Finding Vulnerabilities in Open Source Projects
February 2 2022The Open Source Security Foundation announced $10 million in funding from a pool of tech and financial companies, including $5 million from Microsoft and Google, to find...
Read moreTwelve-Year-Old Linux Vulnerability Discovered and Patched
January 31 2022It’s a privilege escalation vulnerability:
Linux users on Tuesday got a major dose of bad news — a 12-year-old vulnerability in a system tool called Polkit gives attackers unfettered...
Read more
More Log4j News
December 16 2021Log4j is being exploited by all sorts of attackers, all over the Internet:
At that point it was reported that there were over 100 attempts to exploit the vulnerability...
Read more
On the Log4j Vulnerability
December 14 2021It’s serious:
The range of impacts is so broad because of the nature of the vulnerability itself. Developers use logging frameworks to keep track of what happens in a...
Read more
Hiding Vulnerabilities in Source Code
November 1 2021Really interesting research demonstrating how to hide vulnerabilities in source code by manipulating how Unicode text is displayed. It’s really clever, and not the sort of attack one...
Read moreMissouri Governor Doesn’t Understand Responsible Disclosure
October 18 2021The Missouri governor wants to prosecute the reporter who discovered a security vulnerability in a state’s website, and then reported it to the state.
The newspaper agreed to hold...
Read more
Zero-Click iMessage Exploit
September 17 2021Citizen Lab released a report on a zero-click iMessage exploit that is used in NSO Group’s Pegasus spyware. Apple patched the vulnerability; everyone needs to update their OS immediately. News articles...
Read moreTracking People by their MAC Addresses
September 6 2021Yet another article on the privacy risks of static MAC addresses and always-on Bluetooth connections. This one is about wireless headphones.
The good news is that product vendors are...
Read morePST, Want a Shell? ProxyShell Exploiting Microsoft Exchange Servers
September 3 2021In August 2021, Mandiant Managed Defense identified and responded to the exploitation of a chain of vulnerabilities known as ProxyShell. The ProxyShell vulnerabilities consist of three CVEs ...
Read morePST, Want a Shell? ProxyShell Exploiting Microsoft Exchange Servers
September 3 2021In August 2021, Mandiant Managed Defense identified and responded to the exploitation of a chain of vulnerabilities known as ProxyShell. The ProxyShell vulnerabilities consist of three CVEs ...
Read more
Recent Comments