1Password for Teams and Business1password.com
We use 1Password to share passwords and secure notes at my current job, same as at my last job. I've tried many alternatives, but always ended up with them. By far the best UX and support I've seen.
Google having problems with BGP. Nginx DoS vulnerabilities. Pwn2Own results are in.
Sponsorships
Overview of recent breaches and cyber attackstemplarbit.com
Templarbit maintains this great list of breaches and attacks, with severity, sources, location, and more. Worth checking out!
News
Breaches and leaks
- Bankers Life: insurance agency, had a data breach impacting over 500.000 customers.
- Kars4Kids: the charity had an unsecured MongoDB instance, containing the information of over 21.000 donors.
- Nordstrom: the retailer notified its employees this week that a contractor gained unauthorised access to employee personal data.
- The Twitter accounts of both Google's Gsuite and Target were hacked this week, and used in a Bitcoin scam: link
Google goes down after major BGP mishap routes traffic through Chinaarstechnica.com
There was a lot of news this week around Google's downtime, which was caused by another BGP misconfiguration. Even though it looks suspicious, most seem to agree that it was an accident.
Nginx server flaws found, can trigger DoS attacksecurityaffairs.co
Over a million servers are currently vulnerable, according to Shodan. If you're running anything older than 1.15.6 and 1.14.1, make sure you check it out.
DARPA uses a remote island to stage a cyberattack on the US power gridsophos.com
Very cool. DARPA held a live exercise where a red team tried to bring down the electrical grid, and the defenders had to hold them off and recover. Looking at Ukraine's recent history, it's not just a theoretical exercise either.
Pwn2Own Tokyo wrap-up: 325.000 USD handed out for 18 vulnerabilitiesbleepingcomputer.com
The iPhone X, Galaxy S9, and Xiaomi Mi6 were all owned. The winners were the two members of Team Fluoroacetate, who took home a whopping 215.000 USD for their exploits.
Botnet pwns 100,000 routers using ancient security flawsophos.com
Just a nice example of how we suck at router security. The flaw has been known and patched since 2013, yet this botnet was able to gather 100.000 compromised routers in only two months.
WordPress GDPR compliance plugin hackedsophos.com
Attackers were found to actively exploit a flaw in an often used GDPR plugin for Wordpress. If you use it, make sure you update.
DJI drone flight logs, photos and videos exposed to unauthorised accessbleepingcomputer.com
The drone maker had an XSS vulnerability which allowed researchers to steal cookies, giving access to user accounts, flight logs, pictures and videos.
Update all the things \o/
- Microsoft: had its Patch Tuesday, fixing 64 vulnerabilities, 12 of which are critical, including one zero-day vulnerability that's being exploited in the wild.
- Adobe fixed three information disclosure vulnerabilities in Acrobat and Reader.
The Intel Microcode boot loader protects older CPUs from Spectrebleepingcomputer.com
In case you're running an old system that didn't get Spectre patches, there's now a bootloader available that patches your CPU at runtime. You do always have to boot from the USB in question. And obviously you have to trust the person who created it. Still, might be useful to some.
XSStrike: Most advanced XSS detection suitegithub.com
It's an open-source tool for XSS detection. I haven't tested it out yet, but it looks pretty sweet.
iSH - An iOS Linux Shell for your iPhone or iPadbleepingcomputer.com
I don't think I've seen a Linux shell on iOS yet, so I figure it's worth a share :-)
12 TED talks on cybersecurityvaronis.com
Just a nice collection of security-related talks, in case you're bored on these grey, drab autumn evenings.