Word of the week
“Car Hacking is Real”
84% of automotive engineers worry their systems aren’t keeping pace with advancing threats
The worlds worst BOTNET countries
Crypto challenge of the week
GDPR Enforcement Tracker
Link HERE – thanks to Marius
Talk about unintended consequences: GDPR is an identity thief’s dream ticket to Europeans’ data
Revenge plan morphs into data leak discovery
Now: TLS1.2 mandatory for proper security
HTTPS everywhere HERE
Verifying SSL/TLS configuration by SANS
Kenya’s Homa Bay: Fart pushes Speaker to suspend debate
A heated debate about market stalls was disrupted by a foul smell and furious finger-pointing at a Kenyan regional assembly on Wednesday, local reports say.
“Honourable Speaker, one of us has polluted the air and I know who it is,” Julius Gaya reportedly told Homa Bay county assembly.
But the member he accused of farting is said to have replied:
“I am not the one. I cannot do such a thing in front of my colleagues.”
Book on the month
Is a new experimental (one article == one page) free magazine about programming (especially programming tricks!), hacking, security hacking, retro computers, modern computers, electronics, demoscene, and other similar topics.
Links HERE and HERE
Comic of the week
##Some OWASP stuff first
-OWASP Threat Modeling and Online Dating presentation @DianaInitiative2019
OWASP events HERE
All InfoSec events HERE
The complete Security Events calendar – Peerlyst
BlackHat USA 2019 – 3-8 August
Keynote: Every Security Team is a Software Team Now by Dino Dai Zovi
Other shots – thanks to Marek
Link to schedule and presentations HERE
DEFCON 27 – more on this next week
Global ALERT level
BLUE or GUARDED indicates a general risk of increased hacking, virus, or other malicious activity. The potential exists for malicious cyber activities, but no known exploits have been identified, or known exploits have been identified but no significant impact has occurred.
Incident data HERE Find your country
NCSC Weekly Threat Report
University students at risk of phishing attacks
Companies overlooking the importance of cloud security
Incidents & events detail
Researchers Find 23 Million Stolen Cards For Sale
Researchers have found over 23 million stolen credit and debit cards up for sale on the dark web, with US consumers by far the biggest hit.
Nearly two out of every three stolen cards on the sites trawled by Sixgill were issued in the US, amounting to more than 15 million. The next biggest hit country was the UK, which accounted for over 7%
Capital One’s breach was inevitable, because we did nothing after Equifax
What I learned at Capital One
This post is long overdue and may not have ever been written had it not been for the recent news on the Capital One breach. I’ve had so many inbounds on being part of the security team and everyone wanting to know what happened. I had to sit down and write this up
Escaping the Chrome Sandbox via an IndexedDB Race Condition
Exploitation of a race condition in the IndexedDB implementation of Chrome, demonstrating a full sandbox escape
Facebook Libra Might Never Launch, Company Concedes in SEC Disclosure
Steam Windows Client Local Privilege Escalation 0day
Canon DSLR Camera Infected with Ransomware Over the Air
Link HERE – thanks to Mithun
What do Uber, Volkswagen and Zenefits have in common? They all used hidden code to break the law
Group s** app leaks locations, pics and personal details. Identifies users in White House and Supreme Court
Where are they?
Responding to Firefox 0-days in the wild
Link HERE – thanks to TK
Cisco ‘Knowingly’ Sold Hackable Video Surveillance System to U.S. Government
Link HERE – thanks to Christophe and “why it’s important to listen to people who would like to report vulnerabilities in your services / software / products”
Galaxy Leapfrogging: Pwning the Galaxy S8
Apple Confirms $1 Million Reward For Anyone Who Can Hack An iPhone
$1 million for an iPhone hack
WhatsApp Hack Attack Can Change Your Messages
During a briefing at the annual Black Hat security conference in Las Vegas on August 7, researchers from Israeli security company Check Point revealed how Facebook-owned WhatsApp could be hacked to change the text of a message and the identity of the sender. If that sounds worrying enough, these vulnerabilities were revealed to WhatsApp last year but remain exploitable today
Microsoft Confirms New Windows CPU Attack Vulnerability, Advises All Users To Update Now
Monero security flaw could’ve seen XMR stolen from cryptocurrency exchanges
Research of the week
Featuring – How to Get Infected With Malware
Computers these days work so smoothly, using them can be plain boring. Want some excitement? Throw off the shackles of your security software and get your system infected with malware! Our tongue-in-cheek guide can show you how
The Fully Remote Attack Surface of the iPhone
While there have been several rumours and reports of fully remote vulnerabilities affecting the iPhone being used by attackers in the last couple of years, limited information is available about the technical details of these vulnerabilities, as well as the underlying attack surface they occur in. I investigated the remote, interaction-less attack surface of the iPhone, and found several serious vulnerabilities.
Vulnerabilities are considered ‘remote’ when the attacker does not require any physical or network proximity to the target to be able to use the vulnerability. Remote vulnerabilities are described as ‘fully remote’, ‘interaction-less’ or ‘zero click’ when they do not require any physical interaction from the target to be exploited, and work in real time. I focused on the attack surfaces of the iPhone that can be reached remotely, do not require any user interaction and immediately process input.
There are several attack surfaces of the iPhone that have these qualities, including SMS, MMS, VVM, Email and iMessage
The Six Pillars of DevSecOps
Achieving Reflexive Security Through Integration of Security, Development and Operations
Link HERE – thanks to Naz
VULNERABILITY FOCUS: JAVA
Attention, fellow AppSec comrades! This blog post shines a spotlight on open source vulnerabilities in the Java universe. In particular, it has come to our awareness that the jackson-databind serialisation library, which parses Java objects to JSON and vice versa, has taken big hits over the past few weeks. To better enlighten our readers, we took an in-depth look into the origins of its (de)serialisation flaws.
Link HERE – in French
Tool of the week
Privacy Preserving Infrastructure for Asynchronous, Decentralized, Multi-Party, and Metadata Resistant Applications
Cwtch (a Welsh word roughly translating to “a hug that creates a safe place”) is a decentralized, privacy-preserving, asynchronous multi-party messaging protocol that can be used to build metadata resistant applications
Credential Scanner (CredScan)
A tool developed and maintained by Microsoft to identify credential leaks such as those in source code and configuration files. Some of the commonly found types of credentials are default passwords, SQL connection strings and Certificates with private keys.
WhiteSource Bolt for GitHub
A FREE app, which continuously scans all your repos, detects vulnerabilities in open source components and provides fixes. It supports both private and public repositories
Microsoft Security Risk Detection
Security Risk Detection is Microsoft’s unique fuzz testing service for finding security critical bugs in software. Security Risk Detection helps customers quickly adopt practices and technology battle-tested over the last 15 years at Microsoft
Remember: Secure DevOps Kit for Azure
The service worker hiding in your browser
New tool easily backdoors vulnerable websites
BURP HTTP Request Smuggling
Open Sourcing the Kubernetes Security Audit
Other interesting articles
##Is Your Serverless Application Secure?
In the past few months, I’ve hosted several sessions on serverless securityfor serverless developers and DevOps folks. What I’ve realized during these sessions is that there are quite a few inaccurate assumptions that developers are making
##A case study in industry collaboration: Poisoned RDP vulnerability disclosure and response
Earlier this year, I reached out to Check Point researcher Eyal Itkin, who had published multiple flaws in several Remote Desktop Protocol (RDP) clients, including a vulnerability in mstsc.exe, the built-in RDP client application in Windows. While there were no active exploits detected in the wild, it was important for me and my team at Microsoft to analyze the vulnerability, do further variant analysis and investigations, and build defenses, including cloud-based post-breach detection in addition to the operating system fix.
The cross-company collaboration that followed was especially critical in this case, because the attack technique is quite tricky to detect. The vulnerability exists in the shared clipboard mechanism. Unlike other RDP vulnerabilities that could allow an attacker to connect to target machines using the RDP protocol, in this case, an attacker would wait for a user to connect to a compromised machine, and then start the attack through the vulnerability. RDP anomaly detection wouldn’t be useful, because exploit behavior doesn’t stand out as unusual.
The vulnerability, called Poisoned RDP vulnerability and designated as CVE-2019-0887, has been fixed, but it serves as a good case study for industry collaboration leading to better and speedier response to security issues. In this blog, we’ll share an overview of the vulnerability and how we worked with Check Point to build the defenses using Windows telemetry
##Common application security challenges & how to overcome them
Application security challenges lie not only in the threats and application vulnerabilities themselves, but also in the processes and approaches taken within the organization to manage application security. A closer look at some of the top application security challenges from both a threat standpoint and a business management view can help you avoid some of the most common pitfalls.
##And finally, how the US, EU and China compete to set industry standards
There is a first-mover advantage for whoever writes the new rules for the digital economy
##HACKING, TOOLS and FUN – CHECK BELOW!
Description: Advanced Blind XSS Payloads.
URL: http://bit.ly/2GtDPyi (+)
Description: Pwning child company to get access to ParentCompany’s Slack Team.