Afraid of missing important security news during the week? We’re here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!
For the less technical
- Polish e-Dowód management tool violates OpenSC LGPL license
- Cloudflare: Moving from reCAPTCHA to hCaptcha
- NSO Group: Facebook tried to license our spyware to snoop on its own addicts – the same spyware it’s suing us over
- Thousands of Zoom video calls left exposed on open Web
- Email provider got hacked, data of 600,000 users now sold on the dark web
- Ransomware scumbags leak Boeing, Lockheed Martin, SpaceX documents after contractor refuses to pay
- Hacker exploits flaw in decentralized bitcoin exchange Bisq to steal $250K
- Russian telco hijacks internet traffic for Google, AWS, Cloudflare, and others
- We hacked a Ford Focus and a Volkswagen Polo
For the more technical
- [VIDEO] VirSecCon2020 – conference materials (≈7h)
- Phishing for SYSTEM on Microsoft Exchange (CVE-2020-0688)
- Hover_with_Power: Steps to reproduce the exploit
- A secret note to Bug hunters about URL structure and its parsers
- Several critical vulnerabilities on most HP machines running Windows
- Learn XPC exploitation – Part 1: Broken cryptography
- Android Security Bulletin—April 2020
- Breaking LastPass: Instant unlock of the password vault
- How we abused Slack’s TURN servers to gain access to internal services
- Can G Suite admin read my email?
- How to protect Serverless (Open)API’s?
- New dark_nexus IoT botnet puts others to shame
- DarkHotel hackers use VPN zero-day to breach Chinese government agencies
- Decade of the RATs: Novel APT attacks targeting Linux, Windows and Android
- Zero-day exploitation increasingly demonstrates access to money, rather than skill — intelligence for vulnerability management
- ITG08 (aka FIN6) partners with TrickBot gang, uses Anchor framework
- Kinsing malware attacks targeting container environments
- Unkillable xHelper and a Trojan matryoshka
- Automatic uncovering of hidden behaviors from input validation in mobile apps (PDF)
- iOS exploit chain deploys LightSpy feature-rich malware
- Don’t let fleeceware sneak into your iPhone
- Microsoft shares new threat intelligence, security guidance during global crisis
- Spam and phishing in 2019
- Clever cryptography could protect privacy in Covid-19 contact-tracing apps
- Fingerprint cloning: Myth or reality?
- Microsoft buys Corp.com so bad guys can’t
- Justdelete.me – a directory of direct links to delete your account from web services
Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.