CVE-2016-10536

The CVE-2016-10536 issue affects engine.io-client (Socket.IO) prior to 1.6.9, where the client passes a settings object containing rejectUnauthorized; if not explicitly set, it can be passed as null, disabling certificate verification and exposing users to Man-in-the-Middle attacks. This behavior...

How do I know if I'm Secure?

Remember those commercials for excessive cell phone roaming coverage? The ones with clever skits highlighting the end user having no idea that their phone had crossed an invisible border and switched from primary to roaming coverage? Immediately incurring increased costs for calling, texting and...

Hundreds of Apps Using Ultrasonic Signals to Silently Track Smartphone Users

Your smartphone may have some apps that are continuously listening inaudible, high-frequency ultrasonic sounds from your surroundings and they know where you go, what you like and dislike — all without your knowledge. Ultrasonic Cross-Device Tracking is a new technology that some marketers and...

Деанонимизация пользователей Darknet(TOR, i2p(d), etc) & SOX &VPN аудиозакладками

Вообщем то ссылка на 33с3 уже была запощена в основном топике, но я хотел бы акцентировать общее внимание на презентацию Talking Behind Your Back On the Privacy & Security of the Ultrasound Tracking Ecosystem от Vasilios Mavroudis и Federico Maggi. Вкратце, суть такова: В 2012 году была основана...

Cisco Meraki MS MRMX Arbitrary Command Execution Vulnerability

The Cisco Meraki MS MRMX is a cloud-managed wireless networking device from Cisco. The Cisco Meraki MS MRMX arbitrary command execution vulnerability allows remote attackers to execute arbitrary commands by leveraging knowledge of cross-device secrets and per-device secrets...