Vulnerable web applications allow hackers to bypass corporate firewalls netsparker.com
A detailed technical article which explains how malicious attackers can target vulnerable web applications running on developers' workstations.
Crashing iDevices with CSS. Breaches at India's biometric database, a US Gov payment site and many more.
Sponsorships
1Password for Teams and Business1password.com
I use 1Password to securely share passwords and notes with my colleagues. Can't recommend them enough and I'm super honoured to have them as a sponsor.
News
Breaches and leaks
- Adhaar: India's biometric database, holding over a billion people, seems to be trivially spoofable/accessible.
- Newegg, a large online technology retailer, had credit card information leeched, again by Magecart. It's unknown at this point how many people were affected.
- GovPayNow: an online payment service of the US government, where things like traffic tickets and even bail can be paid, exposed all receipts. You could simply change the ID in the URL (yes, this again, ffs) and see the other receipts.
- US State Department: its "unclassified e-mail system" was breached, exposing personal information of a "small number" of employees.
- Bristol Airport had a ransomware infection and had to resort to writing flight schedules on whiteboards for a bit before recovering.
- Medcall Healthcare Advisors: healthcare provider, had 7 gigs of medical information in an exposed s3 bucket.
- Unknown: an unprotected MongoDB database was found with just under 11 million personal records. The researcher is not certain who it belongs to, although there are suspicions.
A new CSS-based web attack will crash and restart your iPhonebleepingcomputer.com
Windows systems vulnerable to FragmentSmack DoS bugbleepingcomputer.com
Similar to Linux a few months back (link), a number of Windows versions can be rendered unresponsive by it. A fix was included in this month's Patch Tuesday.
Researchers describe cold-boot attack that works on all laptopsthreatpost.com
We all know that once an attacker gets physical access to your device it's much harder to defend yourself. This bypasses disk encryption though, and even firmware passwords if the device is in sleep mode. It's a bit hard to make out if anything can be done, but how I understand it is that one can only make it as hard as possible by using disk encryption, a firmware password and always shut down or hibernate your device.
Remote code execution in Alpine Linuxjusti.cz
There's a vulnerability in apk, the default package manager. It can be exploited through a malicious package or a man-in-the-middle (MiTM) attack. Lot's of Docker images are based in Alpine, so check your own.
iOS 12 is here: these are the security features you need to know aboutsophos.com
Automatic updates, USB restricted mode and password management improvements.
Critical out-of-band patch for Adobe Acrobat Readerthreatpost.com
This seems to have missed the window of their regular patch cycle last week. It fixes seven vulnerabilities, one of which can trigger remote code execution.
Equifax IT staff had to rerun hackers' database queries to work out what was nicked theregister.co.uk
Article on the internal process after the Equifax hack. Not exactly heartwarming. Hackernews discussion here.
Breachroom: A collection of recent cyber attacks and data breachestemplarbit.com
Nice project from Templarbit, gathering all information on high-level breaches.
GitHub - OWASP/NodeGoat: github.com
Very cool project. It provides an environment to learn about how the OWASP Top 10 security risks apply to Node.js applications and teaches how to mitigate them.
The effectiveness of publicly shaming bad securitytroyhunt.com
It's a sad fact that many companies only seem to change their insecure practices when they are publicly shamed about them. Troy Hunt makes his position on this very clear with a bunch of examples.
Extended Validation certificates are deadtroyhunt.com
Another one of Troy's. I must admit that I don't know how CA's are going to stay alive with Let's Encrypt being a pretty awesome thing.