Google may share your email address with malicious websites
https://ift.tt/2KUYtrU
Submitted May 11, 2018 at 10:47PM by albinowax
via reddit https://ift.tt/2G5WAF9
https://ift.tt/2KUYtrU
Submitted May 11, 2018 at 10:47PM by albinowax
via reddit https://ift.tt/2G5WAF9
The Daily Swig | Web security digest
Google may share your email address with malicious websites
It can happen with just one click.
Launching a Public HackerOne Vulnerability Disclosure Program
https://ift.tt/2wy5mw3
Submitted May 11, 2018 at 11:02PM by jamieweb
via reddit https://ift.tt/2KbbFHN
https://ift.tt/2wy5mw3
Submitted May 11, 2018 at 11:02PM by jamieweb
via reddit https://ift.tt/2KbbFHN
www.jamieweb.net
Launching a Public HackerOne Security Vulnerability Disclosure Program
A write-up of launching the public HackerOne security vulnerability disclosure program for JamieWeb. hackerone.com/jamieweb
Federal government claims DCNS data leak has 'no bearing' on Australia
https://ift.tt/2bC0tHN
Submitted May 12, 2018 at 12:58AM by dengorilla1
via reddit https://ift.tt/2KbwjaP
https://ift.tt/2bC0tHN
Submitted May 12, 2018 at 12:58AM by dengorilla1
via reddit https://ift.tt/2KbwjaP
ZDNet
Federal government claims DCNS data leak has 'no bearing' on Australia
Australia has not been affected by leaked documents revealing details around the combat capability of submarines that French company DCNS built for the Indian Navy, the government has said.
The private key of an SSL certificate that belongs to a brazilian bank has been leaked. What are the risks?
Some background first: last week, some data from a Brazilian bank named Inter was rumored to have been leaked. That included personal data, documents, transaction logs, credit card passwords, everything a bank could possibly have, including the certificate's private key. The bank denied everything.Two days ago some guy showed up on r/brasil claiming he obtained the private key from somewhere public, which he did not disclose. Someone suggested that he signed a message to prove he had it, which he successfully did and can be verified here. It's worth noting that the certificate in question had been replaced on the website in march but did not expire and was still valid.The obvious reaction to this would be for the bank to ask for the revocation to the Certificate Authority, in this case, Go Daddy. The surprising thing is: it's been more than 48 hours since this went public and the certificate has not been revoked yet. The bank is dead silent about this.Considering the keys have fallen in malicious hands which intends to do man-in-the-middle attacks, what are the possible attack vectors from which this is possible? I know DNS spoofing is a possibility. Are there other types of attacks which can originate from this? Some relatives have bank accounts there and are worried. Thanks in advance.
Submitted May 12, 2018 at 12:40AM by Capable_Professional
via reddit https://ift.tt/2rADnGT
Some background first: last week, some data from a Brazilian bank named Inter was rumored to have been leaked. That included personal data, documents, transaction logs, credit card passwords, everything a bank could possibly have, including the certificate's private key. The bank denied everything.Two days ago some guy showed up on r/brasil claiming he obtained the private key from somewhere public, which he did not disclose. Someone suggested that he signed a message to prove he had it, which he successfully did and can be verified here. It's worth noting that the certificate in question had been replaced on the website in march but did not expire and was still valid.The obvious reaction to this would be for the bank to ask for the revocation to the Certificate Authority, in this case, Go Daddy. The surprising thing is: it's been more than 48 hours since this went public and the certificate has not been revoked yet. The bank is dead silent about this.Considering the keys have fallen in malicious hands which intends to do man-in-the-middle attacks, what are the possible attack vectors from which this is possible? I know DNS spoofing is a possibility. Are there other types of attacks which can originate from this? Some relatives have bank accounts there and are worried. Thanks in advance.
Submitted May 12, 2018 at 12:40AM by Capable_Professional
via reddit https://ift.tt/2rADnGT
Gist
Verifying Banco Intermedium's private key leak
Verifying Banco Intermedium's private key leak. GitHub Gist: instantly share code, notes, and snippets.
Attacking Palo Alto Networks PAN-OS ‘readSessionVarsFromFile()’
https://ift.tt/2KS01CO
Submitted May 12, 2018 at 02:16AM by powershelltutorials
via reddit https://ift.tt/2rBMR41
https://ift.tt/2KS01CO
Submitted May 12, 2018 at 02:16AM by powershelltutorials
via reddit https://ift.tt/2rBMR41
Pentest Geek
Attacking Palo Alto Networks PAN-OS 'readSessionVarsFromFile()'
Just last weak Philip Peterson created a Metasploit Module for attacking Palo Alto Networks PAN-OS and achieving remote code execution! I recently had the pleasure of leveraging this attack vector on a pentest...
How does ROCA affect Windows secure boot?
I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an RSA key. At that point, the public key can be used to derive the private key. My question, however, is how this affects secure boot in current versions of Windows. As far as I know, the TPM does not perform any key generation for secure boot and the secure boot keys are managed by Microsoft. Therefor, as far as the end user is concerned, ROCA isn't really relevant in the context of secure boot. Is this correct?
Submitted May 12, 2018 at 02:27AM by RoaringTrash
via reddit https://ift.tt/2G9tPXV
I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an RSA key. At that point, the public key can be used to derive the private key. My question, however, is how this affects secure boot in current versions of Windows. As far as I know, the TPM does not perform any key generation for secure boot and the secure boot keys are managed by Microsoft. Therefor, as far as the end user is concerned, ROCA isn't really relevant in the context of secure boot. Is this correct?
Submitted May 12, 2018 at 02:27AM by RoaringTrash
via reddit https://ift.tt/2G9tPXV
reddit
How does ROCA affect Windows secure boot? • r/security
I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present...
Baltimore Police Can't Explain Why Their All-Seeing Spy Planes Were Kept Secret
https://ift.tt/2bYI33a
Submitted May 12, 2018 at 04:12AM by dengorilla1
via reddit https://ift.tt/2IhdJgK
https://ift.tt/2bYI33a
Submitted May 12, 2018 at 04:12AM by dengorilla1
via reddit https://ift.tt/2IhdJgK
Motherboard
Baltimore Police Can't Explain Why Their All-Seeing Spy Planes Were Kept Secret
Baltimore has had “Google Earth With TiVo capability” since January, but avoided public scrutiny thanks to a private donation from two Texas billionaires.
CVE-2018-1000136 - Electron nodeIntegration Bypass (RCE)
https://ift.tt/2Icnm0h
Submitted May 12, 2018 at 07:44AM by Gallus
via reddit https://ift.tt/2Ictgyt
https://ift.tt/2Icnm0h
Submitted May 12, 2018 at 07:44AM by Gallus
via reddit https://ift.tt/2Ictgyt
Trustwave
CVE-2018-1000136 - Electron nodeIntegration Bypass
A few weeks ago, I came across a vulnerability that affected all current versions of Electron at the time (
Google Duplex Abuse
With all great technology comes the dark side. The demo was pretty impressive but I could imagine this being used for mass scale nefarious activities. A call spammer was just slapped with a big fine for a pretty simple recorded message. Imagine the level of sophistication these attacks could now leverage using something like Duplex for their robo calls.Google mentioned they would have a notification system to ensure the receiver knows the call is being recorded and their interacting with AI but if this becomes adopted for consumer services most people will become numb to that warning.Thoughts? :)
Submitted May 12, 2018 at 06:19AM by mactalker
via reddit https://ift.tt/2IfJvLa
With all great technology comes the dark side. The demo was pretty impressive but I could imagine this being used for mass scale nefarious activities. A call spammer was just slapped with a big fine for a pretty simple recorded message. Imagine the level of sophistication these attacks could now leverage using something like Duplex for their robo calls.Google mentioned they would have a notification system to ensure the receiver knows the call is being recorded and their interacting with AI but if this becomes adopted for consumer services most people will become numb to that warning.Thoughts? :)
Submitted May 12, 2018 at 06:19AM by mactalker
via reddit https://ift.tt/2IfJvLa
reddit
Google Duplex Abuse • r/security
With all great technology comes the dark side. The demo was pretty impressive but I could imagine this being used for mass scale nefarious...
Disclosing a security issue to the public
A major hosting company has a security issue that, in certain circumstances, leaves it's customer's data on it's filesystem even after the data should have been deleted. I found a way to access that "deleted" data, by mistake. I reported the issue via email, but considering the "we don't keep the data" answer, I guess that my report was not taken seriously. Should I keep bugging them or just make the issue public?
Submitted May 12, 2018 at 12:01PM by sorin-mihai
via reddit https://ift.tt/2IbLxzQ
A major hosting company has a security issue that, in certain circumstances, leaves it's customer's data on it's filesystem even after the data should have been deleted. I found a way to access that "deleted" data, by mistake. I reported the issue via email, but considering the "we don't keep the data" answer, I guess that my report was not taken seriously. Should I keep bugging them or just make the issue public?
Submitted May 12, 2018 at 12:01PM by sorin-mihai
via reddit https://ift.tt/2IbLxzQ
reddit
r/security - Disclosing a security issue to the public
1 votes and 0 so far on reddit
CVE-2018-1000136 - Electron nodeIntegration Bypass
https://ift.tt/2Icnm0h
Submitted May 12, 2018 at 04:41PM by glumaproasta
via reddit https://ift.tt/2IxHnBN
https://ift.tt/2Icnm0h
Submitted May 12, 2018 at 04:41PM by glumaproasta
via reddit https://ift.tt/2IxHnBN
Trustwave
CVE-2018-1000136 - Electron nodeIntegration Bypass
A few weeks ago, I came across a vulnerability that affected all current versions of Electron at the time (
Edward Snowden: WikiLeaks document dump on CIA hacking capability 'looks authentic'
https://ift.tt/2lUmZLN
Submitted May 12, 2018 at 10:26PM by dengorilla1
via reddit https://ift.tt/2rF5Pqm
https://ift.tt/2lUmZLN
Submitted May 12, 2018 at 10:26PM by dengorilla1
via reddit https://ift.tt/2rF5Pqm
Washington Examiner
Edward Snowden: WikiLeaks document dump on CIA hacking capability 'looks authentic'
Former NSA contractor Edward Snowden said on Tuesday that the WikiLeaks dump of what it claims to be more than 8,700 documents from the CIA's Center for Cyber Intelligence "looks authentic" and "is genuinely a big deal."
Vega Stealer Malware Takes Aim at Chrome, Firefox
https://ift.tt/2rCK6QI
Submitted May 13, 2018 at 12:33AM by volci
via reddit https://ift.tt/2KX7pgq
https://ift.tt/2rCK6QI
Submitted May 13, 2018 at 12:33AM by volci
via reddit https://ift.tt/2KX7pgq
Threatpost | The first stop for security news
Vega Stealer Malware Takes Aim at Chrome, Firefox
A malware dubbed Vega Stealer has been uncovered, looking to make off with saved credentials and credit-card information in the Chrome and Firefox browsers. While it's a simple payload for now, resear
Malware Found In The Ubuntu Snap Store
https://ift.tt/2Gb6PaV
Submitted May 13, 2018 at 04:15AM by Chris911
via reddit https://ift.tt/2KSJLkV
https://ift.tt/2Gb6PaV
Submitted May 13, 2018 at 04:15AM by Chris911
via reddit https://ift.tt/2KSJLkV
Linux Uprising Blog
Malware Found In The Ubuntu Snap Store
Oh, snap! Just because some packages are available to install directly from the Ubuntu Software Center doesn't make them safe. This is proved by a recent discovery of malware in some snap packages from the Ubuntu Snaps Store.
Backdooring with Metadata (Applicable to Linux, FreeBSD, Oracle Solaris, macOS etc.)
https://ift.tt/2IeFaaV
Submitted May 13, 2018 at 07:49AM by ikotler
via reddit https://ift.tt/2rEcQJ3
https://ift.tt/2IeFaaV
Submitted May 13, 2018 at 07:49AM by ikotler
via reddit https://ift.tt/2rEcQJ3
Sex toy inventor hacks Amazon Echo smart speaker to create dominatrix
https://dailym.ai/2I2JNc7
Submitted May 13, 2018 at 11:58AM by Iot_Security
via reddit https://ift.tt/2jQzMR0
https://dailym.ai/2I2JNc7
Submitted May 13, 2018 at 11:58AM by Iot_Security
via reddit https://ift.tt/2jQzMR0
Mail Online
Alexa, punish! Sex toy inventor hacks Amazon Echo
A British engineer based in Milton Keynes has used an Amazon speaker to build a device that issues electric shocks to its wearer's genitals following a short conversation with the device.
PRB-Backdoor - A Fully Loaded PowerShell Backdoor with Evil Intentions - A Study
https://ift.tt/2Kjljbr
Submitted May 13, 2018 at 11:04AM by Prav123
via reddit https://ift.tt/2Kj2R2E
https://ift.tt/2Kjljbr
Submitted May 13, 2018 at 11:04AM by Prav123
via reddit https://ift.tt/2Kj2R2E
sec0wn.blogspot.co.uk
PRB-Backdoor - A Fully Loaded PowerShell Backdoor with Evil Intentions
INTRODUCTION The great people at ClearSky reached out to me a couple of days ago regarding a sample that they suspected could be related...
The untold story of a 17 year old kid fighting for his innocence with Facebook (2009)
https://ift.tt/2rDnlfD
Submitted May 13, 2018 at 03:58PM by itsmemikeyy
via reddit https://ift.tt/2wDr41x
https://ift.tt/2rDnlfD
Submitted May 13, 2018 at 03:58PM by itsmemikeyy
via reddit https://ift.tt/2wDr41x
Bugs in Logitech Harmony Hub Put Connected IoT Devices at 'High Risk'
https://ift.tt/2wq36qH
Submitted May 13, 2018 at 03:24PM by Iot_Security
via reddit https://ift.tt/2Ifsc13
https://ift.tt/2wq36qH
Submitted May 13, 2018 at 03:24PM by Iot_Security
via reddit https://ift.tt/2Ifsc13
Threatpost | The first stop for security news
Bugs in Logitech Harmony Hub Put Connected IoT Devices at ‘High Risk’
Vulnerabilities found in the Logitech Harmony Hub can give adversaries root access to the device – allowing attackers to control other smart home devices linked to it, such as smart locks and connec
Weak Security and Vulnerabilities in the Portuguese Government's Authentication System
https://ift.tt/2GcQgeW
Submitted May 13, 2018 at 10:18PM by Kitty_Cent
via reddit https://ift.tt/2IEQAZg
https://ift.tt/2GcQgeW
Submitted May 13, 2018 at 10:18PM by Kitty_Cent
via reddit https://ift.tt/2IEQAZg
The Codeumentary
The Weak Security Of The Portuguese Government's Authentication System
The weak security of Autenticacao.gov.pt and Chave Movel Digital. This is part one of a series of blog posts that explores the weak security and various vulnerabilities found in the Portuguese Government's secure authenticate system.
“Client-Side” CSRF
https://ift.tt/2IiffPU
Submitted May 14, 2018 at 01:24PM by albinowax
via reddit https://ift.tt/2L0es7N
https://ift.tt/2IiffPU
Submitted May 14, 2018 at 01:24PM by albinowax
via reddit https://ift.tt/2L0es7N