Security News

Morningstar Security News gathers all the most popular infosec and cyber security news headlines into a single page that auto-updates 24/7.

Most Popular

Exploits

Tools

Vulnerabilities

Reversing/I like ASM

Malware/APT

Crypto

Podcasts

Threat Intel

Privacy/VPNs

Help Wanted

Locks/Social Engineering

Security Blogs

Mainstream Media

Thirsty for more

PacketStorm
Go Malware Is Now Common, Having Been Adopted By Both APT And E-Crime Groups
Old Foe Or New Enemy? Here's How Researchers Handle APT Attribution
Oxford Lab With COVID-19 Research Links Targeted By Hackers
Round Two Coming In Congressional Grilling Over SolarWinds
Npower App Attack Exposed Customers' Bank Details
Chart Shows Connections Between Cybercrime Groups
Ukraine Says Russia Planted Malware In Its Document Portal
Cisco Warns Of Critical Auth Bypass Security Flaw
McDonald's Has An Intel Team Spying On Workers
Four New Hacking Groups Are Targeting Critical Infrastructure
VMware Warns Of Critical Remote Code Execution Flaw
SolarWinds Hack Was The Work Of At Least 1,000 Engineers, Tech Execs Tell Senate
The Register
Imperva pretty adamant that security analytics aggregator product Sonar is not 'one dashboard to rule them all'new
Google looks at bypass in Chromium's ASLR security defense, throws hands up, won't patch garbage issue
Half a million stolen French medical records, drowned in feeble excuses
India's demand to identify people on chat apps will 'break end-to-end encryption', say digital rights warriors
1Password has none, KeePass has none... So why are there seven embedded trackers in the LastPass Android app?
UK's National Cyber Security Centre sidles in to help firm behind hacked NurseryCam product secure itself
Ever felt that a few big tech companies are following you around the internet? That's because ... they are
Alexa, swap out this code that Amazon approved for malware... Installed Skills can double-cross their users
Revealed: The military radar system swiped from aerospace biz, leaked online by Clop ransomware gang
'We're finding bugs way faster than we can fix them': Google sponsors 2 full-time devs to improve Linux security
Think you know all about security pen-testing in the cloud? Here’s how to prove it
Mozilla Firefox keeps cookies kosher with quarantine scheme, 86s third-party cookies in new browser build
Reddit - NetSec
Server Side Request Forgery -€” Attack and Defense | SideChannelnew
HTB Academy write-upnew
The little bug that couldn't: Securing OpenSSL - The GitHub Blognew
PortSwigger Research: Top 10 web hacking techniques of 2020new
Anti-Debug and Anti-MemoryDump for Androidnew
Downloading and Exploring AWS EBS Snapshotsnew
A Quick Look at GKE Autopilot (in 15 minutes)
PoC which piggybacks off of the Outlook COM interface to execute shellcode on a system
Post-Spectre Web Development
Beta version of the multi-tool Collaboration for Reverse Engineering (CollaRE)
1.5 million facebook profile data released on open web available to download, check if you are interested.
Building a CSP-backed Password Cracker
Bleeping Computer
The Week in Ransomware - February 26th 2021 - Back from the Holidaysnew
Twitter scammers earned over $145k this week in Bitcoin, Ethereum, Dogenew
T-Mobile discloses data breach after SIM swapping attacksnew
Ransomware gang hacks Ecuador's largest private bank, Ministry of Financenew
Ryuk ransomware now self-spreads to other Windows LAN devicesnew
Malicious Firefox extension allowed hackers to hijack Gmail accounts
Intel wireless driver updates fix Windows 10 blue screen issues
XBOX Live outage prevents players from logging in
Microsoft removes 3D Objects, Windows 10's most useless folder, from File Explorer
Dutch Research Council (NWO) confirms ransomware attack, data leak
Microsoft shares CodeQL queries to scan code for SolarWinds-like implants
North Korean hackers target defense industry with custom malware
The Hacker News
North Korean Hackers Targeting Defense Firms with ThreatNeedle Malware
ALERT: Malicious Amazon Alexa Skills Can Easily Bypass Vetting Process
Cisco Releases Security Patches for Critical Flaws Affecting its Products
Chinese Hackers Using Firefox Extension to Spy On Tibetan Organizations
The Top Free Tools for Sysadmins in 2021
Russian Hackers Targeted Ukraine Authorities With Supply-Chain Malware Attack
Online Trackers Increasingly Switching to Invasive CNAME Cloaking Technique
Experts Warns of Notable Increase in QuickBooks Data Files Theft Attacks
Everything You Need to Know About Evolving Threat of Ransomware
Critical RCE Flaws Affect VMware ESXi and vSphere Client — Patch Now
Experts Find a Way to Learn What You're Typing During Video Calls
5 Security Lessons for Small Security Teams for the Post COVID19 Era

Threat Wire

Exploits

Packet Storm Exploits
Package Control Arbitrary File Writenew
Microsoft DirectWrite fsg_ExecuteGlyph Buffer Overflownew
Chrome DataElement Out-Of-Bounds Readnew
Trojan-Proxy.Win32.Delf.ai Buffer Overflownew
Doctor Appointment System 1.0 Cross Site Scriptingnew
Trojan-Dropper.Win32.Daws.etlm Unauthenticated Rebootnew
Online Catering Reservation System 1.0 SQL Injectionnew
VisualWare MyConnection Server 11.x Remote Code Execution
Triconsole 3.75 Cross Site Scripting
Zenphoto CMS 1.5.7 Shell Upload
Remote Desktop Web Access Authentication Timing Attack
Trojan.Win32.Hotkeychick.am Insecure Permissions
Exploit-DB Webapps
[webapps] Simple Employee Records System 1.0 - File Upload RCE (Unauthenticated)
[webapps] Triconsole 3.75 - Reflected XSS
[webapps] LightCMS 1.3.4 - 'exclusive' Stored XSS
[webapps] Vehicle Parking Management System 1.0 - 'catename' Persistent Cross-Site Scripting (XSS)
[webapps] LayerBB 1.1.4 - 'search_query' SQL Injection
[webapps] Batflat CMS 1.3.6 - 'multiple' Stored XSS
[webapps] Monica 2.19.1 - 'last_name' Stored XSS
[webapps] PEEL Shopping 9.3.0 - 'Comments/Special Instructions' Stored Cross-Site Scripting
[webapps] Comment System 1.0 - 'multiple' Stored Cross-Site Scripting
[webapps] Online Exam System With Timer 1.0 - 'email' SQL injection Auth Bypass
[webapps] OpenText Content Server 20.3 - 'multiple' Stored Cross-Site Scripting
[webapps] Beauty Parlour Management System 1.0 - 'sername' SQL Injection
Exploit-DB Local and Privilege Escalation
[local] LogonExpert 8.1 - 'LogonExpertSvc' Unquoted Service Path
[local] Softros LAN Messenger 9.6.4 - 'SoftrosSpellChecker' Unquoted Service Path
[local] dataSIMS Avionics ARINC 664-1 - Local Buffer Overflow (PoC)
[local] Apport 2.20 - Local Privilege Escalation
[local] Tasks 9.7.3 - Insecure Permissions
[local] PDFCOMPLETE Corporate Edition 4.1.45 - 'pdfcDispatcher' Unquoted Service Path
[local] Epson USB Display 1.6.0.0 - 'EMP_UDSA' Unquoted Service Path
[local] AnyTXT Searcher 1.2.394 - 'ATService' Unquoted Service Path
[local] SmartFoxServer 2X 2.17.0 - God Mode Console Remote Code Execution
[local] SmartFoxServer 2X 2.17.0 - Credentials Disclosure
[local] Millewin 13.39.146.1 - Local Privilege Escalation
[local] AMD Fuel Service - 'Fuel.service' Unquote Service Path
Exploit-DB DoS
[dos] Product Key Explorer 4.2.7 - 'multiple' Denial of Service (PoC)
[dos] SpotAuditor 5.3.5 - 'multiple' Denial Of Service (PoC)
[dos] Managed Switch Port Mapping Tool 2.85.2 - Denial of Service (PoC)
[dos] AgataSoft PingMaster Pro 2.1 - Denial of Service (PoC)
[dos] Nsauditor 3.2.2.0 - 'Event Description' Denial of Service (PoC)
[dos] jQuery UI 1.12.1 - Denial of Service (DoS)
[dos] Easy CD & DVD Cover Creator 4.13 - Denial of Service (PoC)
[dos] Nxlog Community Edition 2.10.2150 - DoS (Poc)
[dos] TapinRadio 2.13.7 - Denial of Service (PoC)
[dos] RarmaRadio 2.72.5 - Denial of Service (PoC)
Exploit-DB Shellcode
Exploit-DB Papers
Exploit-DB Remote
[remote] Remote Desktop Web Access - Authentication Timing Attack (Metasploit Module)
[remote] ASUS Remote Link 1.1.2.13 - Remote Code Execution
[remote] python jsonpickle 2.0.0 - Remote Code Execution
[remote] Unified Remote 3.9.0.2463 - Remote Code Execution
[remote] HFS (HTTP File Server) 2.3.x - Remote Command Execution (3)
[remote] Erlang Cookie - Remote Code Execution
[remote] FRITZ!Box 7.20 - DNS Rebinding Protection Bypass
[remote] Solaris SunSSH 11.0 x86 - libpam Remote Root
[remote] SmarterMail Build 6985 - Remote Code Execution
[remote] Dup Scout Enterprise 10.0.18 - 'sid' Remote Buffer Overflow (SEH)
[remote] Huawei HedEx Lite 200R006C00SPC005 - Path Traversal
[remote] Dup Scout Enterprise 10.0.18 - 'online_registration' Remote Buffer Overflow

LiveOverflow

Vulnerabilities

Tools

Exploit Dev

Reddit - Exploit Dev
Is anyone interested in pursuing some longer-term projects together?
Help with shellcoding with C without absolute addresses (Windows exe)
Why do heap exploration techniques usually have "House of" in the name?
Fuzzing combined with symbolic execution: a demonstration on SymCC and AFL.
Computer Science Comparision
Reviewing AnyText Searcher Unquoted Service Path Exploit in Windows
ROP detection using deep learning
Finding the exploit with my node js project
Running a (honeypot) fake power plant on the internet for a month
How to get started with exploit development
Exploit for CVE-2021-3156 (the recent sudo vuln)
Which more important company name vs role?
Source Incite
Smarty Template Engine Multiple Sandbox Escape PHP Code Injection Vulnerabilities
Making Clouds Rain :: Remote Code Execution in Microsoft Office 365
Google Project Zero
Déjà vu-lnerability
A Look at iMessage in iOS 14
Windows Exploitation Tricks: Trapping Virtual Memory Access
The State of State Machines
Hunting for Bugs in Windows Mini-Filter Drivers
In-the-Wild Series: Android Exploits
In-the-Wild Series: Android Post-Exploitation
In-the-Wild Series: Windows Exploits
In-the-Wild Series: Chrome Infinity Bug
In-the-Wild Series: Chrome Exploits
Introducing the In-the-Wild Series
An iOS hacker tries Android
Security Researchers
Review: Perlroth's book on the cyberarms marketnew
Detectify security updates for February 22
Making hibernation work under Linux Lockdown
Diversity & Belonging at Detectify: Challenging the traditional way to do security
Digital Offense Capabilities Are Currently Net Negative for the Security Ecosystem
Vuln of the Month: CVE-2020-10148 SolarWinds Orion Authentication Bypass
Hide Your Servers in Plain Sight, Presenting ShieldWall
Security Defender Insights: Improving security visibility in the remote-work reality
Detectify security updates for February 8
Keep it secret. Keep it ... safe?
Tailoring Cobalt Strike on Target
DynamicWrapperEx – Windows API Invocation from Windows Script Host

Reversing/I like ASM

Reddit - Reverse Engineering
Reverse engineering a drone's IP cam. streamnew
Check out how multiplication is done on the transistor level in a small computer system I've built just out of discrete electronics. Enjoy 🙂new
Exploring a New Detection Evasion Technique on Linuxnew
GNU poke 1.0 released: an interactive, extensible editor for binary data
Parallel Binary Code Analysis
That's a delicious manufacturing process. Let reverse engineer it !
DC540 hacking challenge 0x00002 [MicroPython CTF]
How to Break Your JAR in 2021 - Decompilation Guide for JARs and APKs
Beta version of multi-tool Collaboration for Reverse Engineering tool (CollaRE)
CVE-2020-8625: A Fifteen-Year-Old RCE Bug Returns in ISC BIND Server
Exploiting (and Patching) a Zero Day RCE Vulnerability in a Western Digital NAS
Exploiting a denial of service exploit in the ASM Java classfile parser
Reddit - Game Hacks
Need a hack(i am paying)
Rust script
Among us Hacks
Need cheats (fortnite) all I really need is soft aim
PREMIUM RUST SCRIPTS
Custom Rust Scripts from BlackHawk
PREMIUM RUST SCRIPTS
Best auto clicker for minecraft?
RUST PREMIUM CHEATS
SCUM Multiplayer
help needed for hacking an unity pinball game
Need a game model ripped
Reddit - REGames
Request: A tool to extract .bin files from Beyond Good & Evil + Beyond Good & Evil HD.new
Where to start?
How to identify N64 function signatures?
Decoding/Editing .bin files
Which tool can generate a call graph from a binary with function symbols?
Relatively easy money challenge. 20 Bucks!
Take-2 files DMCA Takedown notice against re3 (fully reverse engineered GTA III and VC)
Opening watch dogs (WiiU) files
How to get started decompiling PSX games
Hello in substrate hiking to change weapons skins and costumes
How does one begin reverse engineering games?
GTA III and Vice City fully reverse engineered, with ports to many platforms
StackExchange - ReverseEngineering
Smart Battery Issues, a RE Quest?new
Proper workflow for x64dbg to Angr?
IDA refuses to recognize basic block as part of function that jumps to it
How to check if a process is running in memory
Looking to make a career change from one form of RE to another
Changing page permissions at runtime under a debugger
Figuring out Win10 ShellMenuHost/StartMenuHost cache data relation for Tiles
Hooking an interface method wiht Frida in an Android application
r2 impractical? [closed]
Reverse engineer decryption of cookie
Detect which type of SSL Pinning is being used on Android Applications
Specify which analyses to perform in Ghidra headless mode

Guided Hacking

Malware/APT

Reddit - Malware
Application malware testing!new
Malware Analysis for PDF Files | TryHackMe MAL: REMnux - The Redux
Dark vs Light Mode in YouTube Tutorials
Sandbox extract features in CSV file
CrackMe Hex Arrays with Ghidra!
I've never seen post-installation use of a web shell
Usage Share of Most Popular Antivirus Brands (1997 - 2020)
Trickbot analysis
Oyabun v. 2.0 release notes
A program which shuts down the PC on startup
Fastcaptchasolver malware
is this malware
Unit42
IronNetInjector: Turla’s New Malware Loading Tool
WatchDog: Exposing a Cryptojacking Campaign That’s Operated for Two Years
Threat Brief: Windows IPv4 and IPv6 Stack Vulnerabilities (CVE-2021-24074, CVE-2021-24086 and CVE-2021-24094)
BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech
Exploits in the Wild for WordPress File Manager RCE Vulnerability (CVE-2020-25213)
Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes
Pro-Ocean: Rocke Group’s New Cryptojacking Malware
Network Attack Trends: Internet of Threats
Wireshark Tutorial: Examining Emotet Infection Traffic
Open Source Tool Release: Gaining Novel AWS Access With EBS Direct APIs
xHunt Campaign: New BumbleBee Webshell and SSH Tunnels Used for Lateral Movement
TA551: Email Attack Campaign Switches from Valak to IcedID
FireEye Threat Research
So Unchill: Melting UNC2198 ICEDID to Ransomware Operations
Cyber Criminals Exploit Accellion FTA for Data Theft and Extortion
Purgalicious VBA: Macro Obfuscation With VBA Purging
Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part Two)
Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part One)
Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part Two)
Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part One)
Phishing Campaign Leverages WOFF Obfuscation and Telegram Channels for Communication
Training Transformers for Cyber Security Tasks: A Case Study on Malicious URL Prediction
Training Transformers for Cyber Security Tasks: A Case Study on Malicious URL Prediction
Emulation of Kernel Mode Rootkits With Speakeasy
Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452

Bug Bounties

Crypto

Podcasts

Security Weekly
Coming To A Theatre Near You - PSW #684new
Party Time! - PSW #683
Annual Checkup - PSW #682
Get Out of My House - PSW #681
There Was Definitely Harm Done - PSW #680
The Floppy Tangent - PSW #679
The Breath of the Targets - PSW #678
This Is How You Get Skynet - PSW #677
The Whole Crew's Awesome - PSW #676
Risky.Biz
Risky Business #615 -- Dependency confusion is, uh, pretty bad
Risky Biz Feature Podcast: A primer on Microsoft cloud security
Risky Business #614 -- So was it Florida Man or an Iranian APT?
Risky Business #613 -- It's time to check your Accellion logs
Risky Biz Soap Box: Email is a target, not just a vector
Risky Business #612 -- DPRK slides into researcher DMs
Risky Business #611 -- MalwareBytes the latest "Holiday Bear" victim
Risky Business #610 -- Propellerheads in dark on JetBrains
Risky Biz Soap Box: Mapping NIST 800-53 to MITRE ATT&CK
Risky Business #609 -- It's not NotPetya
Risky Business #608 -- FireEye discloses breach and tool exfil
Risky Biz Soap Box: VMRay co-founders on the evolution of sandbox tech
The CyberWire
Shining a light on China's cyber underground. [Research Saturday]new
Oxford lab studying the COVID-19 virus is hacked. Zoom impersonation campaign. Senators would’ve liked to have heard from Amazon about Solorigate. NSA likes zero trust.…new
PLA spyware keeps Tibetans under surveillance. Cyber conflict between Ukraine and Russia, some conventionally criminal, other state-directed. US Executive Order addresses supply chain resilience.
Accellion FTA compromise spreads. Ocean Lotus is back. LazyScripter seems to represent a new threat group. Notes from the SolarWinds hearings. New ICS threat actors.
DDoS in hybrid war. Accellion compromise attributed. Initial access brokers. Agile C2 for botnets. US Senate’s SolarWinds hearing. US DHS cyber strategy. Shiny new phishbait.
Facebook takes down Myanmar military page. Chinese cyberespionage and cloned Equation Group tools. Supply chain compromises. Threat trends.
Billy Wilson: Translating language skills to technical skills. [HPC] [Career Notes]
Attackers (ab)using Google Chrome. [Research Saturday]
Mopping up Solorigate. Tehran’s Lightning and Thunder in Amsterdam. The view from Talinn. Malware designed for Apple’s new chips. Lessons from the ice, and how…
The WatchDog Monero cryptojacking operation. “A criminal syndicate with a flag.” US Senator asks FBI, EPA for a report on water system cybersecurity. Cybercrooks placed…
US warns of DPRK threat to cryptocurrency holders, and indicts four on conspiracy charges. Centreon says Sandworm affected unsupported open-source tools. Big Hack skepticism. Patch…
France’s ANSII warns of a longrunning Sandworm campaign. DPRK tried to steal COVID-19 vaccine data. Supermicro is exasperated. Static Kitten phishes in the UAE
Cyber Security Interviews
#115 – Alyssa Miller: We Are Lacking Empathy
#114 – Chloé Messdaghi: How Can We Do Better
#113 – Julian Waits: Diversity of Thought
#112: Douglas Brush – Pain Is Inevitable, Suffering Is Optional
#111 – Danny Akacki: Work Worth Doing
#110 – Ryan Louie: Security Starts In the Mind
#109 – Amanda Berlin: Happier People Stay Longer
#108 – Bill Hudenko: The Mind Body Connection
#107 – Daniel Wood: We Don’t Have Enough Skilled People
#106 – Jasson Casey: Hire Missionaries, Not Mercanaries
#105 – John Hammond: Raise The Cyber Security Poverty Line
#104 – David Wong: Many Layers of Complexity
ISC Daily Stormcast
ISC StormCast for Friday, February 26th, 2021
ISC StormCast for Thursday, February 25th, 2021
ISC StormCast for Wednesday, February 24th, 2021
ISC StormCast for Tuesday, February 23rd, 2021
ISC StormCast for Monday, February 22nd, 2021
ISC StormCast for Friday, February 19th, 2021
ISC StormCast for Thursday, February 18th, 2021
ISC StormCast for Wednesday, February 17th, 2021
ISC StormCast for Tuesday, February 16th, 2021
ISC StormCast for Monday, February 15th, 2021
Darknet Diaries
85: Cam the Carder
84: Jet-setters
83: NSA Cryptologists
82: Master of Pwn
81: The Vendor
80: The Whistleblower

Threat Intel

Reddit - Onions
LofDD [E 008] EQUAL by OPORTUNITY or SEPARATED by FAKE EQUALITY... 5.2.2019 HAPPY FREEDOM DAY...new
US implicates Saudi crown prince in journalist’s killingnew
Anybody know someone who can hack into snap account?new
Is "Primary Documents" Real?new
dark web linksnew
4 Arrested in Germany for Selling Meth, Ketamine, and Marijuana on the Dark Webnew
Creepy Dark Web Links?new
Tor Browser random sites redirecting to the same onionnew
Help finding an onion site
Orbot not working for apps
Wall Street Vendor johncarter7 Arrested After Selling Counterfeit Oxycodone Pills Containing Fentanyl
TorPaste: An anonymous PasteBin clone with encryption
Reddit - Pwned
CD Projekt Red 'EPICALLY pwned': Cyberpunk 2077 dev publishes ransom note after company systems encrypted
Florida city of Oldsmar's municipal water supply was almost poisoned during cyberattack, Sheriff says. A plant operator witnessed mouse movement on-screen and reverted the change
ENEL, Italian multinational manufacturer and distributor of electricity and gas with international customers, affected by data disclosure - 300,000 customers personal data leaked
Brazilian electric utility company COPEL hit by cyberattack; >1TB private data exfiltrated
Major Brazilian electric utility company Eletrobras hit by ransomware
EscortReviews.com vBulletin site suffers data breach; 470,000 members affected
Online image editor Pixlr breached - Cybercriminal posts 1.9 million user records for free on forum
USCellular data breach after "employees scammed" by criminals to access CRM software - customer name, address, PIN, cell phone numbers, service plan, and billing/usage statements…
Corrugated packaging company WestRock reports ransomware incident - homepage offline
Cybersecurity device company SonicWall says its internal systems were targeted using zero-day exploits in its own products
Einstein Healthcare Network (Pennsylvania) notifies Patients of August email breach, 5 months later
Scotland environmental regulator hit by ‘ongoing’ ransomware attack since Christmas Eve - internal systems and external data products are still offline
HaveIBeenPwned
Filmai.in - 645,786 breached accounts
NurseryCam - 10,585 breached accounts
People's Energy - 358,822 breached accounts
NetGalley - 1,436,435 breached accounts
CityBee - 110,156 breached accounts
Ge.tt - 2,481,121 breached accounts
StoryBird - 1,047,200 breached accounts
Pixlr - 1,906,808 breached accounts
Bonobos - 2,811,929 breached accounts
Nitro - 77,159,696 breached accounts
Romwe - 19,531,820 breached accounts
Jobandtalent - 10,981,207 breached accounts

Privacy/VPNs

Slashdot - Rights
Apple Forced To Add iPhone and MacBook Repairability Scores To Comply With French Lawnew
Apple Mail and Hidden Tracking Imagesnew
Biden Lifts Trump-Era Ban Blocking Legal Immigration To USnew
Valve Has To Provide Some Steam Sales Data To Apple, Judge Says
Facebook Is Considering Facial Recognition For Its Upcoming Smart Glasses
A New Browser Extension Blocks Any Websites that Use Google, Facebook, Microsoft, or Amazon
Firefox's Total Cookie Protection Aims To Stop Tracking Between Multiple Sites
Google Finally Adds iOS Privacy Labels To Gmail
Clubhouse Chats Are Breached, Raising Concerns Over Security
Apple Is Going To Make It Harder to Hack iPhones With Zero-Click Attacks
Silicon Valley-backed Groups Sue Maryland To Kill Country's First-Ever Online Advertising Tax
Biden To Order Review of US Reliance on Overseas Supply Chains For Semiconductors, Rare Earths
Reddit - Privacy
Privacy respecting non-smartphonenew
Judge in Google case disturbed that 'incognito' users are trackednew
What do you think of AdNasuem - Ublock but fakes clicks to hurt trackers and confuse your profile?new
Can you install Google Play Store ONLY, without the "required" services?new
Instagram sent me a targeted ad from a text message conversation I had with my sisternew
Iplogger...new
Universal Android Debloater is an open source tool that removes bloatware without root. Automatically or via user choice. Get back your battery, security and privacynew
Take Action against TikTok as they violate European privacy law and children’s data protection regulations.new
Deleting a Reddit account properlynew
Any opinion about this?: https://www.presearch.org/new
What is your privacy setup? (For those who feel they have a balance between privacy and comfort.new
Lockdown app? Is it good for privacy?new
Reddit - VPN
How do I setup IPv6 on a Synology NAS?new
Connecting to a server, does it matter which one? Same city? Same Country?new
Can a VPN help my connection to a friend who lives far away?new
Another dumb VPN question!new
Millions of VPN users have personal details stolennew
Infiot Taps the Smart Edge with Microsoft Azurenew
How can I fix PR_END_OF_FILE_ERROR when using vpn?
Can I subscribe to a foreign streaming service using a VPN?
VPN kills Ethernet connection on Lineage OS 16 (Android 9) on Raspberry Pi 4
Brook v20210214 Released – cross-platform strong encryption, undetectable proxy. Open Source via GPLv3
Will proctoring software, such as Respondus, work while using a VPN?
Is it possible for OpenVPN UDP connections to mess up with your Google Photos, iCloud, OneDrive, etc. backups?
PrivacyTools.io
Cut unwanted internet access from Appsnew
iOS: is it possible to contain a folder of apps needed for work (+social media for work) and maintain privacy?new
what are the vulnerabilites in this scenario of posting online anonymously?new
Authenticator Pro or Aegisnew
Is Blokada effective? Any issues I should know about?new
ISP blocking DoH/DoT?new
Physical electronic protection - Your thoughts?new
How do I remove my details from web?new
1. Are PWAs more secure? 2. For private phone: a) GrapheneOS b) wait for Linux phone or c) custom ROM where you don't sign into…new
BBC - Spy pixels in emails have become endemicnew
Warden - Android App that shows trackers and loggers from each installed application (first posted by u/tinylittleroar approx. 8 months ago)new
Brave vs Firefox | Part 2new
EFF
Federal Court Agrees: Prosecutors Can’t Keep Forensic Evidence Secret from Defendantsnew
From Creativity to Exclusivity: The German Government's Bad Deal for Article 17new
The SAFE Tech Act Wouldn't Make the Internet Safer for Users
Virginia's Weak Privacy Bill Is Just What Big Tech Wants
Interoperability Gains Support at House Hearing on Big Tech Competition
EFF joins Dozens of Organizations Urging More Government Transparency
Coded Resistance: Freedom Fighting and Communication
Student Surveillance Vendor Proctorio Files SLAPP Lawsuit to Silence A Critic
How Do Copyright Rules Affect Internet Creators? And What Can They Do About It?
Cops Using Music to Try to Stop Being Filmed Is Just the Tip of the Iceberg
Racial and Immigrant Justice Groups Sue Government for Records of COVID-19 Data Surveillance
EFF to First Circuit: Schools Should Not Be Policing Students’ Weekend Snapchat Posts

Help Wanted

Reddit - AskNetSec
how many firewall alerts do you receive every day per device?new
SSH Public Key Descriptions
How can I automate detecting that developers are rolling their own crypto?
Is there anything preventing over-the-air or powerline attacks against Apple's secure enclave chips?
Reddit - Netsec Students
Introduction to Networking | Network Basics for Beginners - IP addressesnew
Malware Analysis for Word Documents | TryHackMe MAL: REMnux - The Reduxnew
The Good, the Bad and the Ugly in Cybersecurity - Week 9new
Important RBI Update on Your Bank Cards for Online Shopping!
Bypassing Respondus with 2 monitors!
Fuzzing native Python extensions with Atheris
Cybersecurity Career
NSA Issues Guidance on Zero Trust Security Model
Critical Cybersecurity Incident Research
What some gadgets/tools that you have?
First time nmap, help!
Manually create and send raw ICMP packets
Stackoverflow - Security
Error with ruby version on termux when I try to install metasploitnew
What is the best way to work with big data in mysql? (Follow-up between members, notifications etc.)new
What is the best code obfuscator for .net environment? [closed]new
SSL and Encryption and how to edit itnew
Error namespace not included C# adsfsdafsdafsadfsdfdsa [closed]new
Can Angular Universal be used as a server side Guard for routing?new
ReactJs vs app QML, which to choose in terms of performance? [closed]new
How to use separate custom filters managed by Spring with multiple security configurations?new
is there any secure admin panel for Node.js/MySQL? [closed]new
Writing a simple http login bruteforcer in python, getting diferent behavior when reading from wordlistnew
Firebase: Firestore security rules for collectionGroup queriesnew
Secure web api build using asp.net core with Azure AD
Stack Exchange
Is rsyncd secure? (except for the lack of transport encryption)new
Securing crypto wallets with redundant passwordsnew
Standard Protocols or secure mechanism to authenticate users offlinenew
Cmd line tool to scan an eml file against spam/phishing rulesnew
John the ripper "no password hashes loaded(see FAQ)" [closed]new
Access to a js variable which visible for a brief period of time via XSSnew
There are many open ports opened by system on a Windows 8 computer - are the system files modified?new
JS client side encryption & Oauthnew
Does an ethical hacker need to stay anonymous?new
How can I scrape the XSRF cookie value to bypass CSRF protection?new
What is the purpose of a targeted email without any meaningful content?new
Security level of DSA when $q$ is a 224 bit prime? [migrated]new

Locks/Social Engineering

Reddit - Lockpicking
Be the first to correctly identify and win a highly prized SlothPicker shirt...🦥new
Aha finally after about an hour! American 1100new
My first homemade pinsnew
Channel Update and Giveaway Announcement!new
Today my boss locked himself out of his officenew
I don't see a key gauge for Brinks ?new
My first homemade key for the challenge lock I made. It's beautiful in an ugly sort of way... but it works!new
Abus 80TI/50 Titalium very tricky pick it definitely has countermilling i just wish I could gut itnew
Zeiss Ikon. Not that difficult to pick, but a beautifully made lock.new
Adding ABUS 55/40 to the checklistnew
My first attempt at making homemade security pins for a challenge lock. 5 driver pins and 2 key pins.new
Yay! How's your Friday evening?new
Reddit - Social Engineering
Turns out you could just do this outside any storenew
Social Commerce Market Report with Detailed Insights on Size, Share, Trends and Forecast 2020 – 2027 | Key Players – Twitter, Weibo.
What words or phrases in a university application subconsciously influence the reader?
Mimetic Theory
All SCAMS are Social Engineering. Watch how this FACEBOOK PAGE HIJACKING SCAM is done
How to social engineer anydesk reversing the connection?
A short story about a new job, phishing and "personal matters"
If you wanted to classify different people, how would you do it?
Which social engineering books give exercises and step by step instructions and exercises?
Court traffic ticket
Your biggest frustration
New Program

Hak5

Security Blogs

Security Bloggers Network
Five worthy reads: Are we ready for a passwordless future?new
CPAC 2021 Open Display of Nazi Symbolsnew
Review: Perlroth’s book on the cyberarms marketnew
Modern Identities for the Digital First Worldnew
Network Threat Hunting Made Easy With the MistNet NDR MITRE ATT&CK™ Enginenew
Sete práticas de segurança cibernética que toda organização deveria implementarnew
Evolução da cibersegurança: Uma breve linha do temponew
Um dia na vida de um analista SOCnew
Google to Underwrite Contributors to Linux Securitynew
Infrastructure Hygiene: Fixing Vulnerabilitiesnew
BSides Calgary 2020 – Evil Mog’s ‘From Print Spooler To Kerberos Silver Tickets’new
Black History Month Spotlight: Jane-Glenna Anthonynew
ThreatPost
Amazon Dismisses Claims Alexa ‘Skills’ Can Bypass Security Vetting Processnew
Stalkerware Volumes Remain Concerningly High, Despite Bansnew
Lazarus Targets Defense Companies with ThreatNeedle Malwarenew
Yeezy Fans Face Sneaker-Bot Armies for Boost ‘Sun’ Release new
Malware Gangs Partner Up in Double-Punch Security Threatnew
Podcast: Ransomware Attacks Exploded in Q4 2020
Protecting Sensitive Cardholder Data in Today’s Hyper-Connected World
Cyberattacks Launch Against Vietnamese Human-Rights Activists
Health Website Leaks 8 Million COVID-19 Test Results
Malicious Mozilla Firefox Extension Allows Gmail Takeover
Cisco Warns of Critical Auth-Bypass Security Flaw
Tax Season Ushers in Quickbooks Data-Theft Spike
digitalmunition
DFS Aviation Services gewinnt Airport Technology Excellence Award für einen vorbildlichen Umgang mit der Corona-Situationnew
Nagios XI 5.7.5 Remote Code Execution ≈ Packet Stormnew
LightCMS 1.3.4 Cross Site Scripting ≈ Packet Stormnew
ASM Pacific Technology-Aktie unter 50-Tage-Linie – boerse.denew
Squid 4.14 / 5.0.5 Code Execution / Double Free ≈ Packet Stormnew
Why People Are The Heart Of Everything We Do In Businessnew
Trojan-Spy.Win32.SpyEyes.elr Insecure Permissions ≈ Packet Stormnew
Backdoor.Win32.Azbreg.amw Insecure Permissions ≈ Packet Stormnew
ASM Pacific Technology prsentierte Quartalsergebnisse | Nachrichtnew
Trojan.Win32.Hotkeychick.am Insecure Permissions ≈ Packet Stormnew
SHAREHOLDER ALERT: Monteverde & Associates PC Announces an Investigation of Reinvent Technology Partners – RTP | Nachrichtnew
Remote Desktop Web Access Authentication Timing Attack ≈ Packet Stormnew
eHacking News
SQL Triggers Used by Hackers to Compromise User Databasenew
Unprotected Private Key Allows Remote Hacking of PLCsnew
AIVD says they face cyber attacks from Russia and China every daynew
Google Reveals Details of a Recently Patched Windows Flaw
15,000 Clients Data Leaked Accidently by a Turkish Firm
Turkey Dog Activity Continues to use COVID Lures
The head of Microsoft announced evidence of the involvement of Russian intelligence in the cyber attack
Private Information of 50,000 French Healthcare Workers Stolen
Total Cookie Protection Launched in The New Upgrade of Firefox
A Crypto Mining Botnet is Abusing Bitcoin Blockchains
Experts listed the methods used by fraudsters to obtain personal data
Bitcoin Slips 17% to $45,000 as Caution Sweeps Over Crypto
Wired - Security
Clubhouse's Security and Privacy Lag Behind Its Huge Growthnew
Hackers Tied to Russia's GRU Targeted the US Grid for Years
2034, Part V: Sailing Into Darkness
The Woman Bulldozing Video Games’ Toughest DRM
China Hijacked an NSA Hacking Tool—and Used It for Years
A Trippy Visualization Charts the Internet's Growth
Sites Have a Sneaky New Way to Track You Across the Web
Apple Offers Its Closest Look Yet at iOS and MacOS Security
Feds Indict North Korean Hackers for Years of Heists
Parler Says It’s Back
Malware Is Now Targeting Apple’s New M1 Processor
How to Avoid Phishing Emails and Scams
Krebs on Security
How $100M in Jobless Claims Went to Inmates
Checkout Skimmers Powered by Chip Cards
Mexican Politician Removed Over Alleged Ties to Romanian ATM Skimmer Gang
U.S. Indicts North Korean Hackers in Theft of $200 Million
Bluetooth Overlay Skimmer That Blocks Chip
What’s most interesting about the Florida water system hack? That we heard about it at all.
Microsoft Patch Tuesday, February 2021 Edition
Arrest, Raids Tied to ‘U-Admin’ Phishing Kit
Facebook, Instagram, TikTok and Twitter Target Resellers of Hacked Accounts
‘ValidCC,’ a Major Payment Card Bazaar and Looter of E-Commerce Sites, Shuttered
U.K. Arrest in ‘SMS Bandits’ Phishing Service
The Taxman Cometh for ID Theft Victims
Naked Security
S3 Ep21: Cryptomining clampdown, the 100-ton man, and ScamClub ads [Podcast]
Keybase secure messaging fixes photo-leaking bug – patch now!
Naked Security Live – How to calculate important things using a computer
Nvidia announces official “anti-cryptomining” software drivers
The massive coronavirus IT blunder with a funny side
S3 Ep20: Corporate megahacking, true love gone bad, and tax grabs [Podcast]
US names three North Koreans in laundry list of cybercrime charges
“ScamClub” gang outed for exploiting iPhone browser bug to spew ads
Romance scams at all-time high: here’s what you need to know
How one man silently infiltrated dozens of high-tech networks
Naked Security Live – When is a bug bounty not a bug bounty?
Egregor ransomware criminals allegedly busted in Ukraine
Schneier on Security
Friday Squid Blogging: Far Side Cartoonnew
The Problem with Treating Data as a Commodity
On Chinese-Owned Technology Platforms
Twelve-Year-Old Vulnerability Found in Windows Defender
Dependency Confusion: Another Supply-Chain Vulnerability
GPS Vulnerabilities
Friday Squid Blogging: Amazing Video of a Black-Eyed Squid Trying to Eat an Owlfish
Router Security
WEIS 2021 Call for Papers
Virginia Data Privacy Law
Browser Tracking Using Favicons
Malicious Barcode Scanner App
Linux Security
Microsoft: We've open-sourced this tool we used to hunt for code by SolarWinds hackers>
Sysdig Donates Module to CNCF to Improve Linux Security>
'We're finding bugs way faster than we can fix them': Google sponsors 2 full-time devs to improve Linux security>
Top Linux distro tells users: Stop using out of date versions, update your software now>
Red Hat closes StackRox Kubernetes security acquisition>
Windows Subsystem for Linux 2: The GUI features developers have been asking for>
Python programming language hurries out update to tackle remote code vulnerability>
Cheap baby monitors and security cameras – widespread flaw allows remote viewing>
To infinity and beyond: Linux and open-source goes to Mars>
Introducing Crowdsec: A Modernized, Collaborative Massively Multiplayer Firewall for Linux>
Linux Foundation offers free Node.js class>
Windows and Linux servers targeted by new WatchDog botnet for almost two years>
Dark Reading
NSA Releases Guidance on Zero-Trust Architecturenew
'Nerd' Humornew
The Edge Pro Tip: Fasten Your Seatbeltsnew
Securing Super Bowl LVnew
Attackers Turn Struggling Software Projects Into Trojan Horsesnew
After a Year of Quantum Advances, the Time to Protect Is Now
Inside Strata's Plans to Solve the Cloud Identity Puzzle
Microsoft Releases Free Tool for Hunting SolarWinds Malware
North Korea's Lazarus Group Expands to Stealing Defense Secrets
Ransomware, Phishing Will Remain Primary Risks in 2021
Thousands of VMware Servers Exposed to Critical RCE Bug
5 Key Steps Schools Can Take to Defend Against Cyber Threats
Securelist
The state of stalkerware in 2020
Lazarus targets defense industry with ThreatNeedle
Whitehat Security Blog
HITB News
Facebook to reverse Australia news ban after lawmakers alter bill
Twitter is now adding a controversial 'hacked materials' warning label to tweets
CEOs, Senators discuss mandating cyber-attack disclosures
Chinese hackers cloned a Windows security flaw stolen from the NSA
Pixel 5a leak shows a headphone jack, flat screen, and a familiar design
Facebook’s Petty Unfriending of Australia
Bitcoin’s price rises to $50,000 as mainstream institutions hop on
North Korea may have hacked into Pfizer servers looking for COVID data
New type of supply-chain attack hit Apple, Microsoft and 33 other companies
Lithuanian police investigate leak of 110,000 personal IDs
If Work Is Going Remote, Why Is Big Tech Still Building?
French IT monitoring company's software targeted by hackers: cyber agency
The RISKS Digest
His Lights Stayed on During Texas's Storm. Now He Owes $16,752
Current state of DDoS
Re: Incredibly poor software design costs Citigroup $500M
Re: Spy pixels in emails have become endemic'
John Deere Promised Farmers It Would Make Tractors Easy to Repair. It Lied.
Re: U.S. Water Supply Has Few Protections Against Hacking
UN discusses how not to kill the planet
Quantum networking progress
IRS trifecta -- not good news
Malware Is Now Targeting Apple's New M1 Processor
Future warfare will feature autonomous weaponry
Abbott appointees made 'astonishing' cuts to power reliability team
Kaspersky Blog
Cybersecurity in Johnny Mnemonic | Kaspersky official blog
Transatlantic Cable podcast, episode 190 | Kaspersky official blog
How, and why, to set up Off-Facebook Activity | Kaspersky official blog
What to do if your company gets attacked by ransomware | Kaspersky official blog
Transatlantic Cable podcast, episode 189 | Kaspersky official blog
How hackers use phishing to hijack sites through hosting provider
Kaspersky Transatlantic Cable podcast, episode 188 | Kaspersky official blog
Crypto scam on Discord uses fake news websites | Kaspersky official blog
Tips for private and safe dating on Tinder | Kaspersky official blog
How to run Flash in 2021, and why you shouldn’t
Kaspersky Transatlantic Cable podcast, episode 187 | Kaspersky official blog
CD Projekt confirms ransomware attack on internal system | Kaspersky official blog
Adam Shostack & friends
Linkedin Learning
My Year Without Flying
“Better OKRs Through Threat Modeling”
Threat Modeling and Social Issues
Irius Risk & Gary McGraw
Podcast on Using Games
Digital Guru Books
Humble Bundle: Good, Cheap Books
It’s 2021: Have you checked your backups?
Vaccines
Just the Great Conjunction of Saturn and Jupiter…shot from the moon
Dinosaur Feathers
Graham Cluley
Npower scraps app, and urges customers to change passwords, after data breach
Recorded Future’s free Cyber Daily newsletter brings trending threat insights straight to your inbox
Smashing Security podcast #216: Playboy, prison, and digital ploys – with Garry Kasparov
NurseryCam suffers data breach after security concerns raised
US charges North Korean hackers in relation to WannaCry, Sony Pictures attack, and an attempt to steal more than a billion dollars from banks
Breaking news: Facebook breaks news (and other pages) for Australian users
An appearance on the “Engage” podcast
Smashing Security podcast #215: Sexy cows banned on Facebook
Get trending threat insights delivered to your inbox with Recorded Future’s free Cyber Daily newsletter
Could an ex-employee be planting ransomware on your firm’s network?
NurseryCam has serious security issues, claims researcher
After hackers blackmailed their clients, Finnish therapy firm declares bankruptcy
Rapid7
Celebrating Black History Today and Every Daynew
Building a Holistic VRM Strategy That Includes the Web Application Layer
Multiple Unauthenticated Remote Code Control and Execution Vulnerabilities in Multiple Cisco Products
VMware vCenter Server CVE-2021-21972 Remote Code Execution Vulnerability: What You Need to Know
Software Engineering, Vulnerability and Risk Management: Revolutionizing the Security Landscape at Rapid7
How to Combat Alert Fatigue With Cloud-Based SIEM Tools
Take the Full-Stack Approach to Securing Your Modern Attack Surface
Securing Your Web App, One Robot at a Time
Why More Teams are Shifting Security Analytics to the Cloud This Year
Monitor Google Cloud Platform (GCP) Data With InsightIDR
Talkin’ SMAC: Alert Labeling and Why It Matters
New InsightVM Dashboard Helps You Discover Significant Changes in Your Environment from the Past 30 Days
Hacker News (YCombinator) - Security
SolarWinds CEO blames intern for password leaknew
Falling sperm counts could threaten the human race
Facebook is pushing back on Apple’s new iPhone privacy rules
Show HN: Doppler Share – Share one-off secrets with end-to-end encryption
Protest note about user privacy changes by Reddit
Spy pixels in emails have become endemic (BBC)
SiPearl Lets Rhea Design Leak: 72x Zeus Cores, 4x HBM2E, 4-6 DDR5
GNU Taler – Payment system for privacy-friendly, fast, easy online transactions
Indian Government's Volunteer Programme to Report 'Anti-National' Content
Amazon insiders sound alarm over security
Hundreds of workers at cybersecurity agency vote to strike
Show HN: Horcrux, a Playground for Shamir Secret Sharing
Hacker Noon #Security
Security Exchange Commission SEC Has Officially Delisted Long Blockchain Corporationnew
Bitcoin On The Brink of Mass Adoption. Whither Next?new
10 Ways to Reduce Data Loss and Potential Downtime Of Your Databasenew
How Piwik built a Google Analytics alternative out of an open-source projectnew
Software Developers' Top 12 Secure Software Development Lifecycle (SSDL) practices by Microsoft
Simple Steps to Follow in Order to Ensure Greater Personal Internet Privacy
Send Offline Functionality (SOF) to Transact XinFin's XDC Coins
Delete Your Old Tweets: 90% of Employers Consider Your Social Media Activity When Hiring
6 Deep Learning Techniques for Stronger Cybersecurity
A Honeypot Experiment Shows How Long It Takes To Get Hacked
Privacy Communities: Blockchain-Based Networks Rise After the Breakdown of Tech Giants
An Introduction to Adversarial Attacks and Defense Strategies

Security in Mainstream Media