Cyber Security Informer

We Are Almost 3! Cloud Security Podcast by Google 2023 Reflections

Anton on Security

JANUARY 10, 2024

We started doing the LIVE VIDEO recording sessions ( the latest ) We have a fun new community site for discussions We also covered a lot of AI. So we have covered AI for security, we have covered securing AI and we have not yet covered the third pillar (countering the AI-armed attacker). what a NOT surprise ?

Cloud Migration

Cloud Migration Government Network Security Risk

Massive iPhone Hack Targets Uyghurs

Schneier on Security

SEPTEMBER 3, 2019

This story broke in waves, the first wave being about the iPhone. Earlier this year Google's Threat Analysis Group (TAG) discovered a small collection of hacked websites. TAG was able to collect five separate, complete and unique iPhone exploit chains, covering almost every version from iOS 10 through to the latest version of iOS 12.

Hacking

Hacking Surveillance Malware Government

Retrofitting Temporal Memory Safety on C++

Google Security

MAY 26, 2022

We extended this mechanism to also cover allocations that serve as backing memory for other allocators, e.g., zone memory that is managed by V8 for the optimizing JavaScript compiler. Hardware Memory Tagging to the Rescue MTE (Memory Tagging Extension) is a new extension on the ARM v8.5A Pointers are also assigned a 4-bit tag.

Technology

Technology Architecture Authentication Software

Webinars

Reimagining Cybersecurity Training: Driving Real Impact on Security Culture

MORE WEBINARS

We Are Almost 3! Cloud Security Podcast by Google 2023 Reflections

Security Boulevard

JANUARY 10, 2024

We started doing the LIVE VIDEO recording sessions ( the latest ) We have a fun new community site for discussions We also covered a lot of AI. So we have covered AI for security, we have covered securing AI and we have not yet covered the third pillar (countering the AI-armed attacker). what a NOT surprise ?

Cloud Migration

Cloud Migration Government Network Security Risk

Ghostwriter v4.1: The Custom Fields Update

Security Boulevard

APRIL 5, 2024

There’s so much to cover that we won’t be offended if you want to look at the CHANGELOG for a quick synopsis. Configuring Custom Fields on the Admin Panel With these sections, we can simplify our report templates by boiling them down to something as basic as a cover page and a series of pages with Jinja2 code referencing our custom fields.

Penetration Testing

Penetration Testing Social Engineering Engineering Cybersecurity

Maze Ransomware Operators: 'We Are Closing'

SecureWorld News

NOVEMBER 2, 2020

You would not even notice when you will be tagged with chips or your DNA will be the only was to access the new digital world. Last year, SecureWorld covered a story where a teenage hacker, who went by the name TheHackerGiraffe, quickly became a well known name in the industry only to retire a few weeks later.

Ransomware

Ransomware Cybercrime Hacking Technology

WordCamp Seattle 2017 – The Emerald City Event

SiteLock

AUGUST 27, 2021

Andrea even highlighted a few project contributors by telling their stories of how they got involved. She covered beginning, intermediate and advanced technical topics such as proper titles, headings, keywords, and image meta tags. Get Google to Love Your WordPress Website.

Architecture

Architecture Marketing Malware Software

Lab Walkthrough?—?Lucee Server Arbitrary File Write [CVE-2021–21307]

Pentester Academy

APRIL 13, 2023

or sign up for a 7-day, risk-free trial with INE and access this lab and a robust library covering the latest in Cyber Security, Networking, Cloud, and Data Science! Technical difficulty: Beginner Introduction Lucee Server is a dynamic, Java-based (JSR-223), tag and scripting language used for rapid web application development.

Risk

Risk Software InfoSec Cybersecurity

Just What Does It Take to Develop a Career in the Cybersecurity Domain?

IT Security Guru

JANUARY 12, 2021

I recently made a LinkedIn post asking people to share their stories about how they happened to become cybersecurity professionals. Specialization is a rabbit hole topic that we might not be able to cover in detail in this post. What kind of specializations are available?

Cybersecurity

Cybersecurity Government IoT Penetration Testing

Lab Walkthrough?—?The WannaCry Ransomware

Pentester Academy

FEBRUARY 23, 2023

or sign up for a 7-day, risk-free trial with INE and access this lab and a robust library covering the latest in Cyber Security, Networking, Cloud, and Data Science! cp -rf /root/Desktop/tools/html-templates/* /var/www/html/ls /var/www/html/ Modify the index.html file and paste the below code under the HTML <body> tag. <script>

Ransomware

Ransomware Encryption Cryptocurrency Banking

Listening in at Latimer House. RF emissions and more

Pen Test Partners

JANUARY 8, 2024

There’s a great story about two sisters in WWII who joined the Wrens, the women’s branch of the Royal Navy (fully integrated into the Royal Navy in the 1990’s). It stressed the need to protect sensitive information and cultivated a culture of silence over military matters. There are positives and negatives of course.

Computers and Electronics

Computers and Electronics Risk Technology Manufacturing

Angular + React: Vulnerability Cheatsheet

Security Boulevard

MARCH 1, 2022

The vulnerabilities I will cover in this post are: Authentication bypass. But the SOP does not limit javascript code, and the HTML <script> tag is allowed to load Javascript code from any origin. Improper access control. Open redirects. Cross-site request forgery (CSRF). Template injection. Cross-site script inclusion (XSSI).

Authentication

Authentication Banking Phishing Passwords

The Telegram phishing market

SecureList

APRIL 5, 2023

This story covers the variety of phishing services available on Telegram, their details and pricing, and ways of detecting phishing content that originates in Telegram. ” Links to the channels are spread via YouTube, GitHub and phishing kits they make.

Phishing

Phishing Marketing Scams Accountability

Kids on the Web in 2021: Infinite creativity

SecureList

JUNE 1, 2021

Web filtering in Kaspersky Safe Kids currently covers the following categories: Software, audio, video. To get a fuller picture of children’s interests, it is useful to look at the 10 mobile apps on which children across the world spent most of their time during the period covered by this study. Internet communication.

Mobile

Mobile Internet Internet Software

Friday Squid Blogging: A Tracking Device for Squid

Schneier on Security

FEBRUARY 22, 2019

Really : After years of "making do" with the available technology for his squid studies, Mooney created a versatile tag that allows him to research squid behavior. As Mooney and Katija refine the tags, they plan to produce an adaptable, open-source package that scientists researching other marine invertebrates can also use.

Engineering

Engineering Technology

Machine Learning in Cybersecurity Course – Part 2: Specific Applications and Challenges

NopSec

APRIL 7, 2019

Finally, we covered some common challenges encountered when designing machine learning systems, as well as adversarial machine learning in specific. In this post, we complete the story by summarizing the remaining topics covered in the webinar – the three specific applications of ML to security problems and the challenges.

Cybersecurity

Cybersecurity Data breaches Malware Risk

Node.js Vulnerability Cheatsheet

Security Boulevard

FEBRUARY 17, 2022

The vulnerabilities I will cover in this post are: Prototype pollution. But the SOP does not limit javascript code, and the HTML <script> tag is allowed to load Javascript code from any origin. Attackers often modify log files to cover up their tracks during an attack. applications, and how you can find and prevent them.

Authentication

Authentication Encryption Engineering Firewall

Understanding Have I Been Pwned's Use of SHA-1 and k-Anonymity

Troy Hunt

JUNE 30, 2022

Both these positions make no sense whatsoever when you peel back the covers and understand what's happening underneath, but I get how on face value these conclusions can be drawn. Or alternatively: Our [insert title of person who fills out paperwork but has no technical understanding here] says that k-anonymity involves sending you PII.

Passwords

Passwords Identity Theft Consumer Services Password Management

APT annual review 2021

SecureList

NOVEMBER 30, 2021

Possibly the biggest story of 2021, an investigation by the Guardian and 16 other media organizations, published in July, suggested that over 30,000 human rights activists, journalists and lawyers across the world may have been targeted using Pegasus. Private sector vendors play a significant role in the threat landscape.

Malware

Malware Mobile Spyware Surveillance

A Decade of Have I Been Pwned

Troy Hunt

DECEMBER 3, 2023

And that's precisely what this 185th blog post tagging HIBP is - the noteworthy things of the years past, including a few things I've never discussed publicly before. There's a wild story to be told there one day but whilst that saga is now well and truly behind me, the scars are still raw.

Data breaches

Data breaches Passwords Internet Internet

Why access management needs to evolve beyond passwords

CyberSecurity Insiders

OCTOBER 13, 2021

It was a similar story with a study covered by Threatpost about a month later. That ’ s nearly double its price tag of $381,920 back in 2015. Two in 10 individuals said that they weren’t sure whether those with whom they shared their passwords went on to share those same credentials with others.

Passwords

Passwords Accountability Data breaches Authentication

The Hacker Mind Podcast: Surviving Stalkerware

ForAllSecure

SEPTEMBER 21, 2021

So, again it's outside of anything we can cover in this podcast, but really consent is one of the really big issues here. The same with social media apps, I have to go through various settings to make sure that I'm not tagged without my permission, or in some cases even block a person now and again. And it's not just Microsoft.

Technology

Technology Software Surveillance Media

Happy 10th anniversary & Kali's story.so far

Kali Linux

MARCH 28, 2023

This is the story of how Kali came to be, and some of the challenges along the way. Believe it or not, there is even more to the story where can go into more detail. Setup We knew how important it was to have a functioning setup process, and it needs to be able to cover a lot of different scenarios. was first released.

InfoSec

InfoSec Penetration Testing Architecture Software

Thinking About the Future of InfoSec (v2022)

Daniel Miessler

MARCH 20, 2022

The ideas will cover multiple aspects of InfoSec, from organizational structure to technology. Some teams will tag activity with various labels (OFFSEC, CHAOSOPS, UNKNOWN, ATTACKER22301 etc.) Or you’re an executive telling the data security story to your stakeholders. Will there be OFFSEC people? Absolutely.

InfoSec

InfoSec Insurance Engineering Technology

Is India's Aadhaar System Really "Hack-Proof"? Assessing a Publicly Observable Security Posture

Troy Hunt

JANUARY 10, 2018

The video within that story reiterates over and over again that "Aadhaar data cannot be breached" It then goes on to quote the government as saying that: it cannot be questioned by a handful of individuals. Much of what I'm going to cover in the remainder of this blog post will focus on the site at uidai.gov.in

Hacking

Hacking Government Risk Encryption

Ode to the use-after-free: one vulnerable function, a thousand possibilities

Scary Beasts Security

MAY 5, 2017

Introducing CVE-2012-3748 CVE-2012-3748 has a very storied history. Direct fallout is at [3], [5], [11], [12], [13] with a significant secondary fallout at [10] that we’ll cover later. u.asInt64 & TagMask); } Where tag() returns the latter 4 bytes of the value, CellTag==0xfffffffb and TagMask==0xffff000000000002.

Hacking

Hacking Mobile Accountability

Mystic Stealer

Security Boulevard

JUNE 15, 2023

This is the story of information stealers today. Whether it's Bitcoin, DashCore, Exodus, or any other popular crypto wallet, Mystic Stealer has it covered. Data stolen from the infected system is labeled with specific binary tags that identify the type of information when it is sent to the C2 server.

Cryptocurrency

Cryptocurrency Password Management Malware DNS

The CyberWire Daily Podcast EP. 389 With Guest Speaker David Brumley

ForAllSecure

AUGUST 14, 2019

BGR says the price tag for Pegasus is in the range of millions of dollars. If $300 million isn't enough to cover such compensation, Equifax is on the hook to pony up an additional $125 million if necessary. Dave Bittner: [00:14:21] A story here from CNET. Dave Bittner: [00:03:09] This isn't a commodity attack tool.

Energy and Utilities

Energy and Utilities Penetration Testing Government Education

The CyberWire Daily Podcast EP. 389 With Guest Speaker David Brumley

ForAllSecure

AUGUST 14, 2019

BGR says the price tag for Pegasus is in the range of millions of dollars. If $300 million isn't enough to cover such compensation, Equifax is on the hook to pony up an additional $125 million if necessary. Dave Bittner: [00:14:21] A story here from CNET. Dave Bittner: [00:03:09] This isn't a commodity attack tool.

Energy and Utilities

Energy and Utilities Penetration Testing Government Education

THE CYBERWIRE DAILY PODCAST EP. 389 WITH GUEST SPEAKER DAVID BRUMLEY

ForAllSecure

AUGUST 14, 2019

BGR says the price tag for Pegasus is in the range of millions of dollars. If $300 million isn't enough to cover such compensation, Equifax is on the hook to pony up an additional $125 million if necessary. Dave Bittner: [00:14:21] A story here from CNET. Dave Bittner: [00:03:09] This isn't a commodity attack tool.

Energy and Utilities

Energy and Utilities Penetration Testing Government Education

Nation-State Actors Phishing Trump and Biden Campaigns

SecureWorld News

JUNE 5, 2020

With an acronym like TAG, you might expect a lighthearted, playful Google group running in a field. But Google's Threat Analysis Group (TAG) is anything but. And according to Shane Huntley , Head of TAG, the team recently uncovered some vital security intel regarding the 2020 U.S. APT groups target Trump and Biden campaigns.

Phishing

Phishing Telecommunications Government Engineering

Turning a £400 BBC Micro (1981) into a $40,000 disc writer (1987)

Scary Beasts Security

JULY 10, 2020

Introduction One of the most iconic floppy disc protection stories is Dungeon Master. There is also this excellent article which goes more into the stories surrounding the Dungeon Master protection. The reason for the hefty price tag is likely the timing precision required to create fuzzy bits reliably. This is not suitable.

Accountability

Accountability Technology

Advanced threat predictions for 2023

SecureList

NOVEMBER 14, 2022

Although 2022 did not feature any mobile intrusion story on the scale of the Pegasus scandal, a number of 0-days have still been exploited in the wild by threat actors. Last June, Google’s TAG team released a blog post documenting attacks on Italian and Kazakh users that they attribute to RCS Lab, an Italian offensive software vendor.

Firmware

Firmware Surveillance Mobile Telecommunications

Cyber Security Informer

We Are Almost 3! Cloud Security Podcast by Google 2023 Reflections

Massive iPhone Hack Targets Uyghurs

Webinars

Trending Sources

Retrofitting Temporal Memory Safety on C++

Webinars

We Are Almost 3! Cloud Security Podcast by Google 2023 Reflections

Ghostwriter v4.1: The Custom Fields Update

Maze Ransomware Operators: 'We Are Closing'

WordCamp Seattle 2017 – The Emerald City Event

Lab Walkthrough?—?Lucee Server Arbitrary File Write [CVE-2021–21307]

Just What Does It Take to Develop a Career in the Cybersecurity Domain?

Lab Walkthrough?—?The WannaCry Ransomware

Listening in at Latimer House. RF emissions and more

Angular + React: Vulnerability Cheatsheet

The Telegram phishing market

Kids on the Web in 2021: Infinite creativity

Friday Squid Blogging: A Tracking Device for Squid

Machine Learning in Cybersecurity Course – Part 2: Specific Applications and Challenges

Node.js Vulnerability Cheatsheet

Understanding Have I Been Pwned's Use of SHA-1 and k-Anonymity

APT annual review 2021

A Decade of Have I Been Pwned

Why access management needs to evolve beyond passwords

The Hacker Mind Podcast: Surviving Stalkerware

Happy 10th anniversary & Kali's story.so far

Thinking About the Future of InfoSec (v2022)

Is India's Aadhaar System Really "Hack-Proof"? Assessing a Publicly Observable Security Posture

Ode to the use-after-free: one vulnerable function, a thousand possibilities

Mystic Stealer

The CyberWire Daily Podcast EP. 389 With Guest Speaker David Brumley

The CyberWire Daily Podcast EP. 389 With Guest Speaker David Brumley

THE CYBERWIRE DAILY PODCAST EP. 389 WITH GUEST SPEAKER DAVID BRUMLEY

Nation-State Actors Phishing Trump and Biden Campaigns

Turning a £400 BBC Micro (1981) into a $40,000 disc writer (1987)

Advanced threat predictions for 2023

Stay Connected