RSS Reader for Computer Security Articles
Credit to Author: Lily Hay Newman| Date: Wed, 22 Nov 2017 16:05:00 +0000
This year, a team of Labrador retrievers trained to sniff out body-worn explosives will help lock down NYC’s Macy’s Thanksgiving Day Parade.
Read MoreCredit to Author: Elisa Lippincott (TippingPoint Global Product Marketing)| Date: Wed, 22 Nov 2017 14:10:15 +0000
It’s that time of year again, when many will gather with their families, eat way too much, and catch those crazy Black Friday sales. I’ve been seeing “Black Friday” sales for almost two weeks now. Cyber Monday, which falls on the Monday after the U.S. Thanksgiving holiday, is probably going to be coupled with news…
Credit to Author: Alex Perekalin| Date: Wed, 22 Nov 2017 14:00:46 +0000
Can’t resist the convenience of free Wi-Fi? Here’s a way to make it secure.
Read More
Credit to Author: Lucas Mearian| Date: Wed, 22 Nov 2017 03:34:00 -0800
As enterprises push ahead with mobile-first strategies – and employee smartphones and tablets increasingly becoming business tools – the importance of mobile threat defense (MTD) is growing.
Using mobile threat detection and defense, however, is no small task; the technology must cover applications, networks and device-level threats to iOS and Android phones and tablets to be effective.
“We talk about mobile threat defense, rather than detection – the reason being these solutions not only detect, but also can prevent and remediate threats,” said Dionisio Zumerle, research director for mobile security at Gartner.
The MTD market is growing in terms of adoption, and has started to attract attention from endpoint protection platform (EPP) vendors and in other related markets, according to a recent report from Gartner.
Credit to Author: Issie Lapowsky| Date: Wed, 22 Nov 2017 11:00:00 +0000
Former staffers of the State Department’s Global Engagement Center, tasked with fighting propaganda, say that ‘administrative incompetence’ has hamstrung efforts.
Read More
Credit to Author: Andy Greenberg| Date: Wed, 22 Nov 2017 00:56:09 +0000
The ridesharing service’s latest scandal combines routine security negligence with an “appalling” coverup.
Read More
Credit to Author: SSD / Maor Schwartz| Date: Tue, 21 Nov 2017 12:14:39 +0000
Vulnerabilities summary The following advisory describes 2 (two) vulnerabilities found in DblTek webserver. DBL is “specialized in VoIP products, especially GoIPs. We design, develop, manufacture, and sell our products directly and via distributors to customers. Our GoIP models now cover 1, 4, 8, 16, and 32-channel in order to meet the wide range of market … Continue reading SSD Advisory – DblTek Multiple Vulnerabilities
Read More
Credit to Author: SSD / Maor Schwartz| Date: Tue, 21 Nov 2017 08:58:38 +0000
漏洞概要 以下安全公告描述了在GraphicsMagick中发现的两个漏洞。 GraphicsMagick是“图像处理方面的瑞士军刀。 基础包中的源码共有267K行(根据David A. Wheeler统计)，它提供了强大而有效的工具和库，支持读，写超过88种主要图像处理格式，包括DPX，GIF，JPEG，JPEG-2000，PNG，PDF，PNM和TIFF等重要格式。 在GraphicsMagick中发现的两个漏洞是： 内存信息泄露 堆溢出 漏洞提交者 一位独立的安全研究人员Jeremy Heng（@nn_amon）和Terry Chia（Ayrx）向 Beyond Security 的 SSD 报告了该漏洞 厂商响应 厂商已经发布了这些漏洞的补丁(15237:e4e1c2a581d8 and 15238:7292230dd18)。获取更多信息： ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txt 漏洞详细信息 内存信息泄露 GraphicsMagick易受到magick/describe.c文件的DescribeImage函数中存在内存信息泄露漏洞影响。 负责打印包含的IPTC配置文件信息的图像中的这一部分代码存在漏洞。 该漏洞可以通过特制的MIFF文件触发。 存在漏洞的代码路径如下： [crayon-5a14a6571e4e8110629866/] profile_length变量中的值在MIFF头中的profile-iptc = 8字段设置 当访问profile [i]时，因为不检查i的值，所以会出现越界访问。 如果断在describe.c第738行，在执行strncpy操作的时候我们可以获取到堆中的内容。 [crayon-5a14a6571e4f3204539767/] 0x08000a001c414141是我们植入MIFF文件中的payload。 [crayon-5a14a6571e4f8559265142/] 检查与payload相邻的值0x00007ffff690fba8，发现它其实是libc中main_arena结构中的一个地址。 [crayon-5a14a6571e4fc975205403/] 现在我们可以计算到libc base的偏移量 – 0x3c4b98 漏洞证明 $ python miff/readexploit.py [+] Starting local process ‘/usr/bin/gm’: pid … Continue reading SSD安全公告–GraphicsMagick多个漏洞
Read More