With the recent release of BloodHound’s ACL Attack Path Update as well as the work on Active Directory DACL backdooring by @_wald0 and myself (whitepaper here), I started to investigate ACL-based…

The Apache Foundation has released security updates to address vulnerabilities in Apache Tomcat. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected server. 

The existence of Uber's access to special iPhone functions is not disclosed in any consumer-facing information included with its app.

A report in The Wall Street Journal says that hackers working for the Russian government stole sensitive documents from a NSA contractor's home computer. The story goes on to say the contractor was targeted after the files were discovered by Kaspersky's Anti…

Earlier today, Apple has issued an emergency update for macOS High Sierra to address a bug that exposed the passwords of encrypted APFS volumes via the password hint feature.

When an attacker penetrates an organization’s computer network and lays hold of institutional or personal data, the effects can be devastating. A company is likely to lose any of the following in the wake of a breach: reputation, time spent dealing.

Russian hackers were able to identify the material and access the contractor's home machine because he was using Kaspersky software, a former official said.

In recent years, there is an increasing attention to the UEFI BIOS security. As a result, there are more advanced technologies created to protect UEFI BIOS from illegal modifications. One of such technologies is Intel Boot Guard (BG) – a hardware-assisted…

We conclude the Critical Security Control series with number twenty. Penetration tests. You have all the other controls in place, your teams running with synergy, and you are protected. Now you need to prove it through testing. Actively, and in a controlled…

Layered security mechanisms are forcefully promoted by industry standards such as PCI DSS and (briefly) the OWASP Top 10 . In this post, ...

Posted by Mateusz Jurczyk of Google Project Zero Patch diffing is a common technique of comparing two binary builds of the same code – ...

We are all tired of logins and passwords, and the promise of switching to the use of biometrics to replace all of that.  The new Apple phone has done a fantastic job of explaining what’s possible for going way beyond the easy to hack fingerprint to the facial…

1 points and 0 comments so far on reddit

Vulnerability management is an important element of creating a secure networking environment.  Join Mike Vasquez, Senior Technical Instructor at StormWind Studios, as we discuss vulnerability management and tools for companies of all sizes. Learn how to make…

Turning off your Bluetooth and Wi-Fi radios when you’re not using them is good security practice (not to mention good for your battery usage). When you consider Bluetooth’s known vulnerabilities, it’s especially important to make sure your Bluetooth and Wi…

Through a failed login example, we illustrates how playbooks can be configured to read end user responses, analyze them, and perform subsequent actions.

Let’s imagine you are given a task to fix a web bug that is filed by someone. You will have to understand what is the bug, find the…

How to create an iOS profile for iPad and iPhone that automatically connects you to different VPNs (e.g. Meraki, FRITZ!Box and Streisand)

So, Disqus has been hacked. Yeah, it is what we at BetaNews — plus many other websites — use for commenting. Should you be worried? Probably not. You see, this hack happened all the way…

The problematic implacations of SESTA, PR troubles for CBS's Showtime after cryptocoin mining software was found embedded in their webpage & much more!