CVE-2018-12465 Remote Code Execution in Micro Focus Secure Messaging Gateway

An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway SMG allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve...

The Effects of Iran's Telegram Ban

The Center for Human Rights in Iran has released a report outlining the effect's of that country's ban on Telegram, a secure messaging app used by about half of the country. The ban will disrupt the most important, uncensored platform for information and communication in Iran, one that is used...

MicroFocus Secure Messaging Gateway Remote Code Execution

This module exploits a SQL injection and command injection vulnerability in MicroFocus Secure Messaging Gateway. An unauthenticated user can execute a terminal command under the context of the web user. One of the user supplied parameters of API endpoint is used by the application without input...

Free Speech Advocates Blast Amazon Over Threats Against Signal

On Tuesday, Moxie Marlinspike, founder of the secure messaging app Signal, posted a letter sent to him from Amazon threatening to suspend the company’s AWS account for using a technique called domain-fronting on its network. The technique is used to protect messages sent via the Signal’s messagin...

Russia is Banning Telegram

Russia has banned the secure messaging app Telegram. It's making an absolute mess of the ban -- blocking 16 million IP addresses, many belonging to the Amazon and Google clouds -- and it's not even clear that it's working. But, more importantly, I'm not convinced Telegram is secure in the first...

Keeping your business and personal instant messages secure

Most people want to know their instant messages are securely wrapped up—whether that's for personal privacy or making sure online scammers can't grab the message content. If you're sending text on a sensitive topic, or perhaps some photo attachments intended for one person only, you definitely...

Apple iPhone X Face ID Fooled by a Mask

Apple’s Face ID technology, the centerpiece biometric authentication mechanism for the iPhone X, has been cracked a little more than a week after it was introduced to the public. Researchers from Vietnamese security company Bkav demonstrated that they could fool the technology to unlock the phone...

On the S3 Leaks, Zerodium's Messaging App Bounties, ROPEMAKER, and More

Mike Mimoso and Chris Brook discuss the news of the week, including the recent AWS S3 leaks, Zerodium’s bounty on secure messaging app zero days, Ropemaker, and cobot vulnerabilities. Download: ThreatpostNewsWrapAugust252017.mp3 Music by Chris Gonsalves Show notes: Industrial Cobots Might Be The...

Zerodium Offers $500K for Secure Messaging App Zero Days

Zerodium, a vendor operating in the nebulous exploit acquisition market, has put a premium on zero-day vulnerabilities in secure messaging applications in a new pricing structure announced today. Remote code execution and local privilege elevation zero days in messaging apps such as WhatsApp,...

The US Senate Is Using Signal

The US Senate just approved Signal for staff use. Signal is a secure messaging app with no backdoor, and no large corporate owner who can be pressured to install a backdoor. Susan Landau comments. Maybe I'm being optimistic, but I think we just won the Crypto War. A very important part of the US...

Google's Key Transparency Simplifies Public Key Lookups

Google has taken a big step toward simplifying public key lookups at Internet scale with the release to open source on Thursday of Key Transparency. Key Transparency is admittedly a prototype, Google said, but it could provide significant relief for secure messaging systems suffering from...

[SECURITY] Fedora 23 Update: cryptobone-1.0.5-1.fc23

The Crypto Bone is a secure messaging system that makes sure a user's email is always encrypted without burdening the user with the message key management. Based on a GUI and a separate daemon, both ease-of-use and security are assured by a novel approach to encryption key management. While the...

[SECURITY] Fedora 24 Update: cryptobone-1.0.5-1.fc24

The Crypto Bone is a secure messaging system that makes sure a user's email is always encrypted without burdening the user with the message key management. Based on a GUI and a separate daemon, both ease-of-use and security are assured by a novel approach to encryption key management. While the...

​DARPA Wants To Build Ultra Secure Messaging App for US Military

Just last month, DARPA launched a project dubbed "Improv," inviting hackers to transform simple household appliances into deadly weapons. Now, the Defense Advanced Research Projects Agency is finding someone in the private sector to develop a hacker-proof "secure messaging and transaction platfor...

WhatsApp Encryption: A Good Start, but Far from a Security Panacea

WhatsApp’s addition of end-to-end encryption is a good start, but does not present users with a complete solution that protects against the prying eyes of intrusive governments and nosey third-parties. That’s the consensus among privacy and security experts that commend Facebook-owned WhatsApp fo...

WhatsApp turns on End-to-End Encryption by default for its 1 Billion Users

WhatsApp is updating its messaging app so that every text message and voice call will be encrypted for the company’s one billion users. Yes, Whatsapp has finally implemented full end-to-end encryption, as promised a year ago. This means, from now every message, image or voice call you made will b...

libotr Off-the-Record Secure Messaging Security Patch

Users of secure messaging apps such as Pidgin, Adium and others built upon libotr, the Off-the-Record protocol, are being urged to update immediately to current versions after the discovery of a critical flaw that can be used in targeted attacks to expose encrypted communication. The OTR...

Signal Desktop Released by Moxie Marlinspike

In March when Moxie Marlinspike and Open Whisper Systems released the iOS version of the Signal encrypted messaging app, the noted security researcher promised to expand its reach and among other things, eventually release a desktop version of Signal. That vision was realized on Wednesday with th...

OpenText Secure MFT 2014 R2 SP4 Cross Site Scripting

Advisory ID: SYSS-2015-041 Product: Secure MFT Vendor: OpenText Affected Versions: 2013 R1, 2014 R1, 2014 R2 Tested Versions: 2014 R2 SP4 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Vendor Notification: 2015-08-05 Solution Date: 2015-08-14 Public...

I2P - The Invisible Internet Project

I2P is an anonymous network, exposing a simple layer that applications can use to anonymously and securely send messages to each other. The network itself is strictly message based a la IP, but there is a library available to allow reliable streaming communication on top of it a la TCP. All...