A decade inside Microsoft Security

Ten years ago, I walked onto Microsofts Redmond campus to take a role on a team that partnered with governments and CERTs on cybersecurity. Id just left a meaningful career in US federal government service because I thought it would be fascinating to experience first-hand the security challenges...

October 27, 2017 – Morning Cyber Coffee Headlines – “Stranger Things” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 27, 2017 - Headlines Carbon Black in the News: The push toward...

Tor: Enforce minimum master password complexity

Hi Team, Actual results: There is no password complexity set for Master password in about:preferencessecurity , Because I was able to set my password like 123,123456,www, admin etc which is really common, apart from that we can use spaces as well in master password i was able to set space as my...

ownCloud: Password Complexity Not Enforced On Password Change

Hi! Owncloud does not enforce password complexity on password change, so it's possible to use passwords of any size or form. In example I can set my password to be "a" or "qwerty". How to reproduce: Change your password to something that does not match your required complexity. Proof Of Concept:...

Changes in Password Best Practices

NIST recently published its four-volume SP800-63b Digital Identity Guidelines. Among other things, it makes three important suggestions when it comes to passwords: 1. Stop it with the annoying password complexity rules. They make passwords harder to remember. They increase errors because...

Radancy: Weak password

It takes ash123456789123456789 as a password,which is not secure.It can be cracked using Dictionary,brute force etc attacks. Impact: If password complexity is not enforced people may tend to put easily guessable password which may be exploitable for a malicious user. Solution-To make it more...

Legal Robot: Wrong password validation message

Hello, Your password validation message seems to be contradicting with the server side validation of password field during new account sign up at https://app.legalrobot.com/sign-in. When you start typing in password field, it says Passwords must be more than 8 characters but when you type more th...

4 Principles For Hybrid Cloud Success

The future is cloud. At this point in it’s evolution it’s undeniable. The questions facing organizations now are “how much?” and “how fast?” How do you map out a reasonable path to a cloud deployment? Few organizations will be 100 percent cloud and most will take years to migrate existing assets...

CVE-2017-9853

An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length requirements are set. Also, strong passwords are impossible due to a maximum of 12 characters and a limited set of...

PT-2017-19219 · Sma Solar Technology · Sunny Tripower +2

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products affected versions not specified Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30 Description: An issue was discovered in SMA Solar Technology products, where all inverters have a weak...

Debian DLA-1044-1 : ipsec-tools security update

The racoon daemon in IPsec-Tools 0.8.2 and earlier contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remote attacker to exhaust computational resources on the remote endpoint by repeatedly sending ISAKMP fragmen...

[SECURITY] [DLA 1044-1] ipsec-tools security update

Package : ipsec-tools Version : 1:0.8.0-14+deb7u1 CVE ID : CVE-2016-10396 Debian Bug : 867986 The racoon daemon in IPsec-Tools 0.8.2 and earlier contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remote attacker ...

Rapid7 acquires Komand for security orchestration and automation

Today, Rapid7 announced the acquisition of Komand, an orchestration and automation solution for both security and IT teams. You can read the formal announcement here, but I wanted to share a little bit about why Im so excited about this acquisition. Komand has been bold. Theyve been unafraid to...

CVE-2017-11343

Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in On lookup time...

CVE-2017-11343

Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in On lookup time...

Input validation

Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in On lookup time...

CVE-2017-11343

Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in On lookup time...

CHICKEN Algorithm Complexity Vulnerability

CHICKEN Scheme is a compiler and interpreter based on the Scheme language , it can compile Scheme code into standard C code , and supports extensions . A security vulnerability exists in CHICKEN Scheme 4.12.0 and earlier versions. An attacker can exploit the vulnerability to perform an algorithmi...

CVE-2017-11343: Inefficient Algorithmic Complexity

Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in On lookup time...

CVE-2017-11343

CHICKEN Scheme versions up to 4.12.0 are vulnerable to an algorithmic complexity attack due to an incomplete fix for CVE-2012-6125. The issue arises from crafted input causing O(n) symbol-table lookups. The Fedora advisory FEDORA-2017-76ce091a43 provides a fix for CVE-2017-11343 (referenced in th...