511
Google to Acquire Mandiant
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
New
The latest blog posts to take off on Hacker News. 642 posts.
512
An update on the threat landscape
Online security is extremely important for people in Ukraine and the surrounding region right now. Government agencies, independent newspapers and public service provide…
513
Critical cross-account vulnerability in Microsoft Azure automation service
AutoWarp is a critical vulnerability in Microsoft Azure Automation Service that allows unauthorized access to other customer accounts using the service.
514
SATCOM terminals under attack in Europe: a plausible analysis
------ Update 03/12/2022 Reuters has published new information on this incident, which initially matches the proposed scenario. You can find...
515
Windows Defender is enough, if you harden it
This article is not intended to convince you to abandon your current antivirus solutions. In this post I would like to share my observations and ways to improve the effectiveness of Defender. You don’
516
What's the risk from fake Yubikeys?
I found this on a security-related Slack (shared with permission). It launched an entertaining discussion about the risks of taking a potentially fake FIDO token. We all know the risks of taking a free USB drive and shoving it in our computer, right? USB sticks can install software, act as a keylogger, transmit data…
517
Escaping privileged containers for fun
Despite the fact that it is not a 'real' vulnerability, escaping privileged Docker containers is nevertheless pretty funny. And because there will always be people who will come up with reasons or excuses to run a privileged container (even though you really shouldn't), this could really be handy at some point in the…
518
Finding an authorization bypass on my own website
The mysqljs parameterized query parser handles objects as column name and key, leading to alterations of the query.
519
Mozilla patches two use-after-free vulnerabilities (ab)used in the wild
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.
520
The perils of the “real” client IP
This post ended up being incredibly long comprehensive. I’m afraid that many people won’t read enough to get everything that’s important, so here are the key points:
521
Retrieving your browsing history through a CAPTCHA
Web developer and cybersecurity researcher
522
523
Help Censored Users – Run a Tor Bridge
Today the Tor Project is launching the Run a Tor Bridge campaign. Participants are invited to contribute and help censored users by running a Tor bridge. You can find more details below, including our special reward kits for participants. The campaign will run from November 17 to January 7, 2022. Join us and help…
524
New Linux vulnerability affecting cgroups: can containers escape?
CVE-2022-0492 is the third recent kernel vulnerability that allows malicious containers to escape. We offer root cause analysis and mitigations.
525
526
The new White House memo on zero trust is a strong signal
The new White House memo on zero trust is a strong signal that the US federal government is taking an active stance regarding cybersecurity. Not only does this have far-reaching ramifications for the public and private sectors, it also serves to cut through the noise about zero trust with an impartial source. Let’s…
527
528
529
Anatomy of a JWT
Technical article explains JSON Web Tokens (JWT), their component parts, and how they are used for authentication.
530
How to earn money by hacking a “walking for money” app
Or how to reverse engineer React Native apps, and abuse API.
531
A planned EU regulation about website certificates is causing concern
Feisty Duck’s Cryptography & Security Newsletter is a periodic dispatch bringing you commentary and news surrounding cryptography, security, privacy, SSL/TLS, and PKI. It's designed to keep you informed about the latest developments in this space. Enjoyed every month by more than 50,000 subscribers. Written by Hanno…
532
Briar has been removed from Google Play
Status update Update (February 28, 13:20 UTC): Briar is available on Google Play again. Briar was briefly removed from Google Play because we didn’t provide Google’s review team with a username and password for testing the app. We provided Google with a username and password for testing and the app is now available…
533
534
GitHub’s database of security advisories is now open source
Anyone can now provide additional information and context to further the community’s understanding and awareness of security advisories.
535
Gitlab Critical Security Release
GitLab release announcements and feature highlights.
536
Is Grammarly a keylogger? What can you do about it?
Is Grammarly a keylogger? Here's what to consider so employees can reap the benefit of this valuable tool without compromising data security.
537
A practical guide to securing Google Workspace for a startup
View the Fleet handbook.
538
Don't Use RAR
Group for Apps and Services on Exascale Research Infrastructure is a research, development, and teaching unit at FIDIT + MedRi.
539
Cloudflare to acquire Area 1 Security for $162M
Earlier today we announced that Cloudflare has agreed to acquire Area 1 Security
540
Detecting Monero Miners with Bpftrace
Pixie Blog