Afraid of missing important security news during the week? We’re here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!
For the less technical
- The NSA phone surveillance program was illegal and expensive: And it did not stop a single terrorist attack
- A prison video visitation service exposed private calls between inmates and their attorneys
- Universities are using surveillance software to spy on students
- ICO fines British Airways £20m for data breach affecting more than 400,000 customers
- German authorities raid FinFisher offices
- 20 arrests in QQAAZZ multi-million money laundering case
- Officials announce international operation targeting transnational criminal organization QQAAZZ
- Ubisoft, Crytek data posted on ransomware gang’s site
- Barnes & Noble hit by cyberattack that exposed customer data
- Bitcoin wallet update trick has netted criminals more than $22 million
- Five Eyes governments, India, and Japan make new call for encryption backdoors
- United States, six other nations ask tech companies to build backdoors to encrypted communications
- Microsoft will adopt Google Chrome’s controversial Manifest V3 in Edge
For the more technical
- Microsoft October 2020 Patch Tuesday
- Top reason to apply October, 2020’s Microsoft patches: Ping of Death Redux
- CVE-2020-16898 – Exploiting “Bad Neighbor” vulnerability
- Mutation XSS via namespace confusion – DOMPurify bypass
- Nano Defender has been sold to Turkish Developers and is now collecting personal data
- SonicWall VPN portal critical flaw (CVE-2020-5135)
- Linux: Heap-based type confusion in L2CAP (BleedingTooth)
- Linux: Stack-Based Information Leak in A2MP (BleedingTooth)
- Linux: Heap-Based Buffer Overflow in HCI event packet parser (BleedingTooth)
- Research: Can you build spyware for a Fitbit?
- Code execution via the Windows Update client (wuauclt)
- How to find vulnerabilities in code: Bad words
- Different ways to authenticate your APIs
- Exposing covert surveillance backdoors in children’s smartwatches
- APT actors chaining vulnerabilities against SLTT, critical infrastructure, and elections organizations
- The state of exploit development: 80% of exploits publish faster than CVEs
- “Front Door” into BazarBackdoor: Stealthy cybercrime weapon
- Trickbot disrupted
- Lemon Duck brings cryptocurrency miners back into the spotlight
- Exponential growth in DDoS attack volumes
- Twitter Investigation Report
- Shady deals: The destructive relationship between network access sellers and ransomware groups
- KELA’s 100 over 100: September 2020 in network access sales
- IAmTheKing and the SlothfulMedia malware family
- FIN11: Widespread email campaigns as precursor for ransomware and data theft
- Mapping malware use of open source offensive security tools (PDF) + OST Map
- Orca Security 2020 State of Virtual Appliance Security Report (PDF)
- How we’re tackling evolving online threats
- The Geography of BEC: The Global Reach of the World’s Top Cyber Threat (PDF)
Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.