Safeguarding the Nation’s Critical Infrastructure

In May of 1998, President Clinton issued Presidential Decision Directive 63: Protecting America’s Critical Infrastructures. This Directive proposed steps to enact the recommendations of the President’s Commission on Critical Infrastructure Protection, published in October 1997. Twenty years on, h...

Critical RCE Bugs Patched in Drupal 7 and 8

Drupal is urging users to upgrade to the latest release that fixes two critical remote code execution bugs impacting Drupal 7 and Drupal 8. Developers have also identified three additional “moderately critical” vulnerabilities. “A remote attacker could exploit some of these vulnerabilities to tak...

Russian Trolls Are Still Playing Both Sides—Even With the Mueller Probe

The latest indictment against Russian trolls shows how they sowed division in the US on wedge issues, including the investigation into their activity...

Major weapon systems developed by US DoD highly vulnerable to cyber attacks

By Uzair Amir Several Critical Vulnerabilities Identified in Major Weapon Systems Being Developed by US DoD. The advanced weapon systems developed by the US Department of Defense with a whopping estimated expenditure of $1.66 trillion are plagued with grave flaws, which make them a potential targ...

5 Takeaways From the #CbConnect18 “Women in Cybersecurity” Keynote

Wow, what a great few days here at Cb Connect. Sometimes with conferences, you go out with one problem to solve and leave with 50. Cb Connect really exposed some great ways to solve problems, no matter the size of the team or the Cb product in house. I also had some great takeaways from the 'Wome...

Bloomberg blunder highlights supply chain risks

Ooh boy! Talk about a back-and-forth, he said, she said story! No, we’re not talking about that Supreme Court nomination. Rather, we’re talking about Supermicro. Supermicro manufacturers the type of computer hardware that is used by technology behemoths like Amazon and Apple, as well as governmen...

Security Vulnerabilities in US Weapons Systems

The US Government Accounting Office just published a new report: "Weapons Systems Cyber Security: DOD Just Beginning to Grapple with Scale of Vulnerabilities" summary here. The upshot won't be a surprise to any of my regular readers: they're vulnerable. From the summary: Automation and connectivi...

Why Supply Chain Hacks Are a Cybersecurity Worse Case Scenario

A blockbuster report from Bloomberg says that China has compromised servers used by major US companies. It's a problem that experts have long feared, and still don't know how to resolve...

Chinese Spying Chips Found Hidden On Servers Used By US Companies

A media report today revealed details of a significant supply chain attack which appears to be one of the largest corporate espionage and hardware hacking programs from a nation-state. According to a lengthy report published today by Bloomberg, a tiny surveillance chip, not much bigger than a gra...

Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash

The US-CERT has released a joint technical alert from the DHS, the FBI, and Treasury warning about a new ATM scheme being used by the prolific North Korean APT hacking group known as Hidden Cobra. Hidden Cobra, also known as Lazarus Group and Guardians of Peace, is believed to be backed by the...

jira.legal4.us XSS vulnerability

Open Bug Bounty ID: OBB-681742 Description| Value ---|--- Affected Website:| jira.legal4.us Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Dark Web: US court seizes assets and properties of deceased AlphaBay operator

By Carolina AlphaBay was one of the largest dark web marketplaces - In 2017, its admin Alexandre Cazes committed suicide in a Thai prison. The Fresno Division of the U.S. District Court for the Eastern District of California has finally concluded a 14-month long civil forfeiture case and allowed...

WannaCry ransomware fame North Korean hacker tracked down by the US

By Waqas It is no secret that the US government has always suspected and even accused North Korea was carrying out ransomware attacks using the destructive WannaCry ransomware and for hacking Sony Pictures. But it merely has remained a suspicion so far. However, now the US authorities have found...

Siemens SIMATIC PLCs Reported Issues Summary (Update A)

Overview ICS-CERT has been coordinating multiple reports of issues affecting various models within the Siemens SIMATIC Step 7 S7 programmable logic controller PLC product line. ICS-CERT has coordinated the issues with both Siemens and the researcher and continues to work with both entities. A...

Cisco Network NVF Infrastructure Software (NFVIS) Detection (HTTP)

HTTP based detection of Cisco Network NVF Infrastructure Software NFVIS. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

upton-house.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-672588 Description| Value ---|--- Affected Website:| upton-house.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

watersofwales.org.uk XSS vulnerability

Open Bug Bounty ID: OBB-672336 Description| Value ---|--- Affected Website:| watersofwales.org.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

islandselfcatering.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-671908 Description| Value ---|--- Affected Website:| islandselfcatering.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Following Facebook and Twitter, Google Targets Iranian Influence Operation

In the wake of influence-campaign takedowns by Facebook and Twitter, Google has issued a report detailing its own efforts to root out foreign influence operatives allegedly tied to an Iranian state-run media broadcaster. The news comes as President Donald Trump appeared to tweet in opposition to...

shop.zkm.de XSS vulnerability

Open Bug Bounty ID: OBB-668428 Description| Value ---|--- Affected Website:| shop.zkm.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...