Security News

Morningstar Security News gathers all the most popular infosec and cyber security news headlines into a single page that auto-updates 24/7.

Most Popular

Exploits

Tools

Vulnerabilities

Reversing/I like ASM

Malware/APT

Crypto

Podcasts

Threat Intel

Privacy/VPNs

Help Wanted

Locks/Social Engineering

Security Blogs

Mainstream Media

Thirsty for more

PacketStorm
New Moriya Rootkit Stealthily Backdoors Windows new
Critical Cisco Bugs Threaten Corporate Networks new
Your Own Phone Number Can Be Used To Hack You, Study Finds
Dogecoin Has To Be Taken Seriously Now
New Crypto Stealer Panda Spread Via Discord
JET Engine Flaws Can Crash Microsoft IIS And SQL Servers
Data Leak Makes Peloton's Horrible, No-Good, Really Bad Day Even Worse
Americans Turn To VPNs To Prevent Online Fraud And Hacking
Scammer Used Fake Court Order To Take Over Dark Web Drug Market Directory
Qualys Puts 21 Nails Into Exim Mail Server
Dell Patches Vulnerable Driver For Over A Decade Of Products
4,700 Amazon Employees Had Unauthorized Access To Private Seller Data
The Register
Russian cyber-spies changed tactics after the UK and US outed their techniques – so here's a list of those changes new
Privacy activist Max Schrems on Microsoft's EU data move: It won't keep the NSA away new
Cisco HyperFlex web interface has critical flaw that lets attackers get root and execute arbitrary commands new
Kids in Hong Kong and other highly surveilled states worry infosec careers are just asking for trouble new
Google Play to require privacy labels on apps in 2022, almost two years after Apple new
Google will make you use two-step verification to login new
Qualcomm Snapdragon 855 modem code flaw exposed Android smartphones to possible snooping
Crane horror Reg reader uses his severed finger to unlock Samsung Galaxy phone
Chrome on Windows turns on Intel, AMD chip-level defenses against malicious websites
JET engine flaws can crash Microsoft's IIS, SQL Server, say Palo Alto researchers
21 nails in Exim mail server: Vulnerabilities enable 'full remote unauthenticated code execution', millions of boxes at risk
East London council blurts thousands of residents' email addresses in To field blunder
Reddit - NetSec
versionshaker: find a remote website's version based on its public js/css resources from git new
Domain hijacking vulnerability in Route 53/Gandi new
The Journey to Try Harder: TJnull’s Preparation Guide for PEN-200 PWK/OSCP 2.0
CVE-2021-32030: ASUS GT-AC2900 Authentication Bypass
Static Analysis of Android Application & Tools Used
MouseTrap: My first six CVEs, 0click RCEs on computers running the latest version of RemoteMouse. Vendor never responded so they're released as unpatched 0days.
Tool Release – Socks Over RDP
Cisco RV34X Privilege Escalation (CVE-2021-1520) Root Cause Analysis
JAF is an internally developed, red team-oriented tool from Accenture for interacting with Jenkins build servers.
Sending Webhooks Securely
Almost 8 million BGP route leaks and more than 7 million BGP hijacks in Q1 2021 alone
Top 8 Terminal Emulators for Linux [ in 2021 ]
Bleeping Computer
Bulletproof hosting admins plead guilty to running cybercrime safe haven new
Microsoft pauses development of Windows 10X, its Chrome OS competitor new
Foxit Reader bug lets attackers run malicious code via PDFs new
Russian state hackers switch targets after US joint advisories new
Microsoft Edge crashes when watching full screen YouTube videos new
Twitter Tip Jar may expose PayPal address, sparks privacy concerns new
Data leak marketplaces aim to take over the extortion economy new
Cuba Ransomware partners with Hancitor for spam-fueled attacks new
Google wants to enable multi-factor authentication by default
Microsoft introduces Windows 10's new default user interface font
Windows 10 Sun Valley update kicks Windows 95's icons to the curb
New TsuNAME DNS bug allows attackers to DDoS authoritative DNS servers
The Hacker News
4 Major Privacy and Security Updates From Google You Should Know About new
6 Unpatched Flaws Disclosed in Remote Mouse App for Android and iOS new
New TsuNAME Flaw Could Let Attackers Take Down Authoritative DNS Servers new
New Stealthy Rootkit Infiltrated Networks of High-Profile Organizations new
CISO Challenge: Check Your Cybersecurity Skills On This New Competition Site
Critical Flaws Hit Cisco SD-WAN vManage and HyperFlex Software
New Qualcomm Chip Bug Could Let Hackers Spy On Android Devices
New Spectre Flaws in Intel and AMD CPUs Affect Billions of Computers
New Study Warns of Security Threats Linked to Recycled Phone Numbers
BIOS PrivEsc Bugs Affect Hundreds of Millions of Dell PCs Worldwide
ALERT — New 21Nails Exim Bugs Expose Millions of Email Servers to Hacking
LuckyMouse Hackers Target Banks, Companies and Governments in 2020

Threat Wire

Exploits

Packet Storm Exploits
macOS Gatekeeper Check Bypass new
Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation new
WifiHotSpot 1.0.0.0 Unquoted Service Path new
Android Memory Disclosure / Out-Of-Bounds Write / Double-Free new
Voting System 1.0 Shell Upload new
Human Resource Information System 0.1 Remote Code Execution new
Sandboxie Plus 0.7.4 Unquoted Service Path new
Sandboxie 5.49.7 Denial Of Service new
b2evolution 7-2-2 SQL Injection
WordPress WP Super Edit 2.5.4 Arbitrary File Upload
Schlix CMS 2.2.6-6 Remote Code Execution
Schlix CMS 2.2.6-6 Cross Site Scripting
Exploit-DB Webapps
[webapps] Voting System 1.0 - Authentication Bypass (SQLI) new
[webapps] Voting System 1.0 - Remote Code Execution (Unauthenticated) new
[webapps] Human Resource Information System 0.1 - Remote Code Execution (Unauthenticated) new
[webapps] PHP Timeclock 1.04 - Time and Boolean Based Blind SQL Injection # Date: May 3rd 2021 new
[webapps] Schlix CMS 2.2.6-6 - Remote Code Execution (Authenticated)
[webapps] Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)
[webapps] Wordpress Plugin WP Super Edit 2.5.4 - Remote File Upload
[webapps] b2evolution 7-2-2 - 'cf_name' SQL Injection
[webapps] Savsoft Quiz 5 - 'User Account Settings' Persistent Cross-Site Scripting
[webapps] Markdown Explorer 0.1.1 - XSS to RCE
[webapps] Xmind 2020 - XSS to RCE
[webapps] Tagstoo 2.0.1 - Stored XSS to RCE
Exploit-DB Local and Privilege Escalation
[local] Sandboxie Plus 0.7.4 - 'SbieSvc' Unquoted Service Path new
[local] Epic Games Easy Anti-Cheat 4.0 - Local Privilege Escalation new
[local] WifiHotSpot 1.0.0.0 - 'WifiHotSpotService.exe' Unquoted Service Path new
[local] Epic Games Rocket League 1.95 - Stack Buffer Overrun new
[local] MariaDB 10.2 /MySQL - 'wsrep_provider' OS Command Execution
[local] Google Chrome V8 Engine 8.9.40 - Remote Code Execution
[local] Rockstar Service - Insecure File Permissions
[local] Ext2Fsd v0.68 - 'Ext2Srv' Unquoted Service Path
[local] Hi-Rez Studios 5.1.6.3 - 'HiPatchService' Unquoted Service Path
[local] ELAN Touchpad 15.2.13.1_X64_WHQL - 'ETDService' Unquoted Service Path
[local] ActivIdentity 8.2 - 'ac.sharedstore' Unquoted Service Path
[local] Elodea Event Collector 4.9.3 - 'ElodeaEventCollectorService' Unquoted Service Path
Exploit-DB DoS
[dos] Sandboxie 5.49.7 - Denial of Service (PoC) new
[dos] WordPress Plugin WPGraphQL 1.3.5 - Denial of Service
[dos] Hasura GraphQL 1.3.3 - Denial of Service
[dos] glFTPd 2.11a - Remote Denial of Service
[dos] DD-WRT 45723 - UPNP Buffer Overflow (PoC)
[dos] ProFTPD 1.3.7a - Remote Denial of Service
[dos] KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Device Reboot (Unauthenticated)
[dos] Nsasoft Hardware Software Inventory 1.6.4.0 - 'multiple' Denial of Service (PoC)
[dos] Product Key Explorer 4.2.7 - 'multiple' Denial of Service (PoC)
[dos] SpotAuditor 5.3.5 - 'multiple' Denial Of Service (PoC)
[dos] Managed Switch Port Mapping Tool 2.85.2 - Denial of Service (PoC)
[dos] AgataSoft PingMaster Pro 2.1 - Denial of Service (PoC)
Exploit-DB Shellcode
Exploit-DB Papers
Exploit-DB Remote
[remote] GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution (2)
[remote] Tenda D151 & D301 - Configuration Download (Unauthenticated)
[remote] vsftpd 2.3.4 - Backdoor Command Execution
[remote] Linux Kernel 5.4 - 'BleedingTooth' Bluetooth Zero-Click Remote Code Execution
[remote] Google Chrome 81.0.4044 V8 - Remote Code Execution
[remote] Google Chrome 86.0.4240 V8 - Remote Code Execution
[remote] vsftpd 3.0.3 - Remote Denial of Service
[remote] KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm
[remote] KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Hard coded Credentials Shell Access
[remote] Microsoft Exchange 2019 - SSRF to Arbitrary File Write (Proxylogon)
[remote] Golden FTP Server 4.70 - 'PASS' Buffer Overflow (2)
[remote] CatDV 9.2 - RMI Authentication Bypass

LiveOverflow

cURL error 28: Operation timed out after 10001 milliseconds with 0 out of 0 bytes received

Vulnerabilities

Tools

Exploit Dev

Reddit - Exploit Dev
No valid address for Pop-Pop-Ret sequence
Hiring Exploit Engineers/Developers
How I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit
Intro to Blackbox Fuzzing: Binary-only fuzzing (pdfinfo) using AFLplusplus
Heappy: an heap editor to support heap exploitation process 🙂
Phoenix Stack-Two
Resources similar to opensecuritytraining
Searching for ARM ROP Gadgets as easy as 1-2-3
Discord servers and Telegram channels
A foray into Linux kernel exploitation on Android
Fuzzing Rust crate library (ical-rs) using honggfuzz-rs (Youtube/Tutorial)
can you like the video you dont need to watch it i wanna try something with the algorithm
Source Incite
Smarty Template Engine Multiple Sandbox Escape PHP Code Injection Vulnerabilities
Google Project Zero
Designing sockfuzzer, a network syscall fuzzer for XNU
Policy and Disclosure: 2021 Edition
Who Contains the Containers?
In-the-Wild Series: October 2020 0-day discovery
Security Researchers
More doorbell adventures
SonarQube 8.9 LTS: 3 steps to a smooth upgrade
Anatomy of how you get pwned
PHP Supply Chain Attack on Composer
Detectify Security Updates for 27 April
WordPress 5.7 XXE Vulnerability
Azure Application Proxy C2
Canada’s Proposed Privacy Law Reforms Are Not Enough: A Path to Improving Organizational Transparency and Accountability
An accidental bootsplash
A hacker’s approach to finding security bugs in open source software
Ethics: University of Minnesota's hostile patches
Tenet: A Trace Explorer for Reverse Engineers

Reversing/I like ASM

Reddit - Reverse Engineering
Mobile Security: Reverse Engineer Android Apps From Scratch - Free Course From Udemy new
Wireshark Tutorial: Decrypting HTTPS Traffic (Includes SSL and TLS)
VB6 P-Code Disassembly - Avast Threat Labs
A vulnerability in VoIPmonitor allows an unauthenticated attacker to execute arbitrary code: CVE-2021-30461
Making the basic buffer overflow demo more approachable
Reverse Engineering: Ghidra For Beginners - Free Course From Udemy
Reverse Engineers' Hex Editor 0.3.91 released
CVE-2021-26900: Privilege Escalation Via a Use After Free Vulnerability In win32k - includes root cause analysis and PoC
Video Walkthrough for "IRCWare" Reversing Challenge (HackTheBoxEU)
FOX – Fix Objective-C XREFs in Ghidra
How To Visit 516 Arouca: The World’s Longest Pedestrian Suspension Bridge
Inviting Myself to the 'Diablo II: Resurrected' Closed Alpha
Reddit - Game Hacks
EFT HACKS | EFT NINJA | ESP | AIMBOT | NO SPREAD | NO RECOIL new
Someone saw working aimbot for overwatch?
*FULL IN DEPTH TUTORIAL ON HOW TO DO EVENT FILES FOR NBA 2K21 CURRENT GEN*
Dead By Daylight Account Modding
MIAMI HEAT MASCOT FOR NBA 2K21 CURRENT GEN
THE BEST RUST HACKS/SCRIPTS FOR AN AFFORDABLE PRICE (ESP+, Scripts, Aimbot, etc)
Selling Escape From Tarkov, Warzone, Fortnite, R6, PUBG, Rust, Spoofers, all available here!!! Join up to crush the competition!
EU FILE ASIA/EUROPE FILES FOR NBA 2K21 SAVEWIZARD
game hack
dragon city hack
Cheap sale prices on wz and cw hacks, and giveaways in xp lobbies
Csgo
Reddit - REGames
How to improve IDA Analyzing speed?
Another kept egg out of the dungeon
Godzilla Vs. Kong Vs … Ghidra? - Ghidra Scripting, PCode Emulation, and Password Cracking
Blackbox reverse engineering?
reverse engineering dnspy and export
Creating a dll-loader and dll in one project.
Game Hacking Fundamentals - The Game Hacking Book
Where to start ?
Reverse Engineering help, please!
DHDEV
s3k_hijack from BigEvilCorporation — demonstration of hijacking the Sonic & Knuckles Mega Drive lock-on cart to run user code
Drug Lord 2.2
StackExchange - ReverseEngineering
Decrypting cocos2d based game files new
How can I reverse this python code (obfuscated by b64, gzip and many more) new
Help me please decode the string (looks like gzip but it is not) new
Address representing 20 bytes but adding some x00, the address represnt only 4 bytes new
IDA Pro, How to forcefully disassemble "mips 32" instead of "mips 16"? new
Assembly to C decompiler
I need help to decode this encrypted javascript
WinDBG does not break on memory access
How to decompile python ELF file (Compiled with Nuitka)?
Function name from Ordinal number in Radare2
Can't add tracing in IDA, showing it in gray
How to load modules symbols to IDA while debugging a process

Guided Hacking

Malware/APT

Reddit - Malware
myLog(0x00): Step into the Cyber World! new
Malware Careers
Windows Defender's VDM Format
RM3 – history, detailed technical analysis and observations of a banking malware targeting Oceania, the UK, Germany and Italy.
Regshot meaning
Ransomware Survey - I want to hear from you!
Wrui Ransomware not being able to decrypt files
Quite Scared
Trojan:Win32/Tiggre!plock
Getting loads of fake google results in search results
Security firm Kaspersky believes it found new CIA malware
Android Malware Flubot using UPS themed Emails for Phishing
Unit42
File Transfer Threats: Risk Factors and How Network Traffic Visibility Can Help
Detecting and Preventing Malicious Domains Proactively with DNS Security
New Shameless Commodity Cryptocurrency Stealer (WeSteal) and Commodity RAT (WeControl)
Unsecured Kubernetes Instances Could Be Vulnerable to Exploitation
Threat Brief: Codecov Bash Uploader
Are Your Nagios XI Servers Turning Into Cryptocurrency Miners for Attackers?
Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials
New Vulnerability Affecting Container Engines CRI-O and Podman (CVE-2021-20291)
Threat Assessment: Clop Ransomware
Network Attack Trends: Internet of Threats (November 2020-January 2021)
Emotet Command and Control Case Study
Attackers Conducting Cryptojacking Operation Against U.S. Education Organizations
FireEye Threat Research
The UNC2529 Triple Double: A Trifecta Phishing Campaign
UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat
Ghostwriter Update: Cyber Espionage Group UNC1151 Likely Conducts Ghostwriter Influence Activity
Ghostwriter Update: Cyber Espionage Group UNC1151 Likely Conducts Ghostwriter Influence Activity
Abusing Replication: Stealing AD FS Secrets Over the Network
Zero-Day Exploits in SonicWall Email Security Lead to Enterprise Compromise
Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day
Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day
Hacking Operational Technology for Defense: Lessons Learned From OT Red Teaming Smart Meter Control Infrastructure
Hacking Operational Technology for Defense: Lessons Learned From OT Red Teaming Smart Meter Control Infrastructure
M-Trends 2021: A View From the Front Lines
Back in a Bit: Attacker Use of the Windows Background Intelligent Transfer Service

Bug Bounties

HackerOne
What To Do When You Don’t Know You’ve Been Compromised new
The 5 Secrets Of A Mature Vulnerability Management Program
Saxo Bank Celebrates One Year of Bug Bounties: Q&A with CISO Mads Syska Hasling
Hacker Spotlight AMA: Wolf101
How HackerOne Helps the Vulnerability Management Process
A Security Engineer and Hacker Share Their Experiences with Security Assessments
Hacker Spotlight AMA: debsec
HackerOne Product Enhancements Help Detect, Remediate, and Analyze Cloud Misconfigurations
Why we sold our founding vulnerability as an NFT
Hacker Spotlight AMA: none_of_the_above
Reddit’s Public Bug Bounty Program Kicks Off: Q&A with Reddit’s Allison Miller and Spencer Koch, and top program hacker @renekroka
Hacker Spotlight AMA: niemand_sec
Reddit - BugBounty
How to start ? new
What are interesting subdomains you would look at when doing recon? new
Twitter http callback in my burp collab new
Do you guys spend a lot of time reading? new
Can you use aquatone on a VPS? new
Workplace by Facebook | Unauthorized access to companies environment — $27,5k new
Account takeover in cups.mail.ru ($1,500 bounty) new
SSRF to local google cloud metadata access by Noob3xploiter new
Facebook Server-side request forgery (Bounty 10000) new
Need help reporting a vulnerability.
Earn up to $10K from the Opera Bug Bounty program - Blog | Opera Security
US Department of Defense expands vulnerability disclosure program
Pentester Land
Portswigger
<span>Experience Burp Suite Enterprise Edition in a new live demo</span> new

Crypto

Reddit - Crypto
Help on determining what this is. new
Everyone on android, install this app and use my Code "MadsakH", then u get a bonus! new
PantherSwap new
#RBC #ROBOTCOIN #PANCAKESWAP NOW LIVE new
Please help . Scam ? new
AES Asynchronous Encryption new
Tixl building bridges new
Setup a Crypto Digibyte Full Node on Linux
Draft "Functional Definition of End-to-End Secure Messaging" - to be E2EE it must quack like E2EE
Not sure if this is allowed, but I’m working on a store, which accepts crypto. All my proceeds will go towards crypto.
EOS - Near Breakout
$KISHU - KISHUSAWP- OTHERS SAY BUT KISHU FINISHES. IT HAS ITS OWN KINGDOM NOW.
StackExchange - Crypto
Does the security of RSA come from just the carries in multiplication? new
Why don't in any cryptographic libraries check the Lehman's method? new
RSA Modulus with D, E, PHI and inv(p,q) new
How to factorize the group order in Pohlig-Hellman algorithm new
How to write proofs for universal composable security？ new
Transparent Voting and Advance Secret Code new
XMSS vs MSS (Motivation) new
Security of Full Domain Hash (or not quite full) new
How android/linux decide to choose system certificate, which one to use? new
Construting a method to share the secret new
mbedtls: Get public key as hex string new
Is the dealer a volunteer in Shamir secret sharing scheme?

Podcasts

Security Weekly
Vulcan Mind Meld - PSW #692
Curmudgeon Pills - PSW #691
The Hunt for Red October - PSW #690
Short Term Memory Issues - PSW #689
You Want More Budweiser? - PSW #688
Don't Waste Bourbon - PSW #687
We're A Lot Happier - PSW #686
As Long As You're Happy - PSW #685
Coming To A Theatre Near You - PSW #684
Party Time! - PSW #683
Annual Checkup - PSW #682
Risky.Biz
Risky Business #622 -- GitHub weighs exploit ban
Risky Business #621 -- Ultra professional criminal attackers ascendant
Snake Oilers: Greynoise! MergeBase! Votiro!
Risky Business #620 -- Project Zero burns Western counterterrorism operation
Risky Business #619 -- REvil crew demands $50m from Acer
Risky Biz Soap Box: 12 years since Operation Aurora. Have we learned anything?
Risky Business #618 -- MS security licensing faces congressional scrutiny
Risky Biz Feature Podcast: Chasing crooks through the blockchain
Risky Business #617 -- Exchangapalooza '21
Risky Business #616 -- Exchange 0day party time for Chinese APT crew
Risky Biz Soap Box: ExtraHop CTO and co-founder Jesse Rothstein
Risky Business #615 -- Dependency confusion is, uh, pretty bad
The CyberWire
CISA on FiveHands. Connections among cybergangs, Russian intelligence services? Software supply chain security. Scripps Health incident update. Home routers. Ryuk hits research institute. new
Some possible insight into what a Chinese cyberespionage unit is up to. Hackathons, from Beijing to Washington. Panda Stealer is after crypto wallets. And Peloton…
DDoS interrupts Belgium’s parliament. New malware in the wild. Spies and crooks work around MFA, OAuth. COVID-19 scam site takedown. Online election fraud (in a…
VPN vulnerability exploited for cyberespionage closed. “IT security incident” at medical system. Android banking Trojans and cryptocurrency. Cyber threats to the Tokyo Olympics.
Data exposure reported in the Philippines. FISA targets down during the pandemic. Babuk changes its focus. New variant of the Buer loader in the wild.…
Jim Zufoletti: Building your experience portfolio. [Entrepreneur] [Career Notes]
A snapshot of the ransomware threat landscape. [Research Saturday}
Investigating VPN exploits, and the crooks and spies who use them. BadAlloc afflicts OT. Notes on cyberespionage. The criminal market for deepfakes.
Buggy APIs may expose credit scores. Dealing with ransomware. Iran-Israeli tensions are up. Russia says it will always see the Americans coming. Surge cyber capacity.…
More intelligence on Ghostwriter, and a convergence of hacking and influence operations. Naikon APT has a new backdoor. FluBot returns. MAPP reconsidered. Defense counsel on…
The FBI and CISA take a look at the SVR, and offer advice for potential targets. Openness and information warfare. OPSEC and privacy. Babuk hits…
Prankers on Zoom, with convincing video. Emotet takedown. US response to SolarWinds reviewed. Cancer therapy disrupted by attack on cloud provider. Oscar phishing.
Cyber Security Interviews
#117 – Sara Avery: Go After What You Want
#116 – Jennifer Brown: This Is A Wakeup Call
#115 – Alyssa Miller: We Are Lacking Empathy
#114 – Chloé Messdaghi: How Can We Do Better
#113 – Julian Waits: Diversity of Thought
ISC Daily Stormcast
ISC StormCast for Friday, May 7th, 2021 new
ISC StormCast for Thursday, May 6th, 2021
ISC StormCast for Wednesday, May 5th, 2021
ISC StormCast for Tuesday, May 4th, 2021
ISC StormCast for Monday, May 3rd, 2021
ISC StormCast for Friday, April 30th, 2021
ISC StormCast for Thursday, April 29th, 2021
ISC StormCast for Wednesday, April 28th, 2021
ISC StormCast for Tuesday, April 27th, 2021
ISC StormCast for Monday, April 26th, 2021
Darknet Diaries
91: webjedi
90: Jenny
89: Cybereason - Molerats in the Cloud
88: Victor
87: Guild of the Grumpy Old Hackers
86: The LinkedIn Incident
85: Cam the Carder

Threat Intel

Reddit - Onions
Fantastic book new
First post new
How to host a onion service new
Welcome to the game new
How to damage control? new
Scammer Used Fake Court Order to Take Over dark.fail
New to dark web and onion links,new some help
Is SecMail down?
legit?
Hey I'm new here can I get some help please?
Looking for dread forums, having trouble navigating my way there
Was I phished?
Reddit - Pwned
Geico data breach exposed customers' driver's license numbers
Mobikwik (India) KYC data leaked
$5.7 Million Crypto Stolen Due To A Security Breach at Cryptocurrency platform Roll
Worldwide Hack: Microsoft Exchange Server Zero-day Exploits
American Armed Forces Mutual Aid Association hack impacted more than 161,000
CD Projekt Red 'EPICALLY pwned': Cyberpunk 2077 dev publishes ransom note after company systems encrypted
Florida city of Oldsmar's municipal water supply was almost poisoned during cyberattack, Sheriff says. A plant operator witnessed mouse movement on-screen and reverted the change
ENEL, Italian multinational manufacturer and distributor of electricity and gas with international customers, affected by data disclosure - 300,000 customers personal data leaked
Brazilian electric utility company COPEL hit by cyberattack; >1TB private data exfiltrated
Major Brazilian electric utility company Eletrobras hit by ransomware
HaveIBeenPwned
ParkMobile - 20,949,825 breached accounts
Descomplica - 4,845,378 breached accounts
Jefit - 9,052,457 breached accounts
bigbasket - 24,500,011 breached accounts
MangaDex - 2,987,329 breached accounts
ShopBack - 20,529,819 breached accounts
ClearVoice Surveys - 15,074,786 breached accounts
Phone House España - 5,223,350 breached accounts
Facebook - 509,458,528 breached accounts
Unverified Data Source (unverified) - 11,498,146 breached accounts
Liker - 465,141 breached accounts
Travel Oklahoma - 637,279 breached accounts

Privacy/VPNs

Slashdot - Rights
US and UK Release Details on Russia's SolarWinds Hackers new
Months-long Twitter Backlash Had Zero Impact on WhatsApp's User Base new
Opposing PRO Act, Uber and Other Gig Companies Spend Over $1 Million Lobbying
Google Play's App Listings Will Require Privacy Info Next Year, Just Like the App Store
American Schools' Phone Apps Send Children's Info To Ad Networks, Analytics Firms
College Student Sues Proctorio After Source Code Copyright Claim
Biden Blocks Trump's Gig-worker Rule
White House Launches New AI Website
Snapchat Can Be Sued Over Role In Fatal Car Crash, Court Rules
Biden Team May Partner With Private Firms To Monitor Extremist Chatter Online
#FreeFortnite Hecklers Add a Shout-Out To Epic-Apple Trial
What3Words Sends Legal Threat To a Security Researcher For Sharing an Open-Source Alternative
Reddit - Privacy
Two-Step Required Authentication for iPhone? new
Searching for privacy respecting mobile game new
How does file shredding work on SSD / Mobile new
I’ve been sent a Facebook login code. new
Does Google get data from sites that use their captcha service? new
How to offload all my gmail to a thumb drive to protect it? new
Best DNS provider? new
How private Apple really is? new
How safe is imgur? I get views even though my imgur photo posts are set to hidden new
How do I pollute my contacts for whatsapp? new
Is there any way to wipe data from an SSD without getting rid of the Windows installation? new
Playing Valorant Safely new
Reddit - VPN
Can a VPN allow access to blacked-out sports events on youtubetv. new
Tiger VPN dead? new
vpn question new
When I use USB Tethering via smartphone on my PC, will the VPN work? new
help. new
Wanting to get cheap Amazon prime using vpn new
Is DDoSing Illegal? new
If I use Google apps without signing in or with fake data and with a virtual private network, do they become private because they do… new
Split tunneling - some questions new
Can authoritarian states Ban All VPNs? is that even possible?
low bitrate on any protocols other than OpenVPN
Using VPN router to hide location on work laptop that tracks location and uses it’s own VPN
PrivacyTools.io
Is there a tool that would delete video exif data just like there is one for photos? new
Blueprint For Using Social Media Privately new
Google Analytics opt out browser addon? new
Should I change my Add-ons? new
PSA Email scam new
WhatsApp scraps May 15 deadline for its controversial privacy policy new
whatsapp alternative, or sandbox? new
WhatsApp said today that it won’t delete or deactivate your account if you don’t accept its privacy policy that’s rolling out on May 15. new
Is it possible for websites to extract the saved passwords in my internet browser? new
I made a Wikipedia proxy site, Wikiless.org new
SkyTransfer Update: File Deletion, Portal Changing, Filename Cloaking (Decentralized, E2E Encrypted, Open Source File Sharing) new
Anonymous smart watch for calorie tracking? new
EFF
Outliving Outrage on the Public Interest Internet: the CDDB Story
The Enclosure of the Public Interest Internet
Introducing the Public Interest Internet
Surveillance Self-Defense Playlist: Getting to Know Your Phone
Foreign Intelligence Surveillance Court Rubber Stamps Mass Surveillance Under Section 702 - Again
The Florida Deplatforming Law is Unconstitutional. Always has Been.
Facebook Oversight Board Affirms Trump Suspension -- For Now
Proposed New Internet Law in Mauritius Raises Serious Human Rights Concerns
Tell Congress: Support the Fourth Amendment Is Not For Sale Act
Brazil's Bill Repealing National Security Law Has its Own Threats to Free Expression
EFF at 30: Protecting Free Speech, with Senator Ron Wyden
Apple’s AppTrackingTransparency is Upending Mobile Phone Tracking

Help Wanted

Reddit - AskNetSec
Reddit - Netsec Students
What exactly is Cybersecurity? new
About sums it up new
Burp Suite embedded browser doesn't start new
Looking at building a vpn, has anyone done this via a VPS? (azure/DO) new
Enabling Oracle SSL/TLS Authentication new
How do I get a career in fraud investigations? new
Immersive labs XSS reflected attack
TJNull posted a new guide for the PWK/OSCP!
What questions can I expect in a phone screening call?
networking router/switch or network security
Odd Syslog Entry
What is Insecure Deserialization? | Security Engineering Interview Questions
Stackoverflow - Security
Can a Man-in-the-Middle-Attack be achieved by adding a cloudfront domain to a domain not owned by me? new
Open Source Security Testing for windows application [closed] new
Need of Encryption/Decryption of REST API request/response? new
I'm having a problem fixing react-scripts vulnerabilities new
Prohibit VBS CPL SCR extensions through Windows security policies with PowerShell or Batch new
Is not using --no-cache safe when building Docker image using BuildKit to pass secret new
Oracle OLS LBACSYS Errors new
Is rel="noreferrer" needed when the target is a custom framename? new
Run Tool with a Python Script [closed] new
For CVE-2021-22885, is it only dangerous for array content? new
R plumber - how to caution against code injection new
Few questions about handshake in TLS1.3 new
Stack Exchange
Router firewall ICMP risks and threats? new
Enable or Disable CORS for Domains and API new
Unclear security impact of a Reflected XSS vulnerability new
How does Anti-CSRF token get delivered? new
Escaping out of a select query to run a statement that modifies data in the database new
Can a cloned page have HTTPS certificates? new
Link test differs from link location in plaintext view is not visible in Thunderbird new
AWS credentials seem terribly insecure. Why? new
Android System Update Spyware Can Steal Your Photos, Money, Record Calls and Track You Too. What to do if this happens? [closed] new
How to choose specific file names in php code? [migrated] new
can disconnect all phone contact to computer via cmos script? [closed] new
Transparent Voting and Advance Secret Code [migrated] new

Locks/Social Engineering

Reddit - Lockpicking
Anchor Las 810-1 picked with custom tool - my first pick with a self-made tool! new
How is your friday going? new
According to map of reddit, r/lockpicking has overlap with survival subreddits new
How do I approach this type of lock (I can't find the name) new
VIDEO: Picking Brummies world traveling Corbin padlock. Tension cranked to 11 💪🏻😆 new
Decided to make my own picks here is MK 1 new
Just sanded my pick and was able to open a lock I've been struggling on for months new
Not lock mail, but almost as good new
Master lock 2250 picked new
Vintage all brass Union Lever padlock picked for Dmac 100 Subscriber Giveaway #dmac100 new
Finally..I'm able to Spp my mindy smiley padlock.. new
what's wrong with this picture? new
Reddit - Social Engineering
Frederick the Great, potatoes and the art of rebranding
Great Examples of how scammers use social engineering in Documentary called Generation Hustle.
Spotify premium upgrades 1 year
The Gentleperson's Guide To Forum Spies (spooks, feds, etc.) -- GCHQ Documents
Research to Prove how easy it is to Research a Person to Craft Social Engineering Content
Why Are False Beliefs So Persistent? How social reinforcement shapes our perceptions.
Is this douchebag behavior ?
The Most INHUMANE Mental Health Treatments in History
New Jersey to give free beer to Covid vaccine recipients
Enemies into friends
Trying to get a specific stranger to accept a gift card or confirm ID?
Normalising the abnormal: From ‘We’re not planning Covid passports’ to ‘They may be needed long term’ in 3 easy months

Hak5

Security Blogs

Security Bloggers Network
People of JumpCloud | Emma Neuberger new
What is File Sanitization? Everything to Know new
Very Many Qualcomm Phone Chips Hiding Very Nasty Vulnerability new
Professional Certifications, Reboot! new
Pingback: ICMP Tunneling Malware new
Best Practices During World Password Day new
LogicGate Significantly Expands Integrations Suite and Services new
Revealing the ‘Snip3’ Crypter, a Highly Evasive RAT Loader new
Best Practices for Communicating SecOps to the Board new
Teaching Cybersecurity to Children new
Going Beyond Cloud Security Posture Management: How to Mitigate Risk Across Multiple Cloud Instances new
Protecting Collaboration Channels for Remote Work new
ThreatPost
iPhone Hack Allegedly Used to Spy on China’s Uyghurs new
80% of Net Neutrality Comments to FCC Were Fudged new
Qualcomm Chip Bug Opens Android Fans to Eavesdropping
Critical Cisco SD-WAN, HyperFlex Bugs Threaten Corporate Networks
Ryuk Ransomware Attack Sprung by Frugal Student
Massive DDoS Attack Disrupts Belgium Parliament
New Crypto-Stealer ‘Panda’ Spread via Discord
Anti-Spam WordPress Plugin Could Expose Website User Data
Raft of Exim Security Holes Allow Linux Mail Server Takeovers
Peloton’s Leaky API Spilled Riders’ Private Data
Feds Shut Down Fake COVID-19 Vaccine Phishing Website
Global Phishing Attacks Spawn Three New Malware Strains
digitalmunition
WifiHotSpot 1.0.0.0 Unquoted Service Path ≈ Packet Storm new
Solutions Review Finds: The Highest-Rated Cybersecurity Books new
Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation ≈ Packet Storm new
macOS Gatekeeper Check Bypass ≈ Packet Storm new
Goodwin Appoints Industry Veteran To Its Newly Created Chief Information Security Officer Role new
A former federal cybersecurity chief is now helping from an academic standpoint new
New Moriya rootkit stealthily backdoors Windows systems new
CISO Stories: Part Two – Infosecurity Magazine new
Data Protection And The Role Of Vendor Management | Jackson Lewis P.C. new
Red Hat Security Advisory 2021-1518-01 ≈ Packet Storm new
Bragg Gaming Signs Deal with Logrand Entertainment Group in Mexico new
Backdoor.Win32.Floder.gqe Insecure Permissions ≈ Packet Storm new
eHacking News
New South Wales Labor Party Hit By Avaddon Threat Attackers Demand Ransom new
Smishing Campaign: Roaming Mantis Attacks OS Android Systems With Malware new
Qakbot Malware is Targeting the Users Via Malicious Email Campaign new
40% of all Android Phones Affected by Qualcomm Snapdragon Vulnerability new
More Than 180 OAuth 2.0 Cloud Malware Apps Discovered new
BazarBackdoor Campaigns in Attempts to Avoid Detection new
Twilio Impacted By The Recent Codecov Supply-Chain Attack
More Than 200 Belgian Organizations Knocked Offline in a Massive DDoS Attack
Positive Technologies reported on the impact of U.S. sanctions on its IPO plans
Northeastern University Team Finds New Ways to Detect Bugs in its Research
New Vulnerabilities in Cellebrite's Tools Discovered by a Researcher
Panda Stealer Spreads Via Discord to Steal User Crypto-Currency
Wired - Security
How a Former Netflix Exec Built a Brazen Bribery Scheme
They Told Their Therapists Everything. Hackers Leaked It All
Don’t Buy Into Facebook’s Ad-Tracking Pressure on iOS 14.5
A Ransomware Group Hit DC Police—Then Pivoted to Extortion
Google's Grand Plan to Eradicate Cookies Is Crumbling
An Ambitious Plan to Tackle Ransomware Faces Long Odds
Feds Arrest an Alleged $336M Bitcoin-Laundering Kingpin
AirDrop Is Leaking Email Addresses and Phone Numbers
Hackers Used ‘Mind-Blowing’ Bug to Dodge macOS Safeguards
The New iOS Update Lets You Stop Ads From Tracking You
VPN Hacks Are a Slow-Motion Disaster
Signal's Founder Hacked a Notorious Phone-Cracking Device
Krebs on Security
Investment Scammer John Davies Reinvents Himself? new
Malicious Office 365 Apps Are the Ultimate Insiders
The Wages of Password Re-use: Your Money or Your Life
Task Force Seeks to Disrupt Ransomware Payments
Note to Self: Create Non-Exhaustive List of Competitors
Did Someone at the Commerce Dept. Find a SolarWinds Backdoor in Aug. 2020?
Microsoft Patch Tuesday, April 2021 Edition
ParkMobile Breach Exposes License Plate Data, Mobile Numbers of 21M Users
Are You One of the 533M People Who Got Facebooked?
Ransom Gangs Emailing Victim Customers for Leverage
Ubiquiti All But Confirms Breach Response Iniquity
New KrebsOnSecurity Mobile-Friendly Site
Naked Security
S3 Ep31: Apple zero-days, Flubot scammers and PHP supply chain bug [Podcast]
Firefox for Android gets critical update to block cookie-stealing hole
Dell fixes exploitable holes in its own firmware update driver – patch now!
Apple products hit by fourfecta of zero-day exploits – patch now!
Naked Security Live – Beware ‘Flubot’: the home delivery scam with a difference
PHP community sidesteps its third supply chain attack in three years
S3 Ep30: AirDrop worries, Linux pests and ransomware truths [Podcast]
Gamers update! Nvidia patches GPU driver kernel escalation bugs
Ransomware: don’t expect a full recovery, however much you pay
Naked Security Live – Just how (un)safe is AirDrop?
Apple AirDrop has “significant privacy leak”, say German researchers
Linux team in public bust-up over fake “patches” to introduce bugs
Schneier on Security
The Story of Colossus
New Spectre-Like Attacks
Tesla Remotely Hacked from a Drone
Identifying the Person Behind Bitcoin Fog
Friday Squid Blogging: On Squid Coloration
Serious MacOS Vulnerability Patched
Identifying People Through Lack of Cell Phone Use
Second Click Here to Kill Everybody Sale
Security Vulnerabilities in Cellebrite
When AIs Start Hacking
Friday Squid Blogging: Squid-Shaped Bike Rack
On North Korea’s Cyberattack Capabilities
Linux Security
Raft of Exim Security Holes Allow Linux Mail Server Takeovers>
Linux's Technical Advisory Board reports on the UMN 'Hypocrite Commits' patches>
21Nails: Multiple Critical Vulnerabilities Discovered in Exim Mail Server - Patch Now!>
The 10 Best Linux Server Distributions>
Linux Mint 18.x reaches end of life, upgrade now>
Linux kernel bug opens door to all manner of attacks>
Microsoft buys Linux distribution maker Kinvolk to boost Azure cloud services>
Red Hat Enterprise Linux 8.4 to focus on driving edge adoption>
Researchers Uncover Stealthy Linux Malware That Went Undetected for 3 Years>
Linux kernel vulnerability exposes stack memory, causes data leaks>
KDE Gear 21.04 Software Suite Officially Released with Many Improved KDE Apps>
Shells makes using Linux in the cloud incredibly easy>
Dark Reading
How North Korean APT Kimsuky Is Evolving Its Tactics new
Most Organizations Feel More Vulnerable to Breaches Amid Pandemic new
FBI, NSA, CISA & NCSC Issue Joint Advisory on Russian SVR Activity new
The Edge Pro Quote: Password Empowerment new
Defending Against Web Scraping Attacks new
11 Reasons Why You Sorta Love Passwords new
Troy Hunt: Organizations Make Security Choices Tough for Users new
New Techniques Emerge for Abusing Windows Services to Gain System Control
Google Plans to Automatically Enable Two-Factor Authentication
CISA Publishes Analysis on New 'FiveHands' Ransomware
Securing the Internet of Things in the Age of Quantum Computing
Cloud-Native Businesses Struggle with Security
Securelist
Operation TunnelSnake
Spam and phishing in Q1 2021
Whitehat Security Blog
HITB News
FDA reportedly plans to authorize Pfizer’s COVID vaccine for teens 12-15 in days
Microsoft launches open source tool Counterfeit to prevent AI hacking
4,700 Amazon employees had unauthorized access to private seller data
Then a Hacker Began Posting Patients’ Deepest Secrets Online
Dell just patched a driver security flaw dating from 2009
Three new malware families found in global finance phishing campaign
New Spectre attack once again sends Intel and AMD scrambling for a fix
Raspberry Pi Zero W-Powered Password Thief Helps With Penetration Testing
Apple says iOS 14.5.1 and macOS 11.3.1 patch WebKit flaws that may have been actively exploited
Yet another Google AI leader has defected to Apple
An ambitious plan to tackle ransomware faces long odds
Why Not Turn Airports Into Giant Solar Farms?
The RISKS Digest
BadAlloc: Microsoft looked at memory allocation code in tons of devices and found this one common security flaw
Re: Outlook/Exchange accounts under attack
Re: The Plane Paradox
Re: SolarWinds, Microsoft Hacks Prompt Focus on Zero-Trust Security
100 prohibited porcupine quills seized at Dulles Airport
How to give Feedback about the Feedback Form?
Pro-Trump web forums are abuzz with directions to forge Covid vaccine cards
Dark web child abuse image site with 400,000 members taken down in global police sting
Known software issue grounds Ingenuity Mars copter as it attempted fourth flight
Stealthy Linux backdoor malware spotted after three years of minding your business
Legal chatbot firm DoNotPay adds anti-facial recognition filters to its suite of handy tools
Paying ransomware doesn't pay
Kaspersky Blog
How to configure notifications in Android | Kaspersky official blog new
Phishing attack on Office 365 users through Google Docs
Transatlantic Cable podcast, episode 200 | Kaspersky official blog
QR code fraud | Kaspersky official blog
Cybersecurity in season 2 of The Mandalorian
iOS prompts: "Allow App to track your activity across other companies' apps and websites?" | Kaspersky official blog
What is doxing? | Kaspersky official blog
Transatlantic Cable podcast, episode 199 | Kaspersky official blog
Ransomware attacks on healthcare | Kaspersky official blog
How has Covid-19 impacted cybersecurity for SMB?
How to get rid of extraneous noise using apps | Kaspersky official blog
What smishing is and how to protect yourself from it | Kaspersky official blog
Adam Shostack & friends
Apple Guidance on Intimate Partner Surveillance
Threat Model Thursday: Technology Consumers
“Stop Vaccine Finger Wagging”
This time for sure, Pinky!
IoT Security & Threat Modeling
Thursday Threat Model: Github’s Approach
The Updates Must Go Through
Dear Microsoft: Please fix MAU
Can Training Work Remotely?
Behind the Scenes: Training Development
Passover Pie
Threat Modeling Classes
Graham Cluley
Insurer AXA says it will no longer cover ransomware payments in France new
Chinese smart TVs caught hoovering up data about devices on customers’ networks new
NSA offers advice: connecting OT to the rest of the net can lead to “indefensible levels of risk”
Recorded Future’s free Cyber Daily brings the latest trending threat insights to your inbox
Smashing Security podcast #226: Cryptocrazies and NFTs
Signal says its Instagram ads were banned for being too honest
Peloton exercise bikes found exposing user data – company dawdles in its response
Boystown, dark web child abuse image website with 400,000 members, shut down by police
DigitalOcean admits data breach exposed customers’ billing details
Smashing Security podcast #225: Master of your domain, gripe sites, and John Deere Farmergeddon
Etsy-owned musical instrument marketplace Reverb suffers data breach
Was the email account of Merseyrail’s MD hacked to spread word of ransomware attack?
Rapid7
MDR Vendor Must-Haves, Part 9: Assigned Analyst Pods and Security Program Advisors
Rapid7 Releases New Industry Cyber-Exposure Report (ICER): ASX 200
4 DevOps Challenges to Cloud Security and Compliance—and How IaC Can Help
Kubernetes Security Is Not Container Security
Securing Kubernetes Deployments From Runway to Takeoff
Grow, Develop, and Impact More Than Just Your Career: Software Engineering at Rapid7 Belfast
Rapid7's 2021 ICER Takeaways: Web Security Among the Fortune 500
DevSecOps and the New Scope of Application Development
[Security Nation] Marina Ciavatta and int eighty Put the Fun into Hacking With Hacking Esports and Dual Core Music
What's New in DivvyCloud by Rapid7: April 2021
Rapid7's 2021 ICER Takeaways: Email Security Among the Fortune 500
What’s New in InsightVM: Q1 2021 in Review
Hacker News (YCombinator) - Security
The future of work is not threatening your employees new
Apple Silicon Hardware Secrets: SPRR and Guarded Exception Levels (GXF) new
Facebook threatens to make iOS users pay. Please do it, Mr. Zuckerberg new
Android Devices Are at Risk of Data Theft (2020) new
Amazon Fake Reviews Scam Exposed in Data Breach new
Privacy Implications of Accelerometer Data [pdf]
I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit
A simpler and safer future – without passwords
A future without passwords
The Grim Secret of Nordic Happiness
Exploiting Aliasing for Manga Restoration
Why What3Words is not suitable for safety critical applications
Hacker Noon #Security
From Passwords to Passwordless Authentication
The Urban Myths of Secure Coding: Part 1
Crypto Crime Falls as Platforms Step Up Security Measures
Business Digitalization Introduces Additional Cyber Threats To Be Aware Of
Cybersecurity Measures to Secure Dropshipping Automation
How To Prevent Trending Ransomware Attacks
3 Tips To Prevent Mobile Banking Trojans
An Open-Source Tool For Security Scans Of Container Images — Vilicus
Gaming Industry Sees Rise in Cyberattacks During the Pandemic
What Does the Future Hold for Cloud Security?
Cybersecurity Vendor Proofpoint Goes Private in a 12.3 Billion Deal
Web Application Penetration Testing: A Complete Guide

Security in Mainstream Media