Afraid of missing important security news during the week? We’re here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!
For the less technical
- 2019 Pwnie Award winners
- Microsoft’s Windows Defender is now one of the best antivirus apps in the world
- Understanding why phishing attacks are so effective and how to mitigate them
- US files lawsuit against Bitcoin exchange that helped launder ransomware profits
- Apple seeks to shut down Corellium’s ‘perfect replicas’ of iOS
- Second Life is plagued by security flaws, ex-employee says
- Major breach found in biometrics system used by banks, UK police and defence firms
- High-security locks for government and banks hacked by researcher
- Never-Googlers: Web users take the ultimate step to guard their data
For the more technical
- The first issue of Paged Out! (PDF)
- Patch new wormable vulnerabilities in Remote Desktop Services (CVE-2019-1181/1182)
- Microsoft’s August 2019 Patch Tuesday fixes 93 vulnerabilities
- Windows CTF flaws enable attackers to fully compromise systems
- New Dragonblood vulnerabilities found in WiFi WPA3 standard
- KNOB Attack: Breaking Bluetooth security
- Gaining code execution using a malicious SQLite database
- Screwed drivers – signed, sealed, delivered
- Huge survey of firmware finds no security gains in 15 years
- New HTTP/2 flaws expose unpatched web servers to DoS attacks
- Spying on HTTPS
- Threat hunting using DNS firewalls and data enrichment
- Kasper-Spy: Kaspersky Anti-Virus puts users at risk
- Canon DSLR camera infected with ransomware over the air
- A remote-start app exposed thousands of cars to hackers
- Investigating CAN bus network integrity in avionics systems
- Cerberus – a new banking trojan from the underworld
- Gootkit banking trojan – deep dive into anti-analysis features
- The curious case of a fileless TrickBot infection
- LokiBot gains new persistence mechanism, uses steganography to hide its tracks
- New Remcos RAT arrives via phishing email
- The Hidden Bee infection chain: the stegano pack
- Malware naming Hell: taming the mess of AV detection names
- Recent Cloud Atlas activity
- Keeping a hidden identity: Mirai C&Cs in Tor network
- Inside malware markets: current trends and competitive forces
- Malvertising: Online advertising’s darker side
- Adware posing as 85 photography and gaming apps on Google Play installed over 8 million times
- Phishing campaigns imitating CEOs bypass Microsoft Gateway to target energy sector
- 100% JavaScript phishing page
- The good, the bad and the non-functional, or “how not to do an attack campaign”
- Confidential company documents exposed in public sandboxes
- How Facebook catches bugs in its 100 million lines of code
- Showing vulnerability to a machine: automated prioritization of software vulnerabilities
- From email to phone number, a new OSINT approach
- Username (and password) free login with security keys
- Google will now let Android users log in to some services without a password + more information
- New Research: Lessons from Password Checkup in action
- Reversing an Oppo ozip encryption key from encrypted firmware
- Extended mobile forensics: analyzing desktop computers
- These legit-looking iPhone lightning cables will hijack your computer
- Making it Rain shells in Kubernetes
- Commando VM 2.0: Customization, containers, and Kali
Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.