Information Management Today

Google links three exploitation frameworks to Spanish commercial spyware vendor Variston

Security Affairs

NOVEMBER 30, 2022

Google’s Threat Analysis Group (TAG) linked three exploitation frameworks to a Spanish surveillance spyware vendor named Variston. While tracking the activities of commercial spyware vendors, Threat Analysis Group (TAG) spotted an exploitation framework likely linked Variston IT, a Spanish firm. ” TAG concludes.

Archiving

Archiving Risk Government IT

China-linked APT Curious Gorge targeted Russian govt agencies

Security Affairs

MAY 3, 2022

China-linked Curious Gorge APT is targeting Russian government agencies, Google Threat Analysis Group (TAG) warns. Google Threat Analysis Group (TAG) reported that an APT group linked to China’s People’s Liberation Army Strategic Support Force (PLA SSF), tracked as Curious Gorge , is targeting Russian government agencies.

Manufacturing

Manufacturing Phishing Passwords Military

Patch Tuesday, December 2018 Edition

Krebs on Security

DECEMBER 11, 2018

The weakness, which is present on all support versions of Windows, is tagged tagged with the less severe “important” rating by Microsoft mainly because it requires an attacker to be logged on to the system first. Adobe will stop supporting Flash at the end of 2020.

Security

Security IT

Webinars

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

MORE WEBINARS

Security Affairs newsletter Round 357 by Pierluigi Paganini

Security Affairs

MARCH 13, 2022

Is it fake news? CVE-2022-0492 flaw in Linux Kernel cgroups feature allows container escape Charities and NGOs providing support in Ukraine hit by malware.

Security

Security Data breaches Ransomware Manufacturing

In 2022, more than 40% of zero-day exploits used in the wild were variations of previous issues

Security Affairs

JULY 30, 2023

The popular Threat Analysis Group (TAG) Maddie Stone wrote Google’s fourth annual year-in-review of zero-day flaws exploited in-the-wild [ 2021 , 2020 , 2019 ], it is built off of the mid-year 2022 review. ” reads the report published by Google TAG.

IT

IT Security Information Security

A new DDoS technique abuses HTML5 Hyperlink Audit Ping in massive attacks

Security Affairs

APRIL 15, 2019

In this case, attackers used a common HTML5 attribute, the <a> tag ping, to trick these users to unwittingly participate in a major DDoS attack that flooded one web site with approximately 70 million requests in four hours.” This was the first case of a DDoS attack using the <a> tag ping attribute.

Security

Security IT

Weekly Vulnerability Recap – October 9, 2023 – Zero-Days Strike Android, Microsoft, Apple, Cisco & More

eSecurity Planet

OCTOBER 9, 2023

Researchers from Google’s Threat Analysis Group (TAG) and Project Zero uncovered the weakness, which is connected to unauthorized access to freed memory, possibly allowing attackers to corrupt or change sensitive data. Arm also published two additional vulnerabilities, CVE-2023-33200 and CVE-2023-34970.

Libraries

Libraries Ransomware Access Security

Humans are Bad at URLs and Fonts Don’t Matter

Troy Hunt

OCTOBER 28, 2020

Here's a beautiful illustration of the problem: If you look at the address bar in the current version of Firefox, your eyes tell you you're looking at apple.com yet if you look at the title of the tab, you realise you're not on the tech giant's website at all rather you're on ?????.com com instead.

Phishing

Phishing Passwords Education IT

Google TAG warns that Russian COLDRIVER APT is using a custom backdoor

Security Affairs

JANUARY 18, 2024

Google TAG researchers warn that COLDRIVER is evolving tactics, techniques and procedures (TTPs), to improve its detection evasion capabilities. Recently, TAG has observed COLDRIVER delivering custom malware via phishing campaigns using PDFs as lure documents. ” reads TAG’s analysis. ” concludes the report.

Phishing

Phishing Encryption Military Archiving

Types of Sites and Site Collections in SharePoint 2013

JKevinParker

JUNE 21, 2014

Actually, they just inserted empty cells, which both Firefox and Internet Explorer failed to render for me. While I'm at it, the headings should use TH tags instead of TDs. These TH tags should be scoped as "col" for column. The entire header row should be wrapped in a THEAD tag.

Libraries

Libraries Records Management Access Communications

Subresource Integrity and Upgrade-Insecure-Requests are Now Supported in Microsoft Edge

Troy Hunt

MAY 1, 2018

Edge now joins the other major browsers in rejecting any script which doesn't hash down to the value specified in the integrity tag. That UserVoice idea goes back to August 2014, Chrome started supporting SRI in September 2015 and Firefox followed a few months later in December. This has been a long time coming.

IT

IT Security Government

Firefox cross-domain text theft.

Scary Beasts Security

DECEMBER 17, 2008

Here's the second bug from my PacSec presentation, and it's another Firefox one; kudos to the Firefox security team for their responsiveness. It involves, yes, a cross-domain tag. This particular bug involves Firefox's window.onerror handler, which reports on JavaScript parse and execution errors.

Authentication

Authentication Security IT

Patch Tuesday, February 2019 Edition

Krebs on Security

FEBRUARY 12, 2019

Adobe labels it an “important” bug, while Microsoft tags it with a far more severe “critical” label. Firefox also forces users with the Flash add-on installed to click in order to play Flash content; instructions for disabling or removing Flash from Firefox are here.

Security

Security IT Access

This is the old ChiefTech blog.: You heard it here first. the online desktop vs offline Webapp debate

ChiefTech

MARCH 28, 2007

Firefox has already said it is looking to add support for offline applications into its next version. If this happens, it will be bad news for Apollo - because Firefox users are not going to switch. Technorati tags: Offline Webapps , Adobe Apollo , Read/WriteWeb at 10:16 PM View blog reactions 2comments: Graham Chastney said.

IT

IT Paper Archiving Cloud

This is the old ChiefTech blog.: The trials of churning and porting

ChiefTech

JULY 17, 2007

BTW I gave in a installed Google Gears (using portable Mozilla Firefox ) so I could take my RSS feeds offline, but to be honest its still less than satisfactory; unless I replicate the whole of the Internet offline I cant follow up any of the interesting links anyway.

Paper

Paper Archiving IT

This is the old ChiefTech blog.: Reflections on mashing my Blogosphere

ChiefTech

APRIL 15, 2007

Technorati tags: Mashing , Yahoo! Its now humming along about as good as its going to be within the current limits of Yahoo! Still, technical problems aside, Im enjoying this new feed Ive created and Ive also started to use the My Cosmos Feed pipe to explore the cosmos around other bloggers. Stay tuned!

Paper

Paper Archiving IT

This is the old ChiefTech blog.: Looks like your Teqlo session has expired.

ChiefTech

FEBRUARY 15, 2007

For the record I known that Teqlo is in beta and Im using the portable version of FireFox and that may have caused a problem, however I had no issues with getting into Yahoo! Technorati tags: Teqlo , Mashups , Enterprise Mashups , Rod Boothby at 6:51 AM View blog reactions 1 comments: Rod said. Pipes using it.

Passwords

Passwords Paper Archiving IT

Add-ons, Extensions and CSP Violations: Playing Nice with Content Security Policies

Troy Hunt

NOVEMBER 14, 2018

Some brief background first as I'll be sharing this post with a bunch of folks for which this may be new: A CSP is a response header or meta tag that allows you to declare a policy for your website declaring what sorts of content can be loaded from where. into the pages.

Security

Security IT Libraries Access

This is the old ChiefTech blog.: ThinkFree Portable Review

ChiefTech

APRIL 22, 2007

Also worth checking out is the server-based edition - in fact I think this combined with offline access would be a great combination for larger organisatons.

Retail

Retail Records Management Paper Archiving

This is the old ChiefTech blog.: The first step in creating a mash-up is.

ChiefTech

FEBRUARY 17, 2007

After registering again sans space in my username , I had only one more hurdle to cross - installing the Flash plugin into Portable Firefox. Technorati tags: Teqlo , Rod Boothby , Yahoo! I finally got the Teqlo public beta humming along. Once you get in Teqlo , there isnt really a lot to see yet. programming environment.

Paper

Paper Archiving Access IT

Security Keys

Imperial Violet

MARCH 26, 2018

However, no browser ever implemented that API prior to a forthcoming (at the time of writing) version of Firefox. Extensions for Firefox were also available prior to native support in that browser.). Extensions for Firefox were also available prior to native support in that browser.).

Security

Security Passwords Authentication Phishing

Bypassing Browser Security Warnings with Pseudo Password Fields

Troy Hunt

NOVEMBER 2, 2017

That really ramped up in Jan when both Chrome and Firefox started displaying warnings when a login form was served insecurely. No really, someone has actually done this: Frustrated by Firefox's pesky security warnings about insecure login forms scaring your users? Not everyone was happy about this because hey, HTTPS is hard, right?

Passwords

Passwords Security IT

The Hacker Mind Podcast: Hacking the Art of Invisibility

ForAllSecure

MARCH 1, 2022

And I’m not talking about services that can quote remove your buddy’s Instagram photos where you are tagged doing something Not Safe For Work. Why use TOR instead of Firefox or chrome? You're also not just going to go online, you're going to use a special browser you're going to use Tor.

Privacy

Privacy IT Passwords Encryption

I'm Open Sourcing the Have I Been Pwned Code Base

Troy Hunt

AUGUST 7, 2020

Let me explain: HIBP Has Always Been Open in Spirit I've already written extensively about the architecture of the system across many of the 128 previous blog posts tagged as Have I Been Pwned. The very second blog post on that tag was about how I used Azure Table Storage to make it so fast and so cheap. Glenford Williams ????

Passwords

Passwords IT Privacy Libraries

Dashlane vs. 1Password: Compare Top Password Managers for 2021

eSecurity Planet

MAY 14, 2021

You can also create tags to group related items, like financial information and social media accounts, or favorite items you use frequently. Both platforms support web apps and extensions for all major browsers, including Safari, Edge, Chrome, and Firefox. 1Password’s mobile app is simple and easy to navigate.

Passwords

Passwords Encryption Authentication Access

Firefox fixes CSS-based cross-origin theft issue

Scary Beasts Security

JULY 22, 2010

Firefox just released version 3.6.7 For interesting background reading, see: [link] Turns out, the same character set override applies to loading cross-origin CSS via the tag. For interesting background reading, see: [link] Turns out, the same character set override applies to loading cross-origin CSS via the tag.

IT

This is the old ChiefTech blog.: Google vs Offline Web 2.0 Applications?

ChiefTech

FEBRUARY 26, 2007

Thats hard -- but not so hard that Google engineers cant figure it out, especially with some help from Firefox, Adobe, and others trying to weaken the Microsoft monopoly (see Rob Drurys post on this topic)." DOM Storage is designed to provide a larger, securer, and easier-to-use alternative to storing information in cookies.

Access

Access Paper Archiving IT

A more plausible E4X attack

Scary Beasts Security

MAY 20, 2009

Firefox has had an implementation for quite some time but no other major browser seems to have followed suit. You'll need Firefox to see the popup alert indicating cross-domain XML theft: [link] The attack works by cross-domain including the XML formatted inbox into the attacker's page via. First, you'll want to see it in action.

Security

Security IT

Is India's Aadhaar System Really "Hack-Proof"? Assessing a Publicly Observable Security Posture

Troy Hunt

JANUARY 10, 2018

These are enormously useful for everything from blocking unauthorised external assets from being loaded into the page to prohibiting script tags from being injected to even fixing up content being insecurely embedded such as we saw with that commented out YouTube video.

Security

Security Government Encryption Risk

This is the old ChiefTech blog.: Popfly, some bugs, but a step in the right direction

ChiefTech

MAY 26, 2007

However, I wont hide my ongoing disappointment of Web-based applications that require the latest browser ( Internet Explorer or Firefox only) and yet another plugin (in this case Silverlight ) to operate correctly. Technorati tags: Popfly , Microsoft , Silverlight , Teqlo , Yahoo!

Libraries

Libraries Paper Archiving IT

Information Management Today

Google links three exploitation frameworks to Spanish commercial spyware vendor Variston

China-linked APT Curious Gorge targeted Russian govt agencies

Webinars

Trending Sources

Patch Tuesday, December 2018 Edition

Webinars

Security Affairs newsletter Round 357 by Pierluigi Paganini

In 2022, more than 40% of zero-day exploits used in the wild were variations of previous issues

A new DDoS technique abuses HTML5 Hyperlink Audit Ping in massive attacks

Weekly Vulnerability Recap – October 9, 2023 – Zero-Days Strike Android, Microsoft, Apple, Cisco & More

Humans are Bad at URLs and Fonts Don’t Matter

Google TAG warns that Russian COLDRIVER APT is using a custom backdoor

Types of Sites and Site Collections in SharePoint 2013

Subresource Integrity and Upgrade-Insecure-Requests are Now Supported in Microsoft Edge

Firefox cross-domain text theft.

Patch Tuesday, February 2019 Edition

This is the old ChiefTech blog.: You heard it here first. the online desktop vs offline Webapp debate

This is the old ChiefTech blog.: The trials of churning and porting

This is the old ChiefTech blog.: Reflections on mashing my Blogosphere

This is the old ChiefTech blog.: Looks like your Teqlo session has expired.

Add-ons, Extensions and CSP Violations: Playing Nice with Content Security Policies

This is the old ChiefTech blog.: ThinkFree Portable Review

This is the old ChiefTech blog.: The first step in creating a mash-up is.

Security Keys

Bypassing Browser Security Warnings with Pseudo Password Fields

The Hacker Mind Podcast: Hacking the Art of Invisibility

I'm Open Sourcing the Have I Been Pwned Code Base

Dashlane vs. 1Password: Compare Top Password Managers for 2021

Firefox fixes CSS-based cross-origin theft issue

This is the old ChiefTech blog.: Google vs Offline Web 2.0 Applications?

A more plausible E4X attack

Is India's Aadhaar System Really "Hack-Proof"? Assessing a Publicly Observable Security Posture

This is the old ChiefTech blog.: Popfly, some bugs, but a step in the right direction

Stay Connected