My precious: security, privacy, and smart jewelry

Emery was staring at her computer screen for almost an hour, eyes already lackluster as the full-page ad on Motiv looped once more. She was contemplating whether she'd give in and get her boyfriend Ben a new fitness tracker as a present for his upcoming marathon. The phone app he was currently...

Mail.ru: [Mail.Ru Android] Typo in permission name allows to write contacts without user knowledge

Hi, Mail.Ru app registers permission writecontacts xml but uses write xml which is unclaimed, has normal protection level by default and automatically granted to all apps. It means that any third-party apps have ability to insert any data into that database PoC xml java ContentValues contentValue...

CVE-2018-6260

Summary (CVE-2018-6260) NVIDIA’s GPU Display Driver contains a local-information-disclosure vulnerability due to a side channel exposed by GPU performance counters. A local attacker could access data processed on the GPU. The flaw affects NVIDIA Display Driver for Linux and Windows; no remote/vec...

Nextcloud: Event privacy level does not work in Thunderbird

Events in shared calendar with changed privacy level to any other than public are shown in Thunderbird as public anyway with all details How to reproduce: 1 - create an event in user A's calendar shared to user B 2 - change privacy setting of this event to any other than public 3 - open Thunderbi...

How to Safely and Securely Dispose of Your Old Gadgets

Keep your data private and the environment protected...

Flogging a dead smart horse

Connected stuff is getting everywhere, even in to managing the health of your connected horse. Yes, really. One Friday afternoon after PTP lunchtime drinks in the pub, we bought an ‘Orscana’ horse tracking device. It sat on the shelf for 13 months until after another session in the pub over lunch...

Mongo Web Admin 6.0 - Information Disclosure

Exploit Title: Mongo Web Admin 6.0 - Information Disclosure Dork: N/A Date: 2018-11-04 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.mongoadmin.org/ Software Link: https://netix.dl.sourceforge.net/project/mongo-web-admin/mongoDesktopAdminSetup-beta-6.exe Version: 6.0 Category: Webapps...

On Heels of Criticism, Newly-Released Google Chrome 70 Prioritizes Privacy

Google has lifted the curtain on its latest version of Chrome, which the tech giant has pledged touts more data privacy features, as well as fixes for high-priority vulnerabilities. The release comes after Google had promised updates in Chrome 70 to “better communicate our changes and offer more...

CVE-2018-3188

CVE-2018-3188 – Oracle iStore in Oracle E-Business Suite is affected in versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. The vulnerability resides in the Oracle iStore component’s Web interface and is exploitable by an unauthenticated attacker who can access the system ...

Privacy Regulation Could Be a Test for States’ Rights

When the California Consumer Privacy Act CCPA passed in June, security experts applauded the state legislation as a win for consumers. The ruling gave residents certain rights around how their personal data can be stored, accessed, sold and deleted. But months later in September, the U.S. Chamber...

Google to Encrypt Android Cloud Backups With Your Lock Screen Password

In an effort to secure users' data while maintaining privacy, Google has announced a new security measure for Android Backup Service that now encrypts all your backup data stored on its cloud servers in a way that even the company can't read it. Google allows Android users to automatically backup...

Google to Encrypt Android Cloud Backups With Your Lock Screen Password

In an effort to secure users' data while maintaining privacy, Google has announced a new security measure for Android Backup Service that now encrypts all your backup data stored on its cloud servers in a way that even the company can't read it. Google allows Android users to automatically backup...

How to Check If Your Facebook Account Got Hacked—And How Badly

Facebook Friday offered more details about its recent breach. Here's how to see if you were affected...

Calif. Law Takes Aim at Weak IoT Passwords

In a first of its kind law, California Governor Jerry Brown signed a bill that bans the use of default “admin” passwords on internet-connected devices sold in the state and requires manufacturers use strong passwords instead. California has been taking aggressive legislative action in 2018 to...

Helen Nissenbaum on Data Privacy and Consent

This is a fantastic Q with Cornell Tech Professor Helen Nissenbaum on data privacy and why it's wrong to focus on consent. I'm not going to pull a quote, because you should read the whole thing...

Google Vows Privacy Changes in Chrome Browser After User Backlash

Google took steps to quiet critics Wednesday after irking them earlier this week when data privacy issues tied to Chrome 69 came to light. On Sunday, Matthew Green, a cryptographer and professor at Johns Hopkins University, blasted Google for what he said were questionable privacy policies in...

license2.qnap.com XSS vulnerability

Open Bug Bounty ID: OBB-679312 Description| Value ---|--- Affected Website:| license2.qnap.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-17404

The CVE-2018-17404 vulnerability affects the SBIbuddy app (com.sbi.erupee) for Android, specifically versions 1.41 and 1.42. The description indicates an information disclosure flaw that could allow an attacker to sniff sensitive data such as mobile numbers, PAN numbers from government IDs, and d...

U.S. Mobile Giants Want to be Your Online Identity

The four major U.S. wireless carriers today detailed a new initiative that may soon let Web sites eschew passwords and instead authenticate visitors by leveraging data elements unique to each customer's phone and mobile subscriber account, such as location, customer reputation, and physical...

Millions of Records Exposed in Veeam Misconfigured Server

UPDATE Hundreds of millions of records were exposed after a MongoDB server belonging to disaster-recovery firm Veeam was left misconfigured, researchers found. The open server contained a 200-gigabyte database with millions of records. Researcher Bob Diachenko, who discovered the misconfiguration...