Developers + GDPR/PCI question
Does anyone know if PCI or GDPR policy restrict the app developers having access to customers data? (e.g. some basic, some sensitive such as last 4 digits of card number).Ive been told yes but I don't believe thats reasonable. Fixing certain bugs seems impossible without setting the state of the data.
Submitted January 25, 2018 at 10:27PM by craigtaub
via reddit http://ift.tt/2naAY2F
Does anyone know if PCI or GDPR policy restrict the app developers having access to customers data? (e.g. some basic, some sensitive such as last 4 digits of card number).Ive been told yes but I don't believe thats reasonable. Fixing certain bugs seems impossible without setting the state of the data.
Submitted January 25, 2018 at 10:27PM by craigtaub
via reddit http://ift.tt/2naAY2F
reddit
Developers + GDPR/PCI question • r/security
Does anyone know if PCI or GDPR policy restrict the app developers having access to customers data? (e.g. some basic, some sensitive such as last...
How Secure Is Your Data When It's Stored in the Cloud?
http://ift.tt/2DyfV0Z
Submitted January 26, 2018 at 12:04AM by robert_brooks
via reddit http://ift.tt/2E7RloL
http://ift.tt/2DyfV0Z
Submitted January 26, 2018 at 12:04AM by robert_brooks
via reddit http://ift.tt/2E7RloL
Scientific American
How Secure Is Your Data When It’s Stored in the Cloud?
As cloud storage becomes more common, data security is an increasing concern
High Risk Vulnerabilities within the DoD from Coldfusion, Dotnet Nuke, Oracle, and more
http://ift.tt/2DD4VUi
Submitted January 26, 2018 at 12:18AM by alyssathegryphon
via reddit http://ift.tt/2Gh43m0
http://ift.tt/2DD4VUi
Submitted January 26, 2018 at 12:18AM by alyssathegryphon
via reddit http://ift.tt/2Gh43m0
Medium
High Risk Vulnerabilities within the DoD from Coldfusion, Dotnet Nuke, Oracle, and more
Introduction
Exploiting Electron RCE in Exodus wallet
http://ift.tt/2nd2FrN
Submitted January 26, 2018 at 02:09AM by JE_SHORT
via reddit http://ift.tt/2GjZwPB
http://ift.tt/2nd2FrN
Submitted January 26, 2018 at 02:09AM by JE_SHORT
via reddit http://ift.tt/2GjZwPB
Medium
Exploiting Electron RCE in Exodus wallet
While browsing Twitter I’ve noticed ElectronJS remote code execution vulnerability in protocol handler. That sounds severe. As stated in…
10 Solid Tips to Increase and optimize IIS Performance for 2018. Covers ASP.Net, WordPress,ColdFusion And SharePoint
http://ift.tt/2DMgoQt
Submitted January 26, 2018 at 01:44AM by BitsAndScrews
via reddit http://ift.tt/2FhYItp
http://ift.tt/2DMgoQt
Submitted January 26, 2018 at 01:44AM by BitsAndScrews
via reddit http://ift.tt/2FhYItp
Bits & Screws Tech Community
10 Solid Tips to Increase and optimize IIS Performance for 2018. Covers ASP.Net, WordPress,ColdFusion And SharePoint | Bits & Screws…
Here are 10 solid performance optimization tips to speed up IIS web sites Internet Information Service. IIS Version 5.1 to IIS Version 10
Microsoft releases updated VS compiler for Spectre V2. Let the builds begin. GCC backports to v7
http://ift.tt/2DKCVNU
Submitted January 26, 2018 at 02:02AM by kn1ght
via reddit http://ift.tt/2FdFjcX
http://ift.tt/2DKCVNU
Submitted January 26, 2018 at 02:02AM by kn1ght
via reddit http://ift.tt/2FdFjcX
VS.Modern
Visual Studio 2017 15.5 Release Notes
Release notes for the latest features and improvements in Visual Studio 2017. Plan better, code together and ship faster with Visual Studio.
3 Questions About CYBERTACOS You Know You Want To Ask
http://ift.tt/2DLDDdC
Submitted January 26, 2018 at 12:29AM by Uminekoshi
via reddit http://ift.tt/2nceOOn
http://ift.tt/2DLDDdC
Submitted January 26, 2018 at 12:29AM by Uminekoshi
via reddit http://ift.tt/2nceOOn
Nehemiah Security
3 Questions about CYBERTACOS you know you want to ask - Nehemiah Security
3 questions about CYBERTACOS you always wanted to get answers to.
Bastion Hopping With SSH And ScaleFT
http://ift.tt/2FfsUFB
Submitted January 26, 2018 at 12:15AM by alexdebrie
via reddit http://ift.tt/2BuxE7K
http://ift.tt/2FfsUFB
Submitted January 26, 2018 at 12:15AM by alexdebrie
via reddit http://ift.tt/2BuxE7K
ScaleFT
ScaleFT - Bastion Hopping With SSH And ScaleFT
One of our values at ScaleFT is to do our best to support our users where they are, with the decisions and tools they’ve already selected. This means treating SSH bastions as an SSH feature, parameterizing and centralizing the associated configurations, and…
Moar ASUS router vulns
http://ift.tt/2DFljDR
Submitted January 26, 2018 at 02:18AM by aetsu
via reddit http://ift.tt/2nb42Hq
http://ift.tt/2DFljDR
Submitted January 26, 2018 at 02:18AM by aetsu
via reddit http://ift.tt/2nb42Hq
Security Art Work
Some vulnerability in ASUS routers - Security Art Work
A few months ago, I changed my old TP-LINK router to an ASUS. Since it is the de facto manufacturer recommended by my ISP, in order to avoid any complications that could lead to delays in getting my Internet up and running I decided to go with it. Then comes…
NetBSD kernel wscons IOCTL vulnerable bug class
http://ift.tt/2DMVD7D
Submitted January 26, 2018 at 02:16AM by ffyns
via reddit http://ift.tt/2DFvIzu
http://ift.tt/2DMVD7D
Submitted January 26, 2018 at 02:16AM by ffyns
via reddit http://ift.tt/2DFvIzu
blog.infosectcbr.com.au
NetBSD kernel wscons IOCTL vulnerable bug class
Dr Silvio Cesare In this blog post I discuss a vulnerable bug class that exists in the NetBSD kernel based on an incorrect coding style...
I've searched the news and haven't found any mention of this, so I came to Reddit
My role: Like most of you I don't have any official spokesperson role for my company so I'm going to keep their name out of this. I have a small role in security validation. I write software tools that decompile and deconstruct thousands of other tools and libraries in order to manually ensure compliance (proper compiler flags, which libraries are included, that certain libraries never get included, etc...)Recently (since the start of the new year) I am aware of multiple governments getting detailed tours of our validation process. This has resulted in us getting a great deal more enforcement power to push developers and product managers to actually act on our alerts and warnings.Any given tool usually has between 10 and 15 minor to moderate CVEs associated with any given release, but getting anyone responsible to take these vulnerabilities seriously (act on anything) has always been a bit challenging. This seems to be getting pressure from the top (outside pressure) to change.My question is: are any of you aware of what is driving this?Sure, I can speculate as well as anyone else, but hard facts are a bit harder to come by. This seems to be pretty big, but I haven't seen any coverage on it.Rumors include pseudo-official word of large incentives, world funding shifts, additional contracts (or contracts being threatened by) proper enforcement, etc...
Submitted January 26, 2018 at 02:45AM by skyleach
via reddit http://ift.tt/2DKXD06
My role: Like most of you I don't have any official spokesperson role for my company so I'm going to keep their name out of this. I have a small role in security validation. I write software tools that decompile and deconstruct thousands of other tools and libraries in order to manually ensure compliance (proper compiler flags, which libraries are included, that certain libraries never get included, etc...)Recently (since the start of the new year) I am aware of multiple governments getting detailed tours of our validation process. This has resulted in us getting a great deal more enforcement power to push developers and product managers to actually act on our alerts and warnings.Any given tool usually has between 10 and 15 minor to moderate CVEs associated with any given release, but getting anyone responsible to take these vulnerabilities seriously (act on anything) has always been a bit challenging. This seems to be getting pressure from the top (outside pressure) to change.My question is: are any of you aware of what is driving this?Sure, I can speculate as well as anyone else, but hard facts are a bit harder to come by. This seems to be pretty big, but I haven't seen any coverage on it.Rumors include pseudo-official word of large incentives, world funding shifts, additional contracts (or contracts being threatened by) proper enforcement, etc...
Submitted January 26, 2018 at 02:45AM by skyleach
via reddit http://ift.tt/2DKXD06
reddit
I've searched the news and haven't found any mention... • r/security
My role: Like most of you I don't have any official spokesperson role for my company so I'm going to keep their name out of this. I have a small...
Exploiting Custom Template Engines
http://ift.tt/2DKjgxz
Submitted January 26, 2018 at 02:48AM by fang0654
via reddit http://ift.tt/2naJ8sW
http://ift.tt/2DKjgxz
Submitted January 26, 2018 at 02:48AM by fang0654
via reddit http://ift.tt/2naJ8sW
Depthsecurity
Exploiting Custom Template Engines
Introduction
When performing an application assessment one of the areas within an app I pay particular attention to is any ability to define custom templates.
When performing an application assessment one of the areas within an app I pay particular attention to is any ability to define custom templates.
Stack Based Buffer Overflows on x64 (Windows)
http://ift.tt/2DDnCHf
Submitted January 26, 2018 at 01:15AM by Vasile4444
via reddit http://ift.tt/2DAUvAz
http://ift.tt/2DDnCHf
Submitted January 26, 2018 at 01:15AM by Vasile4444
via reddit http://ift.tt/2DAUvAz
Nytro Security
Stack Based Buffer Overflows on x64 (Windows)
The previous two blog posts describe how a Stack Based Buffer Overflow vulnerability works on x86 (32 bits) Windows. In the first part, you can find a short introduction to x86 Assembly and how the…
Unpacking Pykspa Malware With Python and IDA Pro - Subscriber Request Part 1
https://www.youtube.com/watch?v=HfSQlC76_s4
Submitted January 24, 2018 at 06:11PM by fireh7nter
via reddit http://ift.tt/2E9jMmp
https://www.youtube.com/watch?v=HfSQlC76_s4
Submitted January 24, 2018 at 06:11PM by fireh7nter
via reddit http://ift.tt/2E9jMmp
YouTube
Unpacking Pykspa Malware With Python and IDA Pro - Subscriber Request Part 1
Open Analysis Live! We use IDA Pro and Python noscripts to removed obfuscated code and statically unpack malware. This is Part 1 of a two part subscriber request asking us to determine why this malware would not run in their sandbox. In Part 1 we use Python…
Free course of ethical hacking, basic to advanced 2018!
http://ift.tt/2rIjvEe
Submitted January 26, 2018 at 06:01AM by gburu
via reddit http://ift.tt/2GgU8wF
http://ift.tt/2rIjvEe
Submitted January 26, 2018 at 06:01AM by gburu
via reddit http://ift.tt/2GgU8wF
en.gburu.net
Free ETHICAL HACKING Course: Beginner to Advanced 2018!! - en.gburu.net
Free Ethical Hacking course, you will learn everything you need to perform your own security audits and be a good ethical hacker, from novice to expert.
Unknown log in attempts on Tillys.com — should I be concerned?
Today, I got this email from customerservice@tillys.com.Hi [my name], Your account has been temporarily locked because the maximum number of invalid logins has been exceeded.Please try logging in again later.If you feel you have received this email in error, please contact customer service.This is an automatically generated email, please do not reply.I was quite scared by this, because I've never had such emails sent to me before. So I wanted to see if anyone else had this issue; if Tilly's were recently compromised or something.So I looked up the email content with quotation mark on Google, and I got a very fishy result. Only website I could find with this exact text is from the website of a New Zealand clothing brand, icebreaker. This seemed strange, but I assumed that maybe they used a same template or something for their security system so it's plausible they have the same message. (I have no idea how programming works. Is this a plausible idea?)Then, I sent a email to tillys support that I have been alarmed about unknown log in attempts to my account, so I would like to know location of where the log in attempts came from and what the attempts were. After the support mail was sent, I went to log in to my account, which I honestly don't even remember making, to be honest. I searched Tillys.com on my gmail search engine, but there weren't any of those "Thanks for joining Tillys.com!" type of mail in the past.So in case that my computer is exposed to a keylogger, I pressed forgot password to reset the password, without making any real attempts to log in, and changed my Tillys.com password to something completely unusual; a combination of words and numbers that I never used as a password before. When I logged in, I found more weird things.I was signed up for email updates, despite the fact that as I mentioned, I have not received any emails from Tilly's before. I looked for it on every inbox. Nothing is there.It is signed up with my real name and my birthdate, but the gender is wrong and the shipping address is a non-exsistent address. (Random numbers and null city, etc.)I ran a Windows Defender test and found a Trojan virus, and deleted it immediately. I pirate through torrent time to time, but very rarely and my last download has been quite a while ago.This is some weird fishy shit. I'm scared that this is all a set-up by a hacker to access my account. I will wait for their techsupport team to reply, but I would like to know if any of this is significant; something to worry about. Thank you guys in advance.
Submitted January 26, 2018 at 08:29AM by myheartsaysyesindeed
via reddit http://ift.tt/2BsvSUS
Today, I got this email from customerservice@tillys.com.Hi [my name], Your account has been temporarily locked because the maximum number of invalid logins has been exceeded.Please try logging in again later.If you feel you have received this email in error, please contact customer service.This is an automatically generated email, please do not reply.I was quite scared by this, because I've never had such emails sent to me before. So I wanted to see if anyone else had this issue; if Tilly's were recently compromised or something.So I looked up the email content with quotation mark on Google, and I got a very fishy result. Only website I could find with this exact text is from the website of a New Zealand clothing brand, icebreaker. This seemed strange, but I assumed that maybe they used a same template or something for their security system so it's plausible they have the same message. (I have no idea how programming works. Is this a plausible idea?)Then, I sent a email to tillys support that I have been alarmed about unknown log in attempts to my account, so I would like to know location of where the log in attempts came from and what the attempts were. After the support mail was sent, I went to log in to my account, which I honestly don't even remember making, to be honest. I searched Tillys.com on my gmail search engine, but there weren't any of those "Thanks for joining Tillys.com!" type of mail in the past.So in case that my computer is exposed to a keylogger, I pressed forgot password to reset the password, without making any real attempts to log in, and changed my Tillys.com password to something completely unusual; a combination of words and numbers that I never used as a password before. When I logged in, I found more weird things.I was signed up for email updates, despite the fact that as I mentioned, I have not received any emails from Tilly's before. I looked for it on every inbox. Nothing is there.It is signed up with my real name and my birthdate, but the gender is wrong and the shipping address is a non-exsistent address. (Random numbers and null city, etc.)I ran a Windows Defender test and found a Trojan virus, and deleted it immediately. I pirate through torrent time to time, but very rarely and my last download has been quite a while ago.This is some weird fishy shit. I'm scared that this is all a set-up by a hacker to access my account. I will wait for their techsupport team to reply, but I would like to know if any of this is significant; something to worry about. Thank you guys in advance.
Submitted January 26, 2018 at 08:29AM by myheartsaysyesindeed
via reddit http://ift.tt/2BsvSUS
Tillys
Tillys | Men, Women and Kids' Clothing & Shoe Store
Shop Tillys for the best in men's clothing, women's clothing, kid's clothing, backpacks, shoes and accessories from all of your favorite brands
IDS x series alarm system
Error: Version No. 2.02 busy. Will not arm the alarm because of this error.
Submitted January 26, 2018 at 02:22PM by Gtex555
via reddit http://ift.tt/2DEhFWs
Error: Version No. 2.02 busy. Will not arm the alarm because of this error.
Submitted January 26, 2018 at 02:22PM by Gtex555
via reddit http://ift.tt/2DEhFWs
reddit
IDS x series alarm system • r/security
Error: Version No. 2.02 busy. Will not arm the alarm because of this error.
Amazing Incident Response 45K PCs and 4K Servers in 10 days
http://ift.tt/2nf36ll
Submitted January 26, 2018 at 03:27PM by akapranos
via reddit http://ift.tt/2DGEqxq
http://ift.tt/2nf36ll
Submitted January 26, 2018 at 03:27PM by akapranos
via reddit http://ift.tt/2DGEqxq
Debugging Android third-party Java apps with native methods
http://ift.tt/2Ea7c6g
Submitted January 26, 2018 at 03:10PM by xaocuc
via reddit http://ift.tt/2DA2kq3
http://ift.tt/2Ea7c6g
Submitted January 26, 2018 at 03:10PM by xaocuc
via reddit http://ift.tt/2DA2kq3
reddit
Debugging Android third-party Java apps with native methods • r/netsec
3 points and 0 comments so far on reddit
Why IP-based rules are bad, but we still use it
http://ift.tt/2ncAs51
Submitted January 26, 2018 at 04:22PM by jpkroehling
via reddit http://ift.tt/2Bv0yVv
http://ift.tt/2ncAs51
Submitted January 26, 2018 at 04:22PM by jpkroehling
via reddit http://ift.tt/2Bv0yVv
Medium
Why IP-based rules are bad, but we still use it
One of the first decisions when architecting a Web Application Firewall is whether or not to add blacklists based on IP addresses. Even…
How to Hack a Turned-off Computer, or Running Unsigned Code in Intel ME
http://ift.tt/2BwkAyI
Submitted January 26, 2018 at 06:26PM by alexlash
via reddit http://ift.tt/2Gix5Sb
http://ift.tt/2BwkAyI
Submitted January 26, 2018 at 06:26PM by alexlash
via reddit http://ift.tt/2Gix5Sb
Ptsecurity
How to Hack a Turned-off Computer, or Running Unsigned Code in Intel ME
At the recent Black Hat Europe conference, Positive Technologies researchers Mark Ermolov and Maxim Goryachy spoke about the vulnerability ...