Beware! Undetectable CrossRAT malware targets Windows, MacOS, and Linux systems
http://ift.tt/2BsSWmj
Submitted January 25, 2018 at 06:14PM by Vault10001
via reddit http://ift.tt/2nbQhZX
http://ift.tt/2BsSWmj
Submitted January 25, 2018 at 06:14PM by Vault10001
via reddit http://ift.tt/2nbQhZX
The Hacker News
Beware! Undetectable CrossRAT malware targets Windows, MacOS, and Linux systems
Beware of new cross-platform CrossRAT spying malware, targeting Windows, MacOS, Solaris and Linux computers.
Rules and targets for Pwn2Own 2018 announced. Up to $2,000,000 in prizes available.
http://ift.tt/2DyknwF
Submitted January 25, 2018 at 07:02PM by RedmondSecGnome
via reddit http://ift.tt/2E86TZD
http://ift.tt/2DyknwF
Submitted January 25, 2018 at 07:02PM by RedmondSecGnome
via reddit http://ift.tt/2E86TZD
Zero Day Initiative
Pwn2Own Returns for 2018: Partners with Microsoft and Sponsored by VMware
The Quick Summary · Pwn2Own returns for 2018 with five categories of targets: virtualization, web browsers, enterprise applications, servers, and a special Windows Insider Preview Challenge category. · ZDI partners with Microsoft for the event and welcomes…
Security In 5: Episode 160 - Only 10% Of Gmail Users Have Two-Factor Authentication Enabled, Don't Be In The 90%
http://ift.tt/2DA6SAK
Submitted January 25, 2018 at 07:36PM by BinaryBlog
via reddit http://ift.tt/2nbuvVs
http://ift.tt/2DA6SAK
Submitted January 25, 2018 at 07:36PM by BinaryBlog
via reddit http://ift.tt/2nbuvVs
Libsyn
Security In Five Podcast: Episode 160 - Only 10% Of Gmail Users Have Two-Factor Authentication Enabled, Don't Be In The 90%
Google recently announced a report that only 10% of Gmail accounts have two-factor authentication enabled. Although the feature has been available since 2011 mass adoption has not occurred. This episode goes into what two-factor authentication is and why…
Spectre and Meltdown attack explained, simply, for non-programmers
http://ift.tt/2nc1zwt
Submitted January 25, 2018 at 07:18PM by kulious
via reddit http://ift.tt/2DD3EN1
http://ift.tt/2nc1zwt
Submitted January 25, 2018 at 07:18PM by kulious
via reddit http://ift.tt/2DD3EN1
The Pensieve
Spectre and Meltdown attack explained, simply, for non-programmers
I have seen a lot of discussions online about the Spectre and Meltdown attack. They opened a profoundly new way to think about computer architecture. However, the first time I talked about that idea to my parents, the only feedback I’ve got was confusion…
Students asking basic pointers for a hackathon (beginner level)
Hello,My school had an open invitation to attend a hackathon. I registered and was put into a group. There are several groups of students from my school participating in the same hackathon. There are 4 of us in this group. Apart from me and one other, we have some decent knowledge of linux, and use of the software. The other two students didn't really understand what and how KALI even was.Assuming you participate, and even if you don't find any vulnerabilities, we get credits for being apart of it.That said, we would like to at least have a fighting chance. We have been given some basic instructions. I'm not sure where to start once we are connected to the network and have scanned it.Note, I have set up my Kali linux. It's dist-upgraded and ready to go.These are my basic assumptions. Scan network with nmap, to find all available devices. We have been told they are 'hidden' somehow. I think this means scan the network with nmap at like T4? But what are the best options that I should be looking at?Once we find all the devices. Nmap should help with OS detection etc. As well as open ports and versions.This is where I get confused. They told us that the computers are like Windows 7 and full of holes.How do I know what program/port to use so that I can apply metasploit exploits to it?Clearly from reading this you can probably see my gaps in knowledge.If you would kindly point out some tips and tricks, we would appreciate having a fighting chance. :)
Submitted January 25, 2018 at 08:44PM by beangay
via reddit http://ift.tt/2naWs0u
Hello,My school had an open invitation to attend a hackathon. I registered and was put into a group. There are several groups of students from my school participating in the same hackathon. There are 4 of us in this group. Apart from me and one other, we have some decent knowledge of linux, and use of the software. The other two students didn't really understand what and how KALI even was.Assuming you participate, and even if you don't find any vulnerabilities, we get credits for being apart of it.That said, we would like to at least have a fighting chance. We have been given some basic instructions. I'm not sure where to start once we are connected to the network and have scanned it.Note, I have set up my Kali linux. It's dist-upgraded and ready to go.These are my basic assumptions. Scan network with nmap, to find all available devices. We have been told they are 'hidden' somehow. I think this means scan the network with nmap at like T4? But what are the best options that I should be looking at?Once we find all the devices. Nmap should help with OS detection etc. As well as open ports and versions.This is where I get confused. They told us that the computers are like Windows 7 and full of holes.How do I know what program/port to use so that I can apply metasploit exploits to it?Clearly from reading this you can probably see my gaps in knowledge.If you would kindly point out some tips and tricks, we would appreciate having a fighting chance. :)
Submitted January 25, 2018 at 08:44PM by beangay
via reddit http://ift.tt/2naWs0u
reddit
Students asking basic pointers for a hackathon... • r/security
Hello, My school had an open invitation to attend a hackathon. I registered and was put into a group. There are several groups of students from...
Why more sites don't use PGP/GPG for 2FA?
Reddit just enabled 2FA for all accounts using Google Authenticator. Many sites are using this method or text messaging. What if I don't want to use my phone or don't have it. If I forget my phone and head out for the day, I'm stuck.This made me curious about another form of 2FA which is not used all that often: PGP (or GPG). Given the nature of Reddit, I would think there would be a good number of us who would use it if it was offered.I assume it is because the number of people using PGP is relatively small when you consider the entire population of internet users. Other than that, is there another reason why more sites don't offer PGP as an option for 2FA?
Submitted January 25, 2018 at 09:15PM by flipjargendy
via reddit http://ift.tt/2E7pN2P
Reddit just enabled 2FA for all accounts using Google Authenticator. Many sites are using this method or text messaging. What if I don't want to use my phone or don't have it. If I forget my phone and head out for the day, I'm stuck.This made me curious about another form of 2FA which is not used all that often: PGP (or GPG). Given the nature of Reddit, I would think there would be a good number of us who would use it if it was offered.I assume it is because the number of people using PGP is relatively small when you consider the entire population of internet users. Other than that, is there another reason why more sites don't offer PGP as an option for 2FA?
Submitted January 25, 2018 at 09:15PM by flipjargendy
via reddit http://ift.tt/2E7pN2P
Reddit
From the announcements community on Reddit
Explore this post and more from the announcements community
Developers + GDPR/PCI question
Does anyone know if PCI or GDPR policy restrict the app developers having access to customers data? (e.g. some basic, some sensitive such as last 4 digits of card number).Ive been told yes but I don't believe thats reasonable. Fixing certain bugs seems impossible without setting the state of the data.
Submitted January 25, 2018 at 10:27PM by craigtaub
via reddit http://ift.tt/2naAY2F
Does anyone know if PCI or GDPR policy restrict the app developers having access to customers data? (e.g. some basic, some sensitive such as last 4 digits of card number).Ive been told yes but I don't believe thats reasonable. Fixing certain bugs seems impossible without setting the state of the data.
Submitted January 25, 2018 at 10:27PM by craigtaub
via reddit http://ift.tt/2naAY2F
reddit
Developers + GDPR/PCI question • r/security
Does anyone know if PCI or GDPR policy restrict the app developers having access to customers data? (e.g. some basic, some sensitive such as last...
How Secure Is Your Data When It's Stored in the Cloud?
http://ift.tt/2DyfV0Z
Submitted January 26, 2018 at 12:04AM by robert_brooks
via reddit http://ift.tt/2E7RloL
http://ift.tt/2DyfV0Z
Submitted January 26, 2018 at 12:04AM by robert_brooks
via reddit http://ift.tt/2E7RloL
Scientific American
How Secure Is Your Data When It’s Stored in the Cloud?
As cloud storage becomes more common, data security is an increasing concern
High Risk Vulnerabilities within the DoD from Coldfusion, Dotnet Nuke, Oracle, and more
http://ift.tt/2DD4VUi
Submitted January 26, 2018 at 12:18AM by alyssathegryphon
via reddit http://ift.tt/2Gh43m0
http://ift.tt/2DD4VUi
Submitted January 26, 2018 at 12:18AM by alyssathegryphon
via reddit http://ift.tt/2Gh43m0
Medium
High Risk Vulnerabilities within the DoD from Coldfusion, Dotnet Nuke, Oracle, and more
Introduction
Exploiting Electron RCE in Exodus wallet
http://ift.tt/2nd2FrN
Submitted January 26, 2018 at 02:09AM by JE_SHORT
via reddit http://ift.tt/2GjZwPB
http://ift.tt/2nd2FrN
Submitted January 26, 2018 at 02:09AM by JE_SHORT
via reddit http://ift.tt/2GjZwPB
Medium
Exploiting Electron RCE in Exodus wallet
While browsing Twitter I’ve noticed ElectronJS remote code execution vulnerability in protocol handler. That sounds severe. As stated in…
10 Solid Tips to Increase and optimize IIS Performance for 2018. Covers ASP.Net, WordPress,ColdFusion And SharePoint
http://ift.tt/2DMgoQt
Submitted January 26, 2018 at 01:44AM by BitsAndScrews
via reddit http://ift.tt/2FhYItp
http://ift.tt/2DMgoQt
Submitted January 26, 2018 at 01:44AM by BitsAndScrews
via reddit http://ift.tt/2FhYItp
Bits & Screws Tech Community
10 Solid Tips to Increase and optimize IIS Performance for 2018. Covers ASP.Net, WordPress,ColdFusion And SharePoint | Bits & Screws…
Here are 10 solid performance optimization tips to speed up IIS web sites Internet Information Service. IIS Version 5.1 to IIS Version 10
Microsoft releases updated VS compiler for Spectre V2. Let the builds begin. GCC backports to v7
http://ift.tt/2DKCVNU
Submitted January 26, 2018 at 02:02AM by kn1ght
via reddit http://ift.tt/2FdFjcX
http://ift.tt/2DKCVNU
Submitted January 26, 2018 at 02:02AM by kn1ght
via reddit http://ift.tt/2FdFjcX
VS.Modern
Visual Studio 2017 15.5 Release Notes
Release notes for the latest features and improvements in Visual Studio 2017. Plan better, code together and ship faster with Visual Studio.
3 Questions About CYBERTACOS You Know You Want To Ask
http://ift.tt/2DLDDdC
Submitted January 26, 2018 at 12:29AM by Uminekoshi
via reddit http://ift.tt/2nceOOn
http://ift.tt/2DLDDdC
Submitted January 26, 2018 at 12:29AM by Uminekoshi
via reddit http://ift.tt/2nceOOn
Nehemiah Security
3 Questions about CYBERTACOS you know you want to ask - Nehemiah Security
3 questions about CYBERTACOS you always wanted to get answers to.
Bastion Hopping With SSH And ScaleFT
http://ift.tt/2FfsUFB
Submitted January 26, 2018 at 12:15AM by alexdebrie
via reddit http://ift.tt/2BuxE7K
http://ift.tt/2FfsUFB
Submitted January 26, 2018 at 12:15AM by alexdebrie
via reddit http://ift.tt/2BuxE7K
ScaleFT
ScaleFT - Bastion Hopping With SSH And ScaleFT
One of our values at ScaleFT is to do our best to support our users where they are, with the decisions and tools they’ve already selected. This means treating SSH bastions as an SSH feature, parameterizing and centralizing the associated configurations, and…
Moar ASUS router vulns
http://ift.tt/2DFljDR
Submitted January 26, 2018 at 02:18AM by aetsu
via reddit http://ift.tt/2nb42Hq
http://ift.tt/2DFljDR
Submitted January 26, 2018 at 02:18AM by aetsu
via reddit http://ift.tt/2nb42Hq
Security Art Work
Some vulnerability in ASUS routers - Security Art Work
A few months ago, I changed my old TP-LINK router to an ASUS. Since it is the de facto manufacturer recommended by my ISP, in order to avoid any complications that could lead to delays in getting my Internet up and running I decided to go with it. Then comes…
NetBSD kernel wscons IOCTL vulnerable bug class
http://ift.tt/2DMVD7D
Submitted January 26, 2018 at 02:16AM by ffyns
via reddit http://ift.tt/2DFvIzu
http://ift.tt/2DMVD7D
Submitted January 26, 2018 at 02:16AM by ffyns
via reddit http://ift.tt/2DFvIzu
blog.infosectcbr.com.au
NetBSD kernel wscons IOCTL vulnerable bug class
Dr Silvio Cesare In this blog post I discuss a vulnerable bug class that exists in the NetBSD kernel based on an incorrect coding style...
I've searched the news and haven't found any mention of this, so I came to Reddit
My role: Like most of you I don't have any official spokesperson role for my company so I'm going to keep their name out of this. I have a small role in security validation. I write software tools that decompile and deconstruct thousands of other tools and libraries in order to manually ensure compliance (proper compiler flags, which libraries are included, that certain libraries never get included, etc...)Recently (since the start of the new year) I am aware of multiple governments getting detailed tours of our validation process. This has resulted in us getting a great deal more enforcement power to push developers and product managers to actually act on our alerts and warnings.Any given tool usually has between 10 and 15 minor to moderate CVEs associated with any given release, but getting anyone responsible to take these vulnerabilities seriously (act on anything) has always been a bit challenging. This seems to be getting pressure from the top (outside pressure) to change.My question is: are any of you aware of what is driving this?Sure, I can speculate as well as anyone else, but hard facts are a bit harder to come by. This seems to be pretty big, but I haven't seen any coverage on it.Rumors include pseudo-official word of large incentives, world funding shifts, additional contracts (or contracts being threatened by) proper enforcement, etc...
Submitted January 26, 2018 at 02:45AM by skyleach
via reddit http://ift.tt/2DKXD06
My role: Like most of you I don't have any official spokesperson role for my company so I'm going to keep their name out of this. I have a small role in security validation. I write software tools that decompile and deconstruct thousands of other tools and libraries in order to manually ensure compliance (proper compiler flags, which libraries are included, that certain libraries never get included, etc...)Recently (since the start of the new year) I am aware of multiple governments getting detailed tours of our validation process. This has resulted in us getting a great deal more enforcement power to push developers and product managers to actually act on our alerts and warnings.Any given tool usually has between 10 and 15 minor to moderate CVEs associated with any given release, but getting anyone responsible to take these vulnerabilities seriously (act on anything) has always been a bit challenging. This seems to be getting pressure from the top (outside pressure) to change.My question is: are any of you aware of what is driving this?Sure, I can speculate as well as anyone else, but hard facts are a bit harder to come by. This seems to be pretty big, but I haven't seen any coverage on it.Rumors include pseudo-official word of large incentives, world funding shifts, additional contracts (or contracts being threatened by) proper enforcement, etc...
Submitted January 26, 2018 at 02:45AM by skyleach
via reddit http://ift.tt/2DKXD06
reddit
I've searched the news and haven't found any mention... • r/security
My role: Like most of you I don't have any official spokesperson role for my company so I'm going to keep their name out of this. I have a small...
Exploiting Custom Template Engines
http://ift.tt/2DKjgxz
Submitted January 26, 2018 at 02:48AM by fang0654
via reddit http://ift.tt/2naJ8sW
http://ift.tt/2DKjgxz
Submitted January 26, 2018 at 02:48AM by fang0654
via reddit http://ift.tt/2naJ8sW
Depthsecurity
Exploiting Custom Template Engines
Introduction
When performing an application assessment one of the areas within an app I pay particular attention to is any ability to define custom templates.
When performing an application assessment one of the areas within an app I pay particular attention to is any ability to define custom templates.
Stack Based Buffer Overflows on x64 (Windows)
http://ift.tt/2DDnCHf
Submitted January 26, 2018 at 01:15AM by Vasile4444
via reddit http://ift.tt/2DAUvAz
http://ift.tt/2DDnCHf
Submitted January 26, 2018 at 01:15AM by Vasile4444
via reddit http://ift.tt/2DAUvAz
Nytro Security
Stack Based Buffer Overflows on x64 (Windows)
The previous two blog posts describe how a Stack Based Buffer Overflow vulnerability works on x86 (32 bits) Windows. In the first part, you can find a short introduction to x86 Assembly and how the…
Unpacking Pykspa Malware With Python and IDA Pro - Subscriber Request Part 1
https://www.youtube.com/watch?v=HfSQlC76_s4
Submitted January 24, 2018 at 06:11PM by fireh7nter
via reddit http://ift.tt/2E9jMmp
https://www.youtube.com/watch?v=HfSQlC76_s4
Submitted January 24, 2018 at 06:11PM by fireh7nter
via reddit http://ift.tt/2E9jMmp
YouTube
Unpacking Pykspa Malware With Python and IDA Pro - Subscriber Request Part 1
Open Analysis Live! We use IDA Pro and Python noscripts to removed obfuscated code and statically unpack malware. This is Part 1 of a two part subscriber request asking us to determine why this malware would not run in their sandbox. In Part 1 we use Python…
Free course of ethical hacking, basic to advanced 2018!
http://ift.tt/2rIjvEe
Submitted January 26, 2018 at 06:01AM by gburu
via reddit http://ift.tt/2GgU8wF
http://ift.tt/2rIjvEe
Submitted January 26, 2018 at 06:01AM by gburu
via reddit http://ift.tt/2GgU8wF
en.gburu.net
Free ETHICAL HACKING Course: Beginner to Advanced 2018!! - en.gburu.net
Free Ethical Hacking course, you will learn everything you need to perform your own security audits and be a good ethical hacker, from novice to expert.