of Prime Day Sale
New AI Program can Effectively Remove the Noise from a Photograph
Extortion malware hit porn sites
Anubis Malware Re-Emerges Yet Again; Hackers Distributing It via Google Play Store
Database of 15.6 million hacked passwords available for download on “haveibeenpwned” Website
Wired - Security
Trump’s Russia Denials Have Real Consequences
Amazon Web Services Tests Out Two Tools to Help Keep the Cloud Secure
Meet Jonathan Albright, The Digital Sleuth Exposing Fake News
How Google's Safe Browsing Helped Build a More Secure Web
RealNetworks Launches Free Facial Recognition Tool for Schools
Rubio, Warner Stress Election Security After Trump-Putin Summit
Trump-Putin Press Conference Gave Russia Everything It Wanted
What Robert Mueller Knows—and 9 Areas He'll Pursue Next
How Elucd's 'Sentiment Meter' Helps Cops in LA and NYC Understand Their Precincts
Ukraine Blocks a Russian Hack, a Silk Road Arrest, and More Security News This Week
Security in Mainstream Media
Google News Hacking
Online shopping sites see hacking increase despite security efforts
Investigators warn of keyless cars being broken into due to key fob hacking
Rosenstein: Russian attack on 2016 election 'one tree in a growing forest' of cyber activity
What 2 Do: Russian Email Hacking Your Instagram Account
Russia-friendly Rep. Rohrabacher doubts hacking indictment, plans to consult outside 'experts'
Microsoft discloses first known hacking attempts in midterm elections
$1 million heist on Russian bank started with hack of branch router
Following Russian hacking reports, Florida Legislature OKs $19.2 million for election security
“Don't count Russia out,” experts warn on election hacking amid relative calm
Google Cyber Security
UK cybersecurity agency finds new low-risk concerns with Huawei's security centre
Cyber Security offers long list of work opportunities
WATCH: Rosenstein defends charging foreign agents US can't arrest
FERC Mandates Reporting of Attempted Cybersecurity Breaches
Three Top FBI Cybersecurity Officials to Retire
SNHU Launches Full Bachelor's in Cyber Security Program
Social Media
Digg - Hack
Digg - Security
Slashdot - Rights
Chinese Hackers Targeted IoT During Trump-Putin Summit
FCC Vote Likely Dooms Sinclair-Tribune Merger
FBI Director: Without Compromise on Encryption, Legislation May Be the 'Remedy'
Senate Wants Netflix, Spotify To Send Out Federal Emergency Alerts
Microsoft Reveals First Known Midterm Campaign Hacking Attempts
Should the Word 'Milk' Be Used To Describe Nondairy Milk-Alternative Products?
Russian Shipwreck Allegedly Carrying $130 Billion In Gold Has Been Rediscovered
Leaked Documents Show Facebook's 'Threshold' For Deleting Pages, Groups
DeepMind, Elon Musk and Others Pledge Not To Make Autonomous AI Weapons
IBM Wants $167 Million From Groupon Over Alleged Patent Infringement
DZone Security
Single Sign-On Solutions in Mobile for Native Applications
How RASP Complements Application Security Testing to Minimize Risk
How to Create Your Own Cryptocurrency Blockchain in Python
Top 5 Technological Advantages Of IOTA For Industries
DZone Research: Security Concerns (Part 2)
How to Generate a WildCard SSL Certificate Signing Request (CSR)
How to Market Blockchain With Consensys and Lisk
How to Address Vulnerabilities in Microsoft GitHub Repositories
DZone Research: Security Concerns (Part 1)
5 Steps for CISOs to Build Cyber-Resilience
Social Media > Reddit
Reddit - NetSec
Reverse engineering some Javascript malware
Rule Splitting in Hashtopolis to allow better distribution on Clusters (using Hashcat)
How to instrument Electron-based applications for in-depth security testing
Bypassing Memory Scanners with Cobalt Strike and Gargoyle
Mind the hackers: – PixelPin – Medium
How I was able to delete 13k+ Microsoft Translator Projects
Many infosec professionals reuse passwords across multiple accounts - Help Net Security
GDPR Fueling Rise of PII Theft, Cryptomining Plateauing
Exploiting a Windows 10 PagedPool off-by-one overflow (WCTF 2018) [xpost /r/WindowsSecurity]
Noise protocol matrix
Reddit - AskNetSec
Reddit - Cyberpunk
Kind of Neons HK
What are some modern takes of cyberpunk?
Jumping on the Neon Battlestation bandwagon
How Meta is Cyberpunk now?
Bathroom mirror
Motoko
Books?
Listen up, Elon Musk! (w/ Brett O'Shea) | SRSLY WRONG 157
The hacking computer from our cyberpunk game, just finished modelling and programming it!
Has anyone read this novel? Blood music by Greg Bear. Great Book!
Reddit - Crypto
Huobi officially launches Huobi Cloud
LaneAxis is transforming the global logistics industry by building a Shipper-to-Carrier direct optimization blockchain network powered by smart contracts.
How the Brittish broker the Russian one time pad system during 1920 - 1940
Favorite Crypto Email Newsletters
Math Used in Cryptography?
AES-256 vs cascading ciphers?
PrestaShop Privilege Escalation exploiting padding oracles and CRC-32 affinity
Comparing 2 ways to encrypt a sample string, which one's the best?
How does ECDHE with RSA fit together?
Anything to fully encrypt an android phone?
Reddit - Lockpicking
First open with a gun 🙂
1100 done and done. Now to get her on film...used a home made TOK wrench with it as well
White Belt....here I come. 2 locks/2 opens
I counter-counter-raise your car key. here's my truck key
Security Pin Series Ep.8 - "Kerberos" Security Pin
9th Annual Lancaster Lock Show (July 13-14, 2018)
Kwikset Smartkey (Generation 3) Pick and Gut + Tool
Reddit - Malware
JS Sniffer: E-commerce Data Theft Made Easy
Defcon 2018 Megathread (Las Vegas, August 9–12, 2018)
Apple TV telnet/ssh/ftp on tcp 5000
Did a McAfee scan... This came up
Dissecting Smoke Loader - CERT Polska [In-Depth Smoke Loader Malware Analysis]
GandCrab v4.1.2 malware can now be stopped via new killswitch
Interesting Malware - Experienced Partner needed
ZombieBoy cryptominer/RAT
How to start RE/malware analysis?
Is a vm safe for malware testing?
Reddit - Netsec Students
Ophcrack (Trouble loading tables, Status = inactive)
I want to dualboot my macbook pro 2015 for Kali. Is there anything I should be worried about?
Share your webshell collection
The (not so) secret path into an information security job (part one)
I am Creating a WiFi Security in the Cloud Video Course *NO HARDWARE REQUIRED*
A tip if your studying for Security+
Getting started with honeypots
URI vs Utica
[OSCE Prep] Backdooring a PE File
Creation of a CTF Team
Reddit - Onions
Use my link if you want, it'll help me out too.
Having a difficult time finding hacking/cracking forums on the deep web that aren't offline -- anyone have suggestions?
Is this an infringement of the rules?
How to find real darkness marketplaces?
Free talk Fridays - What's on your mind?
Using Mobile hotspots
Join secure #onions chat on your phone
Help pls :')
Newbie
Blogging on the Deep Web
Reddit - Privacy
Spoofing screen size resolution?
Europe Misfires on Google (for preinstalling its apps on almost all *free* android devices)
Private instant messaging
Doorbell question (yes privacy related)
MASKMAIL – an anonymous email address service to protect your online privacy
Facebook Fixes Privacy Bug Spotted by Consumer Reports
If the threat level is higher up companies (ISPs, Google, etc) knowing who I am and where I am, how can I achieve private texts and calls? Or is it not possible unless it's P2P encrypted?
Amendment1 question
Thoughts on Darkmail?
Can this website report my name or location to its profile users if I don’t have an account and use private browsing mode?
Reddit - Pwned
Australian Government National Health Practitioner Ombudsman and Privacy Commissioner leaks database
"Have I been Pwned" V3 passwords 95% cracked on Hashes.org
MyEtherWallet HOLA VPN Compromised
Hackers caught selling access to airport security systems for $10
Macy’s, Bloomingdales Alert Online Customers of Data Breach
Compromising User Account- ”How I was able to compromise user account via HTTP Parameter Pollution(HPP) in Indian Online Shopping Website”
I think I experienced a cyber crime while employed in a major sports league and need help understanding what happened.
Star Vault – MMORPG Mortal Online Hacked – DeHashed
TypeForm suffered a data breach
Tickets, JavaScript and suppliers. What really happened in Ticketmaster data breach?
Reddit - Reverse Engineering
Reddit - Security CTF
machine learning model, game boy and obfuscated powershell
Newly Published CTF writeups
Recently Published CFTs Writeup
LazySysAdmin: 1 Walkthrough
Reddit - Social Engineering
Thought this should be here...
Understanding Insecurity & Human Nature - How To Overcome Self-Doubt & Live More Confidently
Why You’re Talking to Yourself Right Now
How real-life social engineering techniques are used in movies and television
Joey Diaz on how to get someone to pick up the phone
Robert Caldini - which book to start with?
Could someone here help me with a job interview please? Thanks.
Who is Vladislav Surkov? The many faces and farces of Putin’s most notorious political operative.
Social Engineering books to apply in security audits?
Dissertation research
Reddit - Sysadmin
Need Help Graylog Data Elasticsearch Grafana
[Traveling Techs] What is your best tech backpack for travel with a laptop?
CCleaner Nightmare
Ubiquiti Cloud Keys regularly lose their connection to the Internet
So pumped. Got two things added to my new user script I didn't think could be done.
What are some networking tools to diagnose connection errors? I've been experiencing random connection refused errors from my server.
Sourcing some extra ram.. I'm sorry what!!
Blocking ping for "Security"
Reddit - Bitcoin
Reddit - CryptoCurrency
Daily Discussion Megathread - July 20, 2018
Huobi unveils its business arm – Huobi Cloud to build digital asset exchanges
NEO is now Live on Coss Exchange with 4 pairs, including Fiat!
MATRIX AI Network won the "Best Public Chain" award at this year's China Blockchain Development Conference！ https://t.co/N1iuSPAYny
Nuff said. #stop #sherman
Impact of $50k Bitcoin & Bitcoin ETF on AltCoins?
Do you too suffer with premature "celebration"?
Congratulations r/CryptoCurrency, We've Reached 700K Subscribers!
Gold chart vs Bitcoin chart
'Cryptocurrency Can't Do Anything The USD Can't Do' WRONG
Reddit - VPN
VPN client on router - should my network be set as public or private?
Caught by the fuzz
VPN through USB WiFi stick?
Can a Public Wireless Connection Not Accept a VPN?
Forcefield scam
Need simple setup instructions for OpenVPN server and client on Windows (7)
Can you spoof location but not hide traffic from ISP?
Another VPN question, eyes roll
Companies that say you need to be in state x for work from home
Tools
CyberPunk nowhere.net
Payload Generation Framework: SharpShooter
Block Unauthorized macOS Outgoing Network Traffic: LuLu
Query Windows Machine for RAM Artifacts: memtriage
Automated Pentest Recon Scanner: Sn1per
Spoof SSDP replies to phish for NTLM hashes: evil-ssdp
Firewall and Privatizing Proxy: macOS Fortress
Active Directory Reconnaissance: ADRecon
Indonesian Penetration Testing LFS: Dracos Linux
DNS Rebinding Attack: DNS Rebind Toolkit
Subdomain Discovery Tool: SubFinder
Exploits
Packet Storm Exploits
Exploit-DB Webapps
[webapps] WordPress Plugin All In One Favicon 4.6 - Cross-Site Scripting
[webapps] MyBB New Threads Plugin 1.1 - Cross-Site Scripting
[webapps] Smart SMS & Email Manager 3.3 - 'contact_type_id' SQL Injection
[webapps] Open-AudIT Community 2.1.1 - Cross-Site Scripting
[webapps] FTP2FTP 1.0 - Arbitrary File Download
[webapps] Modx Revolution < 2.6.4 - Remote Code Execution
[webapps] Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Cross-Site Request Forgery
[webapps] Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Configuration Download
[webapps] Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Denial of Service
[webapps] Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - File Manipulation
Exploit-DB Local and Privilege Escalation
[local] ADB Broadband Gateways / Routers - Local Root Jailbreak
[local] ADB Broadband Gateways / Routers - Privilege Escalation
[local] Boxoft WAV to MP3 Converter 1.1 - Buffer Overflow (Metasploit)
[local] Enhanced Mitigation Experience Toolkit (EMET) - XML External Entity Injection
[local] Dell EMC RecoverPoint < 5.1.2 - Local Root Command Execution
[local] Nikto 2.1.6 - CSV Injection
[local] Pale Moon Browser < 27.9.3 - Use After Free (PoC)
[local] Audiograbber 1.83 - Local Buffer Overflow (SEH)
[local] Redis-cli < 5.0 - Buffer Overflow (PoC)
Exploit-DB Shellcode
[shellcode] Linux/x64 - Reverse (::1:1337/TCP) Shell (/bin/sh) + IPv6 + Password (pwnd) Shellcode (115 bytes)
[shellcode] Linux/ARM - Bind (1234/TCP) Shell (/bin/sh) Shellcode (104 bytes)
[shellcode] Linux/x86 - Kill Process Shellcode (20 bytes)
[shellcode] Linux/x86 - Execve /bin/cat /etc/passwd Shellcode (37 bytes)
[shellcode] Linux/ARM - Egghunter (0x50905090) + execve('/bin/sh') Shellcode (60 bytes)
[shellcode] Linux/x86 - Egghunter (0xdeadbeef) + access() + execve(/bin/sh) Shellcode (38 bytes)
[shellcode] Linux/x86 - Bind (4444/TCP) Shell (/bin/sh) Shellcode (105 bytes)
[shellcode] Linux/ARM - Egghunter (x50x90x50x90) + execve('/bin/sh') Shellcode (32 bytes)
[shellcode] Linux/x86 - Bind (5555/TCP) Shell Shellcode (98 bytes)
[shellcode] Linux/x86 - Reverse (10.10.2.4:4444/TCP) Shell Shellcode (68 bytes)
Exploit-DB Papers
[papers] VLAN Hopping Attack
[papers] Abusing Kerberos - Kerberoasting
[papers] Exploiting the Obvious - Bluetooth Trust Relationships
[papers] Sony Playstation 4 (PS4) - PS4 5.05 BPF Double Free Kernel Exploit Writeup
[papers] Symbolic deobfuscation: from virtualized code back to the original
[papers] UAC Bypass & Research with UAC-A-Mola
[papers] Discovering and Plotting Hidden Networks created with USB Devices
[papers] Security of Modern Bluetooth Keyboards
[papers] PoC || GTFO 0x18
[papers] Database Security Threats and Injection Technique
Exploit-DB Remote
[remote] WebKit - not_number defineProperties UAF (Metasploit)
[remote] CyberArk < 10 - Memory Disclosure
[remote] Git < 2.17.1 - Remote Code Execution
[remote] CloudMe Sync < 1.11.0 - Buffer Overflow (SEH) (DEP Bypass)
[remote] Bitmain Antminer D3/L3+/S9 - Remote Command Execution
[remote] D-Link DSL-2750B - OS Command Injection (Metasploit)
[remote] mySCADA myPRO 7 - Hard-Coded Credentials
[remote] HPE iMC 7.3 - Remote Code Execution (Metasploit)
[remote] Nanopool Claymore Dual Miner 7.3 - Remote Code Execution
[remote] Jenkins CLI - HTTP Java Deserialization (Metasploit)
Vulnerabilities
Security Focus Vulnerabilities
More rss feeds from SecurityFocus
Bugtraq: [slackware-security] httpd (SSA:2018-199-01)
Bugtraq: [SECURITY] [DSA 4252-1] znc security update
Bugtraq: [SECURITY] [DSA 4251-1] vlc security update
Bugtraq: GhostMail - (Status Message) Persistent Web Vulnerability
Vuln: Microsoft .NET Framework CVE-2018-8356 Security Bypass Vulnerability
Bugtraq: [SECURITY] [DSA 4248-1] blender security update
Bugtraq: [SECURITY] [DSA 4249-1] ffmpeg security update
Bugtraq: [SECURITY] [DSA 4250-1] wordpress security update
Bugtraq: [slackware-security] mutt (SSA:2018-198-01)
Bugtraq
[slackware-security] httpd (SSA:2018-199-01)
[SECURITY] [DSA 4252-1] znc security update
GhostMail - (filename to link) POST Inject Web Vulnerability
[SECURITY] [DSA 4251-1] vlc security update
Binance v1.5.0 - Insecure File Permission Vulnerability
GhostMail - (Status Message) Persistent Web Vulnerability
Barracuda Cloud Control v3.020 - CS Cross Site Vulnerability
Defense in depth -- the Microsoft way (part 56): 10+ year old security update installers are susceptiblle to 20+ year old vulnerability
[SECURITY] [DSA 4250-1] wordpress security update
[SECURITY] [DSA 4248-1] blender security update
Full Disclosure
Adobe Systems - Arbitrary Code Injection Vulnerability
GhostMail - (Status Message) Persistent Web Vulnerability
GhostMail - (filename to link) POST Inject Web Vulnerability
Binance v1.5.0 - Insecure File Permission Vulnerability
Barracuda Cloud Control 7.1.1.003 - Cross Site Scripting Vulnerability
Barracuda Cloud Control v3.020 - CS Cross Site Vulnerability
CSRF vulnerabilities in D-Link DIR-300
Huawei eNSP v1 - Buffer Overflow (DoS) Vulnerability
G DATA TOTAL SECURITY v25.4.0.3 Activex Buffer Overflow
Total AV 4.1.7 ~ 4 .6.19 - Insecure Permissions
Security Videos & Podcasts
Security Tube
[News] US: China hacking 'repeatedly raised at highest level'
[News] Firefox 19 Fixes HTTPS Phishing Issue, Adds Built-In PDF Viewer
[News] Apple, Facebook, Twitter hacks said to hail from Eastern Europe
[News] Botnet master abuses Facebook for pocket money, researchers reveal
[News] Apple Breached by Facebook Hackers Using Java Exploit
[News] New Mac malware opens secure reverse shell
GrrCon 2017 - Threat Intelligence: Zero to Basics in presentation
[News] McAfee finds sophisticated attacks targeting other 'critical sectors' of the economy
[News] Why encryption doesn't solve the data sovereignty debate
[News] Biometric USB password key worthy of 'Mission: Impossible'
Hak5
Security Weekly
AppSec Solutions in a DevOps World – Application Security Weekly #24
Mayank Varia, Boston University pt. 1 – Business Security Weekly #92
Mayank Varia, Boston University pt. 2 – Business Security Weekly #92
iOS Bugs, Burp Suite, & DevSecOps – Application Security Weekly #24
Airport Security, Dark Web, and Apple – Paul’s Security Weekly #567
007 Spectre, IP Address, and Military Hijackers – Hack Naked News #181
Limor Elbaz, Peerlyst – Paul’s Security Weekly #567
Zane Lackey, Signal Sciences – Paul’s Security Weekly #567
SolarWinds, Mimecast, & AT&T – Enterprise Security Weekly #98
Joe McManus, Automox – Enterprise Security Weekly #98
Risky.Biz
Risky Biz Soap Box: Cylance: Driving machine learning model development with threat research
Snake Oilers 6 part 2: Proofpoint on cred phishing, Exabeam defines next-gen SIEM
Risky Business #506 -- How security teams can work with PR
Risky Business #505 -- Sanger vs FireEye, Reality Winner cops a plea
Snake Oilers 6 part 1: InsightIDR from Rapid7, whitelisting with Airlock Digital and testing your SOC personnel with AttackIQ
Risky Business #504 -- Latest email frauds and changes to money muling
Risky Business #503 -- North Korean tech in the global supply chain
Risky Business #502 -- Inside China's hacker scene
Risky Business #501 -- Trisis: signalling, deterrence or escalation?
Risky Biz Soap Box: Kill your own meat with EclecticIQ
The CyberWire
Fancy Bear's Roman Holiday. RAT phishing in Ukraine. AWS S3 bucket leaks robocaller data. Bug or abuse? NIST to withdraw outdated cybersecurity publications. Content moderation.
Magnibur ransomware spreads. LabCorp discloses suspicious incident on its networks. Spectre, Meltdown notes. Oracle patches. Helsinki summit backing and filling and backing.
Trump-Putin summit. East Asian cyberespionage campaigns. Vulnerable DVRs. Concern about census security.
DNI warns of cyber threats. Russo-US summit. Mueller investigation and indictments. Huawei agonists. Congress reconsiders ZTE reinstatement. Kaspersky receives no emergency ban relief.
A new approach to mission critical systems — Research Saturday
Fancy Bear indictments. VPNFilter found in Ukrainian water-treatment chlorine plant. Comment spam. Speculative execution side-channel attacks. MDM exploits in India.
Timehop refines its breach disclosure. Speculative execution side-channel attacks described. Tech manuals offered for sale on the dark web. Twitter versus bots.
Ticketmaster paycard breach is part of a very large skimmer campaign. Chinese cyberespionage and censorship. Smartphone privacy issues. Data misuse litigation. Affirming the consequent.
More Elon Musk impersonators in social media. Cryptocurrency raided. Spearphishing in Palestine. BlackTech espionage group. Apple upgrades. Polar Flow fitness app and oversharing.
Malware infections down during World Cup matches. UK-Russia tensions. Australian National University hacked. Data breach notes. Calls for cooperation. Tell it to the Marines.
Rapid7 Whiteboard Wednesday
Security Blogs
Krebs on Security
Human Resources Firm ComplyRight Breached
‘LuminosityLink RAT’ Author Pleads Guilty
Sextortion Scam Uses Recipient’s Hacked Passwords
Notorious ‘Hijack Factory’ Shunned from Web
Patch Tuesday, July 2018 Edition
ExxonMobil Bungles Rewards Card Debut
Plant Your Flag, Mark Your Territory
How to Avoid Card Skimmers at the Pump
Supreme Court: Police Need Warrant for Mobile Location Data
AT&T, Sprint, Verizon to Stop Sharing Customer Location Data With Third Parties
Naked Security
Venmo users: time to hide your drug deals and excessive pizza consumption
Google hit with $5.1b fine in EU’s Android antitrust case
Trends in malware – ransomware, cryptojacking, what next? [PODCAST]
Automated money-laundering scheme found in free-to-play games
Could semantic icons replace passwords and PINs?
21-year-old spy tool developer faces prison
“Astoundingly stupid” Kodak (not really) Bitcoin miner bites the dust
Don’t take fright – get web security right [PODCAST]
How to spoof someone’s GPS navigation to send them the wrong way
Welcome to the wonderful world of GDPR! Where next? [PODCAST]
Schneier on Security
Linux Security
Dark Reading
70 US Election Jurisdictions Adopt Free Website Security Service
Cyberattacks in Finland Surge During Trump-Putin Summit
Robotic Vacuums May Hoover Your Data
The Fundamental Flaw in Security Awareness Programs
Free New Scanner Aims to Protect Home Networks
6 Ways to Tell an Insider Has Gone Rogue
Beyond Passwords: Why Your Company Should Rethink Authentication
Number of Retailers Impacted by Breaches Doubles
Microsoft Identity Bounty Program Pays $500 to $100,000 for Bugs
Messenger Apps Top Risk Hit Parade
Securing the Human
Darknet
NetBScanner – NetBIOS Network Scanner
Metta – Information Security Adversarial Simulation Tool
Powershell-RAT – Gmail Exfiltration RAT
SCADA Hacking – Industrial Systems Woefully Insecure
airgeddon – Wireless Security Auditing Script
Acunetix v12 – More Comprehensive More Accurate & 2x Faster
CloudFrunt – Identify Misconfigured CloudFront Domains
Airbash – Fully Automated WPA PSK Handshake Capture Script
XXEinjector – Automatic XXE Injection Tool For Exploitation
Yahoo! Fined 35 Million USD For Late Disclosure Of Hack
Securelist
Whitehat Security Blog
HITB News
The State Bank of Vietnam Suspends Import of Crypto Mining Hardware
Bitmain to launch IPO in Hong Kong Stock Exchange
$1 million heist on Russian bank started with hack of branch router
Gov Report Warns UK Telecoms May Face Security Risk from Huawei
Chinese hackers struck days before Helsinki summit
HSBC Global Head of Digital Says the Bank Is ‘Cautiously Looking’ at Crypto Investment
DOJ drops massive report on its efforts to protect U.S. from cyberattacks
Facial recognition helped identify suspects in Novichok poisoning case
New MacBook Pro keyboard design may fix dust problems after all
Microsoft posts bumper Q4, with Windows, Surface, Azure all up
TAO Security
Securiteam
SSD Advisory – phpMyAdmin File Inclusion and Remote Code Execution
Hack2Win eXtreme Warm Up
beVX Conference Challenge – HiTB
SSD Advisory – QRadar Remote Command Execution
SSD Advisory – Linux AF_LLC Double Free
SSD Advisory – TrustPort Management Unauthenticated Remote Code Execution
SSD Advisory – TerraMaster TOS Unauthenticated Remote Command Execution
The RISKS Digest
Re: Google is training machines to predict when a patient will die
The Complexity of Simply Searching For Medical Advice
Risk and cost/benefit ...
Watch that keyboard!
Inside China Dystopian Dreams
PayPal Apologizes for Letter Demanding Payment From Woman Who Died of Cancer
This keyboard attack steals passwords by reading heat from your fingers
Meet Scrub 50, the robot cleaner
Video: Gavin Williamson hilariously interrupted by Siri during statement to Parliament
FACEPTION
Forbes - Security
Kaspersky Blog
Enhancing Office 365’s detection and antispam
CoinVault: Caught red-handed
Transatlantic Cable podcast, episode 46
The Good, the bad, or the ugly?
Security awareness for local public administrations
Recently leaked malware source code isn’t Carbanak
Transatlantic Cable podcast, episode 45
10 tips to improve your Internet privacy
The weird and wonderful side of information security
Are data breaches stressing you out?
Adam Shostack & friends
Graham Cluley
Hackers automate the laundering of money via Clash of Clans
Microsoft offers up to $100,000 to identity bug finders
Smashing Security #087: How Russia hacked the US election
£200,000 fine for exposing possible child abuse victims in classic Cc/Bcc email blunder
Elon Musk retracts vile Twitter accusation against cave rescuer
Business email compromise scams have netted $12.5 billion, says FBI
21-year-old woman charged with hacking Selena Gomez
IoT search engine exposes passwords of over 30,000 vulnerable DVRs
Get FREE threat intelligence on hackers and exploits with the Recorded Future Cyber Daily
Free eBook: If your friend was put in charge of a cyber budget, what advice would you give them?
Rapid7
Open Source Security Meetup (OSSM): Vegas 2018
Password Tips from a Pen Tester: What is Your Company’s Default Password?
How to Use Metasploit Teradata Modules
Threat Intel Book Club: July recap, August sign-up
Azure Security Center and Active Directory Now Integrate with the Rapid7 Platform
Metasploit Wrapup
How to Build Your Own Caller ID Spoofer: Part 2
Building a Tech Stack to Enable Security Orchestration and Automation
Customer Spotlight: Why Evercore Invests in InsightVM for Security Visibility and Reporting
Patch Tuesday - July 2018
Help Wanted
Stack Overflow
Stack Exchange
Other Stuff
YCombinator
Darpa Shows Off Some Things You Can Do with Distributed Electric Propulsion
Hiring engineers to help change education at Clever (YC S12)
Bitcoin Money Laundering and Mueller’s 12 – A Blockchain Analysis
Review: A Counterfeit, $100 iPhone X
How the Car Keeps Americans Apart
Americans can legally download 3-D printed guns starting next month
Microsoft: Join Developer Design
Google owns duck.com and points it directly at Google search
Farewell, Google Maps
JavaScript fundamentals before learning React
Lobste.rs
Hackaday
A Super Simple ESP8266 IOT Motion Sensor
A Slightly Scientific Examination Of Epoxies
Thinking Inside The (Cardboard) Box With Nintendo Labo Hacks
Mario Candy Machine Gamifies Halloween
Energy Harvesting Design Doesn’t Need Sleep
Using Pad Printers To Add Color To Artistic PCBs
Hackers on Planet Earth, Here We Come!
Expanding the K40 Laser Cutter with Aluminum Extrusion
Delta Clipper: A 1990s Reusable Single-Stage To Orbit Spaceship Prototype
What’s Inside A Scientology E-Meter?
Ars Technica
Microsoft posts bumper Q4, with Windows, Surface, Azure all up
The 5,000% price hike that made Martin Shkreli infamous is no longer paying off
$1 million heist on Russian bank started with hack of branch router
“Fingerprint” of humanity’s climate impact seen in the seasons
New MacBook Pro keyboard design may fix dust problems after all
Project Loon signs its first deal for Internet-delivering balloons—in Kenya
FCC votes against Sinclair/Tribune merger, likely dooming deal
Halo devs not working on battle royale mode for Infinite
Ars on your lunch break: The consequences of a government genetic database
Gorilla Glass 6 tackles the problem of cumulative smartphone damage
Wired
Comic-Con 2018: *Doctor Who*’s First Female Doctor Will Bring a New Generation of Whovians
The Stars of the Comic-Con 'Predator' Panel? Thomas Jane's Feet
Uganda's Regressive Social Media Tax Stays, at Least For Now
How a #MeToo Facebook Group Became a Tool for Harassment
Overlooked '80s Sci-Fi Flicks, Recalled by Wired Readers
How to Make Newborn Guitars Look Artfully Ancient
What's Really Behind Apple's New MacBook Pro Keyboard
Tired of Waiting For 'Kingdom Hearts III'? Check Your Phone
Gorilla Glass 6 Is More Durable and Built For the Future
Nonprofit for Migrants Declines a Donation from Salesforce
Slashdot
Roku's New Wireless Speakers Automatically Turn Loud Commercials Down, Turn Show Audio Up
Things Are Going From Bad To Worse For Apple In India
Apple Won't Replace Faulty MacBook Pro Keyboards With Third-Gen Components
Microsoft and National Geographic Team Up on AI Research Grant
Uber Faces Federal Investigation Over Alleged Gender Discrimination
Amazon's Curious Case of the $2,630.52 Used Paperback
Jeff Bezos Becomes the Richest Man In Modern History, Topping $150 Billion
Amazon Suffers Glitches at the Start of Prime Day
Study Suggests Buried Internet Infrastructure at Risk as Sea Levels Rise
Skype 8.0 Launches on Desktop With Full-HD Video; To Soon Get Encryption and Call Recording Features
DZone
The Sensu Prometheus Collector
Nearby API Pre-Connection Phase
Single Sign-On Solutions in Mobile for Native Applications
Myth 13: The Scrum Master Can't Remove People from the Scrum Team
Moneyball: Data Science in Pure Java With Smile and Tablesaw
Building Highly-Available Apps With IBM Container Service, Kubernetes, and Rancher 2.0
Understanding Backup and Restore Operations in SQL Server Docker Containers
What Is React?
The Ideal Warehouse Architecture? It’s in The Cloud
Accelerate SaaS CI/CD With a Repository Manager