Threat Identity...The First Line of Defense

Last quarter, we discussed zero trust and identity in regard to remote application access. This focus was primarily looking at enterprise users seeking to gain access to applications on a network where there are no boundaries: The internet. In the concept of zero trust, the internet is considered...

Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

Why would customers choose me?

Competitive Differentiation Guide for Financial Services in Digital India We are a young nation 1.3 billion strong, of which just about 500 million are active internet users. Not a small number by any means. We have world's second largest pool of internet users and our online population is larger...

Shopify: App messaging can be hijacked by third-party websites

The JavaScript code at https://cdn.shopify.com/s/assets/admin/index-c6e72fa910cd0182ab1d1e67ff823fb2e6ca61745c00797769410ce01aafc4d8.js installs a message event listener to receive messages from installed apps when these apps are displayed in a frame. The following check rejects invalid event...

Our Extensive Survey on IoT Cybersecurity Has Remarkable Top Consequence

Trend Micro recently conducted a global survey of IT and security decision makers. When asked about the top consequence to IoT security, many would have expected it to be data loss. However, the top consequence named with 52% of respondents was “Loss of Customer Trust.” IoT has a physical compone...

Domain Trust broken on new versions of a domain-joined layer because the computer name has changed

When creating a Platform Layer, it's normal to join it to the domain and leave it joined to the domain. When you add another version to your platform layer, you find that the Computer Name has changed, and that breaks domain trust. On the packaging machine, when you attempt to log on, you receive...

Facebook Security Exec Calls for Tightened Data Privacy

Facebook’s outgoing chief information security officer Alex Stamos has urged the social media company to rethink its approach to data privacy. The executive, whose exit has been widely reported on for months, wrote an internal note to staff that called for changes in how Facebook approaches data...

On Financial Fraud

There are some good lessons in this article on financial fraud: That's how we got it so wrong. We were looking for incidental breaches of technical regulations, not systematic crime. And the thing is, that's normal. The nature of fraud is that it works outside your field of vision, subverting the...

Design/Logic Flaw

Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior to 1.12.26, does not escape all user-provided content when sending invitation emails. A malicious authenticated user can inject content...

Be like a Moomin: How to establish trust between competitors so we can fight cybercrime

Do you know the Moomins? They're a tight-knit, happy, collaborative cartoon family. I'd never heard of them until I was lucky enough to spend a few days at the Microsoft offices in Helsinki, Finland. The Moomin keychain in the photo was a gift from the Finnish CISO. As I did a little research int...

Nicholas Weaver on Cryptocurrencies

This is well-worth reading non-paywalled version. Here's the opening: Cryptocurrencies, although a seemingly interesting idea, are simply not fit for purpose. They do not work as currencies, they are grossly inefficient, and they are not meaningfully distributed in terms of trust. Risks involving...

UBUNTU-CVE-2018-14055

ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf...

CVE-2016-9487

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf...

CVE-2016-9487

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf...

CVE-2016-9487

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf...

CVE-2016-9487 EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf...

Transitioning to the New SOC 2 Criteria – What You Need to Know

SOC 2 has seen quite a few changes in the past year in how reports must be presented in the future. The American Institute of Certified Public Accountants AICPA replaced the old SSAE 16 standard with SSAE 18, released the 2017 Trust Services Criteria, the new Description Criteria DC-200, and a ne...

Ubuntu 16.04 LTS : dns-root-data update (USN-3715-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3715-1 advisory. This update adds the latest DNSSEC validation trust anchor required for the upcoming Root Zone KSK Rollover and refreshes the list of root hints. Tenable has...

Ubuntu 16.04 LTS : Dnsmasq update (USN-3716-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3716-1 advisory. This update adds the latest DNSSEC validation trust anchor required for the upcoming Root Zone KSK Rollover. Tenable has extracted the preceding description block...

Ubuntu: Security Advisory (USN-3715-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...