Why cybersecurity workers are some of the hardest to retain
http://ift.tt/2iQBuAL
Submitted November 14, 2017 at 07:44AM by dpgowan
via reddit http://ift.tt/2ADrKRO
http://ift.tt/2iQBuAL
Submitted November 14, 2017 at 07:44AM by dpgowan
via reddit http://ift.tt/2ADrKRO
VentureBeat
Why cybersecurity workers are some of the hardest to retain
Cybersecurity workers are in high demand, and the security industry may face a shortage of close to two million qualified personnel by 2022. That's concerning giving the increasing number of cyber attacks we're witnessing. But what's more concerning is that…
Quantum Computers Pose Imminent Threat to Bitcoin Security
http://ift.tt/2AtSfda
Submitted November 14, 2017 at 07:16AM by dpgowan
via reddit http://ift.tt/2ACnNge
http://ift.tt/2AtSfda
Submitted November 14, 2017 at 07:16AM by dpgowan
via reddit http://ift.tt/2ACnNge
MIT Technology Review
Quantum Computers Pose Imminent Threat to Bitcoin Security
The massive calculating power of quantum computers will be able to break Bitcoin security within 10 years, say security experts.
Bit of an odd question. I'm part of a online group that creates community-driven content. We plan this to be a long term project that will outline all of us (because we just need another idea channel out there). Do you have any suggestions as to how we could store passwords/etc safely from takeover?
No text found
Submitted November 14, 2017 at 08:32AM by sorryamhigh
via reddit http://ift.tt/2yXxYzx
No text found
Submitted November 14, 2017 at 08:32AM by sorryamhigh
via reddit http://ift.tt/2yXxYzx
reddit
Bit of an odd question. I'm part of a online group... • r/security
1 points and 0 comments so far on reddit
Professional CCTV Security Camera Installation and Wlan Deployment Services in Locust Grove, GA
http://ift.tt/2zVVQnc
Submitted November 14, 2017 at 10:54AM by anugolo
via reddit http://ift.tt/2zBfGDW
http://ift.tt/2zVVQnc
Submitted November 14, 2017 at 10:54AM by anugolo
via reddit http://ift.tt/2zBfGDW
Dnssoperations
Professional CCTV Security Camera Installation and Wlan Deployment Services in Locust Grove, GA
DNS Offering the latest in camera technology of security cameras installation and Wlan Deployment services in Locust Grove, GA. You will protect your home and
Hardening C/C++ Programs Part I – Stack Protector
http://ift.tt/2h1jljD
Submitted November 14, 2017 at 01:40PM by maxxori
via reddit http://ift.tt/2zUFTh2
http://ift.tt/2h1jljD
Submitted November 14, 2017 at 01:40PM by maxxori
via reddit http://ift.tt/2zUFTh2
Productive C++
Hardening C/C++ Programs Part I – Stack Protector
When C, C++ and the Internet were conceived, they were mostly used by academics. Attacks on computer systems were rare, since there was not much incentive to it, so there did not have to be a focus…
Multiple Vulnerabilities in Foscam C1 Indoor HD Cameras
http://ift.tt/2zUYfP5
Submitted November 14, 2017 at 02:39PM by cybergibbons
via reddit http://ift.tt/2yAKqB2
http://ift.tt/2zUYfP5
Submitted November 14, 2017 at 02:39PM by cybergibbons
via reddit http://ift.tt/2yAKqB2
Talosintelligence
Vulnerability Spotlight: Multiple Vulnerabilities in Foscam C1 Indoor HD Cameras
A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group
Chrome 61 UXSS exploit (CVE-2017-5124)
http://ift.tt/2yZqXOC
Submitted November 14, 2017 at 04:04PM by i_bo0om
via reddit http://ift.tt/2iThuOb
http://ift.tt/2yZqXOC
Submitted November 14, 2017 at 04:04PM by i_bo0om
via reddit http://ift.tt/2iThuOb
GitHub
Bo0oM/CVE-2017-5124
Chrome < 62 uxss exploit (CVE-2017-5124)
New version of the Crysis Dharma Ransomware was released on 7 November 2017
New version of the Crysis Dharma Ransomware was released on 7 November 2017, which appends the extension .cobra or more precisely [cranbery@colorendgrace.com] .cobra to encrypted files and makes the data inaccessible to PC users. http://ift.tt/2zCwzxG
Submitted November 14, 2017 at 03:39PM by ved_web_services
via reddit http://ift.tt/2AFv4vR
New version of the Crysis Dharma Ransomware was released on 7 November 2017, which appends the extension .cobra or more precisely [cranbery@colorendgrace.com] .cobra to encrypted files and makes the data inaccessible to PC users. http://ift.tt/2zCwzxG
Submitted November 14, 2017 at 03:39PM by ved_web_services
via reddit http://ift.tt/2AFv4vR
reddit
New version of the Crysis Dharma Ransomware was... • r/security
New version of the Crysis Dharma Ransomware was released on 7 November 2017, which appends the extension .cobra or more precisely ...
'Highly secure' work tool leaks documents
http://ift.tt/2hvUAzt
Submitted November 14, 2017 at 03:25PM by Benjaminsen
via reddit http://ift.tt/2idPbu8
http://ift.tt/2hvUAzt
Submitted November 14, 2017 at 03:25PM by Benjaminsen
via reddit http://ift.tt/2idPbu8
BBC News
Huddle's 'highly secure' work tool exposed KPMG and BBC files
Private files belonging to tax adviser KPMG and the BBC are exposed by Huddle's team-sharing tool.
9 steps to protect against Ransomware
http://ift.tt/2ADyRK2
Submitted November 14, 2017 at 03:07PM by BCNGroup
via reddit http://ift.tt/2iez13L
http://ift.tt/2ADyRK2
Submitted November 14, 2017 at 03:07PM by BCNGroup
via reddit http://ift.tt/2iez13L
IT Support & Consultancy - Stockport, Cheshire, Manchester & Beyond
9 steps to protect against Ransomware | IT Support & Consultancy - Stockport, Cheshire, Manchester & Beyond
Security Best Practices Ransomware attacks start in two main ways. A booby-trapped email with a malicious attachment or via a compromised website; which then work their way down to your endpoints and servers. To stop these attacks, it’s critical that you…
Tricking blind Java deserialization for a treat
http://ift.tt/2jqejRU
Submitted November 14, 2017 at 06:13PM by __sleep
via reddit http://ift.tt/2AFvS3P
http://ift.tt/2jqejRU
Submitted November 14, 2017 at 06:13PM by __sleep
via reddit http://ift.tt/2AFvS3P
Security Café
Tricking blind Java deserialization for a treat
During a black-box penetration test we encountered a Java web application which presented us with a login screen. Even though we managed to bypass the authentication mechanism, there was not much w…
Combination of 3 vulnerabilities leads to unauthenticated RCE on Xplico
http://ift.tt/2ie2NWq
Submitted November 14, 2017 at 06:50PM by wtfse
via reddit http://ift.tt/2zC7WBC
http://ift.tt/2ie2NWq
Submitted November 14, 2017 at 06:50PM by wtfse
via reddit http://ift.tt/2zC7WBC
reddit
Combination of 3 vulnerabilities leads to... • r/netsec
0 points and 0 comments so far on reddit
"Why a Phishing Click Rate of 0% is Bad"
http://ift.tt/2zJNpsq
Submitted November 14, 2017 at 07:42PM by volci
via reddit http://ift.tt/2iUe11E
http://ift.tt/2zJNpsq
Submitted November 14, 2017 at 07:42PM by volci
via reddit http://ift.tt/2iUe11E
securingthehuman.sans.org
Security Awareness Blog | Why a Phishing Click Rate of 0% is Bad
Security Awareness Blog blog pertaining to Why a Phishing Click Rate of 0% is Bad
Security In 5: Episode 111 - OWASP Top 10 - A5 - Security Misconfigurations
http://ift.tt/2AGimwW
Submitted November 14, 2017 at 07:31PM by BinaryBlog
via reddit http://ift.tt/2iVGPXt
http://ift.tt/2AGimwW
Submitted November 14, 2017 at 07:31PM by BinaryBlog
via reddit http://ift.tt/2iVGPXt
Libsyn
Security In Five Podcast: Episode 111 - OWASP Top 10 - A5 - Security Misconfigurations
Halfway through the OWASP Top 10 mini-series we reached number 5, Security Misconfigurations. This item in the top 10 shows that the OWASP covers more than the code. Security Misconfigurations deals with the entire application stack and that means more than…
A brief history of rootkits and bootkits on mobile devices.
http://ift.tt/2iUuByz
Submitted November 14, 2017 at 08:01PM by Mi3Security
via reddit http://ift.tt/2zHSJw8
http://ift.tt/2iUuByz
Submitted November 14, 2017 at 08:01PM by Mi3Security
via reddit http://ift.tt/2zHSJw8
Mi3 Security
A brief history of rootkits and bootkits
The last 5 years has seen the growth of smartphone malware. Explore the timeline of rootkits and bootkits on mobiles devices.
Setting cookies with PDFs via DOMParser
http://ift.tt/2yA0rHp
Submitted November 14, 2017 at 09:21PM by albinowax
via reddit http://ift.tt/2zWWuAK
http://ift.tt/2yA0rHp
Submitted November 14, 2017 at 09:21PM by albinowax
via reddit http://ift.tt/2zWWuAK
insert-noscript.blogspot.co.uk
Firefox - settings cookie via DOMParser
Firefox < 57 - settings cookie via DOMParser While doing some research I discovered a interesting behavior in Firefox. The following...
Alina, the Latest POS Malware
http://ift.tt/2mpmUVT
Submitted November 14, 2017 at 09:32PM by EvanConover
via reddit http://ift.tt/2yZhhDR
http://ift.tt/2mpmUVT
Submitted November 14, 2017 at 09:32PM by EvanConover
via reddit http://ift.tt/2yZhhDR
Panda Security Mediacenter
Alina, the Latest POS Malware - Panda Security Mediacenter
Alina is the latest POS malware discovered by PandaLabs. Attacks on POS terminals are still very popular, especially in countries like the United States.
OnePlus Device Backdoor Root Exploit via EngineerMode App
http://ift.tt/2ie2Kd0
Submitted November 14, 2017 at 10:47PM by overflowingInt
via reddit http://ift.tt/2AHn5y2
http://ift.tt/2ie2Kd0
Submitted November 14, 2017 at 10:47PM by overflowingInt
via reddit http://ift.tt/2AHn5y2
NowSecure
OnePlus Device Root Exploit: Backdoor in EngineerMode App for...
Learn more about the OnePlus device backdoor created by the EngineerMode App and how the NowSecure Threat Research Team helped verify this root exploit. #radare
Unpacking Process Injection Malware With IDA PRO (Part 1)
https://www.youtube.com/attribution_link?a=DxM0yBe1NJs&u=%2Fwatch%3Fv%3DScBB-Hi7NxQ%26feature%3Dshare
Submitted November 14, 2017 at 01:27PM by YioUio
via reddit http://ift.tt/2zArrdH
https://www.youtube.com/attribution_link?a=DxM0yBe1NJs&u=%2Fwatch%3Fv%3DScBB-Hi7NxQ%26feature%3Dshare
Submitted November 14, 2017 at 01:27PM by YioUio
via reddit http://ift.tt/2zArrdH
YouTube
Unpacking Process Injection Malware With IDA PRO (Part 1)
Open Analysis Live! This is a re-post from our old site. We walk though the steps needed to unpack process injection using IDA Pro. In this first part we ide...
Secure Engineering Guidelines
http://ift.tt/2yZoBzu
Submitted November 14, 2017 at 10:01PM by HockeyInJune
via reddit http://ift.tt/2mpmvmC
http://ift.tt/2yZoBzu
Submitted November 14, 2017 at 10:01PM by HockeyInJune
via reddit http://ift.tt/2mpmvmC
Medium
Secure Engineering Guidelines
Some best practices for building and trusting software.
New Facebook Exploit allows hacker to hold accounts ransom.
TL;DR: My Facebook account was taken over and I am completely locked out. I believe this is a new type of attack as I can't find any other instances of it happening online.All of this started roughly 6 months ago, but I haven't had any luck fixing the problem. I am now just trying to spread word that such an exploit exists in Facebook so be careful this doesn't happen to you.The initial Hack:A few months ago I needed emergency access to my Facebook account and didn't have access to my password manager. I decided to reset the password to something simple that I could remember.I got in, checked a few things and logged out. I figured I'd be fine and could change the password to something more secure when I got back home in a few days.Boy was I wrong.The next morning I awoke to a flood of e-mail claiming my password and email address had both been changed for my facebook account.I tried to reset my password, but it was going to the wrong email address.I tried the account recovery process and had my trusted contacts give me recovery codes. This seemed to work, but even after changing my password and email address Facebook wanted to send me and email confirming the changes.This email took forever to arrive and when it did it was encrypted with a GPG key (more on that later).This is where things get very bad.The Ransom Letter:The next morning I woke up to this ransom email.I blurred out my personal info, but the email address they changed my account to was just [myname]@protonmail.com.They also demanded 10 BTC to get access to the protonmail account.Facebook's Great FlawNow I admit that it was my fault for setting a weak password and not turning on 2-Factor. However, Facebook has a MAJOR flaw that allowed these hackers to take over my account and permanently lock me out.That flaw is a little known feature called "Encrypted Notifications".This feature uses your public GPG key to encrypt all emails from Facebook to you. Ensuring that any password recovery or email change forms are protected and can't be accessed by anyone else.Sounds great.Except when a hacker enables the feature on your account with a GPG key you DO NOT control.This is exactly what this hacker did. The GPG Key on my account is the one the belongs to the Protonmail account they set up and is not in my control.I have tried every password and account recovery form, I have tried finding a way to contact Facebook support, and I even tried having a family member use the "memorialize" function to contact facebook.NONE OF THESE OPTIONS WORK.Here is the email I get when trying to recover my account.I have no way to decrypt this. Short of having paid 10BTC, which is close to $80,000 today, I have no way to get back into my account.ConclusionAll a hacker needs to do to permanently lock you out of your account is change your email address and upload a GPG key.Once this is done it doesn't mater if you recover your account or change the email address back to one your control because all future emails (including the recovery confirmation email) are encrypted to a key you do not control.If this happens to you, you are pretty much out of luck as Facebook doesn't seem to have any way to contact them or actually get support.NOTE: If anyone does have a way to contact facebook directly, please let me know. I use this account to run a business and need to get in and turn off my Ad Campaigns.
Submitted November 14, 2017 at 10:51PM by megacats93
via reddit http://ift.tt/2hCCWu1
TL;DR: My Facebook account was taken over and I am completely locked out. I believe this is a new type of attack as I can't find any other instances of it happening online.All of this started roughly 6 months ago, but I haven't had any luck fixing the problem. I am now just trying to spread word that such an exploit exists in Facebook so be careful this doesn't happen to you.The initial Hack:A few months ago I needed emergency access to my Facebook account and didn't have access to my password manager. I decided to reset the password to something simple that I could remember.I got in, checked a few things and logged out. I figured I'd be fine and could change the password to something more secure when I got back home in a few days.Boy was I wrong.The next morning I awoke to a flood of e-mail claiming my password and email address had both been changed for my facebook account.I tried to reset my password, but it was going to the wrong email address.I tried the account recovery process and had my trusted contacts give me recovery codes. This seemed to work, but even after changing my password and email address Facebook wanted to send me and email confirming the changes.This email took forever to arrive and when it did it was encrypted with a GPG key (more on that later).This is where things get very bad.The Ransom Letter:The next morning I woke up to this ransom email.I blurred out my personal info, but the email address they changed my account to was just [myname]@protonmail.com.They also demanded 10 BTC to get access to the protonmail account.Facebook's Great FlawNow I admit that it was my fault for setting a weak password and not turning on 2-Factor. However, Facebook has a MAJOR flaw that allowed these hackers to take over my account and permanently lock me out.That flaw is a little known feature called "Encrypted Notifications".This feature uses your public GPG key to encrypt all emails from Facebook to you. Ensuring that any password recovery or email change forms are protected and can't be accessed by anyone else.Sounds great.Except when a hacker enables the feature on your account with a GPG key you DO NOT control.This is exactly what this hacker did. The GPG Key on my account is the one the belongs to the Protonmail account they set up and is not in my control.I have tried every password and account recovery form, I have tried finding a way to contact Facebook support, and I even tried having a family member use the "memorialize" function to contact facebook.NONE OF THESE OPTIONS WORK.Here is the email I get when trying to recover my account.I have no way to decrypt this. Short of having paid 10BTC, which is close to $80,000 today, I have no way to get back into my account.ConclusionAll a hacker needs to do to permanently lock you out of your account is change your email address and upload a GPG key.Once this is done it doesn't mater if you recover your account or change the email address back to one your control because all future emails (including the recovery confirmation email) are encrypted to a key you do not control.If this happens to you, you are pretty much out of luck as Facebook doesn't seem to have any way to contact them or actually get support.NOTE: If anyone does have a way to contact facebook directly, please let me know. I use this account to run a business and need to get in and turn off my Ad Campaigns.
Submitted November 14, 2017 at 10:51PM by megacats93
via reddit http://ift.tt/2hCCWu1
Imgur
Imgur: The most awesome images on the Internet
I got this email a day after my account was hacked.