The freshest blend of the latest security news
|
IT Security News Security in Mainstream Media Social Media |
Tools Exploits Vulnerabilities |
Security Videos & Podcasts Security Blogs Other Stuff |
Colour scheme |
IT Security News
PacketStorm
Hackers Steal Credit Cards From Newegg, Researchers Say
Mirai Botnet Creators Praised For Helping FBI, Won't Serve Prison Time
US State Department Confirms Staff Email Hack
Hackers Peddle Thousands Of Air Miles On The Dark Web For Pocket Money
US Judge Allows E-Voting Despite Hack Fears
Facebook Now Offers Bounties For Access Token Exposure
A History Of Badgelife, Def Con's Unlikely Obsession With Artistic Circuit Boards
14 Million Records Exposed In GovPayNow Leak
"Lawful Intercept" Pegasus Spyware Found Deployed In 45 Countries
MongoDB Leaks 11 Million User Records From E-Mail Marketing Service
The Register
Oi, you. Equifax. Cough up half a million quid for fumbling 15 million Brits' personal info to hackers
Patch for EE's 4G Wi-Fi mini modem nails local privilege escalation flaw
Heads up: Get ready to tune in live and watch us probe insider threats menacing today's IT
National Museum of Computing to hold live Enigma code-breaking demo with a Bombe
Why waste away in a cubicle when you could be a goddamn infosec neuromancer on £50k*?
Who ate all the PII? Not the blockchain, thankfully
Judge: Georgia's e-vote machines are awful – but go ahead and use them
US State Department confirms: Unclassified staff email boxes hacked
Remote access bug turns Western Digital My Cloud into Everyone's Cloud
'I am admin' bug turns WD's My Cloud boxes into Everyone's Cloud
Security Bloggers Network
FreeRADIUS Alternative
The Joy of Tech®’s ‘Who’s The Fairest’
Targeting the Brand: Your C-Suite May Be at Risk
Fuzzing Bitcoin with the Defensics SDK, part 1: Create your network
Creating Custom CloudTrail Rules in Threat Stack
How to Train Call & Contact Centers for PCI DSS Compliance
GrrCon Augusta 2018, Dr. Jared DeMott’s ‘How To Conduct A Product Security Test: And How it Fits Into The Larger Security Strategy’
Mirai Botnet Authors Avoid Jail Time
The latest cloud hosting service to serve malware
PoSeidon Malware
ThreatPost
Mirai Masterminds Helping FBI Snuff Out Cybercrime
Critical Out-of-Band Patch Issued for Adobe Acrobat Reader
A Hybrid Solution to Taming SOC Alert Overload
XBash Malware Packs Double Punch: Destroys Data and Mines for Crypto Coins
ThreatList: Malware Samples Targeting IoT More Than Double in 2018
State Government Online Payment Service Exposes 14M Customers
Dangerous Pegasus Spyware Has Spread to 45 Countries
Insiders Continue to be Data Theft’s Best Friend
Zero-Day Bug Allows Hackers to Access CCTV Surveillance Cameras
Facebook Now Offers Bounties For Access Token Exposure
ISC SANS
Certificates Revisited - SSL VPN Certificates 2 Ways, (Wed, Sep 19th)
ISC Stormcast For Wednesday, September 19th 2018 https://isc.sans.edu/podcastdetail.html?id=6174, (Wed, Sep 19th)
Using Certificate Transparency as an Attack / Defense Tool, (Tue, Sep 18th)
iOS 12 is out today - Updates for Safari, watchOS, tvOS, iOS. Full details here https://support.apple.com/en-ca/HT201222, (Tue, Sep 18th)
ISC Stormcast For Tuesday, September 18th 2018 https://isc.sans.edu/podcastdetail.html?id=6172, (Tue, Sep 18th)
Dissecting Malicious MS Office Docs, (Mon, Sep 17th)
ISC Stormcast For Monday, September 17th 2018 https://isc.sans.edu/podcastdetail.html?id=6170, (Mon, Sep 17th)
20/20 malware vision, (Sun, Sep 16th)
User Agent String "$ua.tools.random()" ? 🙂 !, (Sat, Sep 15th)
Sextortion - Follow the Money Update, (Fri, Sep 14th)
digitalmunition
4Nonimizer – A Tol For Anonymizing The Public IP Used To Browsing Internet, Managing The Connection To TOR Network And To Different VPNs Providers
One year later BlueBorne disclosure, over 2 Billion devices are still vulnerable
Leaked? 2.0 – A Checking Tool For Hash Codes, Passwords And Emails Leaked
Google Android team found high severity flaw in Honeywell Android-based handheld computers
CyberChef – The Cyber Swiss Army Knife [A Web App For Encryption, Encoding, Compression And Data Analysis]
Researcher devised a new CSS & HTML attack that causes iPhone reboot or freezes Macs
HashPump – A Tool To Exploit The Hash Length Extension Attack In Various Hashing Algorithms
Operator at kayo.moe found a 42M Record Credential Stuffing Data ready to use
Wildpwn – Unix Wildcard Attack Tool
Hershell – Simple TCP reverse shell written in Go
eHacking News
Trade Secrets of GM, Tesla, Volkswagen,Toyota Out In Open
DNS rebinding rerun haunts cyber world
A Botnet Compromises 18,000 Huawei Routers
Ukraine Police Detain Hacker Who Distributed A Crypto-Mining Malware
Hackers account for 90% of login attempts at online retailers
Tech titan discloses new vulnerabilities
Child sex abuse inquiry fined £200,000 for disclosing victims
Ubisoft games hit by DDoS atacks
US' Largest Medical Laboratory Shut Down Its System Over Data Breach Fear
DanaBot Trojan steals sensitive information of bank customers
Wired - Security
DIY Gun Activist Cody Wilson Accused of Child Sexual Assault
John Deere Just Cost Farmers Their Right to Repair
The Collateral Damage of Trump's Extreme Declassifications
The Mirai Botnet Architects Are Now Fighting Crime With the FBI
Palmer Luckey Is Just Getting Started
Edward Snowden on Protecting Activists Against Surveillance
Facebook Broadens Its Bug Bounty to Include Third-Party Apps
Kid-Focused Apps Track Location, UK Spying, and More Security News This Week
A Decade-Old Attack Can Break the Encryption of Most PCs
Why Big Tech and the Government Need to Work Together
Security in Mainstream Media
Google News Hacking
Inside Track: Right Click for Not Happy. Plus, Hacking in the Rain and In-House Movers
Sen. Wyden Warns That Foreign Governments Are Hacking Senators and Their Aides
Weak passwords prone to hacking
Government Hacking Raises New Security Concerns
Access to over 3000 backdoored sites sold on Russian hacking forum
Hackers installed 'sophisticated' malware on Newegg's servers to steal customer data
Hackers To The Rescue – Defining Good Hacking
Microsoft's anti-hacking efforts make it an internet cop
Why voting machines in the US are easy targets for hackers
Google Cyber Security
US DoD Cybersecurity Market, Forecast to 2023
Shanahan: cybersecurity will become new measure for industry
Options Abound for Cyber Security Jobseekers, but Finding the Right Fit Takes Work
Fintech Firm Rolls Out New Cybersecurity Platform
How's your cybersecurity posture? Answer these 5 crucial security questions
Digital Substation Cybersecurity Challenge
Inside China's Latest Cybersecurity Regulation Proposal
Singapore to draw up formal Asean mechanism for cyber security
Cybersecurity Can Boost Plant Productivity
Social Media
Digg - Hack
Digg - Security
Slashdot - Rights
Saint Louis University Is Outfitting Student Living Spaces With Thousands of Echo Dots
'Americans Own Less Stuff, and That's Reason To Be Nervous'
Stolen Android Anti-Piracy Software Dumped On Github
Volkswagen's CEO Was Told About Emissions Software Months Before Scandal, Says Report
Does Gmail's 'Confidential Mode' Go Far Enough?
HUD Files Complaint Alleging Facebook Ad Tools Allow Housing Discrimination
Egypt Fights Terrorism By Censoring Web Sites, Threatening Jail Time For Accessing Them
Australians Who Won't Unlock Their Phones Could Face 10 Years In Jail
H-1B Visa Use Soared Last Year At Major Tech Firms
EU Accepts Resolution Abolishing Planned Obsolescence, Making Devices Easier to Repair
DZone Security
How Does a Code Signing Certificate Help to Protect Developer’s Android Apps?
The Future of the Blockchain: Use Cases, Potential Risks, and Challenges
The Magic of AI in Static Application Security Testing
Why Are So Many Companies Getting Hacked, and What Can Be Done About It?
Grappling With Data Every Day, Organizations Must Consider Data Security
JEP 342: The JVM and Spectre
[DZone Research] Developers as Security Professionals
Security Through Blockchain
Designing a Zero-Trust Environment for Cloud Native
Fintech Trends: With Great Change Comes Enormous Opportunity
Social Media > Reddit
Reddit - NetSec
Why You Should not store sensitive data in Javascript files
Why You Shouldn’t Store Sensitive Data in JavaScript Files
O11ycast | Ep. #5, InfoSec with Gartner's Anton Chuvakin
Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows
Magecart Strikes Again: Newegg in the Crosshairs
Online retailer Newegg beached by Magecart group as well
Using cloud-services, security is your job too
HIDE AND SEEK: Tracking NSO Group’s Pegasus Spyware to Operations in 45 Countries
Ransombile: Yet another reason to ditch SMS
Hunting mobile devices endpoints - the RF and the hard way
Reddit - AskNetSec
Reddit - Cyberpunk
Thought this belonged here: BBC Arts - Neon dreamland: Atmospheric photographs of Tokyo after dark
Hong Kong - source: www.instagram.com/noealzi
Soldier armed with a Drone Jammer, Taksim Square, Istambul.
If the ULA was an evil megacorp of the future
Why does most if not all cyberpunk not have extraterrestrials?
Selling Your Data with Blockchain Tech
Something about this gives me all the feels
Soldier type 3
Sophia by vombavr
Animated - System Resistor 4. by hybridgothica
Reddit - Crypto
I really need some help
Is it correct that quantum computers could break Ed25519 using Shor's?
secp256k1 benchmark on Mac OS
Join first time mega Airdrops
What type of Cipher is this? (Key of Skeleton, Steven Wilson's Hand. Cannot. Erase.)
Decryption that can be done only in a finite amount of time.
How to best deal with crypto volatility
[Q] Solve a*x = b (mod N) with GCD(a,N)≠1 and GCD(a,N) divides b
Reddit - Lockpicking
First open with a gun 🙂
1100 done and done. Now to get her on film...used a home made TOK wrench with it as well
White Belt....here I come. 2 locks/2 opens
I counter-counter-raise your car key. here's my truck key
Security Pin Series Ep.8 - "Kerberos" Security Pin
9th Annual Lancaster Lock Show (July 13-14, 2018)
Kwikset Smartkey (Generation 3) Pick and Gut + Tool
Reddit - Malware
Blocking program internet access
System volume Information malware from pendrive to computer
What tools would need to perform your analysis Efficiently and faster?
Vigilante Botnet Infects Computers to Remove Cryptocurrency Malware
New malware distribution vector: drive-by petting
The Western Union Website Hack
Virusshare.com : Some problems
The anatomy of a .NET malware dropper by @cybereason @0xamit
PyLocky Source Code
Payload Distribution Format (Malware Analysis/Forensics) (X-Post)
Reddit - Netsec Students
How to make a virtualbox VM a separate computer from a network point of view?
How to DETECT malicious urls before getting HACKED (VIDEO DEMO) – Cyber Wizard
Building a Feedback Based Fuzzer (DevLog)
What's your best ressource to pentest an app in Node.js
PWK and OSCP Review
CTP and OSCE Review
Did some wardriving, found IoT device as a client on my network when scanned
FireEye Thread Map, do you understand it?
Mentor and Mentee for Infosec
Jobs - Most indemand areas
Reddit - Onions
Its for the memes man!
What would you look for in a marketplace?
Mhm, any carding sites?
Was Tapiin taken down?
RUSSIAN SITES EVERYWHERE (DARK WEB BROWSING)
Deposit your coins, for new ones
My country opens all mail unless it's only paper, strict customs and intelligence
help me
Downloaded something while using tor, first time browsing, what do I do now?
Newbie Tuesdays - Don't know where to start? Worried about your security? Other questions? Post in here!
Reddit - Privacy
Deep Dive - No YouTube - Text Based Content
Facebook @Workplace?
YouTube trackers
Nowhere To Hide: A (2018) Documentary which shows the insane amount of surveillance that is part of our everyday life. (1:26:00)
This Windows file (WaitList.dat) may be secretly hoarding your passwords and emails
Google AMP is Not a Good Thing - "If this were to become widely adopted, you’d search for something, get results, consume the content, and you’d never leave Google."
Where do people finders get their information from?
Password Manager.
Do you care about your privacy? Maybe it is time to set up your own Dropbox.
Privacy-friendly alternative to Discord
Reddit - Pwned
Getting nutmeg
Companies with data breaches in 2018
Ususjsjd
Australian Government National Health Practitioner Ombudsman and Privacy Commissioner leaks database
"Have I been Pwned" V3 passwords 95% cracked on Hashes.org
MyEtherWallet HOLA VPN Compromised
Hackers caught selling access to airport security systems for $10
Macy’s, Bloomingdales Alert Online Customers of Data Breach
Compromising User Account- ”How I was able to compromise user account via HTTP Parameter Pollution(HPP) in Indian Online Shopping Website”
I think I experienced a cyber crime while employed in a major sports league and need help understanding what happened.
Reddit - Reverse Engineering
Reddit - Security CTF
machine learning model, game boy and obfuscated powershell
Newly Published CTF writeups
Recently Published CFTs Writeup
LazySysAdmin: 1 Walkthrough
Reddit - Social Engineering
Started university, need advice/help on how to approach more people (girls mainly)
How do you deal with people who try to provoke you?
How to Discourage Others From Taking Your Work for Granted
Need help with an insecure coworker who is also a control freak
Will political correctness end up revising and censoring history in order to sanitize it of all conflict?
Asking deep questions and getting interesting answers.
How to deal with manipulative and cunning colleague, have never met anyone like this before
In order to advance the world at a rapid rate, the mindset in society must change from crab in a bucket to "each one teach one".
Don't be an NPC (Non Playable Character)
I'm looking for podcasts / learning resources recommendations
Reddit - Sysadmin
How do you secure your private keys?
Bitlocker on Hyper V VM - how to move?
Windows Server 2029
How do you prevent Candy Crush on Windows 10 Pro 1803 from installing if the app is never provisioned in the first place on first logon?
Reddit - Bitcoin
Reddit - CryptoCurrency
XSN Hardware update and EPoS innovation
Does your coin work in the jungles of Brazil? #ProofOfJungle
PNC Bank Hops Into Blockchain Bandwagon and Joins RippleNet
CryptoTwitter can always make us laugh
Kraken CEO with Yet Another Great Response to NY Regulators
It looks like CCEX has stolen the XTRABTYES from all it's users accounts and blocked them, luckily the team is reimbursing those affected, this is how you deal with an exchange scam
Proof of What? An overview of all the different consensus mechanisms out there [r/CryptoCurrency Event]
A Local butcher shop in my little city in Venezuela started taking payments in crypto to combat Inflation, they even give you discounts for paying in crypto!
Today I started putting money back in the market
Binance CEO and founder Zhao Changpeng announced an ambitious plan to build 5-10 fiat-to-crypto exchanges in the next year!
Reddit - VPN
Recommendations for LTE router that supports VPN tunnels ?
Traffic over private VPS blocked by DAZN
VPN within single browser only?
L2TP router and excepting certain devices on network
Using a home-hosted VPN to access the Internet from work
New to this, getting my first VPN to ease my travel experience. I see that there seem to be no data limits on these services, except for Luminati. Am I looking at comparable products?
WSJ: Why You Need a VPN—and How to Choose the Right One
Buying Steam games in a region-locked region - can I activate then start the download, and turn vpn off and continue the download?
VPN stopped working (Turbo and Hotspot)
Downloaded accidentally The Anarchist Cookbook on a VPN at school on my mobile. Am I safe?
Tools
CyberPunk nowhere.net
Mail Security Testing Framework
Tor Browser for Android
Advanced Network Reconnaissance Toolkit: badKarma
PowerShell Front-End for Windows Debugger Engine: DbgShell
DNS Rebinding Attack Framework: Singularity
CLI for Ephemeral Penetration Testing: hideNsneak
PacketWhisper Exfiltration Toolset
Mobile Application Testing Toolkit: Scrounger
Dynamic Binary Analysis Tool: Manticore
The Offensive Web Application Penetration Testing Framework: TIDoS
Exploits
Packet Storm Exploits
Exploit-DB Webapps
[webapps] Zimbra 8.6.0_GA_1153 - Cross-Site Scripting
[webapps] MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting
[webapps] MyBB Like Plugin 3.0.0 - Cross-Site Scripting
[webapps] TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Remote Reboot)
[webapps] TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Information Disclosure)
[webapps] LG-Ericsson iPECS NMS 30M - Directory Traversal
[webapps] osTicket 1.10.1 - Arbitrary File Upload
[webapps] OpenEMR < 5.0.1 - Remote Code Execution
Exploit-DB Local and Privilege Escalation
[local] ADB Broadband Gateways / Routers - Local Root Jailbreak
[local] ADB Broadband Gateways / Routers - Privilege Escalation
[local] Boxoft WAV to MP3 Converter 1.1 - Buffer Overflow (Metasploit)
[local] Enhanced Mitigation Experience Toolkit (EMET) - XML External Entity Injection
[local] Dell EMC RecoverPoint < 5.1.2 - Local Root Command Execution
[local] Nikto 2.1.6 - CSV Injection
[local] Pale Moon Browser < 27.9.3 - Use After Free (PoC)
[local] Audiograbber 1.83 - Local Buffer Overflow (SEH)
[local] Redis-cli < 5.0 - Buffer Overflow (PoC)
Exploit-DB Shellcode
[shellcode] Linux/x86 - Bind (4444/TCP) Shell (/bin/sh) + IPv6 Shellcode (100 bytes)
[shellcode] Linux/x64 - Reverse (::1:1337/TCP) Shell (/bin/sh) + IPv6 + Password (pwnd) Shellcode (115 bytes)
[shellcode] Linux/ARM - Bind (1234/TCP) Shell (/bin/sh) Shellcode (104 bytes)
[shellcode] Linux/x86 - Kill Process Shellcode (20 bytes)
[shellcode] Linux/x86 - Execve /bin/cat /etc/passwd Shellcode (37 bytes)
[shellcode] Linux/ARM - Egghunter (0x50905090) + execve('/bin/sh') Shellcode (60 bytes)
[shellcode] Linux/x86 - Egghunter (0xdeadbeef) + access() + execve(/bin/sh) Shellcode (38 bytes)
[shellcode] Linux/x86 - Bind (4444/TCP) Shell (/bin/sh) Shellcode (105 bytes)
[shellcode] Linux/ARM - Egghunter (x50x90x50x90) + execve('/bin/sh') Shellcode (32 bytes)
[shellcode] Linux/x86 - Bind (5555/TCP) Shell Shellcode (98 bytes)
Exploit-DB Papers
[papers] [Hebrew] Digital Whisper Security Magazine #93
[papers] [Hebrew] Digital Whisper Security Magazine #92
[papers] [Hebrew] Digital Whisper Security Magazine #95
[papers] [Hebrew] Digital Whisper Security Magazine #94
[papers] [Hebrew] Digital Whisper Security Magazine #97
[papers] [Hebrew] Digital Whisper Security Magazine #96
[papers] Protecting apps against Jailbreaking and Rooting
[papers] File Upload Restrictions Bypass
[papers] VLAN Hopping Attack
[papers] Abusing Kerberos - Kerberoasting
Exploit-DB Remote
[remote] WebKit - not_number defineProperties UAF (Metasploit)
[remote] CyberArk < 10 - Memory Disclosure
[remote] Git < 2.17.1 - Remote Code Execution
[remote] CloudMe Sync < 1.11.0 - Buffer Overflow (SEH) (DEP Bypass)
[remote] Bitmain Antminer D3/L3+/S9 - Remote Command Execution
[remote] D-Link DSL-2750B - OS Command Injection (Metasploit)
[remote] mySCADA myPRO 7 - Hard-Coded Credentials
[remote] HPE iMC 7.3 - Remote Code Execution (Metasploit)
[remote] Nanopool Claymore Dual Miner 7.3 - Remote Code Execution
[remote] Jenkins CLI - HTTP Java Deserialization (Metasploit)
Vulnerabilities
Security Focus Vulnerabilities
More rss feeds from SecurityFocus
Bugtraq: [CVE-2018-12584] Heap overflow vulnerability in reSIProcate through 1.10.2
Bugtraq: [SECURITY] [DSA 4267-1] kamailio security update
Bugtraq: [SECURITY] [DSA 4269-1] postgresql-9.6 security update
Bugtraq: [SECURITY] [DSA 4268-1] openjdk-8 security update
Vuln: Adobe Flash Player CVE-2018-15967 Unspecified Information Disclosure Vulnerability
Vuln: Apache SpamAssassin CVE-2017-15705 Denial of Service Vulnerability
Vuln: Apache Camel CVE-2018-8041 Directory Traversal Vulnerability
Vuln: Google Chrome Unspecified Security Vulnerabilities
Vuln: Moodle CVE-2018-14630 Remote Code Execution Vulnerability
Bugtraq
[SECURITY] [DSA 4297-1] chromium-browser security update
Authentication bypass vulnerability in Western Digital My Cloud allows escalation to admin privileges
SEC Consult SA-20180918-0 :: Remote Code Execution via PHP unserialize in Moodle open-source learning platform
APPLE-SA-2018-9-17-5 Apple Support 2.4 for iOS
race condition in .net core System.IO.Directory.Delete allowing deletion of entire drives
APPLE-SA-2018-9-17-3 tvOS 12
APPLE-SA-2018-9-17-4 Safari 12
APPLE-SA-2018-9-17-1 iOS 12
APPLE-SA-2018-9-17-2 watchOS 5
Disclose SSRF Vulnerability
Full Disclosure
DSA-2018-101: Dell EMC Unity Family Multiple Vulnerabilities
Authentication bypass vulnerability in Western Digital My Cloud allows escalation to admin privileges
SEC Consult SA-20180918-0 :: Remote Code Execution via PHP unserialize in Moodle open-source learning platform
APPLE-SA-2018-9-17-5 Apple Support 2.4 for iOS
APPLE-SA-2018-9-17-4 Safari 12
APPLE-SA-2018-9-17-3 tvOS 12
APPLE-SA-2018-9-17-1 iOS 12
APPLE-SA-2018-9-17-2 watchOS 5
Multiple Vulnerabilities in Oracle WebCenter Interaction 10.3.3
[CVE-2018-16225] QBee MultiSensor Camera LAN Traffic Vulnerability
Security Videos & Podcasts
Security Tube
[News] US: China hacking 'repeatedly raised at highest level'
[News] Firefox 19 Fixes HTTPS Phishing Issue, Adds Built-In PDF Viewer
[News] Apple, Facebook, Twitter hacks said to hail from Eastern Europe
[News] Botnet master abuses Facebook for pocket money, researchers reveal
[News] Apple Breached by Facebook Hackers Using Java Exploit
[News] New Mac malware opens secure reverse shell
[News] Apple patches the Java hole its own developers fell into - eventually
GrrCon 2017 - Threat Intelligence: Zero to Basics in presentation
[News] McAfee finds sophisticated attacks targeting other 'critical sectors' of the economy
[News] Why encryption doesn't solve the data sovereignty debate
Hak5
Security Weekly
April Wright, ArchitectSecurity.org – Application Security Weekly #32
Bluebox-ng, Stock Data Breaches, and CommitStrip- Application Security Weekly #32
Tracking Security Innovation – Business Security Weekly #99
Chris Brenton, ACM – Business Security Weekly #99
Drone Assassins, Security Shaming, and Zero-Day – Hack Naked News #189
Microsoft, Elon Musk, Kernel and Powershell – Paul’s Security Weekly #575
Bypassing PAM, Eyal Neemany – Paul’s Security Weekly #575
Brian Coulson, LogRhythm – Paul’s Security Weekly #575
CLEAR, Demisto, OneLogin & Netskope – Enterprise Security Weekly #106
Dave Maestas, Bandura – Enterprise Security Weekly #106
Risky.Biz
Risky Business #514 -- New NSO Group report released and another State Department email breach. Drink!
Risky Business #513 -- The DPRK indictment, BA gets owned, Webauthn issues and more [CORRECTED]
Snake Oilers 7 part 2: Assetnote.io launch, InQuest and Aiculus
Risky Business #512 -- Five Eyes nations send clear message on encryption
Risky Business feature interview: Linux malware is booming, thanks to IoT
Risky Business #511 -- Australia, Japan to ban Huawei, Struts drama, DNC lols and more
Snake Oilers 7 part 1: Rapid7 on changes to InsightVM, ITProTV on online training
Risky Business feature interview: Bob Lord, CSO, Democratic National Committee
Risky Business #510 -- Hacky hack hack
Risky Business feature: Adam Boileau recaps Black Hat and DEF CON
The CyberWire
Fancy Bear bogus sites taken down. Some in the US Congress think they want hack-back laws. Cyber and sanctions. Operation Red Signature. Doxing Chinese Intelligence. Buggy medical devices.
Beers with Talos — Live from the RiRa at Black Hat
DarkHotel is back. So is Necurs, and it's distributing a modular malware dropper. Industrial espionage follows international trade. Election meddling. The use and abuse of data.
Stealthy ad fraud campaign evades detection. — Research Saturday
Election risks—hacking and influence. Chinese industrial espionage spike. Misconfigured project management. Necurs appears briefly. Bogus Fortnite downloads. What they heard in the banya.
Hacking Old Man River. Nation-state cyber conflict: objectives and norms of behavior. Australia's new cyber laws. ATM campaign. Lawsuits, and the Dread Pirate Robert asks for pardon.
Notes on patching. Foreshadow speculative execution vulnerability. Influence operations. The FBI's new cyber chief. Are stickers a temptation to thieves, hackers, and customs officers?
Cryptowars notes. DDoS in Finland. Bears aren't under the beds; they're in the routers. Smart city attack surfaces. Sanction notes. Training through puzzle-solving .
Spyware for states and spouses. Election hacking demos. New ransomware strains, and a clipper for Android. Airline Wi-Fi is not only irritating, but insecure as well.
Rapid7 Whiteboard Wednesday
Security Blogs
Krebs on Security
Mirai Botnet Authors Avoid Jail Time
GovPayNow.com Leaks 14M+ Records
U.S. Mobile Giants Want to be Your Online Identity
Patch Tuesday, September 2018 Edition
In a Few Days, Credit Freezes Will Be Fee-Free
Leader of DDoS-for-Hire Gang Pleads Guilty to Bomb Threats
Browser Extensions: Are They Worth the Risk?
For 2nd Time in 3 Years, Mobile Spyware Maker mSpy Leaks Millions of Sensitive Records
Alleged ‘Satori’ IoT Botnet Operator Sought Media Spotlight, Got Indicted
Instagram’s New Security Tools are a Welcome Step, But Not Enough
Naked Security
URL spoofing – what it is and what to do about it [VIDEO]
iOS 12 is here: these are the security features you need to know about
Here we Mongo again! Millions of records exposed by insecure database
Years on, third party apps still exposing Grindr users’ locations
How Facebook wants to protect political campaigners from hacking
Intel releases firmware update for ME flaw
Hackers selling research phished from universities on WhatsApp
91 “child friendly” Android apps accused of exploitation
State Department scores an F on 2FA security
Vote now! Which web browser do you trust the most?
Schneier on Security
Linux Security
Dark Reading
As Tech Drives the Business, So Do CISOs
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
Mirai Hackers' Sentence Includes No Jail Time
FBI: Phishing Attacks Aim to Swap Payroll Information
5 Steps to Success for New CISOs
8 Keys to a Successful Penetration Test
Internet-Connected CCTV Cameras Vulnerable to 'Peekaboo' Hack
The Security Costs of Cloud-Native Applications
Websites Attack Attempts Rose in Q2
The Top 5 Security Threats & Mitigations for Industrial Networks
Securing the Human
Darknet
Intercepter-NG – Android App For Hacking
dcipher – Online Hash Cracking Using Rainbow & Lookup Tables
HTTP Security Considerations – An Introduction To HTTP Basics
Cangibrina – Admin Dashboard Finder Tool
Enumall – Subdomain Discovery Using Recon-ng & AltDNS
RidRelay – SMB Relay Attack For Username Enumeration
NetBScanner – NetBIOS Network Scanner
Metta – Information Security Adversarial Simulation Tool
Powershell-RAT – Gmail Exfiltration RAT
Securelist
Whitehat Security Blog
HITB News
Security and Compliance in DevSecOps - Why DevSecOps matters
Ethereum Smart Contract Specification Impact Analysis
Russian surveillance plane got shot down by Syria—and Russia blames Israel
I dismantled Google’s tracking systems — here’s what happened
You can now use Google Maps with Apple’s CarPlay in iOS 12
Man Who Uploaded Deadpool To Facebook May Get Six Months In Prison
A quick explainer on the promise—and risks—of TrueDepth in the iPhone XS
Hands on with the hot new Apple Watch faces in watchOS 5
Apple releases iOS 12 -- update your devices now!
Just one sleepless night can tell your body to start storing fat
TAO Security
Securiteam
SSD Advisory – CloudByte ElastiStor OS Unauthenticated Remote Code Execution
SSD Advisory – VirtualBox VRDP Guest-to-Host Escape
SSD Advisory – Linux Kernel AF_PACKET Use After Free (packet_sock)
SSD Advisory – Infiniband Linux Driver UAF
SSD Advisory – LINE Corporation URI Handlers Remote Commands Execution
SSD Advisory – phpMyAdmin File Inclusion and Remote Code Execution
Hack2Win eXtreme Warm Up
beVX Conference Challenge – HiTB
The RISKS Digest
Huawei busted for cheating over P20, Honor Play performance benchmarks
New Home Dream Destroyed: Fraud Victims Fighting Back After Losing $89,000
Didi Chuxing introduces new safety measures after passenger death
These People Were Just Trying To Get To Maui When They Got On Horrible Flight Where Everything Went Wrong
Re: How FireEye Helped Facebook Spot a Disinformation Campaign
How to Rig an Election
Israel's National Insurance suspends plan for spy system
Your canines' barks may be worse then their bites
MSpy, Which Builds Software To Spy On Phones, Allegedly Leaked Millions Of Records
Officials unveil new facial recognition system at Dulles International Airport
Forbes - Security
Kaspersky Blog
What’s a guest Wi-Fi network, and why do you need one?
Unattended corporate websites cause headaches
Transatlantic Cable podcast, episode 54
CyberStarts Boston
Making two-factor authentication much stronger in two easy steps
Businesses and personal data: In-depth analysis of practices and risks
Why there’s no antivirus for iOS
Are you OK with Facebook being a middleman between you and your bank?
Transatlantic Cable podcast, episode 53
8 funs facts about fax. Yes, fax!
Adam Shostack & friends
Reflective Practice and Threat Modeling (Threat Model Thursday)
Threat Model Thursday: Legible Architecture
Toolbox: After a Conference
Aretha Franklin
Threat Modeling in 2018: Attacks, Impacts and Other Updates
CSO on AppSec at the Speed of Devops
CyberSecurity Hall of Fame
Summer Reading List
CyberSecurity 2.0 Humble Bundle
Threat Modeling Thursday: 2018
Graham Cluley
Hackers phish Butlin’s holiday camp chain, access customers’ personal data
Flaw exposed Comcast Xfinity customers’ partial home addresses and SSNs
Smashing Security #090: Fortnite for Android, and the FCC’s DDoS BS
Snapchat’s source code leaked out, and was published on GitHub
Twitter CEO says they’re taking no action against InfoWars and Alex Jones
No, Michael J Fox isn’t dead
Making millions out of prisoners’ email
You’ll have to disable a recommended Android security setting to install Fortnite
Free eBook: If your friend was put in charge of a cyber budget, what advice would you give them?
Reddit hacked - but don’t give up on 2FA just yet
Rapid7
Rapid7 Threat Intelligence Book Club: ‘Countdown to Zero Day’ Recap
This One Time on a Pen Test, Part 3: How Jumping a Fence and Donning a Disguise Helped Me Steal an Energy Company
Metasploit Wrapup
How to Identify and Prioritize Gaps with the Cybersecurity Maturity Assessment, Post-2018 'Under the Hoodie'
Faster Prod at the Expense of Security? 2018 ‘Under the Hoodie’ Reveals Gaps in Applications
Patch Tuesday - September 2018
This One Time on a Pen Test, Part 2: How Just One Flaw Helped Us Beat the Unbeatable Network
Summertime and the Coding Is (Sometimes) Easy: What I Learned During GSoC for Metasploit
Metasploit Wrapup
Accelerate Incident Response with Security Orchestration and Automation
Help Wanted
Stack Overflow
Stack Exchange
Other Stuff
YCombinator
Senate passes copyright bill to end 140-year protection for old songs
The Gap Table: Analyzing the gender gap in equity
Artificial Intelligence Threatens Jobs in Developing World
Keeping order in the General Assembly: The strange saga of a Viking gavel
There's Not Enough Time
Bitcoin Miners Flock to New York’s Remote Corners, but Get Chilly Reception
Clever (YC S12) is hiring engineers to help change education
Putting This Blog on IPFS
Briar and Bramble: A Vision for Decentralized Infrastructure
Network topologies for large-scale compute centers: It's the diameter (2016)
Lobste.rs
Hackaday
Electric Wheelbarrow Makes Hauling Big Loads Easier
Voice Controlled Stereo Balance With ESP8266
‘SHE BON’ is an Artful, Wearable, Sensual, Sensing Platform
Industrial 3D Printing Uses Layers Like We’ve Never Seen Before
Join Hackaday For A Night Of Pre-Maker Faire Hacks
Braille on a Tablet Computer
Learn To Loop The Python Way: Iterators And Generators Explained
Final Fantasy Exploit Teaches 32-bit Integer Math
Visual Schematic Diffs in KiCAD Help Find Changes
Soldering Like It’s 205 BC
Ars Technica
iOS 12.1 beta suggests a new iPad is coming this fall
Judge orders Cody Wilson’s arrest, but he skipped his return flight from Taiwan
NewEgg cracked in breach, hosted card-stealing code within its own checkout
EU investigating German automakers, alleging collusion on emissions tech
Destiny 2: Forsaken review: Hallelujah, Destiny’s back
Senate passes copyright bill to end 140-year protection for old songs
Despite data caps and throttling, industry says mobile can replace home Internet
3D-printed gun pioneer Cody Wilson accused of having sex with underage girl
Quantum observers with knowledge of quantum mechanics break reality
You can now share your Switch game downloads across consoles
Wired
Wildlife Detective Uses DNA to Link Stolen Ivory to Big Cartels
Jon M. Chu Shot This Short Film Entirely on an iPhone XS Max
The Alt-Right Are Savvy Internet Users. Stop Letting Them Surprise You
PlayStation Classic: Release Date, Price, Specs, How to Pre-Order
The Physics of a Star Wars Bomber Dropping Bombs in Space
Captain Marvel and the Long, Strange History of Female Superhero Names
Ferrari’s Monza SP1 and SP2 Mix 21st Century Tech With 1950s Cool
Why Animal Extinction Is Crippling Computer Science
Slashdot
To Gain Foothold in India, Apple Plans To Open Stores, Offer Deals All Year Around, and Fix Services: Report
Children Learn Best When Their Bodies Are Engaged in the Living World. We Must Resist the Ideology of Screen-Based Learning
'Why Liberal Arts and the Humanities Are as Important as Engineering'
Security Researchers Express Concerns Over Mozilla's New DNS Resolution For Firefox
Vint Cerf on Differential Traceability on the Internet
Security World Hits Las Vegas For a Week of Hacking, Cracking, Fun
Nonmonetary Incentives and the Implications of Work as a Source of Meaning
Traders Are Talking Up Cryptocurrencies, Then Dumping Them, Costing Others Millions
Wells Fargo Says Hundreds of Customers Lost Homes After Computer Glitch
Have Smartphones Killed the Art of Conversation?
DZone
Fear of Decoupling
Unit Testing With Entity Framework and Entity Framework Core 2.1
Reasons for Sunsetting Our Mobile Zone
How to Run Any Dockerized Application on Spring Cloud Data Flow
A Comparison of Data Visualization Tools
Make a POST Request from PHP With Guzzle
Install Drupal on Ubuntu 18.04
How Does a Code Signing Certificate Help to Protect Developer’s Android Apps?
40 Million Tables in MySQL 8.0 With ZFS
5 Not-So-Obvious Traits of a Healthy Team Culture