Critical Flaws in PGP and S/MIME Tools Can Reveal Encrypted Emails in Plaintext

Note—the technical details of the vulnerabilities introduced in this article has now been released, so you should also read our latest article to learn how the eFail attack works and what users can do to prevent themselves. An important warning for people using widely used email encryption...

Free Speech Advocates Blast Amazon Over Threats Against Signal

On Tuesday, Moxie Marlinspike, founder of the secure messaging app Signal, posted a letter sent to him from Amazon threatening to suspend the company’s AWS account for using a technique called domain-fronting on its network. The technique is used to protect messages sent via the Signal’s messagin...

NIST Issues Call for "Lightweight Cryptography" Algorithms

This is interesting: Creating these defenses is the goal of NIST's lightweight cryptography initiative, which aims to develop cryptographic algorithm standards that can work within the confines of a simple electronic device. Many of the sensors, actuators and other micromachines that will functio...

Security Vulnerabilities in VingCard Electronic Locks

Researchers have disclosed a massive vulnerability in the VingCard eletronic lock system, used in hotel rooms around the world: With a $300 Proxmark RFID card reading and writing tool, any expired keycard pulled from the trash of a target hotel, and a set of cryptographic tricks developed over...

Hackers build a 'Master Key' that unlocks millions of Hotel rooms

If you often leave your valuable and expensive stuff like laptop and passports in the hotel rooms, then beware. Your room can be unlocked by not only a malicious staff having access to the master key, but also by an outsider. A critical design vulnerability in a popular and widely used electronic...

Huawei Multiple Product ENUM Module Buffer Overflow Vulnerability

DP300, RP200, TE30, etc. are network video communication devices from Huawei China. A buffer overflow vulnerability exists in the ENUM Electronic Numbers to URI Mapping module of several Huawei products. A remote attacker could send a carefully constructed ENUM message to the affected device by...

CVE-2018-5438

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record EMR system, where ISCV is in KIOSK mo...

CVE-2018-5438

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record EMR system, where ISCV is in KIOSK mo...

Session fixation

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record EMR system, where ISCV is in KIOSK mo...

CVE-2018-5438

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record EMR system, where ISCV is in KIOSK mo...

Friday Squid Blogging: Searching for Humboldt Squid with Electronic Bait

Video and short commentary. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Threat Outbreak Alert RuleID32012: Email Messages Distributing Malicious Software on February 20, 2018

Medium Alert ID: 56874 First Published: 2018 February 20 16:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32012 may contain the following files: Name |...

Securing Our Connected Car Future with Panasonic

There are few more exciting frontiers of the Internet of Things IoT than connected cars. Gartner predicts that there will be 61 million vehicles with built-in connectivity on our roads by 2020. But as we drive ever closer to a future where autonomous vehicles are a commonplace sight, we must be...

Geldkarte - transaktionsid Cross Site Scripting Vulnerability

Document Title: =============== Geldkarte - transaktionsid Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2118 Release Date: ============= 2018-02-20 Vulnerability Laboratory ID VL-ID:...

Physician, protect thyself: healthcare cybersecurity circling the drain

No one knows you better than you do. But thanks to technology advances and the continued digitization of healthcare data accumulation and sharing processes, we can also honestly say the same about your healthcare provider. Indeed, every time we get in touch with a health professional, data is...

Pyeongchang 2018: Staying Cyber Safe during the Olympics

As the 2018 Olympic Games in Pyeongchang approach, NCCIC/US-CERT reminds travelers to be aware of cybersecurity risks. At high-profile events, cyber activists may take advantage of the large audience to spread their message. Cyber criminals may attempt to steal personally identifiable information...

Philips IntelliSpace Cardiovascular System Unauthorized Access Vulnerability

Philips IntelliSpace Cardiovascular ISCV is a comprehensive cardiac image and information management system. An unauthorized access vulnerability exists in the Philips IntelliSpace Cardiovascular System, where ISCV is in kiosk mode for multiple users and uses Windows authentication when used with...

New Rules Announced for Border Inspection of Electronic Devices

The U.S. Customs and Border Patrol announced new restrictions on when agents can copy data from digital devices at border crossing points. Agents now need “reasonable suspicion” in advance of searches of phones, computers, tablets, cameras or any other digital device belonging to people entering ...

lhhrelectronictechnologydevelopment.tradenote.net XSS vulnerability

Open Bug Bounty ID: OBB-454085 Description| Value ---|--- Affected Website:| lhhrelectronictechnologydevelopment.tradenote.net Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation...

Elemental Path's CogniToys Dino Information Disclosure Vulnerability (CNVD-2018-00677)

Elemental Path's CogniToys Dino is a smart toy from Elemental Path's, USA that is capable of voice communication with children. An information disclosure vulnerability exists in Elemental Path's CogniToys Dino using firmware version 0.0.794 and earlier, which stems from the program's use of AES-1...