Name+DOB+SSN=FAFSA Data Gold Mine

KrebsOnSecurity has sought to call attention to online services which expose sensitive consumer data if the user knows a handful of static details about a person that are broadly for sale in the cybercrime underground, such as name, date of birth, and Social Security Number. Perhaps the most...

Australia’s “Essential Eight” is Critical to Meet 2018 Cybersecurity Mandates & Privacy Laws

Christopher Strand, Carbon Black’s security risk and compliance officer recently wrote a blog discussing how the new mandatory data breach notification rule in the Privacy Amendment Notifiable Data Breaches Bill 2016, helps bring attention to cybersecurity solutions and focus on the practices...

CVE-2017-10269

The CVE-2017-10269 entry concerns Oracle Tuxedo (a core component of Oracle Fusion Middleware) with affected versions 11.1.1, 12.1.1, 12.1.3, 12.2.2. Connected sources describe the issue as part of the Jolt protocol vulnerabilities (JoltandBleed) in Oracle Tuxedo/Jolt Server, enabling unauthentic...

CVE-2017-1148

The CVE-2017-1148 entry applies to IBM OpenPages GRC Platform versions 7.2–7.3 with the OpenPages Loss Event Entry (LEE) application. The root cause is described as insecure object reference leading to information disclosure of sensitive data, including private APIs, which could be leveraged for ...

Capital One Fraud Seminar Recap

Recently, I was honored to be invited as a panelist at a recent seminar hosted by Capital One Spark Business to share some views on fraud prevention and cybersecurity with their customers. I was joined by a few other industry experts, Gerald Glickman, a Manager of Capital Ones Fraud Analysis team...

Today’s Predictions for Tomorrow’s Internet

Making predictions is a tricky business and in no area more so than in the area of rapidly developing technology. The pace of change continues to accelerate and the nature of innovation is such that entrepreneurs, as well as criminals are continually searching for “the next big thing” to either...

Today’s Predictions for Tomorrow’s Internet

This weekend I realized just how much the future of securing the Internet of Things IoT will become a critical component to maintain our lifestyle. CyberPatriot is the National Youth Cyber Education Program created by the Air Force Association to encourage careers in STEM. Each year the program...

U.S. Top Law Enforcement Call Strong Encryption a ‘Serious Problem’

BOSTON—Top U.S. law enforcement and policy makers touched the third-rail issue of encryption Wednesday with several high-ranking officials lamenting their inability to crack open phones, laptops and communications protected with strong encryption. U.S. Deputy Attorney General Rod Rosenstein made...

CVE-2017-9794

When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing...

CVE-2017-9794

The CVE-2017-9794 entry describes an information-disclosure flaw in Apache Geode prior to version 1.2.1: when a cluster runs in secure mode, a user with read access to certain data regions can use the gfsh CLI to run queries, and query results may include data from another user’s concurrent gfsh ...

On the Onliner Spambot, WireX, and Sarahah

Mike Mimoso and Chris Brook discuss the news of the week, including the Onliner spambot, Google’s forthcoming Not Secure warnings for Chrome, the WireX botnet, Sarahah privacy and more. Download: ThreatpostNewsWrapSeptember12017.mp3 Music by Chris Gonsalves Show notes: Google Reminding Admins HTT...

The vulnerability of the procedure related to the remote UIM client, the Android CAF-release operating system, allows a perpetrator to compromise the privacy, integrity, and accessibility of protected information.

The vulnerability of the process related to the remote UIM client in Android CAF-release builds is caused by buffer overflow. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Me on Restaurant Surveillance Technology

I attended the National Restaurant Association exposition in Chicago earlier this year, and looked at all the ways modern restaurant IT is spying on people. But there's also a fundamentally creepy aspect to much of this. One of the prime ways to increase value for your brand is to use the Interne...

Smart Vacuum Cleaners Making Map Of Your Home — And Wants to Sell It

What if I say that your cute, smart robotic vacuum cleaner is collecting data than just dirt? During an interview with Reuters, the CEO of iRobot, the company which manufactured Roomba device, has revealed that the robotic vacuum cleaner also builds a map of your home while cleaning — and is now...

Common Sense Clarity on GDPR

Having recently returned from the first phase of Carbon Black’s official General Data Protection Regulation GDPR Data Security and Privacy tour, where I participated in the data privacy and security enablement of numerous European global businesses, I’ve collected many valuable insights on the...

Exif-Remove - Command Line Tool- Remove Exif Data from all Digital Pictures

This tool is made in Python 2.7 compiled using pyinstaller for Windows OS. Nothing is special about this tool it just eases the work for me, maybe will for you too. For what reason? Exif is Metadata stored in hidden in your pictures. Many well-intentioned people unwittingly expose personal...

Nextcloud: Password of failed (2FA) login attempt is stored in log

If I try to log in on Webdav with my usual Nextcloud password, it doesn't work due to 2FA. I need an application password. The password of a failed login attempt by any user is stored plain text in the log: ...OCA\\DAV\\Connector\\Sabre\\Auth-validateUserPass'matthes', 'THEPASSWORD'... Even...

The vulnerability of the Android operating system allows malicious actors to circumvent data privacy by bypassing the protection of the eMMC memory module when the device is powered on.

The vulnerability of the Android operating system relates to the protection against writing to the eMMC memory module. Exploiting this vulnerability allows a malicious actor to circumvent the protection against writing to the eMMC memory module when power is turned on...

Slack: Uninstalling Slack for Windows (64-bit), then reinstalling keeps you logged in without authentication

I understand that you are unlikely to consider bugs that require physical machine access, however this issue affected me directly and I was very surprised by it, so I felt it was important to report it in case it was not known. Steps to reproduce: 1 Install the desktop Slack app for Windows 64-bi...

How to pass kernel command injection bypass Nexus 6 safe start mode-bug warning-the black bar safety net

In 2017 5 on the Android security announcements, Google released a security patch that fixes the Nexus 6 bootloader in the discovery of a serious Vulnerability, CVE-2016-10277 in. Exploit this vulnerability, a physical attacker or a already have the bootloader locked down the target device...