Game of Thrones and HBO — Twitter, Facebook Accounts Hacked

The Game of Thrones hacking saga continues, but this time it's the HBO's and GOT's official Twitter and Facebook accounts got compromised, rather than upcoming episodes. As if the leak of episodes by hackers and the accidental airing of an upcoming episode of Game of Thrones by HBO itself were no...

Facebook Covertly Launches A Photo-Sharing App In China

The Chinese market is no doubt a pot of gold for big technology giants with over 700 million internet users, but the Chinese government heavily controls the Internet within its borders through its Golden Shield project – the Great Firewall of China. The Great Firewall has blocked some 171 out of...

Facebook password stealer; hacking the attacker rather than victim

By Uzair Amir How to hack a Facebook account is one the most This is a post from HackRead.com Read the original post: Facebook password stealer; hacking the attacker rather than victim...

Brave Software: application/x-brave-tab should not be readable.

Summary: It is possible to read a dragged tab object if user is coerced into drag and dropping it into attacker controlled page. This is bad because tab history is mentioned within the object, thus information leaks are possible through a trick. Products affected: Brave: 0.18.14 rev:...

Mystery Company Offers $250,000 Bounty for VM Escape Vulnerabilities

An unnamed company will start an eight-week, invite-only bug bounty program in September that offers a $250,000 payout for virtual-machine escape vulnerabilities tied to an unreleased product. Bugcrowd announced the program today, and said the high-priced bounty is the largest advertised bounty o...

Facebook Like Button - Moderately Critical - XSS - DRUPAL-SA-CONTRIB-2017-066

This module provides a Facebook Like button on node pages and blocks. The module does not sufficiently sanitize output when configured to use custom css rules. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer fblikebutton". CVE...

Flash Player is Dead, Long Live Flash Player!

Adobe last week detailed plans to retire its Flash Player software, a cross-platform browser plugin so powerful and so packed with security holes that it has become the favorite target of malware developers. To help eradicate this ubiquitous liability, Adobe is enlisting the help of Apple,...

Facebook Security Boss: Empathy, Inclusion Must Come to Security

LAS VEGAS—Twenty years of Black Hat seemed to be the appropriate marker in time for Alex Stamos to remind security professionals of their unique position to affect change, not only in technology and business, but also in geopolitics and human rights. Facebook’s chief security officer delivered th...

Black Hat USA 2017 Preview

Mike Mimoso and Tom Spring preview Black Hat, which starts tomorrow in Las Vegas, including some thoughts on what call to action Facebook CSO Alex Stamos may deliver in his keynote address, along with some important topics and sessions that are sure to pop up throughout the week. Download: Black...

The Slippery Slope Starts with "Get 2 Free Airline Tickets"

Written by Or Katz and Raviv Perets A widespread phishing scam that offers free airline tickets has been spotted in the wild by Akamai's Enterprise Threat Protector ETP security research team. The campaign uses a number of social engineering techniques to trick people into providing their private...

web.facebook.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-259411 Description| Value ---|--- Affected Website:| web.facebook.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

facebook.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-259410 Description| Value ---|--- Affected Website:| facebook.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

A Man-in-the-Middle Attack against a Password Reset System

This is nice work: "The Password Reset MitM Attack," by Nethanel Gelerntor, Senia Kalma, Bar Magnezi, and Hen Porcilan: Abstract: We present the password reset MitM PRMitM attack and show how it can be used to take over user accounts. The PRMitM attack exploits the similarity of the registration...

Facebook’s new feature to prevent misuse of profile pics

By Waqas The social media giant Facebook is introducing a new feature for users in India which will help them protect their online privacy by preventing others from misusing their profile picture. The feature is called Profile Picture Guard and is being rolled out after security and privacy...

Radancy: Ability To Takeover any account by Emaill.

Hi Team, I've found that your api api.werkenbijdefensie.nl for your mijn defensie Application do not authenticate Facebook users' probably. Your application doesn't check the Facebook authentication token at all, which makes any attacker able to takeover any account just by using any valid user's...

On Porting EternalBlue to Windows, Facebook Phishing, and More

Mike Mimoso and Chris Brook discuss the news of the week, including how EternalBlue was ported to Windows 10, a Facebook phishing study, QakBot, and this week’s Apple announcements. Download: ThreatpostNewsWrapJune92017.mp3...

Curiosity Kills Security When it Comes to Phishing

Regardless of the amount of training and technology applied to phishing prevention, people are going to click on links, trust messages from supposedly known sources and get into trouble online. A recent academic paper collates the results of an experiment conducted with more than 1,200 German...

Spear Phishing Attacks

Really interesting research: "Unpacking Spear Phishing Susceptibility," by Zinaida Benenson, Freya Gassmann, and Robert Landwirth. Abstract: We report the results of a field experiment where we sent to over 1200 university students an email or a Facebook message with a link to non-existing party...

X (Formerly Twitter): [CRITICAL] Full account takeover using CSRF

Reporter discovered a CSRF vulnerability in the linkage between Periscope accounts and Facebook. This vulnerability would potentially allow for account take-over of Periscope accounts. The problem was resolved and the reporter awarded a bounty...

For many well-known companies impact of Oracle Responsys local file inclusion vulnerability-vulnerability warning-the black bar safety net

Today I want to show you is, how do I find the Oracle Responsys cloud service system in a local file inclusion vulnerabilities LFI Airport. Due to the current commercial sales, network storage and social relationships companies are using the Oracle Responsys cloud solution, so that the...