August 2019 Security Releases

August 2019 Security Releases Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information. Updates are now available for all...

8 New HTTP/2 Implementation Flaws Expose Websites to DoS Attacks

Various implementations of HTTP/2, the latest version of the HTTP network protocol, have been found vulnerable to multiple security vulnerabilities affecting the most popular web server software, including Apache, Microsoft's IIS, and NGINX. Launched in May 2015, HTTP/2 has been designed for bett...

8 New HTTP/2 Implementation Flaws Expose Websites to DoS Attacks

Various implementations of HTTP/2, the latest version of the HTTP network protocol, have been found vulnerable to multiple security vulnerabilities affecting the most popular web server software, including Apache, Microsoft's IIS, and NGINX. Launched in May 2015, HTTP/2 has been designed for bett...

HTTP2 Vulnerabilities

On Tuesday, August 13th at 10 AM Pacific Time 1700UTC, Netflix publicly disclosed a series of vulnerabilities found by Jonathan Looney that impact many implementations of the HTTP2 protocol. A vulnerability found by Piotr Sikora of Google was also released...

h2o -- multiple HTTP/2 vulnerabilities

Jonathon Loomey of Netflix reports: HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following: CVE-2019-95...

Brute_Force - BruteForce Gmail, Hotmail, Twitter, Facebook & Netflix

Install : pip install proxylist pip install mechanize Usage: BruteForce Gmail Attack python3 BruteForce.py -g [email protected] -l Filelist python3 BruteForce.py -g [email protected] -p PasswordSingle BruteForce Hotmail Attack python3 BruteForce.py -t [email protected] -l Filelist...

Leaky Amazon S3 Buckets Expose Data of Netflix, TD Bank

Three publicly-accessible cloud storage buckets from data management company Attunity leaked more than a terabyte of data from its top Fortune 100 customers – including internal business documents, system passwords, sensitive employee information. Israel-based Attunity, which was acquired by Qlik...

Netflix Dial Reference Denial of Service Vulnerability

Netflix Dial Reference is a Dial Discovery and Launch protocol implementation from Netflix, Inc. in the United States. A security vulnerability exists in versions of Netflix Dial Reference prior to 2019-6-18. An attacker could exploit the vulnerability to cause a denial of service...

Internet Bug Bounty: Industry-Wide MITM Vulnerability Impacting the JVM Ecosystem

I've been exploring the industry-wide scope of the use of HTTP to resolve dependencies in build infrastructure across the industry. What I unearthed was that some of the most popular libraries and two compilers were impacted by this vulnerability. Vulnerability CWE-829: Inclusion of Functionality...

Researchers Compromise Netflix Content in Widevine DRM Hack

Researchers have used a proof-of-concept PoC side-channel attack to download an unencrypted raw file for Netflix’ Stranger Things, in a format that’s ready to distribute out to any buyer on the internet. This pirate’s booty is the result of breaking open the widely deployed digital rights...

CB Customer Spotlight: Q&A with Netflix DVD’s Jimmy Sanders

Recently we sat down with Jimmy Sanders, VP of Information Security at Netflix DVD, to talk about his upcoming presentation for CB Connect, Carbon Black’s customer conference. Sanders was one of the headliners at CB Connect 2018, and this year he will be speaking to his peers in the Security...

Hackers Can Tell What Netflix 'Bandersnatch' Choices You Make

Researchers have shown that even though Netflix encrypts its traffic, hackers can figure out your interactive movie choices...

Researchers go hunting for Netflix’s Bandersnatch

A new research paper from the Indian Institute of Technology Madras explains how popular Netflix interactive show Bandersnatch could fall victim to a side-channel attack. In 2016, Netflix began adding TLS Transport Layer Security to their video content to ensure strangers couldn’t eavesdrop on...

A week in security (March 11 – 17)

Last week on Malwarebytes Labs, we looked at the Lazarus group in our series about APT groups, we discussed the introduction of Payment Service Directive 2 PSD2 in the EU, we tackled Google’s Nest fiasco, and the launch of Mozilla's Firefox Send. In addition, we gave you an overview of the...

Purveyor of Cracked Netflix, Hulu, Spotify Accounts Arrested

A Sydney man has been arrested after allegedly selling hundreds of thousands of compromised account details for subscription streaming services, including for Netflix, Hulu and music streaming service Spotify – raking in about $212,000 $300,000 AUD in profit in the process. The Australian Federal...

Using Gmail "Dot Addresses" to Commit Fraud

In Gmail addresses, the dots don't matter. The account "[email protected]" maps to the exact same address as "[email protected]" and "[email protected]" -- and so on. Note: I own none of those addresses, if they are actually valid. This fact can be used to commit fraud:...

How to Find Your Netflix Freeloaders—and Kick Them Out

Sharing is caring. But it's worth checking if your streaming accounts have picked up any suspicious stragglers along the way...

FTC Warns of Netflix Phishing Scam Making Rounds

The Federal Trade Commission FTC is warning of a new phishing scam reeling in Netflix customers and stealing their payment information. According to a post published by the FTC, Wednesday, the spotted scam purports to be an email from Netflix. The email claims that the victim’s account was put on...

Facebook gave Amazon, Netflix, Spotify & others access to private user data

By Waqas Facebook allowed Netflix, Spotify, Amazon, Microsoft, Yandex and Royal Bank of Canada unprecedented access to its users' private data. The social media giant Facebook has been making headlines for all the wrong reasons lately. Now, according to reports, Facebook allowed video streaming...

Facebook Fights Back on Secret Data-Sharing Partnerships

UPDATE Facebook is hitting back after a new report on Tuesday said that the company struck broad data-sharing partnerships with more than 150 companies, including Apple, Amazon and Netflix, exempting them from its normal data privacy terms and conditions. An exhaustive investigation in the New Yo...