New social engineering toolkit draws inspiration from previous web campaigns

Some of the most common web threats we track have a social engineering component. Perhaps the more popular ones are those encountered via malvertising, or hacked websites that push fraudulent updates. We recently identified a website compromise with a scheme we had not seen before; it's part of a...

The Threat of Fake Academic Research

Interesting analysis of the possibility, feasibility, and efficacy of deliberately fake scientific research, something I had previously speculated about...

OpenAI Said Its Code Was Risky. Two Grads Re-Created It Anyway

The artificial intelligence lab cofounded by Elon Musk said its software could too easily be adapted to crank out fake news...

GHSA-3J5X-7CCF-PPGM Cross-site scripting in recommender-xblock

Recommender before 1.3.1 allows XSS. It is possible for a learner to craft a fake resource to recommender, that includes script which could possibly steal credentials from staff if they are lured into viewing the recommended resource...

Cross-site scripting in recommender-xblock

Recommender before 1.3.1 allows XSS. It is possible for a learner to craft a fake resource to recommender, that includes script which could possibly steal credentials from staff if they are lured into viewing the recommended resource...

Fake News and Influence: Information Warfare in the Digital Age

It’s 2019 and we live in a world where understanding what is real and what is fake can be challenging. For the security community, we increasingly deal with information warfare adversaries that rely on that fact; and, operating at internet scale, are capable of causing plenty of havoc...

Huawei Honor10 Lite and Huawei Y9 Denial of Service Vulnerability (CNVD-2019-44785)

Huawei Honor10 Lite and Huawei Y9 are both a smartphone from Chinese company Huawei Huawei. A denial-of-service vulnerability exists in Huawei Honor10 Lite Harry-AL00C before 9.1.0.217 C00E215R3P1 and Huawei Y9 Jackman-L23 before 9.1.0.220 C45E3R1P1T8, which can be exploited to cause a dead loop...

DEBIAN-CVE-2019-3890

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference...

CVE-2019-3890

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference...

CVE-2019-3890

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference...

Information disclosure

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference...

CVE-2019-3890

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference...

CVE-2019-3890

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference...

Another Attack Against Driverless Cars

In this piece of research, attackers successfully attack a driverless car system -- Renault Captur's "Level 0" autopilot Level 0 systems advise human drivers but do not directly operate cars -- by following them with drones that project images of fake road signs in 100ms bursts. The time is too...

CVE-2019-1020004

Tridactyl before 1.16.0 allows fake key events...

CVE-2019-1020004

Tridactyl before 1.16.0 allows fake key events...

CVE-2019-1020004

Tridactyl before 1.16.0 allows fake key events...

CVE-2019-1020004

CVE-2019-1020004 concerns Tridactyl before 1.16.0 and is described in multiple sources as allowing fake key events. The connected documents confirm the affected software version and the basic nature of the issue but do not provide further technical details, attack vectors, impact specifics, or re...

GitLab: Cross-site Scripting (XSS) - Stored in RDoc wiki pages

Summary When creating an RDoc wiki page it's possible to use a large number of html tags and attributes that are normally sanitized, when creating a linkable image of the format link For example it is possible to specify a class attribute when creating an image link: rdoc a will generate the...

Good Twitter Samaritans accidentally prevent shoeshine scam

A few days ago, Indian news portals were buzzing with tales of a well-worn shoeshine scam making its way into social media. It’s a great example of how good-natured gestures can unwittingly aid scammers when we combine high-visibility accounts with potential lack of fact checking. Thankfully, it...