Protecting your Domain Names: Taking the First Steps

Everyone and everything on the Internet depends on the Domain Name System DNS being functional. The DNS has been a common vector for attacks in recent years, and 2019 seems to be no different. Many of these attacks have goals far more sinister than simply taking a company offline or defacing a...

How to browse the Internet safely at work

This Safer Internet Day, we teamed up with ethical hacking and web application security company Detectify to provide security tips for both workplace Internet users and web developers. This article is aimed at employees of all levels. If you’re a programmer looking to create secure websites, visi...

Open Positioner: my new project for tracking IT and security jobs

The idea of my new project is to retrieve the data from job-searching websites and provide better filtering, searching and visualization. I think for the most people who read this, searching for a job in Internet is a pretty common activity. Even if you are not going to change job right now, it...

Top 10 Best Antivirus software for 2019

By Zehra Ali Open the Internet and your screen will be flooded with hacking news and exploits carried out through the use of sophisticated techniques. It is not uncommon to land on news reports of millions of compromised Internet devices. These stories emerge not merely because of the hacker’s...

Why Internet Security Is So Bad

I recently read two different essays that make the point that while Internet security is terrible, it really doesn't affect people enough to make it an issue. This is true, and is something I worry will change in a world of physically capable computers. Automation, autonomy, and physical agency...

Digital Identity, Digital Trust, Janrain and Akamai

Authentication on the World Wide Web is badly broken. We all know it, or at least sense it. Every web site or mobile app that we want to use asks us to register and set up yet another account with yet another username and password. With the typical end user having tens of online accounts, this...

Feds Charge Three in Mass Seizure of Attack-for-hire Services

Authorities in the United States this week brought criminal hacking charges against three men as part of an unprecedented, international takedown targeting 15 different "booter" or "stresser" sites -- attack-for-hire services that helped paying customers launch tens of thousands of digital sieges...

Kaspersky: Web protection component in Anti-Virus products family uses predictable links for certificate warnings

Summary Websites can predict links used in certificate warnings, Safe Money prompts, anti-phishing warnings and similar pages. This allows them to initiate actions without the user's knowledge. Description The links used to override certificate warnings have the following format: https:///?kiscup...

Kaspersky: URL Advisor component in KIS products family is vulnerable to Universal XSS

Summary In Microsoft Edge, URL Advisor UI is served as first-party content on every domain. So the XSS vulnerability I found in this UI automatically applies to all websites, it allows running code in the context of any domain. Description URL Advisor frame is located under...

Kaspersky: Certificate warnings and similar UI elements in Web protection of Anti-Virus products family are susceptible to clickjacking

Summary Clickjacking can be used to trick users into overriding certificate warnings, disabling Safe Money functionality or phishing alerts. Description On certificate warning pages, a single click is sufficient to trigger overriding a wrong certificate. While an additional warning is displayed...

Kaspersky: Web protection component in Anti-Virus products family ignores HSTS security policy

Summary Kaspersky Internet Security seems to ignore the Strict-Transport-Security HTTP header. This allows Man-in-the-Middle attacks on websites that would normally be immune to them. The only requirement is the user confirming the certificate override, something that can be achieved by social...

Information Attacks against Democracies

Democracy is an information system. That's the starting place of our new paper: "Common-Knowledge Attacks on Democracy." In it, we look at democracy through the lens of information security, trying to understand the current waves of Internet disinformation attacks. Specifically, we wanted to...

The US National Cyber Strategy

Last month, the White House released the "National Cyber Strategy of the United States of America. I generally don't have much to say about these sorts of documents. They're filled with broad generalities. Who can argue with: Defend the homeland by protecting networks, systems, functions, and dat...

National Cybersecurity Awareness Month Webinar on Securing the Internet

The Multi-State Information Sharing and Analysis Center, National Cyber Security Alliance, and the Department of Homeland Security are conducting a National Cybersecurity Awareness Month NCSAM webinar focused on securing the internet. The webinar will be held on Tuesday, October 9, 2018, at 2 p.m...

Official mobile version of Tor Browser released for Android – Download now

By Waqas There is good news for pro-anonymity web users who rely upon the Tor browser for using the internet. The first ever mobile browser app for the Tor browser has been released by the Tor Project, the organization behind the Tor network. The mobile version of the Tor browser is available for...

CVE-2018-0649

Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec all programs except packaged ones allows an attacker to gain...

CVE-2018-0649

The CVE-2018-0649 issue concerns an untrusted DLL search path in the installers for Canon IT Solutions Inc. software, affecting multiple products (e.g., ESET Smart Security Premium , ESET Internet Security , ESET Smart Security , ESET NOD32 Antivirus , DESlock+ Pro , and CompuSec ). The underlyin...

CVE-2018-0649

Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec all programs except packaged ones allows an attacker to gain...

Five-Eyes Intelligence Services Choose Surveillance Over Security

The Five Eyes -- the intelligence consortium of the rich English-speaking countries the US, Canada, the UK, Australia, and New Zealand -- have issued a "Statement of Principles on Access to Evidence and Encryption" where they claim their needs for surveillance outweigh everyone's needs for securi...

D-Link DIR-615 - Denial of Service Vulnerability

Exploit for hardware platform in category dos / poc Exploit Title: D-Link DIR-615 - Denial of Service PoC Vendor Homepage: http://www.dlink.co.in Hardware Link: https://www.amazon.in/D-Link-DIR-615-Wireless-N300-Router-Black/dp/B0085IATT6 Version: D-Link DIR-615 Category: Hardware Exploit Author:...