391
HTTP security headers
Appcanary makes sure you never run vulnerable software on your servers. Like our blog? Subscribe to our newsletter or podcast . Browse the archive , or follow us on twitter , github or rss .
New
The latest blog posts to take off on Hacker News. 616 posts.
392
Don't tell people to turn off Windows Update
You know what really surprised me about this whole WannaCry ransomware problem [https://www.troyhunt.com/everything-you-need-to-know-about-the-wannacrypt-ransomware/]? No, not how quickly it spread. Not the breadth of organisations it took offline either and no, not even that so many of them hadn'
393
Lessons from last week’s cyberattack
Early Friday morning the world experienced the year’s latest cyberattack. Starting first in the United Kingdom and Spain, the malicious “WannaCrypt” software quickly spread globally, blocking customers from their data unless they paid a ransom using Bitcoin. The WannaCrypt exploits used in the attack were drawn from…
394
395
396
Proton.B: What this Mac malware does
Eliminate active threats with 24/7/365 threat detection, investigation, and response.
397
Reverse-Engineering the Intel Management Engine
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
398
Fuzzing Irssi
There have been recent efforts within the Irssi and open source security communities to make Irssi more secure through the use of fuzzing. For example the security bugs revealed in the first Irssi security advisory of 2017 were found by fuzzing. In this blog post, we will cover an introduction to fuzzing, how to fuzz…
399
400
Microsoft Issues WanaCrypt Patch for Windows 8, XP
Microsoft Corp. today took the unusual step of issuing security updates to address flaws in older, unsupported versions of Windows — including Windows XP and Windows 8 . The move is a bid to slow the spread of the WanaCrypt ransomware strain that infected tens of thousands of Windows computers virtually overnight this…
401
Cisco's Talos team analysis of WannaCry worm
By Martin Lee, Warren Mercer, Paul Rascagneres, and Craig Williams. Executive Summary A major ransomware attack has affected many organizations across the world reportedly including Telefonica in Spain, the National Health Service in the UK, and FedEx in the US. The malware responsible for this attack is a ransomware…
402
Patching Is Hard
There are many news reports of a ransomware worm . Much of the National Health Service in the UK has been hit; so has FedEx . The patch for the flaw exploited by this malware has been out for a while, but many companies haven’t installed it. Naturally, this has prompted a lot of victim-blaming: they should have…
403
404
Keylogger in Hewlett-Packard Audio Driver
Security reviews of modern Windows Active Domain infrastructures are – from our point of view – quite sobering. Therefore, we often look left and right, when, for example, examining the hardening of protection mechanisms of a workstation. Here, we often find all sorts of dangerous and ill-conceived stuff. We want to…
405
406
Exploiting the Linux kernel via packet sockets
Guest blog post, posted by Andrey KonovalovIntroductionLately I’ve been spending some time ...
407
408
OSS-Fuzz: Five months later, and rewarding projects
The latest news from Google on open source releases, major projects, events, and outreach programs for early career developers.
409
410
Things to Use Instead of JSON Web Tokens
You might have heard that you shouldn't be using JWT. That advice is correct - you really shouldn't use it. In general, specifications that allow the attacker to choose the algorithm for negotiation have more problems than ones that don't (see TLS). N libraries need to implement M different encryption and decryption…
411
412
413
Rediscovering the Intel AMT Vulnerability
On May 1, 2017 Intel disclosed the AMT vulnerability (INTEL-SA-00075), but details of that vulnerability were not made public. However, Tenable researchers were able to overcome this challenge and make Tenable the first to deliver Intel AMT vulnerability detection capabilities to customers, just minutes after Intel’s…
414
Why Is the TSA Scanning Paper?
I’ve been reading a bunch of anecdotal reports that the TSA is starting to scan paper separately: A passenger going through security at Kansas City International Airport (MCI) recently was asked by security officers to remove all paper products from his bag. Everything from books to Post-It Notes, documents and more…
415
Password reuse and credential stuffing
The short version: I'm loading over 1 billion breached accounts into HIBP. These are from 2 different "combo lists", collections of email addresses and passwords from all sorts of different locations. I've verified their accuracy (including my own record in one of them) and many hundreds of millions
416
Something is wrong when the ‘telephone app’ on your phone becomes 3rd party
Since I am not living in my home country, I frequently use two different SIM cards and prefer having a phone with dual-sim support. This limits your choice s...
417
Why Security Backdoors are Bad (2016)
Recently, there has been a bit of controversy over the concept of the government or security agencies adding backdoors to services and…
418
419
Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress
When sophisticated adversaries want to hack a network, they ultimately win. A government mandated encryption backdoor would make Americans less safe.
420