Security News

Morningstar Security News gathers all the most popular infosec and cyber security news headlines into a single page that auto-updates 24/7.

Most Popular

Exploits

Tools

Vulnerabilities

Reversing/I like ASM

Malware/APT

Crypto

Podcasts

Threat Intel

Privacy/VPNs

Help Wanted

Locks/Social Engineering

Security Blogs

Mainstream Media

Thirsty for more

PacketStorm
This Stealthy Malware Hides Behind An Impossible Date new
Mr Goxx, The Cryptocurrency Trading Hamster, Dies new
Credentials Exposed For Majority Of US Financial Firms new
Google Warns Crypto Miners Are Hacking Cloud Accounts new
Cybercriminals Continue Using Zelle To Scam Victims
Tolkien Estate Blocks JRR Token Crypto Currency
Apple Sues 'Amoral 21st Century Mercenaries' NSO For Infecting iPhones With Pegasus Malware
Analyzing A Watering Hole Campaign Using macOS Exploits
Suspect Arrested In Ransom Your Employer Scheme
FBI And CISA Issue Holiday Ransomware, Cyberattack Warning
Code Execution Bug Patched In Imunify360 Linux Server Security Suite
UK Ministry Of Justice Secures HVAC Systems After Register Tipoff
The Register
EU needs more cybersecurity graduates, says ENISA infosec agency – pointing at growing list of master's degree courses
Privacy Sandbox saga continues: UK watchdog extracts more commitments from Google over ad tech
Government-favoured child safety app warned it could violate the UK's Investigatory Powers Act with message-scanning tech
If you want to see off next year’s cyber-threats, the time to prepare is … now
Microsoft Defender for Endpoint laid low. Not by malware, but by another buggy Windows patch
It’s about the survival of the fittest – CISOs must be brave enough to throw away their security playbook, or suffer the consequences
UK.gov emits draft IoT and smartphone security law for Parliamentary scrutiny
Google advises passwords are good, spear phishing is bad, and free clouds get attacked
Huawei's AppGallery riddled with malware-infected games
US bans Chinese firms – including one linked to HPE’s China JV – for feeding tech to Beijing's military
Max Schrems hits Irish Data Protection Commissioner with corruption complaint
Apple's Pegasus lawsuit a 'declaration of war' against offensive software developers, says Kaspersky director
Reddit - NetSec
Vulnerability in the Insulet OmniPod Insulin Management System allows an attacker nearby to schedule or immediately inject insulin new
Blue Team - Black Friday Deals
WordPress Plugin Confusion: How an update can get you pwned
RT @sectalks: Join us. We all need one! #Sydney https://t.co/RtyXXo1o1i
How to Detect Azure Active Directory Backdoors: Identity Federation
Implementing SAML Authentication in Enterprise SaaS Applications
Hunting for Persistence in Linux: Auditd, Sysmon, Osquery, and Webshells
Brida 0.5 released for Hack In Paris 2021
OffensiveAutoIt - Offensive tooling notes and experiments in AutoIt v3
Full key extraction of NVIDIA™ TSEC
Web Fundamentals for Hackers YouTube Series release! With Hand Made Animations!
Android APT spyware, targeting Middle East victims, enhances evasiveness
Bleeping Computer
IKEA email systems hit by ongoing cyberattack new
Google, Apple fined by Italian authority for aggressive data collection new
TrickBot phishing checks screen resolution to evade researchers new
Marine services giant Swire Pacific Offshore hit by ransomware
Marine services provider Swire Pacific Offshore hit by ransomware
Interpol arrests over 1,000 suspects linked to cyber crime
UK government transport website caught showing porn
How cybercriminals adjusted their scams for Black Friday 2021
New Linux malware hides in cron jobs with invalid dates
Discord malware campaign targets crypto and NFT communities
Microsoft Defender for Endpoint fails to start on Windows Server
Windows 10 KB5007253 update released with network printing fixes
The Hacker News
Italy's Antitrust Regulator Fines Google and Apple for "Aggressive" Data Practices new
Hackers Targeting Biomanufacturing Facilities With Tardigrade Malware
Crypto Hackers Using Babadeda Crypter to Make Their Malware Undetectable
CronRAT: A New Linux Malware That’s Scheduled to Run on February 31st
Israel Bans Sales of Hacking and Surveillance Tools to 65 Countries
Product Releases Should Not Be Scary
This New Stealthy JavaScript Loader Infecting Computers with Malware
Hackers Using Microsoft MSHTML Flaw to Spy on Targeted PCs with Malware
If You're Not Using Antivirus Software, You're Not Paying Attention
Warning — Hackers Exploiting New Windows Installer Zero-Day Exploit in the Wild
VMware Warns of Newly Discovered Vulnerabilities in vSphere Web Client
Eavesdropping Bugs in MediaTek Chips Affect 37% of All Smartphones and IoT Globally

Threat Wire

Exploits

Packet Storm Exploits
ManageEngine ADSelfService Plus Authentication Bypass / Code Execution new
D-Link DSL-3782 Pre-Authentication Remote Root new
Backdoor.Win32.Coredoor.10.a Man-In-The-Middle new
Email-Worm.Win32.Deltad Insecure Permissions new
Backdoor.Win32.Coredoor.10.a Authentication Bypass / Code Execution
Bagisto 1.3.3 Client-Side Template Injection
Gerdab.ir SQL Injection
Apple ColorSync CMMNDimLinear::Interpolate Uninitialized Memory
HTTPDebuggerPro 9.11 Unquoted Service Path
CMSimple 5.4 Local File Inclusion / Remote Code Execution
Serva 4.4.0 TFTP Remote Buffer Overflow
WordPress WP Guppy 1.1 Information Disclosure
Exploit-DB Webapps
[webapps] Bagisto 1.3.3 - Client-Side Template Injection
[webapps] CMSimple 5.4 - Local file inclusion (LFI) to Remote code execution (RCE) (Authenticated)
[webapps] Wordpress Plugin WP Guppy 1.1 - WP-JSON API Sensitive Information Disclosure
[webapps] Webrun 3.6.0.42 - 'P_0' SQL Injection
[webapps] Bus Pass Management System 1.0 - 'Search' SQL injection
[webapps] FLEX 1085 Web 1.6.0 - HTML Injection
[webapps] Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection
[webapps] Bludit 3.13.1 - 'username' Cross Site Scripting (XSS)
[webapps] Quick.CMS 6.7 - Cross Site Request Forgery (CSRF) to Cross Site Scripting (XSS) (Authenticated)
[webapps] SuiteCRM 7.11.18 - Remote Code Execution (RCE) (Authenticated) (Metasploit)
[webapps] GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)
[webapps] Wordpress Plugin Smart Product Review 1.0.4 - Arbitrary File Upload
Exploit-DB Local and Privilege Escalation
[local] HTTPDebuggerPro 9.11 - Unquoted Service Path
[local] Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2)
[local] Windows MultiPoint Server 2011 SP1 - RpcEptMapper and Dnschade Local Privilege Escalation
[local] zlog 1.2.15 - Buffer Overflow
[local] 10-Strike Network Inventory Explorer Pro 9.31 - 'srvInventoryWebServer' Unquoted Service Path
[local] RDP Manager 4.9.9.3 - Denial-of-Service (PoC)
[local] Dynojet Power Core 2.3.0 - Unquoted Service Path
[local] Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH)
[local] YouTube Video Grabber 1.9.9.1 - Buffer Overflow (SEH)
[local] 10-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow (SEH)
[local] Mini-XML 3.2 - Heap Overflow
[local] Netgear Genie 2.4.64 - Unquoted Service Path
Exploit-DB DoS
[dos] Pinkie 2.15 - TFTP Remote Buffer Overflow (PoC)
[dos] Modbus Slave 7.3.1 - Buffer Overflow (DoS)
[dos] Xlight FTP 3.9.3.1 - Buffer Overflow (PoC)
[dos] AbsoluteTelnet 11.24 - 'Username' Denial of Service (PoC)
[dos] AbsoluteTelnet 11.24 - 'Phone' Denial of Service (PoC)
[dos] NIMax 5.3.1f0 - 'VISA Alias' Denial of Service (PoC)
[dos] NIMax 5.3.1 - 'Remote VISA System' Denial of Service (PoC)
[dos] Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial-Of-Service (PoC)
[dos] Yenkee Hornet Gaming Mouse - 'GM312Fltr.sys' Denial-Of-Service (PoC)
[dos] SmartFTP Client 10.0.2909.0 - 'Multiple' Denial of Service
[dos] Telegram Desktop 2.9.2 - Denial of Service (PoC)
Exploit-DB Shellcode
Exploit-DB Papers
Exploit-DB Remote
[remote] GNU gdbserver 9.2 - Remote Command Execution (RCE)
[remote] Cypress Solutions CTM-200/CTM-ONE - Hard-coded Credentials Remote Root (Telnet/SSH)
[remote] Cypress Solutions CTM-200 2.7.1 - Root Remote OS Command Injection
[remote] Mitrastar GPT-2541GNAC-N1 - Privilege escalation
[remote] Apache James Server 2.3.2 - Remote Command Execution (RCE) (Authenticated) (2)
[remote] Cisco small business RV130W 1.0.3.44 - Inject Counterfeit Routers
[remote] ECOA Building Automation System - Hard-coded Credentials SSH Access

LiveOverflow

Vulnerabilities

Tools

Exploit Dev

Reddit - Exploit Dev
Paid CTF partner new
Execve shellcode not working
Long names and muscle memory?
Fuzzing with Scapy: Introduction to Network Protocol Fuzzing (DNS & TCP packets)
Source code audit or methodology to find potential Memory corruption in low level language in c/c++ and Assembly.
A bit confused about the jmpcall function in PEDA w/ ASLR but no PIE (x64/Linux)
Exploiting Predictable PRNG Seeds (with PwnTools, incl binary patching)
security researcher assistant
Is it still worth it to read The Shellcoder’s Handbook?
Threat actors offer millions for zero-days, developers talk of exploit-as-a-service
Come see where all the Scammers get their methods. SwipeClub (Groupchat + Vendor)
How to generate millions of files using grammar-based fuzzing (FormatFuzzer)
Source Incite
Unlocking the Vault :: Unauthenticated Remote Code Execution against CommVault Command Center
Chasing a Dream :: Pre-authenticated Remote Code Execution in Dedecms
Google Project Zero
Windows Exploitation Tricks: Relaying DCOM Authentication
Using Kerberos for Authentication Relay Attacks
How a simple Linux kernel memory corruption bug can lead to complete system compromise
Fuzzing Closed-Source JavaScript Engines with Coverage Feedback
Security Researchers
7 SecOps Trends That Could Shape Your Security in 2022
Detectify announces new product names
Devices of Palestinian Human Rights Defenders Hacked with NSO Group’s Pegasus Spyware
Example: forensicating the Mesa County system image
[New research] SSL certificates could be leaking company secrets
GFWatch: A Longitudinal Measurement Platform Built to Monitor China’s DNS Censorship at Scale
Crowdsourced security is now a need, not a nice to have
Debunking: that Jones Alfa-Trump report
Debunked: Is a subdomain takeover ‘game over’ for companies?

Reversing/I like ASM

Reddit - Reverse Engineering
Systematic method to reverse engineer and rewrite DOS games project by Kevinx286 new
OpenLGTV is a collective, non-commercial project for legal reverse engineering and research of LG (Smart and non Smart) TVs firmware, which is partially Open Source. new
SSD's black Friday challenge is live! Solve our binary memory dump challenge and win a $100 Amazon gift card!
Je Ne Sais Quoi - Falcons over the Horizon
Exploiting the Nvidia Falcon microprocessor.
Full key extraction of NVIDIA TSEC
Introduction To Binlex A Binary Trait Lexer Library and Utility - Machine Learning First Steps (OALABS Livestream)
[RevEng] Find CRC utility
Reverse engineering and modifying Android apps with JADX & Frida
/r/ReverseEngineering's Weekly Questions Thread
Reverse engineering a simple JavaScript-driven web application [n00bs-play]
Reversing a DRM with Frida and unicorn
Reddit - Game Hacks
Genshin impact commission exploit?
How to get into any locked pair of airpods
Rust Scripts
Collapse Rust Cheat
Weknowcheats.com free trial of 30 days
Reflexx/skellay scripts is a scam
Collapse Rust Cheat
Vhack Revolutions
Collapse Rust Cheat
Multi Mod Menu Release
Battlefield 2042 scripts + injector
Collapse Rust Cheat
Reddit - REGames
post j2me devs. community - Java phones development/reverse-engineering in the smartphone era
Need Help Getting Started
Help regarding deobfuscating Unity3D .data file
Easier method to modding AssetBundles?
Using IL2CPPInspector to create and inject a new Unity Projector as a mod?
Reverse Engineering REST APIs: The Easy Way
Reversing Windows Minesweeper - Project Layout?
Looking for reverse engineer (paid)
Guxt decompilation - a weekend project based on friend's .idb
*All* Models & Textures Ripped for ACNH 2.0.0 [DAE/PNG]
Midnight Club
New World's Botting Problem
StackExchange - ReverseEngineering
.data segment seem to contain code? new
How to exploit __isoc99_scanf with a segmentation fault new
Edit Squashfs filesystem in flash memory
I can't solve this crackme challenge with radare2
How can I tell ld to link to a local symbol in a shared object?
Prevent IDA from jumping to disassembly when debugging with decompiler
Force a mediatek device into BROM mode via OTG from another Android device
How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?
How is the data section dealt with in PIE?
How can I Bypass the dongle protection for this setup file?
Debug share library in Android application
Patch .net executable via hex editor

Guided Hacking

Malware/APT

Reddit - Malware
New Android Malware Discovered: 9 Million Android Phones Infected
Help figuring out what a Powershell based malware was trying to do.
short investigation of a spam post I found on r/WorldNews
Random comments on Facebook
WHATS "SONAR PROC HIJACK! G45"
Redline Stealer
New ransomware actor uses password-protected archives to bypass encryption protection
Step-by-step Muhstik botnet. Malicious activity, Kubernetes Pod victims, and IOCs.
I tried making a small keylogger in c to try to analyse it. Any thoughts?
BotenaGo Malware Threatening Millions of IoT Devices and Routers
Cyber Security for Hackers and Developers Software Bundle by Pluralsight
New Threat Alert: Krane Malware
Unit42
Observing Attacks Against Hundreds of Exposed Services in Public Clouds
A Peek into Top-Level Domains and Cybercrime
Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer
Updated: New Evidence Emerges to Suggest WatchDog Was Behind Crypto Campaign
Network Scanning Traffic Observed in Public Clouds
Case Study: From BazarLoader to Network Reconnaissance
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
SilverTerrier – Nigerian Business Email Compromise
Wireshark Tutorial: Wireshark Workshop Videos Now Available
Credential Harvesting at Scale Without Malware
Highlights From the Unit 42 Cloud Threat Report, 2H 2021
Network Security Trends: May-July 2021
FireEye Threat Research
ELFant in the Room – capa v3
Pro-PRC Influence Campaign Expands to Dozens of Social Media Platforms, Websites, and Forums in at Least Seven Languages, Attempted to Physically Mobilize Protesters in the…
Pro-PRC Influence Campaign Expands to Dozens of Social Media Platforms, Websites, and Forums in at Least Seven Languages, Attempted to Physically Mobilize Protesters in the…
PST, Want a Shell? ProxyShell Exploiting Microsoft Exchange Servers
Too Log; Didn't Read — Unknown Actor Using CLFS Log Files for Stealth

Bug Bounties

Crypto

Reddit - Crypto
Is it okay for a nonce to be publicly visible to potential attackers? new
Why do encryptions have to be longer than the original message?
AES 512-bit encryption (or an equivalent)
Why did they do it this way?
Next Generation Internet webinar on future of OpenPGP
Releasing the Cracken - A Data Driven Approach for Password Generation
A simple implementation of CubeHash in JavaScript
Word compression idea
Step by step guide of plaintext being encrypted using ECC?
Weekly cryptography community and meta thread
Cryptographers are not happy with how you’re using the word ‘crypto’ - The Guardian
StackExchange - Crypto
In paillier homomorphism, how is the randomness r changed during addition? new
Are there applications of sanitizable signatures without transparency property? new
Why is this image not pre-image resistant? new
Understanding MITM in an example authentication protocol new
How to decrypt a file using RSA and just a public.pem file? new
Proof that exchanged variable was not modified with MITM new
SHA-256 doesn't follow a uniform distribution? [closed] new
What if the other user generate the Session Key rather than KDC for Key Establishment new
QKD measuring qubit with wrong bases
Difference between fuzzy vault and fuzzy commitment?
What is the global resource expense (financial, energy, computing power & time) due to the need for cryptography?
Designated verifier signature from Diffie–Hellman and a MAC

Podcasts

Security Weekly
Hackers Be Hackin' - PSW #719
Snowed In - PSW #718
Funny Stories - PSW #717
The Supreme Counsel - PSW #716
Holy Guacamole - PSW #715
Space Force - PSW #714
Feeling Really Lame - PSW #713
Blinky Boxes - PSW #712
Everything's All Blurry - PSW #711
Playing Hanky Panky - PSW #710
The Magic Fix - PSW #709
Risky.Biz
Risky Business #646 -- Apple cracks the sads, sues NSO Group
Risky Biz Soap Box: DDoS crews will hit you creatively
Risky Business #645 -- How Israel used NSO to make friends in low places
Risky Biz Soap Box: Linux is an infrastructure OS, act accordingly
Risky Business #644 -- USA sanctions NSO Group, hits REvil
Risky Business #643 -- Iranian fuel stations targeted, PNG ransomware a regional security risk
Risky Biz Feature Interview: Mark Dowd on the 0day market and future of exceptional access
Risky Business #642 -- Brits, Dutch and Aussies embrace Hounds Doctrine
Risky Business #641 -- Lawsuit: Ransomware contributed to baby's death
Risky Biz Snake Oilers: Mike Wiacek launches Stairwell, Red Canary on modern MDR and Datadog pitches full stack monitoring
Risky Business #640 -- Huh. The CIA really was out to neck Assange
Risky Business #639 -- USA's ransomware non-policy fails to meet its unstated objective
The CyberWire
CyberWire Pro Research Briefing from 11/23/2021 new
CyberWire Pro Interview Selects: Carolyn Crandall of Attivo Networks. new
Misdirection and layering with a con in the middle. [Hacking Humans Goes to the Movies]
Phishing in the Iranian diaspora. Not your grandma and grandpa’s crytper. Malware-as-a-service. Proofs-of-concept (one is a zero-day). Apple sues NSO Group.
Tardigrade malware infests the US biomanufacturing sector. GoDaddy suffers a significant data breach. Facebook Papers to be reviewed and released. NSO Group’s troubles.
Stealing from the best? An enigma in the criminal-to-criminal market. CISA’s holiday caution. Someone’s impersonating the SEC. Three weekend cyberattacks.
MK Palmore: Lead from where you stand. [CISO] [Career Notes]
How ransomware impacts organizations. [CyberWire-X]
Using bidirectionality override characters to obscure code. [Research Saturday]
Software supply chain threats. Recent Iranian cyber operations. Banking disclosure rules. ICS updates. UK, US announce closer cooperation in cyberops. A real, literal, evil maid?
Developments in cyber gangland, and the increasingly complicated entanglement of crooks and spies. Selling confiscated alt-coin to compensate fraud victims.
CISA and its partners warn of Iranian cyber ops. Cyberespionage in the Middle East with Candiru tools. Belarus connected to Ghostwriter. Facebook boots SideCopy. RAMP…
Cyber Security Interviews
ISC Daily Stormcast
ISC StormCast for Wednesday, November 24th, 2021
ISC StormCast for Tuesday, November 23rd, 2021
ISC StormCast for Monday, November 22nd, 2021
ISC StormCast for Friday, November 19th, 2021
ISC StormCast for Thursday, November 18th, 2021
ISC StormCast for Wednesday, November 17th, 2021
ISC StormCast for Tuesday, November 16th, 2021
ISC StormCast for Monday, November 15th, 2021
Darknet Diaries
105: Secret Cells
104: Arya
103: Cloud Hopper
102: Money Maker
Cyber Presents: How To Not Get Scammed In The Crypto Market
101: Lotería
100: NSO

Threat Intel

Privacy/VPNs

Slashdot - Rights
Google Makes Pledges on Browser Cookies To Appease UK Regulator new
Australia Defamation Case Signals a Crackdown on Ordinary Citizens, Critics Say
UK Privacy Watchdog Warns Adtech the End of Tracking is Nigh
Roblox Sues YouTuber For $1.6 Million Over Terrorizing Kids Platform
A Third of All Dark Web Domains Are Now V3 Onion Sites
US To Require Vaccines For All Border Crossers In January
Elizabeth Holmes Admits Doctoring Lab Reports With Pharma Company Logos
Mozilla Is Ending Support For Its Firefox Password Manager Sync App
New Windows Zero-Day With Public Exploit Lets You Become An Admin
China's New Privacy Law Leaves US Behind
Apple Sues Israeli Spyware Maker, Seeking To Block Its Access To iPhones
India Police Charge Amazon Execs In Alleged Marijuana Smuggling Case
Reddit - Privacy
Creating accounts advice new
FOSS clients to these platforms? new
Is information in a note-taking app viewable by that company? new
House wifi vs cellular data vs hotspot data new
How do session messages work? new
My windows computer uploaded +1gb in 24 hours. I didn't touch a thing. This is normal activity but what is it? new
Learning from no precious tech knowledge, so here's a newbie question desperately needing answering! new
Tik tok listening to me new
Vehicle registration new
Safari recommendation new
Will installing Facebook and Instagram compromise my privacy even more considering I already have whatsapp installed? new
While we know that data brokers have our browsing history and IP addresses, how many results from the same address do they have? new
Reddit - VPN
Steam question new
ISP and keeping data new
VPN Slow in Windows, Fast on Hackintosh(same PC) and Android same Wi-Fi new
How to use VPN and Tor Browser? new
Vpn for mobile hotspot? new
VPN Bypass selected network adapter
Is it possible to use country VPN before work VPN kicks in, to hide that I'm abroad?
Spotify login failed/problem
Some sites are not loading while using VPN?
Use VPN from different location / IP
Log Storing
Not sure if this is most appropriate here or maybe r/homenetworking... I have an OpenVPN server running on pfSense at home. I can't connect to…
PrivacyTools.io
EFF
Coalition Against Stalkerware Celebrates Two Years of Work to Keep Technology Safe for All
UN Human Rights Committee Criticizes Germany’s NetzDG for Letting Social Media Platforms Police Online Speech
Podcast Episode: The Revolution Will Be Open Source
EU Parliament Takes First Step Towards a Fair and Interoperable Market
Manifest V3: Open Web Politics in Sheep's Clothing
Police Aerial Surveillance Endangers Our Ability to Protest
Indonesian Court Allows Internet Blocking During Unrest, Tightening Law Enforcement Control Over Users’ Communications and Data
Digital Rights Updates with EFFector 33.7
Apple’s Self Service Repair Program Must Live Up To Its Promises
EFF Tells Court to Protect Anonymous Speakers, Apply Proper Test Before Unmasking Them In Trademark Commentary Case
EFF’s New Series of How to Fix the Internet Podcast Tackles Toughest Issues in Tech
Podcast Episode: What Police Get When They Get Your Phone

Help Wanted

Reddit - AskNetSec
Hiding url shortened url permanently? new
Web Sec Academy vs Web Application Hacker Handbook new
Seeking information on race condition new
Career advice new
What are some signs or things to look for on wireshark for malicious activity? new
Agile Application Security book... but for non-application security stuff? new
WAHHv2 vs Web Sec Academy? new
Open relay attack new
SPF/DKIM/DMARC, Proofpoint Quarantine and solutions.
How do a get an affordable pen teast for a home network?
Gaining experience in the CyberSecurity field as a college student
Payload vs Shellcode
Reddit - Netsec Students
Blue Team Trainings - Black Friday Discounts
Does NP in GetNPUsers stand for Non-Preauth?
[List of all existing windows processes] Forensics Volatility
Any tips for the CCSP?
Anyone see any coupon codes for CompTia exams?
Recommendation for learning API hacking?
Are there any decent guides of how to create and use a golden ticket to move from domain admin to enterprise admin?
Help choosing best certification (sec+, ccna ....)
How to prepare for the Burp Suite Certificate exam?
DNS Record Type Review
Help with presenting a project
Burp Suite Certified Practitioner exam black friday sale - available at $9
Stackoverflow - Security
How could I secure this API? new
MySQL/MariaDB proxy(?): individual permissions for each table with just one user [closed] new
Tampering with the React Natives Bundle in Android new
is it secure that all capacitor apps use localhost as an origin new
How can I recover my Google account without Google Authenticator(8 digits of numbers)? [closed] new
Binary makes use of insecure API(s). Need official reports for it's Audit for Xamarin new
Does the Intel Management Engine have any private storage space? new
How does Google verify the signature of an id token using public keys and public client ID? new
Security Implications of JSONUtility and how to make secure if not new
Is Docker desktop the same as a Docker Container? new
AWS copy data security [closed] new
Bluehost hosting is continuously updating files maliciously new
Stack Exchange
What does a probe packet look like and how does it interact with a server to determine services new
Employee ID instead of employee names for corporate login? new
What can be done with open ports [duplicate] new
How does the searchfor.cc malware work? [closed] new
How are validation links getting triggered by a third party? new
Metasploit generated tcp handler not working [closed] new
Need help attacking my ethernet network [closed] new
Reasons not to use TLS 1.3? new
Python: Read RSA private key from file on disk and use it to create an AES Cipher [migrated] new
Is there any security reason to not allow adding authenticators for a certain account?
Is it possible to convert an IP packet into a grayscale image through the help of deep packet inspection? [closed]
What's the current status of OTP over SMS? [closed]

Locks/Social Engineering

Reddit - Lockpicking
410 Proof. As requested new
Sparrows coupon code new
Locksmith certification in VA new
New lock storage setup new
I think I’m getting worse at this, the more I practice. Anyone have this problem? Any advice? new
Day 5 in to the hobby. Also managed my front door and some drawer locks. new
Finally was smart enough to get a photo. new
How do you pick an ABUS padlock? new
All in all seems like a good pick. I don't have any lever locks, so I'm excited for 1 or two of these 🙂 new
Why does the end of a door lock feel springy? new
today i lock picked one more lock, besides my training one. very rewarding feeling new
Antiquing! Might pick up a pair lol new
Reddit - Social Engineering
How good at social engineering and deception are very good public speakers? new
How To Stop Being Manipulative: 16 Things You Should Do new
Book / Resource Recommendation
What is the best and most effective book on learning body language and using it as an advantage? (Immoral or Moral)
Manga/Manhwa/Anime about socialengineering/manipulation/psychology
Advanced manipulation tactics and techniques lesson-01-- "Frame Control" -- (Case report_01: Making a Tinder girl unblock me)
أفضل تطبيقات التواصل الاجتماعي للاندرويد
Studying Facial Expressions | Facial Action Coding System (FACS) Practice | Action Unit 10 (AU10)
How do you persuade someone that is ‘above’ you?
Social Engineering / psychology Video Games ?
A recent thread this week about mentalism got 14 upvotes and I wanted to offer a continuation of that discussion today because of BrdigeTrlol's excellent…
What story could you create about yourself to garner sympathy from others?

Hak5

Security Blogs

Security Bloggers Network
DEFCON 29 IoT Village – Hutch’s ‘Alexa, Have You Been Compromised?’ new
The Internet is Held Together With Spit & Baling Wire new
XKCD ‘Fiction Vs. Nonfiction’ new
ADFS Limitations
DEFCON 29 IoT Village – Jay Balan’s ‘5 Years Of IoT Vulnerability Research And Countless 0Days’
MSP Tips for Effective Meta Onboarding
Le modèle de responsabilité partagée de Microsoft: Qui doit sauvegarder les données d’Azure AD et de Microsoft 365? [E-book]
Customer Identity & Access Management: Build -v- Buy
Celebrating Coalition Against Stalkerware Achievements | Avast
Threat Landscape Evolution – Following the Attack Trends
Multi-Objective IoT System Modeling and Analysis—Performance, Energy, Reliability, Robustnes
La lista de control para la auditoría de Microsoft 365 de la Oficina del inspector general (OIG)
ThreatPost
New Twists on Gift-Card Scams Flourish on Black Friday
9.3M+ Androids Running ‘Malicious’ Games from Huawei AppGallery
GoDaddy Breach Widens to Include Reseller Subsidiaries
Apple’s NSO Group Lawsuit Amps Up Pressure on Pegasus Spyware-Maker
Attackers Actively Target Windows Installer Zero-Day
Attackers Will Flock to Crypto Wallets, Linux in 2022: Podcast
How to Defend Against Mobile App Impersonation
Common Cloud Misconfigurations Exploited in Minutes, Report
GoDaddy’s Latest Breach Affects 1.2M Customers
Online Merchants: Prevent Fraudsters from Becoming Holiday Grinches
Attackers Hijack Email Threads Using ProxyLogon/ProxyShell Flaws
Imunify360 Bug Leaves Linux Web Servers Open to Code Execution, Takeover
digitalmunition
eHacking News
Elastic Stack API Security Vulnerability Exposes Customer and System Data
The expert assessed the prospects of cybersecurity company Group-IB after the arrest of its founder
Analysts Warn of Telegram Powered Bots Stealing Bank OTPs
Newly Discovered 'Tomiris’ Backdoor Linked to SolarWinds Attack Malware
Ransomware Attack On Major European Bookseller
RansomEXX Comes into Action Encrypting Files Using AES-CBC
GriftHorse Malware has Infected More than 10 Million Android Devices
Turkish National Charged for DDoS Attack on U.S. Company
Cybersecurity experts have discovered a new hacker group
Scammers are Using Twitter Bots for PayPal and Venmo Scams
Bandwidth Suffers Outages Caused by DDoS Attack
Nobelium APT Group Uses Custom Backdoor to Target Windows Domains
Wired - Security
The Pentagon Set Up a UFO Office new
The McDonald’s Ice Cream Machine Hacking Saga Has a New Twist
Devious ‘Tardigrade’ Malware Hits Biomanufacturing Facilities
A Canadian Teen Was Arrested in a $36.5M SIM-Swap Heist
Iranian Hackers Are Going After US Critical Infrastructure
Locked Out of ‘God Mode,’ Runners Hack Their Treadmills
How Iran Tried to Undermine the 2020 US Presidential Election
DuckDuckGo Wants to Stop Apps From Tracking You on Android
Amazon's Dark Secret: It Has Failed to Protect Your Data
You Need a Password Manager. Here Are the Best Ones
Another Intel Chip Flaw Puts a Slew of Gadgets at Risk
‘Ghostwriter’ Looks Like a Purely Russian Op—Except It's Not
Krebs on Security
Arrest in ‘Ransom Your Employer’ Email Scheme
The ‘Zelle Fraud’ Scam: How it Works, How to Fight Back
Tech CEO Pleads to Wire Fraud in IP Address Scheme
SMS About Bank Fraud as a Pretext for Voice Phishing
Microsoft Patch Tuesday, November 2021 Edition
REvil Ransom Arrest, $6M Seizure, and $10M Reward
‘Tis the Season for the Wayward Package Phish
The ‘Groove’ Ransomware Gang Was a Hoax
Zales.com Leaked Customer Data, Just Like Sister Firms Jared, Kay Jewelers Did in 2018
Conti Ransom Gang Starts Selling Access to Victims
Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability
How Coinbase Phishers Steal One-Time Passwords
Naked Security
Cloud Security: Don’t wait until your next bill to find out about an attack! new
S3 Ep60: Exchange exploit, GoDaddy breach and cookies made public [Podcast]
US government securities watchdog spoofed by investment scammers – don’t fall for it!
Check your patches – public exploit now out for critical Exchange bug
GoDaddy admits to password breach: check your Managed WordPress site!
Black Friday and Cyber Monday – here’s what you REALLY need to do!
Github cookie leakage – thousands of Firefox cookie files uploaded by mistake
S3 Ep59: Emotet, an FBI hoax, Samba bugs, and a hijackable suitcase [Podcast]
Apple’s Mail Privacy Protection feature – watch out if you have a Watch!
The self-driving smart suitcase… that the person behind you can hijack!
Emotet malware: “The report of my death was an exaggeration”
FBI email hack spreads fake security alerts. Here’s what to do…
Schneier on Security
Friday Squid Blogging: Bobtail Squid and Vibrio Bacteria new
Proposed UK Law Bans Default Passwords
Apple Sues NSO Group
“Crypto” Means “Cryptography,” not “Cryptocurrency”
Friday Squid Blogging: Bigfin Squid Captured on Video
New Rowhammer Technique
Is Microsoft Stealing People’s Bookmarks?
Wire Fraud Scam Upgraded with Bitcoin
Why I Hate Password Rules
Book Sale: Click Here to Kill Everybody and Data and Goliath
Securing Your Smartphone
Friday Squid Blogging: Giant Squid Art
Linux Security
Imunify360 Bug Leaves Linux Web Servers Open to Code Execution, Takeover>
AWS commits to update its own Linux every other year>
Linux Kernel 5.14 Reached End of Life, Users Urged to Upgrade to Linux 5.15 LTS>
Lead Microsoft Engineer Kevin Sheldrake Brings Sysmon to Linux>
Alma and Rocky Linux release 8.5 builds, Rocky catches up with secure boot>
Hackers deploy Linux malware, web skimmer on eCommerce servers>
Best Linux desktops for beginners 2021>
Microsoft gives Windows Subsystem for Linux a new icon, fixes issues and updates kernel>
CentOS Alternative Rocky Linux 8.5 Is Out Now with Secure Boot Support, Updated Components>
Keep calm and learn Rust: We'll be seeing a lot more of the language in Linux very soon>
BusyBox flaws highlight need for consistent IoT updates>
Rust-proofing the internet with ISRG's Prossimo>
Dark Reading
How Threat Actors Get Into OT Systems
In Appreciation: Dark Reading's Tim Wilson
MediaTek Chip Flaw Could Have Let Attackers Spy on Android Phones
OpenText Acquires Bricata
When Will Security Frameworks Catch Up With the New Cybersecurity Normal?
Baffle's Data Privacy Cloud Protects Data for Amazon Redshift Customers
New Android Spyware Variants Linked to Middle Eastern APT
Why Should I Adopt a Zero-Trust Security Strategy?
Apple Sues NSO Group for Spyware Use
Holiday Scams Drive SMS Phishing Attacks
How Sun Tzu's Wisdom Can Rewrite the Rules of Cybersecurity
Don't Help Cybercriminals Dash With Your Customers' Cash This Black Friday
Securelist
IT threat evolution in Q3 2021. Mobile statistics
IT threat evolution Q3 2021
IT threat evolution in Q3 2021. PC statistics
Threats to ICS and industrial enterprises in 2022
The dangers of “connected” healthcare: predictions for 2022
Privacy predictions 2022
Cyberthreats to financial organizations in 2022
Black Friday 2021: How to Have a Scam-Free Shopping Day
Whitehat Security Blog
HITB News
From students to masters: HITB+CyberWeek 2021 showcases next generation of cyber security talent in the UAE
Iranian Hackers Are Going After US Critical Infrastructure
Google says it’s improving fingerprint scanner performance with a Pixel 6 update
Locked out of “God mode,” runners are hacking their treadmills
DuckDuckGo wants to stop apps tracking you on Android
Apple has a new work-from-home policy, but it’s still not what employees want
Canadian Teen Arrested in Crypto Theft Worth $36.5 Million
Autism affects the microbiome, not the other way around
Hack In The Box announces key speakers ahead of HITB+CyberWeek 2021, brought by DisruptAD
Israeli spyware firm linked to watering hole attacks on Middle East, UK websites
Intel CPU flaw could enable hackers to attack PCs, cars, and medical devices`
Securing your digital life, part three: How smartphones make us vulnerable
The RISKS Digest
Debris From Test of Russian Antisatellite Weapon Forces Astronauts to Shelter
Google loses appeal against $2.7 billion antitrust fine over its comparison-shopping practices in Europe
Open Source Doesn't Mean More Software Is Better Software
Hackers Targeted Apple Devices in Hong Kong for Widespread Attack
Facebook 3rd party single-sign-on failure
These Parents Built a School App. Then the City Called the Cops
Unconsidered automatic filtering creates damaging side-effects
QR codes, URL's, and restaurants
Congress mandates new car technology to stop drunken driving
Thermal Grease Degradation is an underappreciated hazard
Palestinians Were Targeted by Israeli Firm’s Spyware, Experts Say
DoS Sabotage by Telegram
Kaspersky Blog
Woman jailed after trying to hire hitman on fake site | Kaspersky official blog
Five problems of telehealth | Kaspersky official blog
Eight tips for remote students | Kaspersky official blog
Trojan Source: Hidden source code implants | Kaspersky official blog
The danger of proxyware in corporate networks | Kaspersky official blog
Transatlantic Cable podcast, episode 228 | Kaspersky official blog
Phishing attacks on users of streaming services | Kaspersky official blog
Phishing disguised as spam | Kaspersky official blog
Ransomware attacks are hitting K-12 schools in US | Kaspersky official blog
New features of Kaspersky VPN Secure Connection | Kaspersky official blog
How to protect teens’ mental health on social media | Kaspersky official blog
File scanning in Azure Storage and Amazon S3
Adam Shostack & friends
Turning off the lights?
Training Discount
Graham Cluley
Couple arrested for secretly installing cryptomining software on department store PCs new
Try out 1Password 8 for Windows, where security meets productivity
Sophisticated Tardigrade malware launches attacks on vaccine manufacturing infrastructure
Smashing Security podcast #253: Cybercrime unicorns, HVAC hacks, and NFT piracy – with Mikko Hyppönen
New UK IoT law means huge fines and a ban on default passwords
GoDaddy hack exposes accounts of 1.2 million customers
On the trail of Russia’s $100 million Evil Corp hacking gang
Beware Monzo phishing scams via SMS
Boffins say they can spot a hidden spy cam with just a smartphone
The UK pushes for better supply chain cyber security
Smashing Security podcast #252: Hotel hacks, workplace spies, and the FBI
1Password 8 for Windows: Security, meet productivity
Rapid7
[Security Nation] Chris John Riley on Minimum Viable Secure Product (MVSP)
OWASP Top 10 Deep Dive: Defending Against Server-Side Request Forgery
The End of the Cybersecurity Skills Crisis (Maybe?)
2022 Planning: A First-Year CISO Shares Her Point of View
Make Room for Cloud Security in Your 2022 Budget
Distribute Reports to Email Addresses in InsightVM
2022 Planning: Prioritizing Defense and Mitigation Through Left of Boom
Announcing the 2021 Metasploit Community CTF
Thawing Out the Chilling Effect Of DMCA Section 1201
Better Together: XDR, SOAR, Vulnerability Management, and External Threat Intelligence
Hands-On IoT Hacking: Rapid7 at DefCon 29 IoT Village, Part 4
Time to Act: Bridging the Gap in Cloud Automation Adoption
Hacker News (YCombinator) - Security
Interpersonal Traits of Aspies Placed in Context (2014) new
How did this PayPal spoof email pass SPF, DKIM and DMARC new
Google: An Update on Our Privacy Sandbox Commitments new
Repairing an HP 3478A Multimeter with a Hacksaw new
The internet is held together with spit and baling wire new
I faked tons of Covid passes – “Weak Key Cryptography in real world” new
PostmarketOS Revolutionizes Smartphone Hacking
Security service that protects from SQLi had critical SQLi vulnerability
WordPress security plugin Hide My WP addresses SQL injection, deactivation flaws
Hacking CD/DVD/Blu-ray for Biosensing
Hacking CD/DVD/Blu-ray for Biosensing (2018)
A Live Look at Black Friday/Cyber Monday Sales on Shopify
Hacker Noon #Security
Why SASE (Secure Access Service Edge) Matters for Businesses new
8 Tips for Safe Online Shopping this Holiday Season new
Data Lineage is Like Untangling a Ball of Yarn new
Kids + Dogs + Zoom Meetings - What Could Possibly Go Wrong?
CloudGuard added AWS GWLB: What that Means for AWS Marketplace Offerings
A Cryptographer's Guide to End-to-End Encryption
Australia's Ransomware Action Plan
Public WiFi is the Devil [Part 2]
How a Wormable Android Malware Used to Spread Using WhatsApp Auto-Replies
Making Your Crypto Transactions Truly Anonymous: ZMATIC Vs. Monero Vs. ZCash
Distributed Computing Cloud Is The Way Towards A Web3 Future: A Phala Network Story
8 Must-Have Security Tools for Developers

Security in Mainstream Media

Google News Hacking
The Pentagon Set Up a UFO Office - WIRED new
Impressive Off-Grid Hydroelectric Plant Showcases The Hacker Spirit - Hackaday new
No "Defense of Others" Defense in Justina Pelletier Hospital Hacking Case - Reason new
Experts allege that Queen Elizabeth's 'heavily encrypted' anti-hacking phone has two main connections - BollyInside
Hacking Fingerprints With a $5 Setup To Bypass Biometric Authentication - Cyber Security News
Crypto Hackers Using Babadeda Crypter to Make Their Malware Undetectable - Internet
2021 - Hackers start to value quality over quantity - BCS
Hackers are targeting this Microsoft Windows Installer flaw, say security researchers - ZDNet
Armenian Politicians Exposed to State-Sponsored Spyware Hacking Through Israeli Pegasus Firm - Armenian News by MassisPost
Israel Bans Sales of Hacking and Surveillance Tools to 65 Countries - Internet
Florida Teen Emily Grover Was Accused of Hacking a Homecoming Queen Contest and Faces 16 Years in Prison - The Daily Beast
Personal Data of Thousands of Sonoma County Agencies' Clients Possibly Hacked - CBS San Francisco
Google Cyber Security
Pandemic forcing nations to develop newer frameworks for cybersecurity - The Hindu new
Banca d'Italia : Launch of a cyber security awareness campaign for safer use of digital channels and tools - marketscreener.com new
Report Details Best Practices for Rail Cybersecurity - HS Today - HSToday new
Here's how organisations can protect their business from online scams - gulfbusiness.com new
The means to manage cyberspace and the duty of security - Modern Diplomacy new
Centre of excellence to deal with cyber security to come up in Guwahati - ETCIO.com new
Webinar on cybersecurity - The Tribune new
Open Source Intelligence And Its Possible Effect On Cybersecurity – CommsTrader - CommsTrader new
Centre of excellence to deal with cyber security to come up in Guwahati - ETTelecom.com new
F-Secure collaborates with CyberPeace Institute to help organizations targeted by cyberattacks - Help Net Security new
Centralia Foundation Hosts Cybersecurity Event as Step in Career Pathways Initiative - Centralia Chronicle new
The long read: New consensus in cybersecurity – pv magazine India - pv magazine India new

Thirsty for more

Hacker News (YCombinator)
Path (YC S19) is hiring engineers to help gen z pay for college new
Zelda 64 has been fully decompiled new
Effects of Toxoplasma on Human Behavior new
The Forest People new
Apple has stopped sales in Turkey after the lira crashed 15% in a day new
The Brickyard Summer of 1957 (2008) new
Assembly Language is Number 8 new
The Token Disconnect new
The fabulous Flamingo, a motorhome made from an abandoned aircraft new
Typora 1.0 needs a license code to use new
EmacsConf 2021 – Live Now new
Magma: A Dependently-Typed Language new
Reddit - Cyberpunk
I TAKE PRIDE IN MY GRILLING SKILLS BUT THIS YEAR I LET DOWN MY HUMAN FAMILY new
Metro in Istanbul. new
SteamPunk Future City - Sounds of Gentle Rain 4K new
"Cube" (2021) new
Cyberpunk living space. Kinda reminds one of Korben Dallas' apartment, in The Fifth Element. From Rise of the Dragon (Sega CD version). new
Capsuled Nightmare Artist Pigboom Art new
Newest South Park Movie Takes place in the future and has a 600,000 people retirement home. new
From a recent trip to Chongqing new
Artist: @gufe_visuals new
Wouter Gort new
A person hooked up to a noninvasive brain-computer-interface from neurotech company Kernel, 2020 new
Datacenters | A short Imgur compilation of some of the most sci-fi looking places on Earth: datacenters and server farms, the places where machines think new
Reddit - Security CTF
Hack The Box - Json - Writeup new
Paid CTF challenges new
CVE-2021-43267: Remote Linux Kernel Heap Overflow | TIPC Module Allows Arbitrary Code Execution
Using Google For Information Gathering | TryHackMe Google Dorking
Top 6 Kubernetes Security Tools
Introduction to Kubernetes Pentesting
ENIGMA 8
Nikto scan email header
Examples of atypical wargames?
CSP, Vue and XSS! Intigriti November XSS challenge writeup
SQL Injection in Search Fields | TryHackMe Cybercrafted Minecraft CTF
Help Please Cryptic Hunt
Reddit - Sysadmin
How would you handle this? new
Looking For Sophos Vendor new
Intern for IT new
Remote Desktop Solutions needed new
Using external DHCP (from a router etc.) with Active Directory? new
MS OpenValue SA licensing with vmware hosts new
WAF filtering on firewall new
HP AF400a PDU Mgmt. Module new
I cannot activate Windows default Anti-Virus. How to fix? new
Read-only file system problem on USB with FAT32 new
Centralized Authentication and DNS new
New company using TeamViewer for wfh new
Lobste.rs
Computer Science was always supposed to be taught to everyone, and it wasn’t about getting a job: A historical perspective new
What Does It Take To Port 16-Bit Windows 1.0 Applications Into Native Windows 11 Programs? new
Magma: A dependently-typed language new
We've Been Doing It The Wrong Way new
Optimising memset and memcpy new
Defective UPNP implementations are why so many IoT devices need the cloud new
An 'Attempt' to avoid C++ exceptions new
Run a website off a Google Sheets Database, with Hugo new
How to jailbreak an Amazon Echo Dot? new
JCRCMDS AS/400 GAMES new
NixOS: Headless Home Assistant VM new
Testing new
Hackaday
Indoor Blimp Sails Through The Air Using Ultrasonic Transducers new
PiGlass v2 Embraces the New Raspberry Pi Zero 2 new
Spiral Music Visualization new
Finally, Tame The Si5351! new
Analyzing Starlink Satellite Downlink Communications With Software Defined Radio new
Impressive Off-Grid Hydroelectric Plant Showcases The Hacker Spirit new
The Unofficial Guide To (Avoiding) Electrocution new
Hackaday Podcast Ep 146: Dueling Trackballs, Next Level BEAM Robot, Take Control of Your Bench, and Green Programming
Vision Impaired Electronics Engineer Shows The Way To Get Things Done
A Rotary Phone As A Computer Peripheral
Solder Paste Dispenser Without Giant Compressor
Fifty Shades Of Brown: 3D Printing With Sugar
Ars Technica
It’s time to fear the fungi new
David Tennant makes a dashing Phileas Fogg in Around the World in 80 Days preview new
The best smartwatches and fitness tracker deals for Black Friday [Updated] new
Tesla forced to turn down €1.1 billion in EU support for German battery plant
All the best Black Friday 2021 deals we can find [Updated]
The best Black Friday 2021 deals on Apple devices
Andrew and Lee continue watching The Wheel of Time—and it’s getting real
The SWFT VOLT: A minimalist e-bike with a price to match
The 9 best deals on noise-canceling headphones we’re seeing for Black Friday
Will glow-in-the-dark materials someday light our cities?
Scientists use seismic noise to image first hundred meters of Mars
Microbiologists have cracked the case of Shedd Aquarium’s missing medicines
Wired