Leaking ads

When we use popular apps with good ratings from official app stores we assume they are safe. This is partially true – usually these apps have been developed with security in mind and have been reviewed by the app store's security team. However, we found that because of third-party SDKs many popul...

CVE-2018-10189

An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each...

Skyworth smart TVs have smart hardware vulnerabilities

Skyworth Group Limited is a publicly listed technology company specializing in the production of consumer electronics, networking and communication products. A smart hardware vulnerability exists in Skyworth Smart TV. The vulnerability is due to Skyworth Smart TV's failure to restrict permissions...

Securing Modern Web Applications: Threats and Types of Attacks

Web Application Firewalls are the most advanced firewall capabilities available to IT teams. Deploying the appropriate WAF is important, especially these days when the security threat landscape is changing so rapidly. In a previous post, we introduced Web Application Firewalls: Securing Modern We...

COPPA Compliance

Interesting research: "'Won't Somebody Think of the Children?' Examining COPPA Compliance at Scale": Abstract: We present a scalable dynamic analysis framework that allows for the automatic evaluation of the privacy behaviors of Android apps. We use our system to analyze mobile apps' compliance...

Bitwarden: Tracking Bitwarden firefox addon users

Firefox web extension, generate a UUID for each web-extension and is specific to a user. Unlike chrome extensions. Which means whenever the user installs Bitwarden on Firefox, it generates a different extension ID for each user. You can check the extension ID by about:debugging - under extensions...

Mail.ru: 3rd party shop admin panel blind XSS

Blind XSS in third party shop's admin panel. This host and company is not operated or owned by Mail.Ru Group, but it runs an online shop and processes orders for Mail.Ru branded gift shop. It does not have any privileged/additional access to Mail.Ru network or user's data. Gift shop is not...

The Role That IT Security Teams Need to Play in Connected Hospitals

The WannaCry outbreak that reportedly raked in US$1B in damage costs also forced doctors to cancel scheduled appointments, among other things, brought on warranted concern over pervasive ransomware attacks that could stem from oft-overlooked components of healthcare networks—exposed medical cyber...

Vendor Risk Bites Sears, Delta and Best Buy, while Saks, Lord & Taylor Deal With Breach

Data breaches dominated the cyber security headlines last week, as Sears, Delta, Best Buy, Saks, and Lord & Taylor all found themselves in the news. Sears, Delta and Best Buy: Another vendor risk incident What do retail giant Sears Holdings, consumer electronics chain Best Buy and Delta Air Lines...

Impact Of Chat Service Breach Expands To Best Buy, Kmart

The number of companies coming forward as victims of a data breach – that potentially exposed hundreds of thousands of credit card payment information – has expanded to include Best Buy and Kmart. Last week, software service provider 247.ai, a company that provides online chat services for Delta,...

Node.js third-party modules: [localhost-now] bypassing url filter which leads to read content of arbitrary file

Hi guys, i can bypass url filter in localhost-now module. It allows to read content of arbitrary files on the remote server. Module module name: localhost-now version: 1.0.2 npm page: https://www.npmjs.com/package/localhost-now Module Stats 26 downloads in the last week Vulnerability Description...

[SECURITY] Fedora 28 Update: python3-3.6.5-1.fc28

Python is an accessible, high-level, dynamically typed, interpreted program ming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3 package provides the "python3" executable: the...

Delta, Sears Breaches Blamed on Malware Attack Against a Third-Party Chat Service

Security researchers are pinning a recent data breach – that potentially exposed the credit card information of hundreds of thousands of Delta Air Lines and Sears Holdings customers – on weak third-party security policies. The cyberattack hit software service provider 247.ai, a company that...

Facebook Bolsters Privacy Measures With New Data Access Restrictions

Facebook on Wednesday listed a number of new data access restrictions as the social media company looks to reassure end users that their personal information will remain private. The new measures, detailed in a post by Facebook CTO Mike Schroepfer, limit the personal data that apps can collect...

Streamline Compliance with SWIFT Customer Security Program Requirements

Transferring money from our bank accounts has never been easier than it is today. With a single click on our smartphones, we can transfer money from a bank account in New York to an account at a different bank in the Netherlands. This advancement is largely a result of the fluent communication...

Node.js third-party modules: npm packages that overlap with core node packages

Hi, I have posted here, but I wanted to make you aware of this easy social engineering trick. I do not want to claim any of these are currently malicious, but it they easily could be. Thanks, Marc Impact The attacker could do anything...use the postinstall as the user, work the same as steal data...

Insecure SCADA Systems Blamed in Rash of Pipeline Data Network Attacks

After a cyberattack shut down numerous pipeline communication networks this week, experts are stressing the importance of securing third-party systems in supervisory control and data acquisition SCADA environments. Over the past two days, various major U.S. pipelines across the country reported...

Pocket cryptofarms

In recent months, the topic of cryptocurrency has been a permanent news fixture — the value of digital money has been see-sawing spectacularly. Such pyrotechnics could hardly have escaped the attention of scammers, which is why cryptocurrency fluctuations have gone hand in hand with all kinds of...

Gay dating app Grindr shared user HIV & location data with third-parties

By Waqas Grindr shared personal, HIV and geolocation-related data with two of This is a post from HackRead.com Read the original post: Gay dating app Grindr shared user HIV & location data with third-parties...

CVE-2018-1295

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one...