Countdown to GDPR: IT Policy Compliance

From the first page, the EU’s General Data Protection Regulation stresses the importance it places on the security and privacy of EU residents’ private information. The 88-page document opens by referring to the protection of this personal data as a “fundamental right” essential for “freedom,...

PaulShop Stored Cross-Site Scripting Vulnerability

PaulShop is a shopping cart web system. PaulShop firstname, lastname, address, city, state, zipcode, phone, fax, deliveryaddress, deliverycity, deliverystate, deliveryzipcode Parameter-stored cross-site scripting vulnerability. An attacker can insert malicious js code into a page to obtain user...

Alternatives to Government-Mandated Encryption Backdoors

Policy essay: "Encryption Substitutes," by Andrew Keane Woods: In this short essay, I make a few simple assumptions that bear mentioning at the outset. First, I assume that governments have good and legitimate reasons for getting access to personal data. These include things like controlling crim...

Novel Attack Tricks Servers to Cache And Expose Personal Data

LAS VEGAS—Researcher Omer Gil has devised a way to trick a web server into caching pages and exposing personal data. The so-called web caching attack targets sites that use content delivery network CDN services such as Akamai and Cloudflare. These services act as traffic load balancers and revers...

New Ransomware Threatens to Send Your Internet History & Private Pics to All Your Friends

After WannaCry and Petya ransomware outbreaks, a scary but rather creative new strain of ransomware is spreading via bogus apps on the Google Play Store, this time targeting Android mobile users. Dubbed LeakerLocker, the Android ransomware does not encrypt files on victim's device, unlike...

Reliance Jio Customers' Data Allegedly Hacked – Company Denies Breach

Personal details of some 120 Million customers have been allegedly exposed on the Internet in probably the biggest breach of personal data ever in India. Last night, an independent website named Magicapk.com went online, offering Reliance Jio customers to search for their identification data Know...

Countdown to GDPR: Get 20/20 Visibility Into Your IT Assets

Anyone questioning the importance of IT asset visibility in an organization’s security and compliance postures ought to review the EU’s General Data Protection Regulation GDPR, which goes into effect next year. With the severe requirements the GDPR places on how a business handles the personal da...

Today’s File Security is So ’80s, Part 3: Dynamic Peer Groups – 3 Examples from Customer Data

In the first two parts of this series, we discussed why permissions management, the traditional approach to file security, no longer works and introduced a new approach to file security that leverages machine learning to build dynamic peer groups based on how users actually access files. In this...

Database of Over 198 Million U.S. Voters Left Exposed On Unsecured Server

Information on more than 198 Million United States citizens, that's over 60% of the US population, was exposed in what's believed to be the largest ever known exposure of voter-related to date. This blunder was caused by Deep Root Analytics DRA, a data analytics firm employed by the US Republican...

5 Questions to Ask Your CISO about the GDPR

The European General Data Protection Regulation GDPR comes into force on May 25, 2018, and it will have a huge impact on the way businesses store and collect personal information belonging to those located in the European Union EU. The regulation applies to all businesses that hold and process da...

WannaCry Highlights Major Security Shortcomings Ahead of GDPR D-Day

For all the panic it caused, WannaCry looks finally to have been contained by organisations round the globe. But this isn’t the time to forget about it and move on. There are valuable lessons to be learned about this attack, why it was so successful and what can be done to prevent it happening...

Top 5 GDPR Myths: Get the Facts

The General Data Protection Regulation GDPR has been garnering much attention since its formal adoption in April 2016. With the effective date of May 25, 2018 fast approaching, some popular myths have emerged surrounding the regulation. In this blog post, we’ll examine and debunk a few of the mos...

China Construction Bank's Android app suffers from weak certificate validation vulnerability

China Construction Bank Android APP is the mobile application product of China Construction Bank. China Construction Bank Android APP suffers from a weak certificate validation vulnerability, as the X509TrustManager validation function does not validate the server-side certificate. An attacker ca...

Brave Status Bar Obfuscation Vulnerability

Brave is a Web browser product from Brave Software, Inc. in the United States. A status bar obfuscation vulnerability exists in Brave version 0.12.4, which may unintentionally redirect to a malicious website. An attacker can exploit this vulnerability to redirect users to malicious websites,...

AIO AIO in-car Android App CAPTCHA has design flaws

Shenzhen Dudu Intelligent Technology Co., Ltd. is an innovative technology enterprise focusing on intelligent in-vehicle systems, high-end in-vehicle wearable devices and the construction of car networking ecosystem. AIO AIO in-vehicle Android App verification code has design flaws, attackers can...

CVE-2017-5684

The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical access to the system to gain access to personal information...

CVE-2017-5686

The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical access to the system to gain access to personal information...

CVE-2017-5685

The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical access to the system to gain access to personal information...

Arbitrary Password Reset Vulnerability in Chickie's Travel Android App

Chickie Mobility Android App is an app that provides public bike rental services. There is an arbitrary password reset vulnerability in Qiqi Travel Android APP. It allows an attacker to reset another person's password simply by knowing their cell phone number, and can view any other person's...

IRS Releases Tax-Time Guide

The Internal Revenue Service IRS has released tax-time advice intended to help the public protect their personal and financial data and computers. Recommendations include using strong passwords, backing up files, and using robust security software to help block malware and viruses. Users and...