CVE-2019-6260: Gaining control of BMC from the host processor
http://bit.ly/2S0L5Zv
Submitted January 23, 2019 at 06:56AM by ajdlinux
via reddit http://bit.ly/2FHyqEW
http://bit.ly/2S0L5Zv
Submitted January 23, 2019 at 06:56AM by ajdlinux
via reddit http://bit.ly/2FHyqEW
Ramblings
CVE-2019-6260: Gaining control of BMC from the host processor
This is details for CVE-2019-6260 – which has been nicknamed “pantsdown” due to the nature of feeling that we feel that we’ve “caught chunks of the industry with their…
CISA Emergency Directive on DNS Infrastructure Tampering
http://bit.ly/2R6GeS3
Submitted January 23, 2019 at 06:42AM by watusa
via reddit http://bit.ly/2sC6H02
http://bit.ly/2R6GeS3
Submitted January 23, 2019 at 06:42AM by watusa
via reddit http://bit.ly/2sC6H02
www.us-cert.gov
CISA Emergency Directive on DNS Infrastructure Tampering | US-CERT
The U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to address ongoing incidents associated with global Domain Name System (DNS) infrastructure tampering.
Phishing Quiz Made by Google
http://bit.ly/2S0UH6p
Submitted January 23, 2019 at 08:54AM by CaptMeelo
via reddit http://bit.ly/2CAYQo0
http://bit.ly/2S0UH6p
Submitted January 23, 2019 at 08:54AM by CaptMeelo
via reddit http://bit.ly/2CAYQo0
Withgoogle
Phishing Quiz
Founder of Snort, Marty Roesch is leaving Cisco
http://bit.ly/2TdmD4F
Submitted January 23, 2019 at 10:05AM by techky
via reddit http://bit.ly/2TcToyU
http://bit.ly/2TdmD4F
Submitted January 23, 2019 at 10:05AM by techky
via reddit http://bit.ly/2TcToyU
Medium
Charting a New Course
The Next Chapter of My Journey
Contextualizing Attacker Activity within Sessions in Exchange Online - Using Audit to Track Attackers
http://bit.ly/2RZVwg2
Submitted January 23, 2019 at 11:11AM by shehackspurple
via reddit http://bit.ly/2T6YkVS
http://bit.ly/2RZVwg2
Submitted January 23, 2019 at 11:11AM by shehackspurple
via reddit http://bit.ly/2T6YkVS
reddit
r/netsec - Contextualizing Attacker Activity within Sessions in Exchange Online - Using Audit to Track Attackers
3 votes and 0 comments so far on Reddit
My OSCP (Offensive Security Certified Professional) Journey [Turkish]
http://bit.ly/2FTx8pS
Submitted January 23, 2019 at 04:02PM by rdincel1
via reddit http://bit.ly/2RLd7Je
http://bit.ly/2FTx8pS
Submitted January 23, 2019 at 04:02PM by rdincel1
via reddit http://bit.ly/2RLd7Je
Anatova Ransomware Analysis
http://bit.ly/2FT5QQc
Submitted January 23, 2019 at 05:50PM by GetOffMyWAN
via reddit http://bit.ly/2CCzk1H
http://bit.ly/2FT5QQc
Submitted January 23, 2019 at 05:50PM by GetOffMyWAN
via reddit http://bit.ly/2CCzk1H
McAfee Blogs
Happy New Year 2019! Anatova is here! | McAfee Blogs
During our continuous hunt for new threats, we discovered a new ransomware family we call Anatova (based on the name of the ransom note). Anatova was
Frappé Technologies ERPNext Server Side Template Injection
http://bit.ly/2Dun0lI
Submitted January 23, 2019 at 07:03PM by albinowax
via reddit http://bit.ly/2W9kXuR
http://bit.ly/2Dun0lI
Submitted January 23, 2019 at 07:03PM by albinowax
via reddit http://bit.ly/2W9kXuR
Medium
Frappé Technologies ERPNext Server Side Template Injection
A few months ago I was particularly focused on researching vulnerabilities that occurred in Electronic Medical Record web applications…
1729 - ghostnoscript: subroutines within pseudo-operators must themselves be pseudo-operators - project-zero
http://bit.ly/2FSAY2p
Submitted January 23, 2019 at 08:11PM by xaocuc
via reddit http://bit.ly/2FJ4p7I
http://bit.ly/2FSAY2p
Submitted January 23, 2019 at 08:11PM by xaocuc
via reddit http://bit.ly/2FJ4p7I
Tuya-Convert: Escaping the IoT-Cloud, no solder need
http://bit.ly/2S4vDeX
Submitted January 23, 2019 at 09:54PM by herrmann-the-german
via reddit http://bit.ly/2MrBIwG
http://bit.ly/2S4vDeX
Submitted January 23, 2019 at 09:54PM by herrmann-the-german
via reddit http://bit.ly/2MrBIwG
c't
Tuya-Convert: Escaping the IoT-Cloud, no solder need
IoT company Tuya claims to have made over 11.000 products worldwide smart home ready, possibly gathering data from millions of homes in the process. If you don't want your information in the cloud, we show how to free your smart home devices simply by running…
The ZDI 2018 Retrospective
http://bit.ly/2FHcUiM
Submitted January 23, 2019 at 10:17PM by _TM_dude
via reddit http://bit.ly/2FTUtYm
http://bit.ly/2FHcUiM
Submitted January 23, 2019 at 10:17PM by _TM_dude
via reddit http://bit.ly/2FTUtYm
Zero Day Initiative
The ZDI 2018 Retrospective
At the end of 2016, the ZDI program completed its busiest year ever. This was beat by 2017 with a more than 40% increase in published advisories. When 2018 rolled around, we wondered if that growth would continue or if a plateau was coming. I don’t think…
[CTF] We are hosting EvlzCTF! 2-3 Feb 2019 (x-post r/securityctf)
https://evlzctf.in
Submitted January 24, 2019 at 01:11AM by sciencestudent99
via reddit http://bit.ly/2FMNm4O
https://evlzctf.in
Submitted January 24, 2019 at 01:11AM by sciencestudent99
via reddit http://bit.ly/2FMNm4O
reddit
r/netsec - [CTF] We are hosting EvlzCTF! 2-3 Feb 2019 (x-post r/securityctf)
1 vote and 1 comment so far on Reddit
Open source library - idiomatic nmap bindings in go
http://bit.ly/2RKPMaz
Submitted January 24, 2019 at 02:46AM by Ullaakut
via reddit http://bit.ly/2FT7dP2
http://bit.ly/2RKPMaz
Submitted January 24, 2019 at 02:46AM by Ullaakut
via reddit http://bit.ly/2FT7dP2
GitHub
Ullaakut/nmap
Idiomatic nmap bindings for go developers. Contribute to Ullaakut/nmap development by creating an account on GitHub.
GitHub bug allows users to view private repos after access is revoked.
http://bit.ly/2FKKkhs
Submitted January 24, 2019 at 05:04AM by bicicleteando
via reddit http://bit.ly/2CEydOY
http://bit.ly/2FKKkhs
Submitted January 24, 2019 at 05:04AM by bicicleteando
via reddit http://bit.ly/2CEydOY
Gist
Some issues with GitHub Forks
Some issues with GitHub Forks. GitHub Gist: instantly share code, notes, and snippets.
WordPress Vulnerability Scanner - Google Chrome Extension
http://bit.ly/2SSTTxF
Submitted January 24, 2019 at 05:25AM by sourcingdenis
via reddit http://bit.ly/2T6R644
http://bit.ly/2SSTTxF
Submitted January 24, 2019 at 05:25AM by sourcingdenis
via reddit http://bit.ly/2T6R644
Google
WPintel - WordPress Vulnerability Scanner
WordPress Vulnerability Scanner - Scan for vulnerabilities, version, themes, plugins and much more!
Bugcrowd LevelUp 0x03 2019 YouTube Playlist
https://www.youtube.com/playlist?list=PLIK9nm3mu-S61oMP7pie5d2t1Aah41Fji
Submitted January 24, 2019 at 12:28PM by Cabbage-Guy
via reddit http://bit.ly/2WmoTIK
https://www.youtube.com/playlist?list=PLIK9nm3mu-S61oMP7pie5d2t1Aah41Fji
Submitted January 24, 2019 at 12:28PM by Cabbage-Guy
via reddit http://bit.ly/2WmoTIK
YouTube
LevelUp 0x03 2019 - YouTube
I wrote a blog post about how and why to play CTF challenges
http://bit.ly/2HvQ9B1
Submitted January 24, 2019 at 06:27PM by RayofLight-z
via reddit http://bit.ly/2Dvc8Ei
http://bit.ly/2HvQ9B1
Submitted January 24, 2019 at 06:27PM by RayofLight-z
via reddit http://bit.ly/2Dvc8Ei
wolfshirtz
Playing CTFs for fun and profit(but mostly fun)
Playing CTFs for fun and profit(but mostly fun) CTFs(or capture the flags) are competitions held to help hone and build upon skills in information security. CTFs come in all difficulty levels and some that are more difficult even have simpler versions of…
Magento 2.2.6 / 2.1.15 RCE and local file read
http://bit.ly/2RcFudY
Submitted January 24, 2019 at 11:02PM by Blaklis
via reddit http://bit.ly/2FXGSPV
http://bit.ly/2RcFudY
Submitted January 24, 2019 at 11:02PM by Blaklis
via reddit http://bit.ly/2FXGSPV
reddit
r/netsec - Magento 2.2.6 / 2.1.15 RCE and local file read
7 votes and 0 comments so far on Reddit
A brazilian academic researcher's BGP "research" triggered a bug in FRR twice (jan 8 and jan 23), knocking routers around the world offline
http://bit.ly/2DyC01Z
Submitted January 24, 2019 at 10:42PM by merreborn
via reddit http://bit.ly/2S9t5Ms
http://bit.ly/2DyC01Z
Submitted January 24, 2019 at 10:42PM by merreborn
via reddit http://bit.ly/2S9t5Ms
reddit
r/netsec - A brazilian academic researcher's BGP "research" triggered a bug in FRR twice (jan 8 and jan 23), knocking routers around…
12 votes and 4 comments so far on Reddit
Confiant & Malwarebytes Uncover Steganography Based Ad Payload That Drops Shlayer Trojan On Mac…
http://bit.ly/2Hsylqv
Submitted January 24, 2019 at 11:56PM by _vavkamil_
via reddit http://bit.ly/2Rbplpt
http://bit.ly/2Hsylqv
Submitted January 24, 2019 at 11:56PM by _vavkamil_
via reddit http://bit.ly/2Rbplpt
Confiant
Confiant & Malwarebytes Uncover Steganography Based Ad Payload That Drops Shlayer Trojan On Mac Users
Recent months have seen an uptick in reports of JavaScript malware that hides in image files. This is often referred to as “image based…
Local Admin Access and Group Policy Don't mix
http://bit.ly/2S6IahQ
Submitted January 25, 2019 at 01:31AM by oddvarmoe
via reddit http://bit.ly/2U9TqHy
http://bit.ly/2S6IahQ
Submitted January 25, 2019 at 01:31AM by oddvarmoe
via reddit http://bit.ly/2U9TqHy
TrustedSec
Local Admin Access and Group Policy Don’t Mix - TrustedSec
Having spent a career working with Group Policies, I thought now might be a good time to give an overview of it and I felt like doing a little writeup about Group Policies. I especially want to highlight why having admin access to clients can be really bad.…