Afraid of missing important security news during the week? We’re here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!
For the less technical
- Computer historians crack passwords of Unix’s early pioneers
- University hacker remained hidden behind ‘shadow ecosystem’ for six weeks
- Imperva notifies Cloud WAF customers of security incident
- France to become first EU country to use nationwide facial recognition ID app
- China’s new weapon of choice is your face
- Singapore man faces 34 years for Amazon AWS cryptomining fraud
- Tech companies reported over 45 million online photos and videos of children being sexually abused
- Iranian hackers target Trump campaign as threats to 2020 mount
For the more technical
- Short October Patch Tuesday includes Remote Desktop Client, browser, and authentication patches
- Android Security Bulletin—October 2019
- CVE-2019-16905 – OpenSSH pre-auth XMSS integer overflow
- CVE-2019-16928: Exploiting an Exim vulnerability via EHLO strings
- Critical security issue identified in iTerm2 as part of Mozilla open source audit
- Drupalgeddon2 still used in attack campaigns
- Rusty Joomla RCE + exploit
- DHS and FDA warn about much broader impact of Urgent/11 vulnerabilities
- Multiple D-Link routers found vulnerable to unauthenticated remote code execution
- HP Touchpoint Analytics – DLL search-order hijacking – potential abuses (CVE-2019-6333)
- Multiple vulnerabilities in Schneider Electric Modicon M580
- R7-2019-32: Denial-of-Service vulnerabilities in Beckhoff TwinCAT PLC environment
- Picking unwanted UEFI components out of millions of samples
- X-ray tech lays chip secrets bare
- Planting tiny spy chips in hardware can cost as little as $200
- Intel proposes new SAPM memory type to protect against Spectre-like attacks
- Improper input validation on dbell smart doorbell can lead to attackers remotely unlocking door
- App analysis: Bird
- FBI warns about attacks that bypass multi-factor authentication (MFA)
- Staying hidden on the endpoint: Evading detection with shellcode
- How my application ran away and called home from Redmond
- Apple zero-day exploited in new BitPaymer campaign
- Leveraging Apple Remote Desktop for good and evil
- macOS systems abused in DDoS attacks
- COMpfun successor Reductor infects files on the fly to compromise TLS traffic
- ESET discovers Attor, a spy platform with curious GSM fingerprinting (PDF)
- Morocco: Human rights defenders targeted with NSO Group’s spyware
- Mahalo FIN7: Responding to the criminal operators’ new tools and techniques
- FIN6 compromised e-commerce platform via Magecart to inject credit card skimmers into thousands of online shops
- Magecart: New research shows the state of a growing threat
- Sesame Street among many Volusion customers are compromised
- Ransomware Muhstik target hacks back, drops decryption keys
- Tor Project: Removing end-of-life relays from the network
- A sniffer for Bluetooth 5 and 4.x LE
- Pair locking your iPhone with Configurator 2
Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.