391
Docker container security cheat sheet
Discover essential Docker Security Best Practices for DevOps engineers and security professionals. Cheat sheet included for quick implementation!
392
Hooking Candiru: Another mercenary spyware vendor comes into focus
Candiru is a secretive Israel-based company that sells spyware exclusively to governments. Using Internet scanning, we identified more than 750 websites linked to Candiru’s spyware infrastructure. We found many domains masquerading as advocacy organizations such as Amnesty International, the Black Lives Matter…
393
Apple's “iCloud Private Relay” broke risk based authentication
ZITADEL is the identity infrastructure platform that is built for developers and works for all users and applications.
394
VPN over SSH? The Socks Proxy
Some resources on the internet might be only accessible from clients with particular IP addresses. For example, suppose you want to…
395
Developers fix multitude of vulnerabilities in Apache HTTP Server
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
396
Half-Double: New hammering technique for DRAM Rowhammer bug
Research Team: Salman Qazi, Yoongu Kim, Nicolas Boichat, Eric Shiu & Mattias Nissler Today, we are sharing details around our discovery of ...
397
Noyb.eu files 422 formal GDPR complaints on nerve-wrecking “Cookie Banners”
Today we filed 422 + 36 complaints on "cookie banners" with ten European Data Protection Authorities.
398
Faking Twitter unfurling to phish you
Do you trust links? Well, you shouldn’t. Do you trust this link: Twitter says this link should take you to Uniswap, nobody would be none-the-wiser because we…
399
AlgorithmWatch shuts down Instagram monitoring after threats from Facebook
Digital platforms play an ever-increasing role in structuring and influencing public debate. Civil society watchdogs, researchers and journalists need to be able to hold them to account. But Facebook is increasingly fighting those who try. It shut down New York University’s Ad Observatory last week, and went after…
400
Google, Mozilla Close to Finalizing Sanitizer API for Chrome and Firefox Browse
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
401
What data on myself I collect and why (2020)
How I am using 50+ sources of my personal data
402
403
No general method to detect fraud
The parts of a convincing deception
404
Counter-Strike Global Offsets: reliable remote code execution
One of the factors contributing to Counter-Strike Global Offensive’s (herein “CS:GO”) massive popularity is the ability for anyone to host their own community server. These community servers are free to download and install and allow for a high grade of customization. Server administrators can create and utilize…
405
Cloudflare blocks an almost 2 Tbps multi-vector DDoS attack
Earlier this week, Cloudflare automatically detected and mitigated a DDoS attack that peaked just below 2 Tbps — the largest we’ve seen to date.
406
Microsoft has detected nation-state activity associated with NOBELIUM
The Microsoft Threat Intelligence Center (MSTIC) has detected nation-state activity associated with the threat actor tracked as NOBELIUM, attempting to gain access to downstream customers of multiple cloud service providers (CSP), managed service providers (MSP), and other IT services organizations.
407
408
409
RSA chief believed cryptographers’ warnings on Dual EC DRBG lacked merit (2014)
"When, last September, it became possible that concerns raised in 2007 might have merit as part of a strategy of exploitation, NIST as the...
410
I exploited existing YouTube videos with a fake Patreon profile
I am watching a lot of investing videos on youtube recently. I like to watch them while I eat, or they play in the background while I do something else. I…
411
Access Control for GitHub Pages
GitHub Pages now gives you the option to limit access, making the site visible only to users with access to the repository that published the Page. With access control, you…
412
DDoS-Guard to forfeit internet space occupied by Parler
Parler , the beleaguered social network advertised as a “free speech” alternative to Facebook and Twitter, has had a tough month. Apple and Google removed the Parler app from their stores, and Amazon blocked the platform from using its hosting services. Parler has since found a home in DDoS-Guard , a Russian digital…
413
Proposed illegal image detectors on devices are ‘easily fooled’
Proposed algorithms that detect illegal images on devices can be easily fooled with imperceptible changes to images, Imperial research has found.
414
The new ProtonMail has passed its independent security audit
Before we released the new Proton Mail, security experts conducted an independent audit of its open source code. You can read their report.
415
Bringing supply chain security features to the Go community
GitHub’s supply chain security features are now available for Go modules, which will help the Go community discover, report & prevent vulnerabilities.
416
OAuth with Cloudflare workers on a statically generated site
An article on implementing OAuth user registration for a newsletter on a statically generated site using Cloudflare workers.
417
The cost of the “new way to message on instagram” (2020)
If you are on Instagram, you have been probably bombarded by Instagram Stories and notifications about new features like emojis, chat themes, selfie stickers, and “cross-platform messaging” that will allow you to exchange direct messages with, and search for, friends who are on Facebook. But the...
418
Using GDPR to obtain one’s data as JSON
TL;DR: If you live in the EU or are a EU citizen, companies must provide personal data you provided or they collected in a machine-readable format, following the article 20 of the GDPR.
419
REvil Ransom Arrest, $6M Seizure, and $10M Reward
The U.S. Department of Justice today announced the arrest of Ukrainian man accused of deploying ransomware on behalf of the REvil ransomware gang, a Russian-speaking cybercriminal collective that has extorted hundreds of millions from victim organizations. The DOJ also said it had seized $6.1 million in cryptocurrency…
420
The pitfalls of using SSH-agent, or how to use an agent safely
Unfortunately for you, we promised a follow up to talk about the security implications of using such an agent. So, here we are.