Detecting Lies through Mouse Movements

Interesting research: "The detection of faked identity using unexpected questions and mouse dynamics," by Merulin Monaro, Luciano Gamberini, and Guiseppe Sartori. Abstract: The detection of faked identities is a major problem in security. Current memory-detection techniques cannot be used as they...

Font Steganography

Interesting research in steganography at the font level...

Oracle Linux 7 : procps-ng (ELSA-2018-1700)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-1700 advisory. - Related: CVE-2018-1124 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has n...

Backdoors in D-Link’s backyard

"If you want to change the world, start with yourself." In the case of security research this can be rephrased to: "If you want to make the world safer, start with the smart things in your home." Or, to be more specific, start with your router – the core of any home network as well as an...

Debian DSA-4208-1 : procps - security update

The Qualys Research Labs discovered multiple vulnerabilities in procps, a set of command line and full screen utilities for browsing procfs. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2018-1122 top read its configuration from the current working...

I know where your pet is

Kaspersky Lab's many years of cyberthreat research would suggest that any device with access to the Internet will inevitably be hacked. In recent years, we have seen hacked toys, kettles, cameras, and irons. It would seem that no gadget has escaped the attention of hackers, yet there is one last...

Malicious PHP Script Infects 2,400 Websites in the Past Week

A botnet dubbed Brain Food is giving webmasters indigestion with related attacks that push bogus diet pills and IQ-boosting pills via web pages hosted on legitimate sites. So far, spammers have been successful, thanks to an effective Hypertext Preprocessor PHP script also called Brain Food that h...

oswaldocruz.br XSS vulnerability

Open Bug Bounty ID: OBB-619732 Description| Value ---|--- Affected Website:| oswaldocruz.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

‘Voice-Squatting’ Turns Alexa, Google Home into Silent Spies

A team of academic researchers has tested the phonetic wherewithal of smart-home assistants Amazon Alexa and Google Home, finding it possible to closely mimic legitimate voice commands in order to carry out nefarious actions. The researchers, a composite team from Indiana University in Bloomingto...

Learn How Trillions of DNS Requests Help Improve Security

Akamai's global platform is comprised of 240,000 servers in 3,750 locations within 134 countries. Additionally, our platform interacts with 1.3 billion client devices every day and we ingest 2.5 exabytes of data a year. So why are these stats important? The answer is that this visibility provides...

Beers with Talos EP29 - This is a PSA: Stop Clicking. There is No Prince.

Beers with Talos BWT Podcast Episode 29 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast EP29 Show Notes: Recorded May 11, 2018 - First and foremost, we recorded this episode one day before ou...

Sending Inaudible Commands to Voice Assistants

Researchers have demonstrated the ability to send inaudible commands to voice assistants like Alexa, Siri, and Google Assistant. Over the last two years, researchers in China and the United States have begun demonstrating that they can send hidden commands that are undetectable to the human ear t...

Georgia Governor Vetoes Controversial Hack-Back Bill

Recognizing the concerns of tech giants and security researchers alike, Georgia Gov. Nathan Deal has vetoed a controversial “hack-back” bill that would have allowed companies in the state to perform offensive cyber-actions in the face of an attack. “Certain components of the legislation have led ...

AutoTTP - Automated Tactics Techniques & Procedures

Automated Tactics Techniques & Procedures. Re-running complex sequences manually for regression tests, product evaluations, generate data for researchers & so on can be tedious. I toyed with the idea of making it easier to script Empire or any frameworks/products/toolkits that provide APIs like...

Asylo Open-Source Framework Tackles TEEs for Cloud

Asylo, an open-source framework and software development kit SDK for creating applications that run in trusted execution environments TEEs, has launched to tackle the complexity involved in running a confidential computing platform for workloads in the cloud and virtual environments. TEEs provide...

elevenia.co.id XSS vulnerability

Open Bug Bounty ID: OBB-612534 Description| Value ---|--- Affected Website:| elevenia.co.id Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Abbott Addresses Life-Threatening Flaw in a Half-Million Pacemakers

About 350,000 implantable defilibrators are up for a firmware update, to address potentially life-threatening vulnerabilities. Abbott formerly St. Jude Medical has released another upgrade to the firmware installed on certain implantable cardioverter defibrillator ICD or cardiac resynchronization...

Peel Shopping Cart 9.0.0 Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

Exploit for php platform in category web applications ================================================= Synopsis: Post XSS with dual CSRF via inproper sanitized user input. Product: Peel Shopping Cart Version: 9.0.0 Researcher: Matt Landers email protected twitter.com/matthewjland...

Schneider Electric Patches Critical RCE Vulnerability

Researchers discovered a critical remote code execution vulnerability in two Schneider Electric industrial control related products that could give attackers the ability to disrupt or shut down plant operations. Tenable Research, who discovered the vulnerability CVE-2018-8840 and created a...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition - Denial of Service

What do you need to know? Tenable Research has discovered a critical remote code execution vulnerability in Schneider Electric’s InduSoft Web Studio and InTouch Machine Edition. What's the attack vector? The vulnerability can be remotely exploited without authentication to execute arbitrary...