Varying amounts of money can be earned from an exploit broker, the dark web or from bug bounty programs
Restrictive legislation will force device makers to pre-install local apps
The Trail of Bits Assurance practice has received an influx of Go projects, following the success of our Kubernetes assessment this summer. As a result, we’ve been adapting for Go projects some of the security assessment techniques and tactics we’ve used with other compiled languages. We started by...
Over 440,000 customers may have been affected
Politicians already spreading misinformation on social network
Parsing is hard, even when a file format is well specified. But when the specification is ambiguous, it leads to unintended and strange parser and interpreter behaviors that make file formats susceptible to security vulnerabilities. What if we could automatically generate a “safe” subset of any file...
Aventura Technologies allegedly passed off Chinese-made equipment with known cybersecurity flaws as its own
Companies can practice responding to cyber-attacks at three new centers
TL;DR: x86_64 decoding is hard, and the number and variety of implementations available for it makes it uniquely suited to differential fuzzing. We’re open sourcing mishegos, a differential fuzzer for instruction decoders. You can use it to discover discrepancies in your own decoders and analysis to...
Miami-Dade cops are making eyes at Pinellas County Sheriff's FACES
FOI figures come from just 23 forces
Recently, security researchers discovered that Apple was sending safe browsing data to Tencent for all Chinese users. This revelation has brought the underlying security and privacy guarantees of the safe browsing protocol under increased scrutiny. In particular, safe browsing claims to protect user...
London is taking aerial threats seriously
Remediation lag linked to increase in heart attacks
A few weeks ago I had the inspiring experience of attending the annual Grace Hopper Celebration (GHC), the world’s largest gathering of women in technology. Over four days in Orlando, Florida, GHC hosted a slew of workshops and presentations, plus a massive career fair with over […]
A vulnerability made it possible to intercept Wi-Fi network credentials
Cybersecurity firm Trend Micro has fallen victim to an insider threat
MITRE just updated the ATT&CK Framework to include Cloud TTPs.
The update includes techniques for stealing cookies from machines and using them for lateral movement. These are the two techniques I helped contribute to the matrix:
Credential Access - Steal Web Session Cookie Lateral Movement - We...
Phishing attack report reveals PayPal as the most imitated brand
Observe the landscape, understand where your vulnerabilities are and detect attacks