Recent Posts
Sudo bug lets non-privileged users run as root if pwfeedback is enabled
A new vulnerability in Sudo has been discovered, allowing non-privileged users to execute arbitrary commands as 'root' if the environment is configured with pwfeedback . This was discovered by Joe Vennix of Apple Information Security, who also…
Micropatching the JScript 0-day vulnerability CVE-2020-0674
Just four days after the January 17th, 2020 discovery of a 0-day exploit affecting Internet Explorer's jscript.dll , 0patch have released their analysis of the vulnerable code, along with a micropatch for the 18 bytes that need to change to…
The NIST publishes a new privacy framework
The National Institute of Standards and Technology (NIST), who has previously published Digital Identity Guidelines and a Cybersecurity Framework , has published a Privacy Framework . This framework is useful when developing new products and…
Mozilla has banned 197 Firefox add-ons in the past two weeks
Over the past two weeks, Mozilla has banned nearly 200 Firefox add-ons that were caught executing malicious code, stealing user data, or using obfuscation to hide their behavior. These add-ons have been banned and removed from the add-on store, and…
Chrome Web Store has temporarily suspending publishing or updating paid Chrome extensions
The Chrome Web Store is experiencing a wave of fradulent transactions, and has temporarily suspending publishing and updating paid Chrome extensions. Google engineers described the fradulent transactions as happening "at scale", and Simeon Vincent…
New Muhstik Botnet Attacks Target Tomato Routers
Muhstik is a malware that originally started as a variant of the QNAPCrypt ransomware in October 2019, and was later outfitted with additional attacks for bruteforcing SSH, Wordpress and Drupal credentials, and a few other tools. Exploited devices…
250 Million Microsoft Customer Support Records Exposed Online
On December 5th, 2019, more than 250 million customer support services records dating back to 2005 were exposed due to misconfigured access controls for five Elasticsearch databases. Bob Diachenko discovered these exposed systems on December 29th…
Hacker leaks more than 500k IoT telnet credentials
A hacker has recently published a list of over 515,000 telnet credentials for IoT devices. Telnet is one of the original remote terminal protocols, originating in 1969, and has waned in usage significantly in favour of SSH due to the numerous…
Securing a Linux Server
It is a rarity to watch someone secure a freshly installed server right off the bat, yet the world we live in makes this a necessity. So why do so many people put it off until the end, if at all? I've done the exact same thing, and it often comes…