Ghostery’s Making a Privacy Browser—and Ad-Free Search Engine

The tracker-blocking company will soon launch a privacy-friendly desktop browser as well...

Online Shoppers Undeterred by COVID as Holiday Shopping Season Shifts Earlier

Akamai-Commissioned Survey Hints at Significant Business Consequences If Online Retail Experiences Do Not Meet Consumer Expectations Holiday shoppers are overcoming worries and restrictions and easily adapting to new shopping norms as the COVID-19 pandemic has invaded our lives and made us...

Don’t Put It on the Internet: Tesla Backup Gateway Edition

Derek Abdine, formerly Director of Rapid7 Labs, now CTO at Censys, contributed this blog post. This blog post aims to increase user awareness of the privacy and security risks of connecting devices to the internet. In this edition, we address Tesla Backup Gateways and identify some key areas wher...

Some Apple Apps on macOS Big Sur Bypass Content Filters, VPNs

Security researchers are blasting Apple for a feature in the latest Big Sur release of macOS that allows some Apple apps to bypass content filters and VPNs. They say it is a liability that can be exploited by threat actors to bypass firewalls and give them access to people’s systems and expose...

CVE-2020-13352

GitLab CVE-2020-13352 affects GitLab CE/EE versions 10.2 through 13.3.8, 13.4 through 13.4.4, and 13.5 through 13.5.1, where private group information is leaked when moving a project from a private to a public group. Root cause: information leakage in group visibility handling during transfers. R...

CVE-2020-4763

CVE-2020-4763 affects IBM Sterling File Gateway: vulnerable versions are 6.0.0.0–6.0.3.2 and 2.2.0.0–2.2.6.5_2, where authorization tokens and session cookies are missing the Secure attribute. This allows cookie values to be exposed if users click on an http link or visit a site containing such a...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at the ISC² Security Congress 2020, November 16, 2020. I’ll be on a panel at the OECD Global Blockchain Policy Forum 2020 on November 17, 2020. The panel is called "Deep Dive: Digital Security and Distributed Ledger...

Inrupt’s Solid Announcement

Earlier this year, I announced that I had joined Inrupt, the company commercializing Tim Berners-Lees Solid specification: The idea behind Solid is both simple and extraordinarily powerful. Your data lives in a pod that is controlled by you. Data generated by your things -- your computer, your...

The iOS Covid App Ecosystem Has Become a Privacy Minefield

An analysis of nearly 500 Covid-related apps worldwide shows major differences in how much data they expect you to give up...

Apple Releases Security Updates for Multiple Products

Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. Some of these vulnerabilities have been detected in exploits in the wild. The Cybersecurity and Infrastructure Securi...

Surviving college distance learning during the pandemic: a cybersecurity guide

Social distancing, the wearing of face masks, practicing hand hygiene, and disinfecting often-touched surfaces have become human necessities during the pandemic era. For schools, theyve also had to adapt quickly to incorporate distance learning methods that let students continue their studies. Bu...

“Privacy Nutrition Labels” in Apple’s App Store

Apple will start requiring standardized privacy labels for apps in its app store, starting in December: Apple allows data disclosure to be optional if all of the following conditions apply: if its not used for tracking, advertising or marketing; if its not shared with a data broker; if collection...

Google Releases Security Updates for Chrome

Google has released Chrome version 86.0.4240.198 for Windows, Mac, and Linux. This version addresses CVE-2020-16013 and CVE-2020-16017. An attacker could exploit one of these vulnerabilities to take control of an affected system. These vulnerabilities have been detected in exploits in the wild. T...

SAP Process Integration Information Disclosure Vulnerability

SAP Process Integration is SAP's Enterprise Application Integration EAI software for seamless integration between SAP and non-SAP applications in a company or with systems external to the company. An information disclosure vulnerability exists in SAP Process Integration 1.0. An attacker could...

Apple to Deliver 'Privacy Labels' for Apps, Revealing Data-Sharing Details

After years of complaints about over-permissioned apps that collect, use and share private user information, Apple will be making developer privacy policies more transparent for consumers. Starting Dec. 8, iOS and macOS developers will be required to provide detailed information about how their...

SAP Releases November 2020 Security Updates

SAP has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. These include missing authentication check vulnerabilities affecting SAP Solution Manager JAVA stack. The...

Adobe Releases Security Updates for Multiple Products

Adobe has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review the Adobe...

Mozilla Releases Security Updates for Firefox, Firefox ESR, and Thunderbird

Mozilla has released security updates to address a vulnerability in Firefox, Firefox ESR, and Thunderbird. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review th...

Microsoft Releases November 2020 Security Updates

Microsoft has released updates to address vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review Microsoft’s...

Cisco Releases Security Update for IOS XR Software

Cisco has released a security update to address a vulnerability in IOS XR Software for ASR 9000 Series Aggregation Services Routers. An unauthenticated, remote attacker could exploit this vulnerability to cause a denial-of-service condition. The Cybersecurity and Infrastructure Security Agency CI...