Port 22

~ 1 Nov 2018 ~

Equifax Has Chosen Experian. Wait, What?

On Cross-Site Scripting and Content Security Policy

Cisco Security: Zero-day in SIP inspection engine of ASA 9.4+ and FTD 6.0+ software.

Trickbot Shows Off New Trick: Password Grabber Module

Trickbot Shows Off New Trick: Password Grabber Module

Radisson Rewards Program Targeted in Data Breach

Two New Bluetooth Chip Flaws Expose Millions of Devices to Remote Attacks

Buying Used Voting Machines on eBay

AVEVA InduSoft Web Studio and InTouch Edge HMI (formerly InTouch Machine Edition)

Schneider Electric Software Update (SESU)

Circontrol CirCarLife

Fr. Sauter AG CASE Suite

Perl-Based Shellbot Looks to Target Organizations via C&C

The /r/netsec Monthly Discussion Thread - November 2018

Using ActiveDirectory module for Domain Enumeration from PowerShell Constrained Language Mode

~ 31 Oct 2018 ~

Facebook Business Takeover

Hardware Cyberattacks: How Worried Should You Be?

Was the Triton Malware Attack Russian in Origin?

Chinese Intel Agents Indicted for 5-Year IP Theft Campaign

LightSpeed, a race for an iOS/MacOS sandbox escape

CVE-2018-9411: New critical vulnerability in multiple high-privileged Android services

Jok3r - Network and Web Pentest Framework

The 90s Called, and They Want Their Hacks Back: Memoirs of an Amateur Hacker.

JNDIAT - Penetration testing tool that tests the security of Weblogic servers through T3 protocol

Triage Planning: What Can Security Teams Learn From First Responders? - Red Canary

Growing pains: Skills gap meets expanding threat surface

Growing pains: Skills gap meets expanding threat surface

Gathering Insights on the Reemergence and Evolution of Old Threats Through Managed Detection and Response

Analyzing the root DNSSEC key rollover

ID Systems Throughout the 50 States

[RFC] group entropy for hiding lookup initiator in a distributed hash tables

Five ways to make Halloween less cyber-scary for kids

Five ways to make Halloween less cyber-scary for kids

Bloom filter patent

DDoS Attacks in Q3 2018

Isolated Networks in the Cloud it's possible

I wrote a simple 'rogue device' scanner that uses ping sweeps/nmap to intermittently scan a subnet and log any new hosts. Feedback is welcome!

Emotet Awakens With New Campaign of Mass Email Exfiltration using the Outlook Messaging API

Trivial Exploit for X.org Server Local Privilege Escalation

Kernel RCE caused by buffer overflow in Apple's ICMP packet-handling code (CVE-2018-4407)

~ 30 Oct 2018 ~

Google Home (in)Security: Unauthenticated Google Home API with all sorts of fun uses

Project Dribble: hacking Wi-Fi with cached JavaScript

C++ Async HTTPS server built with oat++ framework and LibreSSL

Kraken Resurfaces From the Deep Web

Java Deserialization From Discovery to Reverse Shell on Limited Environments

Persistent GCP backdoors with Googles Cloud Shell

New iPhone Passcode Bypass Found Hours After Apple Releases iOS 12.1

PEPPERL+FUCHS CT50-Ex

Cell Phone Security and Heads of State

Girl Scouts Hacked, 2,800 Members Notified

.:: Phrack Magazine ::. Viewer Discretion Advised

Disrupting the Flow: Exposed and Vulnerable Water and Energy Infrastructures

Windows 10 Bug Let UWP Apps Access All Files Without Users' Consent

Unpatched MS Word Flaw Could Allow Hackers to Infect Your Computer

Signal Secure Messaging App Now Encrypts Sender's Identity As Well

Facebook's New ID Verification System Is Intrusive

~ 29 Oct 2018 ~

More on the Supermicro Spying Story

Mac cryptocurrency ticker app installs backdoors

Windows Defender Antivirus can now run in a sandbox

CTFR Abuse Certificate Transparency Logs For HTTPS Subdomains

Malware sample library

Attacking Google Authenticator

Same Old yet Brand-new: New File Types Emerge in Malware Spam Attachments

New Android banking family found on Google Play with over 10,000 installs

Ransomware and the enterprise: A new white paper