120 Compromised Ad Servers Target Millions of Internet Users

An ongoing malvertising campaign tracked as "Tag Barnakle" has been behind the breach of more than 120 ad servers over the past year to sneakily inject code in an attempt to serve malicious advertisements that redirect users to rogue websites, thus exposing victims to scamware or malware. Unlike...

Google limits which apps can access the list of installed apps on your device

Apps on Android have been able to infer the presence of specific apps, or even collect the full list of installed apps on the device. What's more, an app can also set to be notified when a new app is installed. Apart from all the usual concerns about misuse of such a data grab, the information ca...

New Browser Attack Allows Tracking Users Online With JavaScript Disabled

Researchers have discovered a new side-channel that they say can be reliably exploited to leak information from web browsers that could then be leveraged to track users even when JavaScript is completely disabled. "This is a side-channel attack which doesn't require any JavaScript to run," the...

Metasploit Wrap-Up

FortiOS Path Traversal Returning community contributor mekhalleh submitted a module targeting a path traversal vulnerability within the SSL VPN web portal in multiple versions of FortiOS. The flaw is leveraged to read the usernames and passwords of currently logged in users which are stored in...

Google FLoC puts ad trackers on a cookie-free diet

Cookie tracking is dying and Google needs a replacement. Its betting on FLoC, an ad tracking technology that lets it understand peoples behaviour while respecting their privacy. Google has announced that its tests show promising signs that FLoC is working. Is this a milestone on the road to more...

openSUSE Security Update : kdeconnect-kde (openSUSE-2020-2343)

This update for kdeconnect-kde fixes the following issue : - Add fingerprinting for device verification boo1177672. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2020-2343. The text description of this...

openSUSE Security Update : kdeconnect-kde (openSUSE-2020-2334)

This update for kdeconnect-kde fixes the following issues : - Add fingerprinting for device verification boo1177672. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2020-2334. The text description of thi...

OPENSUSE-SU-2020:2363-1 Security update for kdeconnect-kde

This update for kdeconnect-kde fixes the following issue: - Add fingerprinting for device verification boo1177672. This update was imported from the openSUSE:Leap:15.2:Update update project...

PT-2020-21634

Name of the Vulnerable Software and Affected Versions kdeconnect-kde affected versions not specified Description The issue concerns device verification and involves adding fingerprinting. Recommendations At the moment, there is no information about a newer version that contains a fix for this iss...

OPENSUSE-SU-2020:2361-1 Security update for kdeconnect-kde

This update for kdeconnect-kde fixes the following issues: - Add fingerprinting for device verification boo1177672. This update was imported from the openSUSE:Leap:15.1:Update update project...

PT-2020-21633

Name of the Vulnerable Software and Affected Versions kdeconnect-kde affected versions not specified Description The issue concerns the addition of fingerprinting for device verification. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

OPENSUSE-SU-2020:2343-1 Security update for kdeconnect-kde

This update for kdeconnect-kde fixes the following issue: - Add fingerprinting for device verification boo1177672...

OPENSUSE-SU-2020:2334-1 Security update for kdeconnect-kde

This update for kdeconnect-kde fixes the following issues: - Add fingerprinting for device verification boo1177672...

PT-2020-21631

Name of the Vulnerable Software and Affected Versions kdeconnect-kde affected versions not specified Description The issue concerns the addition of fingerprinting for device verification. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

PT-2020-21632

Name of the Vulnerable Software and Affected Versions kdeconnect-kde affected versions not specified Description The issue concerns the addition of fingerprinting for device verification. Recommendations At the moment, there is no information about a newer version that contains a fix for this iss...

Evading Link Scanning Security Services with Passive Fingerprinting

By Gal Bitensky, Executive Summary Link scanners are a critical component in multiple classes of security products including email security suites, websites that suggest direct inspection of a suspicious link, and others. Behind the scenes, these services use web clients...

Wsb-Detect - Tool To Detect If You Are Running In Windows Sandbox ("WSB")

wsb-detect enables you to detect if you are running in Windows Sandbox "WSB". The sandbox is used by Windows Defender for dynamic analysis, and commonly manually by security analysts and alike. At the tail end of 2019, Microsoft introduced a new feature named Windows Sandbox WSB for short. The...

Vxscan

This is a Python script for a comprehensive scanning tool called Vxscan. The tool is designed to perform various scans on a target, including sensitive file detection, WAF/CDN identification, port scanning, fingerprint/service identification, operating system identification, weak password...

NICER Protocol Deep Dive: Internet Exposure of IMAP and POP

Welcome to the NICER Protocol Deep Dive blog series! When we started researching what all was out on the internet way back in January, we had no idea we'd end up with a hefty, 137-page tome of a research report. The sheer length of such a thing might put off folks who might otherwise learn a thin...

Researchers Fingerprint Exploit Developers Who Help Several Malware Authors

Writing advanced malware for a threat actor requires different groups of people with diverse technical expertise to put them all together. But can the code leave enough clues to reveal the person behind it? To this effect, cybersecurity researchers on Friday detailed a new methodology to identify...