Identifying People by Metadata

Interesting research: "You are your Metadata: Identification and Obfuscation of Social Media Users using Metadata Information," by Beatrice Perez, Mirco Musolesi, and Gianluca Stringhini. Abstract: Metadata are associated to most of the information we produce in our daily interactions and...

NCCIC Webinar Series on Russian Government Cyber Activity

NCCIC is holding a webinar on Russian government cyber activity against critical infrastructure as detailed in NCCIC Alert TA18-074A today from 1–2:30 p.m. ET. The webinar will feature NCCIC subject matter experts discussing recent cybersecurity incidents, mitigation techniques, and resources tha...

figo.io XSS vulnerability

Open Bug Bounty ID: OBB-654964 Description| Value ---|--- Affected Website:| figo.io Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

uktrainsim.com XSS vulnerability

Open Bug Bounty ID: OBB-654747 Description| Value ---|--- Affected Website:| uktrainsim.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Security Glitch in IoT Camera Enabled Remote Monitoring

Swann has patched a flaw in its connected cameras that would allow a remote attacker to access their video feeds. A research team, consisting of Andrew Tierney, Chris Wade and Ken Munro from Pen Test Partners, as well as security researchers Alan Woodward, Scott Helme and Vangelis Stykas, develop...

Threatpost News Wrap Podcast For July 27

Threatpost’s Tom Spring and Lindsey O’Donnell sit down to discuss the top breaking news from the week. Stories of importance include shipping giant COSCO being hit with a ransomware attack, a Senator requesting a government mandate to stop using Adobe Flash by August 2019, and Facebook’s outgoing...

CVE-2018-14608

Thomson Reuters UltraTax CS 2017 for Windows is affected by CVE-2018-14608. The vulnerability stems from storing customer data in plaintext in unique directories under %install_path%\WinCSI\UT17DATA\client_ID\file_name.XX17, which can be bypassed without authentication by inspecting the strings i...

CVE-2018-14608

Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with some customers' expectations because the data is directly accessible in cleartext. Specifically, it stores customer data in unique directories...

Introducing: Malwarebytes Browser Extension

Are you tired of all the unwanted content the world wide web offers up, whether you like it or not? It is our privilege to introduce you to the Malwarebytes Browser Extension BETA. Or, better said, the Malwarebytes Browser Extensions, because we have one for Firefox and one for Chrome. Introducti...

Hacking Swann & FLIR/Lorex home security camera video

A few weeks back we read a story on the BBC web site about a BBC employee seeing someone else’s video footage on the mobile app for their home security camera. It wasn’t clear how this happened, but we were intrigued, so we bought several of the cameras in question to see for ourselves. We put a...

Facebook Security Exec Calls for Tightened Data Privacy

Facebook’s outgoing chief information security officer Alex Stamos has urged the social media company to rethink its approach to data privacy. The executive, whose exit has been widely reported on for months, wrote an internal note to staff that called for changes in how Facebook approaches data...

A study of car sharing apps

The growing popularity of car sharing services has led some experts to predict an end to private car ownership in big cities. The statistics appear to back up this claim: for example, in 2017 Moscow saw the car sharing fleet, the number of active users and the number of trips they made almost...

Semmle: Email Not Completely Deleted after Deleting an account

Description: If one of the user deletes their account it should be fully deleted in account while semmle doesnt delete it completely. Steps To Reproduce: Register email1 After registering, confirm your account. once email1 is confirmed. add another email which we will name as email2 Now Verify th...

Malicious Cyber Activity Targeting ERP Applications

Digital Shadows Ltd. and Onapsis Inc. have released a report describing an increase in the exploitation of vulnerabilities in Enterprise Resource Planning ERP applications. ERP applications help organizations manage critical business processes—such as product lifecycle management, customer...

thunderbird: S/MIME and PGP decryption oracles can be built with HTML emails

Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird 52.9...

Google Starts Labeling All HTTP Sites as ‘Not Secure’

Websites that insist on sticking with HTTP will have a public relations issue on their hands, beginning today: All of them, without exception, will be labeled as insecure by Google Chrome from now on. Anyone using the Chrome web browser will be served up a warning message anytime they surf to an...

Privacy Questions Raised as Tech Giants Join Forces on Data Portability

A veritable who’s who of tech giants from Google, Facebook, Microsoft and Twitter, went public last week with a partnership on a standards initiative called the Data Transfer Project DTP, built to enable data portability between cloud platforms. But security researchers believe the project’s...

Google Releases Security Update for Chrome

Google has released Chrome version 68.0.3440.75 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. NCCIC encourages users and administrators to review the Chrome Releases page and apply the necessary update. Th...

CVE-2018-14328

CVE-2018-14328 affects Brynamics “Online Trade” (online trading/cryptocurrency investment system). Connected sources confirm information disclosure via direct requests to endpoints such as /dashboard/addplan, /dashboard/paywithcard/charge, /dashboard/withdrawal, and /privacy&terms, leaking sensit...

Facebook Suspends Analytics Firm Over Surveillance Concerns

Online data privacy is again being thrust into the spotlight after Facebook announced Friday it suspended yet another analytics firm due to concerns about the collection and sharing of data. The company is launching an investigation into whether Boston-based Crimson Hexagon’s collection of public...