As 5G Rolls Out, Troubling New Security Flaws Emerge

Researchers have identified 11 new vulnerabilities in 5G—with time running out to fix them...

france3-regions.francetvinfo.fr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1009826 Security Researcher 4NCURZE Helped patch 1551 vulnerabilities Received 7 Coordinated Disclosure badges Received 14 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

Study: Ransomware, Data Breaches at Hospitals tied to Uptick in Fatal Heart Attacks

Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a large...

Mobile Window Shopping Climbs, But Sites Are Still Failing Users

This Diwali we saw mobile usage increase 24% over 2018, at the expense of desktop and tablet devices, as mobile shoppers continued to research before buying, even while in a store. At the same time, bounce rates increased, which means shoppers were likely dissatisfied with their experience and...

Talos, Cisco Incident Response team up to offer more protection than ever

By Sean Mason Over the years, I've had the honor and privilege to work within some of the greatest security teams on the planet, working alongside such passionate and talented people at Cisco makes delivering this announcement perhaps the greatest honor yet. The best security organizations on the...

Tracking CVE-2019-11043 PHP Vulnerability – An Uncommon Chain of Events

On October 22, security researcher Omar Ganiev published a tweet regarding remote code execution vulnerability in PHP-FPM the FastCGI Process Manager running on the Nginx server. The tweet includes a link to a GitHub repository with an explanation of the vulnerability and a PoC proof-of-concept f...

Vulnerabilities Leading to RCE inLabKey Server Biomedical Research Platform

The post Vulnerabilities Leading to RCE in LabKey Server Biomedical Research Platform appeared first on Rhino Security Labs...

KTRW: The journey to build a debuggable iPhone

Posted by Brandon Azad, Project Zero In my role here at Project Zero, I do not use some of the tooling used by some external iOS security researchers, in particular development-fused iPhones with hardware debugging capabilities like JTAG enabled. I believe that access to such devices puts those w...

Friday Squid Blogging: Researchers Investigating Using Squid Propulsion for Underwater Robots

Interesting article and paper. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

A View into Top Level Domain (TLD) Abuse

Data science and security research teams in the carrier organization at Akamai process massive volumes of DNS queries every day to detect and track malicious activity. The data is live-streamed from DNS resolvers deployed in diverse service provider networks in every region of the world. Provider...

Beers with Talos Ep. #64: Your problem isn’t complex, it's simply complexity

By Mitch Neff Beers with Talos BWT Podcast episode No. 64 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded Oct. 10, 2019 This episode lives up to its name, by trying to only take on a minimal topic and the...

Mapping Security and Privacy Research across the Decades

This is really interesting: "A Data-Driven Reflection on 36 Years of Security and Privacy Research," by Aniqua Baset and Tamara Denning: Abstract: Meta-research---research about research---allows us, as a community, to examine trends in our research and make informed decisions regarding the cours...

Microsoft Identity Bounty Improvements

Microsoft is continually improving our existing bounty programs. Today we’re happy to share the latest updates to the Microsoft Identity Bounty. Originally launched in July 2018, the Microsoft Identity bounty program has helped build a partnership with the security research community to improve t...

Microsoft Identity Bounty Improvements

Microsoft is continually improving our existing bounty programs. Today we’re happy to share the latest updates to the Microsoft Identity Bounty. Originally launched in July 2018, the Microsoft Identity bounty program has helped build a partnership with the security research community to improve t...

Three Service Account Secrets Straight from Hackers and Security Pros

Barbara Hoffman, Product Marketing Manager, Thycotic Nearly 19,000 infosec experts travel from all over the world to attend the annual Black Hat Conference. They come to share, educate and disclose their security research on the latest vulnerabilities and cyberthreats. We here at Thycotic love to...

Microsoft and partners design new device security requirements to protect against targeted firmware attacks

Recent developments in security research and real-world attacks demonstrate that as more protections are proactively built into the OS and in connected services, attackers are looking for other avenues of exploitation with firmware emerging as a top target. In the last three years alone, NIST’s...

IoT-Implant-Toolkit - Toolkit For Implant Attack Of IoT Devices

IoT-Implant-Toolkit is a framework of useful tools for malware implantation research of IoT devices. It is a toolkit consisted of essential software tools on firmware modification, serial port debugging, software analysis and stable spy clients. With an easy-to-use and extensible shell-like...

Cloud Research Network Technology Co., Ltd. website building system has a logic flaw vulnerability

Cloud Research Network Technology Co., Ltd. is a company dedicated to optimizing employment methods with Internet thinking and guiding employment services with a big data platform. There is a logic flaw vulnerability in the website building system of Cloud Research Network Technology Co., Ltd,...

Announcing the Security Researcher Quarterly Leaderboard

Right before Black Hat USA 2019, we announced our new researcher recognition program, and at Black Hat we announced the top researchers from the previous twelve months. Since it’s easier to track your progress with regular updates than with just an annual report, we are excited to...

WordPress EU Cookie Law plugin <= 3.0.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by Tobias Fink SBA Research in WordPress EU Cookie Law plugin versions = 3.0.6. Solution 17 October 2019 - we were unable to find a patched version of this plugin...