Rooting Nagios Via Outdated Libraries
http://bit.ly/2DrzDy4
Submitted January 22, 2019 at 08:10PM by chicksdigthelongrun
via reddit http://bit.ly/2U6T6ti
http://bit.ly/2DrzDy4
Submitted January 22, 2019 at 08:10PM by chicksdigthelongrun
via reddit http://bit.ly/2U6T6ti
Medium
Rooting Nagios Via Outdated Libraries
Nagios XI vulnerable since 2012
winPortPush - A PowerShell Utility for Pivoting into Internal Networks via a Compromised Windows Host
http://bit.ly/2AV8RfK
Submitted January 22, 2019 at 09:17PM by kindredsec
via reddit http://bit.ly/2T85XLF
http://bit.ly/2AV8RfK
Submitted January 22, 2019 at 09:17PM by kindredsec
via reddit http://bit.ly/2T85XLF
GitHub
itsKindred/winPortPush
A simple PowerShell utility used for pivoting into internal networks via a compromised Windows host. - itsKindred/winPortPush
checking keepass against PwnedPasswords
http://bit.ly/2Mpbfjp
Submitted January 22, 2019 at 11:35PM by skewlboy
via reddit http://bit.ly/2sFKrlO
http://bit.ly/2Mpbfjp
Submitted January 22, 2019 at 11:35PM by skewlboy
via reddit http://bit.ly/2sFKrlO
GitHub
fopina/kdbxpasswordpwned
Check keepass passwords against https://haveibeenpwned.com/Passwords - fopina/kdbxpasswordpwned
Atlantic Security Conference (AtlSecCon) Call for Papers
EVENT DATEThe Atlantic Security Conference (AtlSecCon) will take place April 24th & 25th, 2019 at the Halifax Convention Centre in Halifax, Nova Scotia, Canada.ABOUT USAtlSecCon, is the first non-profit security conference in Atlantic Canada focusing on bringing some of the world’s brightest and darkest minds together with one common goal – to expand the pool of IT Security knowledge beyond its typical confines.The conference runs for two days and features a diverse selection of presentations prepared by experienced professionals. Multiple presentation tracks are available. Three open for vendor neutral and one track to talk about your next-gen, HD 1080p 4k, 2nd edition, advanced APT product/service.AtlSecCon provides an unmatched opportunity for anyone from Students and IT Professionals, to Managers and C-level folks to collaborate with their peers and learn from the leading industry experts.We look for speakers that are true security professionals, with a depth of understanding on topics that matter and want to teach others.SPEAKER PERKSAll speakers will be given free admission to the 2 day conference, access to the VIP lounge and admission to the speaker’s dinner and after party.SELECTION INFORMATIONThe AtlSecCon board of directors carefully selects talks based on interest and value it may bring to the community. Not sure about your talk? Only one way to find out!Successful speakers will be notified via email as papers are received and selected. Get your papers in soon!October 1st, 2018 – CFP openDecember 31st, 2018 – CFP round 1 complete, speaker announcements madeJanuary 1st, 2019 – CFP round 2 startsFebruary 28th, 2019 – CFP closed, final speaker announcements madeApril 24th & 25th – AtlSecCon 2019!More Info and Submit: https://atlseccon.com/cfp
Submitted January 21, 2019 at 09:53PM by AtlSecCon
via reddit http://bit.ly/2Tds03P
EVENT DATEThe Atlantic Security Conference (AtlSecCon) will take place April 24th & 25th, 2019 at the Halifax Convention Centre in Halifax, Nova Scotia, Canada.ABOUT USAtlSecCon, is the first non-profit security conference in Atlantic Canada focusing on bringing some of the world’s brightest and darkest minds together with one common goal – to expand the pool of IT Security knowledge beyond its typical confines.The conference runs for two days and features a diverse selection of presentations prepared by experienced professionals. Multiple presentation tracks are available. Three open for vendor neutral and one track to talk about your next-gen, HD 1080p 4k, 2nd edition, advanced APT product/service.AtlSecCon provides an unmatched opportunity for anyone from Students and IT Professionals, to Managers and C-level folks to collaborate with their peers and learn from the leading industry experts.We look for speakers that are true security professionals, with a depth of understanding on topics that matter and want to teach others.SPEAKER PERKSAll speakers will be given free admission to the 2 day conference, access to the VIP lounge and admission to the speaker’s dinner and after party.SELECTION INFORMATIONThe AtlSecCon board of directors carefully selects talks based on interest and value it may bring to the community. Not sure about your talk? Only one way to find out!Successful speakers will be notified via email as papers are received and selected. Get your papers in soon!October 1st, 2018 – CFP openDecember 31st, 2018 – CFP round 1 complete, speaker announcements madeJanuary 1st, 2019 – CFP round 2 startsFebruary 28th, 2019 – CFP closed, final speaker announcements madeApril 24th & 25th – AtlSecCon 2019!More Info and Submit: https://atlseccon.com/cfp
Submitted January 21, 2019 at 09:53PM by AtlSecCon
via reddit http://bit.ly/2Tds03P
Halifaxconventioncentre
Halifax Convention Centre
We’re here to make your planning and event experience seamless and straightforward.
Remote Code Execution in apt/apt-get
http://bit.ly/2sGxNmI
Submitted January 22, 2019 at 10:31PM by EvanConover
via reddit http://bit.ly/2AZnFtG
http://bit.ly/2sGxNmI
Submitted January 22, 2019 at 10:31PM by EvanConover
via reddit http://bit.ly/2AZnFtG
justi.cz
Remote Code Execution in apt/apt-get
tl;dr I found a vulnerability in apt that allows a network man-in-the-middle (or a malicious package mirror) to execute arbitrary code as root on a machine i...
Recovering the AES key on a Cortex-M3 processor with emusca, using @Unicorn_Engine and Daredevil, by @jevinskie « Adafruit Industries
http://bit.ly/2sDIGpg
Submitted January 23, 2019 at 02:11AM by digicat
via reddit http://bit.ly/2U9cK7M
http://bit.ly/2sDIGpg
Submitted January 23, 2019 at 02:11AM by digicat
via reddit http://bit.ly/2U9cK7M
Adafruit Industries - Makers, hackers, artists, designers and engineers!
Recovering the AES key on a Cortex-M3 processor with emusca, using @Unicorn_Engine and Daredevil, by @jevinskie
Unicorn Engine is a powerful, lightweight multi-platform, multi-architecture CPU emulator framework. It simulates multiple architectures including Arm, Arm64 (Armv8), M68K, Mips, Sparc, & X86 (…
Abusing Office Web Add-ins (for fun and limited profit) – MDSec
http://bit.ly/2CD3wtC
Submitted January 23, 2019 at 02:03AM by AVERAGE_TEST_DUMMY
via reddit http://bit.ly/2FSKSkH
http://bit.ly/2CD3wtC
Submitted January 23, 2019 at 02:03AM by AVERAGE_TEST_DUMMY
via reddit http://bit.ly/2FSKSkH
www.mdsec.co.uk
Abusing Office Web Add-ins (for fun and limited profit) – MDSec
Break Free - Escaping Restricted Environments and Bypassing DLP
http://bit.ly/2RKPqkj
Submitted January 23, 2019 at 04:32AM by 15charisnoteno
via reddit http://bit.ly/2DuM4sP
http://bit.ly/2RKPqkj
Submitted January 23, 2019 at 04:32AM by 15charisnoteno
via reddit http://bit.ly/2DuM4sP
SIXGEN | United States| Full Spectrum Cybersecurity Solutions
BreakFree
Escaping Restricted Environments and Bypassing DLP I recently completed a “Purple Team” engagement (where a Red team works with a Blue team to demonstrate techn...
CVE-2019-6260: Gaining control of BMC from the host processor
http://bit.ly/2S0L5Zv
Submitted January 23, 2019 at 06:56AM by ajdlinux
via reddit http://bit.ly/2FHyqEW
http://bit.ly/2S0L5Zv
Submitted January 23, 2019 at 06:56AM by ajdlinux
via reddit http://bit.ly/2FHyqEW
Ramblings
CVE-2019-6260: Gaining control of BMC from the host processor
This is details for CVE-2019-6260 – which has been nicknamed “pantsdown” due to the nature of feeling that we feel that we’ve “caught chunks of the industry with their…
CISA Emergency Directive on DNS Infrastructure Tampering
http://bit.ly/2R6GeS3
Submitted January 23, 2019 at 06:42AM by watusa
via reddit http://bit.ly/2sC6H02
http://bit.ly/2R6GeS3
Submitted January 23, 2019 at 06:42AM by watusa
via reddit http://bit.ly/2sC6H02
www.us-cert.gov
CISA Emergency Directive on DNS Infrastructure Tampering | US-CERT
The U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to address ongoing incidents associated with global Domain Name System (DNS) infrastructure tampering.
Phishing Quiz Made by Google
http://bit.ly/2S0UH6p
Submitted January 23, 2019 at 08:54AM by CaptMeelo
via reddit http://bit.ly/2CAYQo0
http://bit.ly/2S0UH6p
Submitted January 23, 2019 at 08:54AM by CaptMeelo
via reddit http://bit.ly/2CAYQo0
Withgoogle
Phishing Quiz
Founder of Snort, Marty Roesch is leaving Cisco
http://bit.ly/2TdmD4F
Submitted January 23, 2019 at 10:05AM by techky
via reddit http://bit.ly/2TcToyU
http://bit.ly/2TdmD4F
Submitted January 23, 2019 at 10:05AM by techky
via reddit http://bit.ly/2TcToyU
Medium
Charting a New Course
The Next Chapter of My Journey
Contextualizing Attacker Activity within Sessions in Exchange Online - Using Audit to Track Attackers
http://bit.ly/2RZVwg2
Submitted January 23, 2019 at 11:11AM by shehackspurple
via reddit http://bit.ly/2T6YkVS
http://bit.ly/2RZVwg2
Submitted January 23, 2019 at 11:11AM by shehackspurple
via reddit http://bit.ly/2T6YkVS
reddit
r/netsec - Contextualizing Attacker Activity within Sessions in Exchange Online - Using Audit to Track Attackers
3 votes and 0 comments so far on Reddit
My OSCP (Offensive Security Certified Professional) Journey [Turkish]
http://bit.ly/2FTx8pS
Submitted January 23, 2019 at 04:02PM by rdincel1
via reddit http://bit.ly/2RLd7Je
http://bit.ly/2FTx8pS
Submitted January 23, 2019 at 04:02PM by rdincel1
via reddit http://bit.ly/2RLd7Je
Anatova Ransomware Analysis
http://bit.ly/2FT5QQc
Submitted January 23, 2019 at 05:50PM by GetOffMyWAN
via reddit http://bit.ly/2CCzk1H
http://bit.ly/2FT5QQc
Submitted January 23, 2019 at 05:50PM by GetOffMyWAN
via reddit http://bit.ly/2CCzk1H
McAfee Blogs
Happy New Year 2019! Anatova is here! | McAfee Blogs
During our continuous hunt for new threats, we discovered a new ransomware family we call Anatova (based on the name of the ransom note). Anatova was
Frappé Technologies ERPNext Server Side Template Injection
http://bit.ly/2Dun0lI
Submitted January 23, 2019 at 07:03PM by albinowax
via reddit http://bit.ly/2W9kXuR
http://bit.ly/2Dun0lI
Submitted January 23, 2019 at 07:03PM by albinowax
via reddit http://bit.ly/2W9kXuR
Medium
Frappé Technologies ERPNext Server Side Template Injection
A few months ago I was particularly focused on researching vulnerabilities that occurred in Electronic Medical Record web applications…
1729 - ghostnoscript: subroutines within pseudo-operators must themselves be pseudo-operators - project-zero
http://bit.ly/2FSAY2p
Submitted January 23, 2019 at 08:11PM by xaocuc
via reddit http://bit.ly/2FJ4p7I
http://bit.ly/2FSAY2p
Submitted January 23, 2019 at 08:11PM by xaocuc
via reddit http://bit.ly/2FJ4p7I
Tuya-Convert: Escaping the IoT-Cloud, no solder need
http://bit.ly/2S4vDeX
Submitted January 23, 2019 at 09:54PM by herrmann-the-german
via reddit http://bit.ly/2MrBIwG
http://bit.ly/2S4vDeX
Submitted January 23, 2019 at 09:54PM by herrmann-the-german
via reddit http://bit.ly/2MrBIwG
c't
Tuya-Convert: Escaping the IoT-Cloud, no solder need
IoT company Tuya claims to have made over 11.000 products worldwide smart home ready, possibly gathering data from millions of homes in the process. If you don't want your information in the cloud, we show how to free your smart home devices simply by running…
The ZDI 2018 Retrospective
http://bit.ly/2FHcUiM
Submitted January 23, 2019 at 10:17PM by _TM_dude
via reddit http://bit.ly/2FTUtYm
http://bit.ly/2FHcUiM
Submitted January 23, 2019 at 10:17PM by _TM_dude
via reddit http://bit.ly/2FTUtYm
Zero Day Initiative
The ZDI 2018 Retrospective
At the end of 2016, the ZDI program completed its busiest year ever. This was beat by 2017 with a more than 40% increase in published advisories. When 2018 rolled around, we wondered if that growth would continue or if a plateau was coming. I don’t think…
[CTF] We are hosting EvlzCTF! 2-3 Feb 2019 (x-post r/securityctf)
https://evlzctf.in
Submitted January 24, 2019 at 01:11AM by sciencestudent99
via reddit http://bit.ly/2FMNm4O
https://evlzctf.in
Submitted January 24, 2019 at 01:11AM by sciencestudent99
via reddit http://bit.ly/2FMNm4O
reddit
r/netsec - [CTF] We are hosting EvlzCTF! 2-3 Feb 2019 (x-post r/securityctf)
1 vote and 1 comment so far on Reddit
Open source library - idiomatic nmap bindings in go
http://bit.ly/2RKPMaz
Submitted January 24, 2019 at 02:46AM by Ullaakut
via reddit http://bit.ly/2FT7dP2
http://bit.ly/2RKPMaz
Submitted January 24, 2019 at 02:46AM by Ullaakut
via reddit http://bit.ly/2FT7dP2
GitHub
Ullaakut/nmap
Idiomatic nmap bindings for go developers. Contribute to Ullaakut/nmap development by creating an account on GitHub.