Security News

Morningstar Security News gathers all the most popular infosec and cyber security news headlines into a single page that auto-updates 24/7.

Most Popular

Exploits

Bug Bounties

Vulnerabilities

Tools

Exploit Dev

Reversing/I like ASM

Malware/APT

Crypto

Podcasts

Threat Intel

Privacy/VPNs

Help Wanted

Locks/Social Engineering

Security Blogs

Mainstream Media

Thirsty for more

Security Twitterverse

PacketStorm
Snake Keylogger Spreads Through Malicious PDFs new
Clearview AI Fined In UK For Illegally Storing Facial Images new
Researchers Find Backdoor Lurking In WP Plugin Used By Schools new
Global Food Supply Chain At Risk From Malicious Hackers
Strapi Exposed Data, Password Reset To Unprivileged Users
DOJ Announces It Won't Prosecute White Hat Security Researchers
Putin Promises To Bolster Russia's IT Security In Face Of Cyber Attacks
Homeland Security Pushes Pause On New Disinformation Board
This Russian Botnet Does Far More Than DDoS Attacks - And On A Massive Scale
Iran, China-Linked Gangs Join Putin's Disinformation War Online
Two Military Satellites Just Communicated Using Space Lasers
Hot Glare Of The Spotlight Doesn't Slow BlackByte Ransomware Gang
The Register
Screencastify fixes bug that would have let rogue websites spy on webcams new
How to find NPM dependencies vulnerable to account hijacking new
Microsoft sounds the alarm on – wait for it – a Linux botnet new
South Korean and US presidents gang up on North Korea's cyber-offensives new
Conti: Russian-backed rulers of Costa Rican hacktocracy?
China-linked Twisted Panda caught spying on Russian defense R&D
Microsoft patches the patch that broke Windows authentication
Microsoft Bing censors politically sensitive Chinese terms
Protecting data now as the quantum era approaches
Canada bans Huawei and ZTE from 5G networks, citing national security risks
India slightly softens infosec incident reporting and data retention rules
US won’t prosecute ‘good faith’ security researchers under CFAA
Reddit - NetSec
A few Tailscale tricks for security testers new
Hiding MSFVENOM Payloads in USB NIC EEPROM new
Beneath the surface: Uncovering the shift in web skimming new
mx-takeover focuses DNS MX records and detects misconfigured MX records. new
I wrote this more from an "analyze rootkit" perspective, but it's equally as valid for "driver bug hunting". Hope you enjoy. new
Exploit Development: No Code Execution? No Problem! Living The Age of VBS, HVCI, and Kernel CFG new
connmap - X11 desktop widget that shows location of your current network peers on a world map
$547 Worth of 18 Books on Python Coding by Starch Press for $18 (-97% oFF)
Matryoshka Trap: Recursive MMIO Flaws Lead to VM Escape
When eBPF meets TLS! A Security Focused Introduction to eBPF
Hacking Chinese IoT FoR $10000
A journey into IoT - Unknown Chinese alarm - Part 2 - Firmware dump and analysis
Bleeping Computer
The Hacker News
Yes, Containers Are Terrific, But Watch the Security Risks new
New Unpatched Bug Could Let Attackers Steal Money from PayPal Users new
Fronton: Russian IoT Botnet Designed to Run Social Media Disinformation Campaigns new
Chinese "Twisted Panda" Hackers Caught Spying on Russian Defense Institutes new
Researchers Find Backdoor in School Management Plugin for WordPress
Cisco Issues Patch for New IOS XR Zero-Day Vulnerability Exploited in the Wild
Researchers Uncover Rust Supply Chain Attack Targeting Cloud CI Pipelines
Cytrox's Predator Spyware Targeted Android Users with Zero-Day Exploits
Microsoft Warns Rise in XorDdos Malware Targeting Linux Devices
Hackers Exploiting VMware Horizon to Target South Korea with NukeSped Backdoor
Hackers Trick Users with Fake Windows 11 Downloads to Distribute Vidar Malware
QNAP Urges Users to Update NAS Devices to Prevent Deadbolt Ransomware Attacks

Threat Wire

Exploits

Packet Storm Exploits
iTop Remote Command Execution new
m1k1o's Blog 1.3 Remote Code Execution new
Blockchain FiatExchanger 2.2.1 SQL Injection new
Blockchain AltExchanger 1.2.1 SQL Injection new
OpenCart Newsletter 3.0.2.0 SQL Injection new
Linux USB Use-After-Free
SAP Application Server ABAP / ABAP Platform Code Injection / SQL Injection / Missing Authorization
LiquidFiles 3.4.15 Cross Site Scripting
PHPIPAM 1.4.4 Cross Site Request Forgery / Cross Site Scripting
Emby Media Server 4.7.0.60 Cross Site Scripting
Trojan-Ransom.Thanos MVID-2022-0607 Code Execution
SDT-CW3B1 1.1.0 Command Injection
Exploit-DB Webapps
[webapps] OpenCart v3.x Newsletter Module - Blind SQLi
[webapps] m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated)
[webapps] Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
[webapps] T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)
[webapps] T-Soft E-Commerce 4 - SQLi (Authenticated)
[webapps] Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
[webapps] Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
[webapps] College Management System 1.0 - 'course_code' SQL Injection (Authenticated)
[webapps] TLR-2005KSH - Arbitrary File Delete
[webapps] ImpressCMS v1.4.4 - Unrestricted File Upload
[webapps] Microfinance Management System 1.0 - 'customer_number' SQLi
[webapps] WebTareas 2.4 - Blind SQLi (Authenticated)
Exploit-DB Local and Privilege Escalation
[local] UDisk Monitor Z5 Phone - 'MonServiceUDisk.exe' Unquoted Service Path
[local] TCQ - ITeCProteccioAppServer.exe - Unquoted Service Path
[local] Wondershare Dr.Fone 11.4.10 - Insecure File Permissions
[local] ExifTool 12.23 - Arbitrary Code Execution
[local] Wondershare Dr.Fone 12.0.7 - Privilege Escalation (ElevationService)
[local] Wondershare Dr.Fone 12.0.7 - Privilege Escalation (InstallAssistService)
[local] Microsoft Exchange Mailbox Assistants 15.0.847.40 - 'Service MSExchangeMailboxAssistants' Unquoted Service Path
[local] Microsoft Exchange Active Directory Topology 15.0.847.40 - 'Service MSExchangeADTopology' Unquoted Service Path
[local] 7-zip - Code Execution / Local Privilege Escalation
[local] PTPublisher v2.3.4 - Unquoted Service Path
[local] EaseUS Data Recovery - 'ensserver.exe' Unquoted Service Path
[local] MiniTool Partition Wizard - Unquoted Service Path
Exploit-DB DoS
Exploit-DB Shellcode
Exploit-DB Papers
Exploit-DB Remote
[remote] SDT-CW3B1 1.1.0 - OS Command Injection
[remote] SolarView Compact 6.0 - OS Command Injection
[remote] F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
[remote] Akka HTTP 10.1.14 - Denial of Service
[remote] USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 - Remote Root Backdoor
[remote] Bookeen Notea - Directory Traversal
[remote] SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)
[remote] ManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure
[remote] Prime95 Version 30.7 build 9 - Remote Code Execution (RCE)
[remote] DLINK DIR850 - Insecure Access Control
[remote] DLINK DIR850 - Open Redirect
[remote] Apache CouchDB 3.2.1 - Remote Code Execution (RCE)

LiveOverflow

Bug Bounties

HackerOne Blog
HackerOne Announces a New Customer Pentest Setup that's More Efficient and Speeds Time to Launch
Understanding Public and Private Bug Bounties and Vulnerability Disclosure Programs
What is Attack Resistance Management?
Why HackerOne Acquired Pull Request and What It Means to Our Customers
Announcing the Results of the 12-month DIB-VDP Pilot
Reddit - BugBounty
Pwn2Own Vancouver: 15th annual hacking event pays out $1.2m for high-impact security bugs new
Blockchain bridge Wormhole pays record $10m bug bounty reward new
What type of bug should i try on this page? need some idea
Can someone plzz tell me if this is a vulnerabilty . I was looking for a url www.example-name.com/static/admin/?/ .Anything after ?/ gives an 403 forbidden…
Valid Bug?
sub domain takeover QUESTION
Would there be a use case for this tool?
Does "The Web Application Hacker's Handbook" 2nd Edition still holds knowledge value?
Dalfox G POC Purpose
What code could've been made that led to this OTP bypass?
[BEGINNER] is it illegal to recon out of scope domains?
Rockstar Games; is offering around 10K U$ — to a researcher
Pentester Land
Portswigger
Gin and Juice Shop: put your scanner to the test
Confused by agents? We've cleaned up our jargon ...
Burp Suite Enterprise Edition: config tips for scanning success
Burp Scanner can now crawl static sites between 6x - 9x faster
Burp Suite Enterprise Edition Kubernetes deployment and auto-scaling
Passive-aggressive scan checks
Introducing the mystery lab challenge
HackerOne Hacktivity

Vulnerabilities

Tools

Exploit Dev

Reddit - Exploit Dev
API Security Offence and Defence: Introduction to API
I'm new to binary exploitation and my interest lie in security for IOT devices. I need suggestions on what I should learn
Hacking: The Art Of Exploitation
Fuzzing
I am starting college, should I start with binary exploitation or web app exploitation, to get jobs and internships? though I do love binary exploitation…
which target to pick after learning basics of binary exploitation? if there is any bug bounty ? sorry if it's lame question
QUESTION
Best OS for exploit development against Windows
What is the one thing ( or skill ) that you should focus on in exploit dev?
developing a remote exploit for a stack overflow in Linux CVE-2022-0435, not including KASLR
34 year old starting in Exploit Development, got a chance ?
What do you need to know to develop expert-level exploits?
Source Incite
Google Project Zero
Release of Technical Report into the AMD Security Processor
The More You Know, The More You Know You Don’t Know
CVE-2021-1782, an iOS in-the-wild vulnerability in vouchers
CVE-2021-30737, @xerub's 2021 iOS ASN.1 Vulnerability
FORCEDENTRY: Sandbox Escape
Racing against the clock -- hitting a tiny kernel race window
Security Researchers
Bada Bing, Bada Boom: Microsoft Bing’s Chinese Political Censorship of Autosuggestions in North America
微軟必應自動建議在北美審查與中國政治相關的關鍵詞
微软必应自动建议在北美审查与中国政治相关的关键词
Exploiting an Unbounded memcpy in Parallels Desktop
Gartner’s top security threat and pentesting vs continuous scans – what you missed from Hack Yourself Stockholm 2021
Can we fix bearer tokens?
g_CiOptions in a Virtualized World
Newly minted filters, improvements to bulk actions, and SSL assessments
Phishing, OWASP, EASM, and hacking WordPress – top themes from Hack Yourself London
Improvements to boost the attack surface view, ports & more

Reversing/I like ASM

Reddit - Reverse Engineering
XELFViewer 0.05 ELF file viewer/editor for Windows, Linux and MacOS.
Linux.Nasty: Assembly x64 ELF virus
Ghostrings: Ghidra scripts for recovering string definitions in Go binaries with P-Code analysis
earlyremoval, in the Conservatory, with the Wrench: Exploring Ghidra’s decompiler internals to make automatic P-Code analysis scripts
apk checks weather its being installed from playstore or not. Have to edit smali. Anybody had this?
Binary Workbench 8.0-alpha can now display file regions and find functions in disassembled code
Interactive decompilation with rellic-xref
Do you recognize this function?
Reverse Engineering Discord's Party Mode
dewolf: Improving Decompilation by leveraging User Surveys
PowerShell Scripts used to run malicious shellcode. Reverse Shell vs Bind Shell
The Apple GPU and the Impossible Bug
Reddit - Game Hacks
Rust Private Script Builds (No recoil), lifetime, never been detected. (30 USD) new
The best cheat to any game i have ever seen! new
Help me
Best/Cheapest Dayz Cheats!
LOST ARK FREE BOT
Rust scripts
HOW TO CHEAT IN FORTNITE WITHOUT USING A SHITTY PASTE
Rust private script builds (No recoil), lifetime, never been detected. (30 USD)
The best cheat to any game i have ever seen!
The best cheat to any game i have ever seen!
Affordable SOFT AIM, and SILENT AIM for, Fortnite, RUST, COD, Valorant, EFT, FiveM and more!
Looking for cheats for apex legends
Reddit - REGames
General steps of reverse engineering for Windows 98-era games new
Need help (paying)
Hardware level packet triggers breakpoint while reverse engineering packets
How To Avoid Flagging Account/HWID Bans While Using IDE/Debugger/etc
Looking for collaborators for a decomp project
CreateToolhelp32Snapshot() am i right about it's logic in simple terms ?
Making a No CD Patch for my fav childhood game
Finding a Local Scope
fallout2-re -- Fallout 2 reverse-engineering project
Anyone tinker around with OSRS steam release?
MHO Revival Project
Most active forums / groups for game hacking?
StackExchange - ReverseEngineering
How do I align a memory dump hex file so that a pointer address matches its location in the memory dump file? new
How do I reverse engineer an Electron compiled file?- a JSC Bytenode file new
What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa? new
How can I set a breakpont before the software exits in Dnspy?
Calling a function with a variable number of args from a proxy DLL
how can i Use cutter like ida, trying to search by address
Manual Switch Statement Declaration IDA
How to fix CRC32 checksum in an xz-compressed folder without corrupting the data?
Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump
Load to Ida binary with all of SO
How to call and what means: _DWORD *__thiscall
help with Ghidra and rewriting assembly

Guided Hacking

Malware/APT

Crypto

Reddit - Crypto
Would there be any benefit to using the Δ between the IV and Hash to find collisions in Merkle–Damgård construction? (Δ=0 fixed point) new
Preliminary Learning ON Kimchi: PLONK new
Weekly cryptography community and meta thread new
Differential cryptanalysis of signature systems - How best to approach?
Question about using Key Encapsulation Mechanisms
Guidance for Choosing an Elliptic Curve Signature Algorithm in 2022
Formal definition of a block cipher and encryption time
RSA: how Chinese Remainder Theorem is used here
Monthly cryptography wishlist thread
Practical bruteforce of "AES-1024" military grade encryption
StackExchange - Crypto
Is there any way to encrypt the entire system drive on GPT? new
Generating private keys based on the list of ciphersuites available new
If RSA uses $e$ with $gcd(e,phi(N))ne1$ can an adversary find $d$ with $m^{ed} equiv m bmod N$ faster? new
Validity and security of task execution new
RIPEMD160 - how were these constants created? new
Non-committing authenticated encryption schemes vs committing authenticated encryption schemes new
"shared" variant of 1-out-of-N oblivious transfer new
Why use cyclotomic polynomials for RLWE? new
How to caculate the inverse of function $x^3$ in $mathbb{F}_{2^n}$ new
About two sequence conversion methods in NIST 800-90B new
How to calculate the inversion fuction S:S:mathbb{F}_{2^n}rightarrow mathbb{F}_{2^n},with S(x)=x^{-1}
Extension of a finite field

Seytonic

Podcasts

Security Weekly
PSW #740 - Fleming Shi
PSW #739 - Fatih Karayumak
PSW #738 - Michael Aminov & Marcus Sachs
PSW #737 - Capt. John Alfred & Thomas Lonardo
PSW #736 - Mike Wilkes & Amanda Berlin
PSW #735 - Sean Metcalf & Jay Beale
PSW #734 - Mark Boltz-Robinson, Hanine Salem
PSW #733 - Stephen Ward, & David Kennedy
PSW #732 - G Mark Hardy, Lawrence Nunn, & Ricky Tan
PSW #731 - Daniel Trauner, Antranig Vartanian, & David Marble
PSW #730 - Alissa Torres & Rich Mogull
Sous Vide Your Spam - PSW #729
Risky.Biz
SAMPLE PODCAST: Risky Biz News: FSB-linked DDoS tool could also be used for disinformation campaigns
Risky Biz Soap Box: While you're watching a quiet one a noisy one will kill you
Risky Business #664 -- The Spanish Prime Minister got Pegasus'd
Risky Business #663 -- Israel cracks down on spyware exports
Risky Business #662 -- It's a bad month to be an electricity grid
Snake Oilers: Vectra, Google Security and SecureStack
Risky Business #661 -- Viasat hack details firm up
Snake OIlers: PentesterLab, AttackForge and Sysdig
Risky Business #660 -- Lapsus$ arrests, latest on Okta incident
Risky Biz Soap Box: Why allowlisting is ready for prime time
Risky Business #659 -- Okta and Microsoft meet LAPSUS$
Risky Business #658 -- Germany sounds alarm on Kaspersky software
The CyberWire
A new loader variant for wiper campaigns. Sanctions, hacktivism, and disinformation. Conti’s toxic branding. Happy birthday, US Cyber Command. new
Charity Wright: Pursue what you love [Threat intelligence] [Career Notes]
AutoWarp bug leads to Automation headaches. [Research Saturday]
Is Conti rebranding? Commercial spyware scrutinized. Notes from the cyber phases of a hybrid war. Notes on the underworld. Software supply chain attack. Canada will…
CISA Alert AA22-138B – Threat actors chaining unpatched VMware vulnerabilities for full system control. [CISA Alerts]
Information operations and the invasion of Ukraine. VMware patches vulnerabilities. F5 BIG-IP vulnerabilities atively exploited. TDI clarifies data incident. Robo-calling the Kremlin.
CISA Alert AA22-138A – Threat Actors Exploiting F5 BIG-IP CVE-2022-1388.
Privateering goes fully political. Compromised robots? Conti’s campaign against Costa Rica. Cyberconflict along the Nile. A reset in the cyber insurance market.
CISA Alert AA22-137A – Weak security controls and practices routinely exploited for initial access. [CISA Alerts]
Russian cyber threats and NATO’s Article 5. Conti says it’s going to bring Cost Rica to its knees. BLE proof-of-concept hack. CISA warns of initial…
Users advised to patch actively exploited Zyxel vulnerability. Hacktivism and influence ops in Russia’s hybrid war. Ransomware notes. Indiscriminate hacktivism? Alt-coin sanctions case will proceed.
Eric Escobar: Collaboration is key. [Pen tester] [Career Notes]
Cyber Security Interviews
ISC Daily Stormcast
ISC StormCast for Tuesday, May 24th, 2022 new
ISC StormCast for Monday, May 23rd, 2022
ISC StormCast for Friday, May 20th, 2022
ISC StormCast for Thursday, May 19th, 2022
ISC StormCast for Wednesday, May 18th, 2022
ISC StormCast for Tuesday, May 17th, 2022
ISC StormCast for Monday, May 16th, 2022
ISC StormCast for Friday, May 13th, 2022
ISC StormCast for Thursday, May 12th, 2022
ISC StormCast for Wednesday, May 11th, 2022
Darknet Diaries
117: Daniel the Paladin
116: Mad Dog
115: Player Cheater Developer Spy
114: HD
113: Adam
112: Dirty Coms

Threat Intel

Reddit - Onions
Okay to use Tor on phone new
Cant create a dread account new
Jabber registration? new
My method for finding new onions on clearnet new
is tor slow or it is me new
Onion " Fuck facebook " closed ? new
Deep link onion diroctery new
what is the difference between onion routing and garlic routing? new
Tor Search engine on the clear net that allows safely onion finding new
Has anyone got any links to find past papers (A Levels/UK), can’t seem to find any new
I just got banned from r/privacy again.. new
trust-based email services
Reddit - Pwned
HaveIBeenPwned
Read Novel (unverified) - 22,424,472 breached accounts
BlackBerry Fans - 174,168 breached accounts
OGUsers (2021 breach) - 348,302 breached accounts
Paragon Cheats - 188,089 breached accounts
PayHere - 1,580,249 breached accounts
Aimware - 305,470 breached accounts
Devil-Torrents.pl - 63,451 breached accounts
Avvo - 4,101,101 breached accounts
Travelio - 471,376 breached accounts
Royal Enfield - 420,873 breached accounts
ZAP-Hosting - 746,682 breached accounts
CDEK (unverified) - 19,218,203 breached accounts

Privacy/VPNs

Slashdot - Rights
DC Attorney General Sues Mark Zuckerberg Over Cambridge Analytica Data Breach new
Florida Law on Social Media Unconstitutional, Appeals Court Rules new
Would You Blur Your House on Every Map App?
Can Tech Firms Prevent Violent Videos Circulating on the Internet?
Avoiding Sanctions with Cryptocurrency? US Govt Files First Criminal Charges
Foreign Torrent Site Operator Can Be Sued in the US, Court Says
Google 'Private Browsing' Mode Not Really Private, Texas Lawsuit Says
Microsoft's Bing Reportedly Censoring Politically Sensitive Chinese Names, Researchers Say
Deadlocked FCC Could Derail Biden's Digital Equity Plans
Court Rules SEC's Internal Judges Are Unconstitutional
The Passwords Most Used By CEOs Are Startlingly Dumb
India Says VPN Firms Unwilling To Comply With New Rules 'Will Have To Pull Out' of the Country
Reddit - Privacy
Exodus Alternative new
Am I being stalked by someone new
FireFox DNS Leak Pro Tip new
MacOS vs Windows 11 privacy (not security), are both ultimately a nightmare compared to Linux and can we even tell if both are ultimately closed… new
Wireleap adds relay network usage metrics and configurable data cap new
Deactivate Intel Service "Inte(R) System Usage Report Service SystemUsageReportSvc_QUEENCREEK" new
Do people know which primary you voted in? new
still possible to buy BCs privately in the US? new
Aside from requesting my information to be removed, what other actions should I take for this company? new
Shall I get a Facebook account if I've already got Instagram? new
Google Account Hacked new
Want to know how to build a Fariday Cage for cheap read to find out. new
Reddit - VPN
Hey does anybody know if i’m able to change IPs with the basic version n.ord vpn ? new
I disabled proxy for a literall second while browsing the net new
Sending vpn info over email new
VPN - Which one works best for unblocking? new
Why are VPNs so slow???
my vpn on my computer is disallowing my smart TV to work
streaming out of market sports
OpenVPN settings for iPhone
Advice setting up router level VPN
How to re-download an app complete from my current App Store but not download from my previous downloaded app from my country’s iCloud?
How to resolve hostnames with openvpn.
How to make an Alt steam acct in AR for cheaper games
PrivacyTools.io
EFF
Data Brokers and True the Vote are the Real Villains of "2000 Mules" Movie new
EFF to Court: California Law Does Not Bar Content Moderation on Social Media new
EFF Opposes Anti-Fiber, Anti-Affordability Legislation in California That Will Raise Prices on Middle Income Users new
Escape from Zoom: EFF's 6th Annual Tech Trivia Night Returns to Meatspace! new
DOJ’s New CFAA Policy is a Good Start But Does Not Go Far Enough to Protect Security Researchers
Two of Peru's Top ISPs Improve Transparency Practices, While Two Competitors Lag Behind, New Hiperderecho's Report Shows
Platform Liability Trends Around the Globe: From Safe Harbors to Increased Responsibility
We Finally Have a Federal Fiber Broadband Plan
New Surveillance Transparency Report Documents an Urgent Need for Change
EFF to Supreme Court: Put Texas Social Media Law Back on Hold
Podcast Episode: An AI Hammer in Search of a Nail
British Citizen Alaa Abd El Fattah Demands An End to Mistreatment in Egyptian Prison

Help Wanted

Reddit - AskNetSec
Kind of a Wifi attack that isn't Evil Twin new
Best path to cybersecurity as a self-taught developer new
Secure Home Network
burp vs zap
How to make a used computer safe
Sending a spoof email
How Dual Messenger technically works on Samsung devices
Does a DNS enabled "gray-net", akin to the dark net w/ onion sites, exist?
Unable to install VirtualBox NDIS6 Bridged Networking Driver.
deleted post with solutions: 'Hi, code injection help please'
Help with blind SQL injection please
Cannot create host-only adapter on VirtualBox
Reddit - Netsec Students
AI use in the workplace survey new
rapid7 insightvm & IDR new
Threat modeling interview tips? new
haddix methodology? new
Search Query : How to find exposed HFS HTTP File Server. Analysis Report on Malicious Code sites on a chinese HFS HTTP Filer Servers. new
university Cybersecurity course
SANS New to Cyber Field Manual.
zap macros? how to perform these steps in ZAP?
Beginner friendly course on Penetration testing?
Recommendation: Students, be more updated before your interviews
Got "hacked" with TFA. Anything I am doing wrong?
Download international standard documents
Stackoverflow - Security
If you can see this, traffic is not passing through mitmproxy. (Notification) new
How to boot service only locally in nodejs? new
How exactly is md5 vulnerable and how to reproduce it? new
DAC Access Control new
Developing a spring boot application using cache poisoning [closed] new
Automatic machine to machine authentication best practice? new
Extend security configuration from Symfony Bundle new
My C# application has a "force integrity disabled" problem new
Best Approach to Store Sensitive Information on Database and retrieve it new
Remove IIS server details in Angular application new
Tpot Honeypot : Attacker Source IP Reputation, Username Tagcloud and Password Tagcloud Display Error new
Shopify - App must set security headers to protect against clickjacking new
Stack Exchange
ROP - ret VS ret 0 new
Best security related routers to buy? [closed] new
How to trust CA chain with sub-CA intermediate new
Decoding Wireshark traffic to identify unauthorized activity? [closed] new
Signal desktop app and mobile app not syncing chat histories [closed] new
Do you know of a reasonable study on MFA value as a function of the nature of the first factor? new
Is a TOTP with RFC 6238 and a password in a manager 2FA? [duplicate] new
How can we find xxe vulnerability in a web site? [closed] new
PHP 7.4.3 preg_match bypass new
How to Ensure Adversaries Receive Information? [closed] new
How to find information that NSA trolls on Stack downvote? [closed] new
Best Way to Reliably Performing Checksums Assuming Entire Internet is Compromised [closed] new

Locks/Social Engineering

Reddit - Lockpicking
Today I successfully picked a pool table new
I was hoping to get some help identifying the corresponding belt for this lock, thank you in advance! new
Squire Vulcan Review - Shame new
What are the cheapest green and blue locks? new
What’s your favorite type of milling? new
I thought these were meant to be tough? Squire Vulcan picked! new
MIWA PR finally picked after watching the explanation video from Artichoke2000 : ) new
A successful wait for a doctors appointment (3x American 1100 and a PacLock PL410 Pro) new
Hey all, just wanted to share my recent pick and gut of Dirty Old Man by Dark Arts Lock Picking. Thanks for watching! new
Hooked Again, After a 2 Month Break new
what a Monday morning new
One Down and one to go new
Reddit - Social Engineering
Are people who use the DARVO method aware of what they are doing and how should you handle such people/situations? new
what would you in this situation?
The trouble with defining conspiracy theories
On the reception and detection of pseudo profound bullshit
How does making observations help connect with strangers?
[Preprint] Alarmism about the dangers of misinformation is associated with the third-person effect: the idea that other people are much more gullible than oneself.
Are people afraid to ask to hang out? / Social Engineering plans for someone else's friend group
Study across 26 countries finds that conspiracy mentality is associated with extreme left- and especially extreme right- wing beliefs, and may be strengthened by deprivation…
Decentralized your Social Media.
Study across 26 countries finds that conspiracy mentality is associated with extreme left- and especially extreme right-wing beliefs, and may be strengthened by deprivation of…
Master List of Logical Fallacies
How do I social engineer for higher salary pay? I want to try this warehouse operative job

Hak5

Security Blogs

Security Bloggers Network
Is Zero Trust a Long-Term Security Solution? new
I joined Balbix to Fuel Explosive Growth Through a Partner Ecosystem new
Secure Developer Velocity with Active Testing new
BSides Prishtina 2022 – Armend Gashi’s ‘What Do OAuth And Football Clubs Have In Common?’ new
The Evolution of Ransomware: Understanding Its Past, Present, and Future new
XKCD ‘Angular Diameter Turnaround’ new
What is OpenAPI and how does it affect API security? new
Extra, Extra, VERT Reads All About It: Cybersecurity News for the Week of May 16, 2022 new
AppSec Decoded: Managing software supply chain risks new
Become a Cybersecurity Hero: An Interview with a White Hat Hacker new
IDS Alliance Raises Awareness of IAM Fundamentals with the ‘CISO Chronicles’ new
BSides Prishtina 2022 – Bleon Proko’s ‘An Overview In Cloud Penetration Testing’ new
ThreatPost
Zero Trust for Data Helps Enterprises Detect, Respond and Recover from Breaches new
Closing the Gap Between Application Security and Observability
380K Kubernetes API Servers Exposed to Public Internet
Critical Vulnerability in Premium WordPress Themes Allows for Site Takeover
APTs Overwhelmingly Share Known Vulnerabilities Rather Than Attack O-Days
April VMware Bugs Abused to Deliver Mirai Malware, Exploit Log4Shell
Sysrv-K Botnet Targets Windows, Linux
iPhones Vulnerable to Attack Even When Turned Off
digitalmunition
eHacking News
Wired - Security
How GDPR Is Failing new
How to Limit Who Can Contact You on Facebook
North Korean IT Workers Are Infiltrating Tech Companies
Spyware Vendors Target Android With Zero-Day Exploits
This Hacktivist Site Lets You Prank Call Russian Officials
Your iPhone Is Vulnerable to a Malware Attack Even When It’s Off
US Courts Are Coming After Crypto Exchanges That Skirt Sanctions
The NSA Swears It Has ‘No Backdoors’ in Next-Gen Encryption
How One Company Helps Keep Russia’s TV Propaganda Machine Online
The Hidden Race to Protect the US Bioeconomy From Hacker Threats
The Case for War Crimes Charges Against Russia’s Sandworm Hackers
Android 13 Tries to Make Privacy and Security a No-Brainer
Krebs on Security
Senators Urge FTC to Probe ID.me Over Selfie Data
When Your Smart ID Card Reader Comes With Malware
DEA Investigating Breach of Law Enforcement Data Portal
Microsoft Patch Tuesday, May 2022 Edition
Your Phone May Soon Replace Many of Your Passwords
Russia to Rent Tech-Savvy Prisoners to Corporate IT?
You Can Now Ask Google to Remove Your Phone Number, Email or Address from Search Results
Fighting Fake EDRs With ‘Credit Ratings’ for Police
Leaked Chats Show LAPSUS$ Stole T-Mobile Source Code
Conti’s Ransomware Toll on the Healthcare Industry
Microsoft Patch Tuesday, April 2022 Edition
RaidForums Gets Raided, Alleged Admin Arrested
Naked Security
Clearview AI face-matching service fined a lot less than expected new
Mozilla patches Wednesday’s Pwn2Own double-exploit… on Friday!
Microsoft patches the Patch Tuesday patch that broke authentication
US Government says: Patch VMware right now, or get off our network
S3 Ep83: Cracking passwords, patching Firefox, and Apple vulns [Podcast]
Pwn2Own hacking schedule released – Windows and Linux are top targets
Apple patches zero-day kernel hole and much more – update now!
Firefox out-of-band update to 100.0.1 – just in time for Pwn2Own?
He sold cracked passwords for a living – now he’s serving 4 years in prison
S3 Ep82: Bugs, bugs, bugs (and Colonial Pipeline again) [Podcast]
Serious Security: Learning from curl’s latest bug update
Colonial Pipeline facing $1,000,000 fine for poor recovery plans
Schneier on Security
Forging Australian Driver’s Licenses new
Friday Squid Blogging: Squid Street Art
The Onion on Google Map Surveillance
Bluetooth Flaw Allows Remote Unlocking of Digital Locks
Websites that Collect Your Data as You Type
iPhone Malware that Operates Even When the Phone Is Turned Off
Attacks on Managed Service Providers Expected to Increase
The NSA Says that There are No Known Flaws in NIST’s Quantum-Resistant Algorithms
Friday Squid Blogging: Squidmobile
Surveillance by Driverless Car
ICE Is a Domestic Surveillance Agency
Apple Mail Now Blocks Email Trackers
Linux Security
Complete Guide to Keylogging in Linux: Part 1> new
VirtualBox On Linux Affected By Security Vulnerability Leaking Host Data To Guests> new
Microsoft: This botnet is growing fast and hunting for servers with weak passwords> new
Google Makes Public Their Open-Source PSP Security Protocol>
Citi Donates Software Supply Chain Security Kit to OpenSSF>
Open source security: Linux Foundation project presents 10-point plan>
Establishing a Root of Trust in Embedded Linux and IoT>
What You Need to Know about the Sysrv-K Cryptomining Botnet in Less than a Minute>
Open Source Burnout: An Opening to More Security Gaps?>
Microsoft: Sysrv botnet targets Windows, Linux servers with new exploits>
BPFdoor: Stealthy Linux malware bypasses firewalls for remote access>
Primer to Container Security>
Dark Reading
Multiple Governments Buying Android Zero-Days for Spying: Google new
QuSecure Carves Out Space in Quantum Cryptography With Its Vision of a Post-RSA World new
Malicious Python Repository Package Drops Cobalt Strike on Windows, macOS & Linux Systems new
Linux Trojan XorDdos Attacks Surge, Targeting Cloud, IoT new
Why the Employee Experience Is Cyber Resilience new
Valeo Networks Acquires Next I.T. new
Kingston Digital Releases Touch-Screen Hardware-Encrypted External SSD for Data Protection new
After the Okta Breach, Diversify Your Sources of Truth new
Chatbot Army Deployed in Latest DHL Shipping Phish
Partial Patching Still Provides Strong Protection Against APTs
Quantum Key Distribution for a Post-Quantum World
Microsoft Rushes a Fix After May Patch Tuesday Breaks Authentication
Securelist
ISaPWN – research on the security of ISaGRAF Runtime new
Evaluation of cyber activities and the threat landscape in Ukraine
Whitehat Security Blog
HITB News
Why it’s hard to sanction ransomware groups new
Broadcom’s play to acquire VMware could strengthen its enterprise focus new
Fake Windows exploits target infosec community with Cobalt Strike new
UK privacy watchdog fines Clearview AI £7.5m and orders UK data to be deleted new
The full saga of Apple’s troubled mixed reality headset has been revealed new
How GDPR Is Failing new
How to Limit Who Can Contact You on Facebook
Researchers find backdoor lurking in WordPress plugin used by schools
New Bluetooth hack can unlock your Tesla—and all kinds of other devices
2 vulnerabilities with 9.8 severity ratings are under exploit. A 3rd looms
Twitter deal leaves Elon Musk with no easy way out
Majority of Kubernetes API Servers Exposed to the Public Internet
The RISKS Digest
Selfies Further Endanger Rare Phallic Plant, Conservationists Fear
Zero-trust security: Assume everyone on the Internet is out to get you -- and already has
PDF election ballots
463 people's COVID benefits accidentally sent to one of them
Eavesdroppers Can Hack 6G Frequency with DIY Metasurface
Two-Card Monte: Why Mastercard And Visa Rarely Shut Down Scammers Who Are Ripping Off Consumers
Crypto meltdown highlights need for urgent regulatory intervention
Sadly, this food delivery robot got caught on the tracks while trying to cross
Artificial Intelligence
China's Internet Censors Try a New Trick: Revealing Users' Locations?
Exposure through identity verification?
Researchers Find Potential Way to Run Malware on iPhone Even When it's OFF
Kaspersky Blog
FIDO passkey: a passwordless future | Kaspersky official blog new
How to upgrade an incident response specialist’s skills
Transatlantic Cable Podcast, episode 251 | Kaspersky official blog
Critical vulnerabilities in VMWare products | Kaspersky official blog
Interview with Ivan Kwiatkowski | Kaspersky official blog
Scammers steal seed phrases to hack cryptowallets | Kaspersky official blog
Wells Fargo phishing e-mails | Kaspersky official blog
How to avoid becoming a ransomware victim a second time
Transatlantic Cable Podcast, episode 250 | Kaspersky official blog
Actively exploited vulnerability in Windows | Kaspersky official blog
How Trojans take out paid subscriptions | Kaspersky official blog
Transatlantic Cable Podcast, episode 249 | Kaspersky official blog
Adam Shostack & friends
Graham Cluley
Greenland hit by cyber attack, finds its health service crippled
Bank refuses to pay ransom to hackers, sends dick pics instead
Phishing gang that stole over 400,000 Euros busted in Spain
Hackers are finding it too easy to achieve their initial access, warn agencies
Smashing Security podcast #275: Jail for Bing, and mental health apps may not be good for you
“Incompetent” council leaks details of students with special educational needs
Russian cyber attack on Eurovision foiled by Italian authorities
Smashing Security podcast #274: Hands off my biometrics, and a wormhole squirmish
Keeper Connection Manager: Privileged access to remote infrastructure with zero-trust and zero-knowledge security
US college set to permanently close after 157 years, following ransomware attack
Tractor giant AGCO hit by ransomware, halts production and sends home staff
Russian TV listings hacked with messages about war crimes in Ukraine
Rapid7