Troy Hunt

FEBRUARY 1, 2018

I'm a fan (which is why I also recently joined Report URI ), and if you're running a website, you should be too. However, you can add a CSP via meta tag and indeed that's what I originally did with the upgrade-insecure-requests implementation I mentioned earlier when I fixed the Disqus issue.

118

118

SecureList

JUNE 6, 2022

At the end of May, researchers from the nao_sec team reported a new zero-day vulnerability in Microsoft Support Diagnostic Tool (MSDT) that can be exploited using Microsoft Office documents. The data used to describe the link is placed in the tag with attributes Type=”[link] Target=”http_malicious_link!”

Data breaches 125

Data breaches Ransomware 125

Security Affairs

DECEMBER 3, 2019

An attacker could embed an iframe tag into a website with the “src” attribute set to the crafted link, then trick the victim into visiting it. Below the vulnerability timeline: 29/10/19 – The vulnerability found 30/10/19 – Vulnerability reported to Microsoft 31/10/19 – Report was closed by Microsoft – ?!? “While OAuth 2.0

Authentication 69

Authentication Accountability Social Engineering Advertising 69

Troy Hunt

APRIL 19, 2018

Me: Ok, but be conscious that means they can never change those scripts without you first modifying the integrity attribute on your script tags and you need time to push that out so as not to break the site. Let me paraphrase: Bank: We're thinking of using SRI to protect malicious modification of scripts we load in from a partner.

Banking 120

Banking DNS 120

Troy Hunt

SEPTEMBER 26, 2018

No HTML tags. 2,663 requests (one of which was to Report URI , thank you very much!) Somewhere in the middle is a responsible approach, for example the sponsorship banner you see at the top of this blog. Companies I choose to partner with get to appear there and they get themselves 140 characters and a link. That is all.

DNS 275

DNS Risk 275

Troy Hunt

NOVEMBER 14, 2018

A nice, slick, clean set of violation reports from the content security policy (CSP) I run on Have I Been Pwned (HIBP). Logging on to Report URI and being greeted with something like this: This blog post is about how add-ons and extensions in browsers cause CSP violations like the ones above and how they should be dealt with.

Media 214

Media Accountability Technology 214

Fox IT

NOVEMBER 1, 2023

Furthermore, there has been a shift in payload type from Cobalt Strike to Mythic agents, matching with previous reporting. Matching with public reporting, we have also seen it as a follow-up in SocGholish infections. Discussing payloads Looking at the dropped payloads, we see that it mostly conforms with what has already been reported.

Computers and Electronics 92

Computers and Electronics Encryption DNS Ransomware 92