Tor Patched Against Zero Day Under Attack

Update The Tor Project has provided a browser update that patches a zero-day vulnerability being exploited in the wild to de-anonymize Tor users. “The security flaw responsible for this urgent release is already actively exploited on Windows systems. Even though there is currently, to the best of...

Anonymous Hacktivist 'Barrett Brown' Released From Prison

Barrett Brown, a journalist, formerly served as an unofficial spokesman for the hacktivist collective Anonymous, finally walked free from prison on Tuesday morning after serving more than four years behind bars. The Dallas-born investigative journalist was arrested in 2012 from his home while he...

Cross-site Scripting Vulnerability in ZhengTong Content Management System

The GovContent Management System is a website management system designed and built on the JAVA EE platform, which is mainly used for the website construction and management of government agencies, enterprises and institutions. A cross-site scripting vulnerability exists in the CMS. The...

InPage Zero Day Used in Attacks Against Banks

A zero-day vulnerability in InPage publishing software used primarily in Urdu, Pashto and Arabic-speaking nations has been publicly exploited in attacks against financial institutions and government agencies in the region. While there are more than 10 million InPage users in Pakistan and India...

peru.gob.pe XSS vulnerability

Vulnerable URL: http://www.peru.gob.pe/transparencia/peptransparenciaosceexoneracionesframe.asp?identidad=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 119444 VIP website status...

iPhone Secretly Sends Your Call History to Apple Even If iCloud Backups are Turned Off

In the fight against encryption, Apple has positioned itself as a staunch defender of its user privacy by refusing the federal officials to provide encryption backdoors into its products, as well as implementing better encryption for its products. However, a new report from a security firm sugges...

Regulation May Be Best Answer to IoT Insecurity

One thing technologists overtly shun is the prospect of government regulation. But recent DDoS attacks carried out by botnets of connected things have spooked some people of influence in security to the point where intervention by lawmakers may be inevitable. Testifying before subcommittees of th...

nyc.gov XSS vulnerability

Vulnerable URL: http://www.nyc.gov/portal/site/nycgov/menuitem.e4c2296f0eee871216a5b0c001c789a0/index.jsp?2962qt=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3692 V...

1.local.gov.uk XSS vulnerability

Open Bug Bounty ID: OBB-190830 Description| Value ---|--- Affected Website:| 1.local.gov.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Microsoft Says Russian APT Group Behind Zero-Day Attacks

Microsoft has singled out Sofacy, an APT group long thought to have ties to Russia’s military intelligence arm GRU, as the entity behind targeted attacks leveraging Windows kernel and Adobe Flash zero days in targeted attacks. The group, which Microsoft calls Strontium, is also known as APT28, Ts...

Election Leaks Failed to Move Needle on Polls

The barrage of information leaks, state-sponsored espionage and hacktivism related to the U.S. presidential election has had a mixed bag of effects on the race and voter confidence. For the most part, attacks against organizations supporting both major political parties, extensive email leaks and...

web2.gov.mb.ca XSS vulnerability

Vulnerable URL: http://web2.gov.mb.ca/laws/statutes/display2.php?p="=ccsm/h060e.php= Details: Description| Value ---|--- Patched:| Yes, at 20.09.2017 Latest check for patch:| 20.09.2017 12:22 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculat...

Ex-NSA Contractor Stole 50 TB of Classified Data; Includes Top-Secret Hacking Tools

Almost two months ago, the FBI quietly arrested NSA contractor Harold Thomas Martin III for stealing an enormous number of top secret documents from the intelligence agency. Now, according to a court document filed Thursday, the FBI seized at least 50 terabytes of data from 51-year-old Martin tha...

Yahoo Asks DNI to De-Classify Email Scanning Order

Yahoo continues to seek high ground with regard to public reports that last year it scanned user email messages in compliance with a classified government order. General counsel Ron Bell yesterday sent a letter to Director of National Intelligence James R. Clapper asking the government to confirm...

Five Ways That Good Guys Share More Than Bad Guys

It takes a lot for me to write a cybersecurity blog post these days. I spend most of my writing time working on my PhD. Articles like Nothing Brings Banks Together Like A Good Hack drive me up the wall, however, and a Tweet rant is insufficient. What fired me up, you might ask? Please read the...

SQL Injection Vulnerability in ChannelList.aspx Page of Shandong Wave Government Approval Platform

Wave Government Approval Platform is a cloud computing infrastructure platform of Shandong Wave Qilu Software Co. A SQL injection vulnerability exists in the ChannelList.aspx page of the Shandong Wave Government Approval Platform, which can be exploited by attackers to obtain sensitive database...

Arbitrary File Upload Vulnerability in Government Affairs Cluster Management System of Beijing Xiangyu Leading Software Co.

Beijing Xiangyu Leader Software Co., Ltd. government affairs cluster management system is an Internet service platform that provides information management services for Chinese government functional units at all levels. There is an arbitrary file upload vulnerability in the government cluster...

Turkey Blocks GitHub, Google Drive and Dropbox to Censor RedHack Leaks

Turkey is again in the news for banning online services, and this time, it's a bunch of sites and services offered by big technology giants. Turkey government has reportedly blocked access to cloud storage services including Microsoft OneDrive, Dropbox, and Google Drive, as well as the code hosti...

The Ethics and Morality Behind APT Reports

DENVER—Investigations into state-sponsored APT campaigns are much more than black-and-white research into malware, exploits and zero-days. Behind the scenes, these can be geopolitical powder kegs that require moral examinations into the ethics of publishing public reports that could expose tools...

NSA Contractor Secretly Charged With Stealing Classified Secrets

The Federal Bureau of Investigation arrested a National Security Agency contractor working for Booz Allen Hamilton and charged him with stealing highly classified documents. Harold T. Martin III, of Glen Burnie, Md was charged in a criminal complaint filed in late August that became public...