The security community scrambled to unpack Krack, a fundamental vulnerability in the ubiquitous, secure Wi-Fi network standard known a WPA2. Though some of the most popular devices are mercifully already protected (like most of those that run Windows and iOS), a staggering population remains exposed to data theft and manipulation every time they connect to
CS Digest Section: Network Security
CVE-2017-11779 fixed by Microsoft in October of 2017, covers multiple memory corruption vulnerabilities in the Windows DNS client. The issues affect computers running Windows 8/ Server 2012 or later, and can be triggered by a malicious DNS response. An attacker can exploit this issue to gain arbitrary code execution in the context of the application that
Two US government agencies have united forces to coordinate the creation of a new set of standards aimed at securing the process of routing of information between major Internet entities, such as Internet Service Providers, hosting providers, cloud providers, educational, research, and national networks. The solution they developed is actually a
Cable Internet with download and upload speeds of 10Gbps may eventually come to American homes thanks to a new specification for higher-speed, symmetrical data transmissions.
On September 5, 2017, the Apache Software Foundation released security bulletins that disclosed three vulnerabilities in the Apache Struts 2 package. Of these vulnerabilities, the Apache Software Foundation classifies one as Critical Severity, one as Medium Severity, and one as Low Severity.
Almost two weeks ago, we reported how unknown attackers managed to compromise the Chrome Web Store account of a developer team and hijacked Copyfish extension, and then modified it to distribute spam correspondence to users.
"This technique uses AES encryption instead of B64 or simple XOR routines write new content to the page at load time," said a Ring 0 Labs representative in an email to Threatpost. "Since this is a newer technique, it can be fairly effective at avoiding scanning services and crawlers that aim to detect these types of sites. But like anything, these services
Marcus Hutchins, the researcher, was widely praised for identifying a way to disable the WannaCry malicious software, or malware, attack that seized hundreds of thousands of computers this year. Researchers credited Mr. Hutchins’s discovery of a so-called kill switch in the malware for stopping its spread and preventing the attack from infecting millions
The attack works on any Docker installation which exposes its API through TCP, which has (until recently) been the default for Windows PCs running Docker for Windows, an application used by developers to create and test containerized applications. "The attack endgame is a persistent remote code execution within the enterprise’s network," Dulce said.
More than 750 domain names were hijacked through the internet's own systems, registrar Gandi has admitted. Late last week, an unknown individual managed to get hold of the company's login to one of its technical providers, which then connects to no fewer than 27 other top-level domains, including .asia, .au, .ch, .jp and .se. Using that login, the