[ News | Blogs | Reddits | Lists | Media | ? ] HoneyDB
  [ privacy | malware | research | vendor ]

Risk and Cyber
Security and Ten Laws of Technology 
A Letter from the Future
InfoSec Hard Problems
DevOps and Security
The Power of Community: 5 Steps to Fast-Track Your InfoSec Career
The 80 / 20 Principle 
Leadership Transitions - 10 Steps for Success
Best Security Movies (and some that haven’t been made yet)
Top Ideas and Posts from 2023
The Art of Influencing - 7 Steps
The Daily Swig | Cybersecurity news and views
We’re going teetotal: It’s goodbye to The Daily Swig
Bug Bounty Radar // The latest bug bounty programs for March 2023
Indian transport ministry flaws potentially allowed creation of counterfeit driving licenses
Password managers: A rough guide to enterprise secret platforms
Chromium bug allowed SameSite cookie bypass on Android devices
Deserialized web security roundup: Twitter 2FA backlash, GoDaddy suffers years-long attack campaign, and XSS Hunter adds e2e encryption
NIST plots biggest ever reform of Cybersecurity Framework
Cisco ClamAV anti-malware scanner vulnerable to serious security flaw
CVSS system criticized for failure to address real-world impact
‘Most web API flaws are missed by standard security tests’ – Corey J Ball on securing a neglected attack vector
AWS Security Blog
2023 ISO 27001 certificate available in Spanish and French, and 2023 ISO 22301 certificate available in Spanish
Integrate Kubernetes policy-as-code solutions into Security Hub
How the unique culture of security at AWS makes a difference
Winter 2023 SOC 1 report now available in Japanese, Korean, and Spanish
Accelerate security automation using Amazon CodeWhisperer
The curious case of faster AWS KMS symmetric key rotation
Detecting and remediating inactive user accounts with Amazon Cognito
TLS inspection configuration for encrypted egress traffic and AWS Network Firewall
How to generate security findings to help your security team with incident response simulations
Explore cloud security in the age of generative AI at AWS re:Inforce 2024
Darknet – Hacking Tools, Hacker News & Cyber Security
Best EDR Of The Market (BEOTM) – Endpoint Detection and Response Testing Tool
AgentSmith HIDS – Host Based Intrusion Detection
padre – Padding Oracle Attack Exploiter Tool
Privacy Implications of Web 3.0 and Darknets
DataSurgeon – Extract Sensitive Information (PII) From Logs
Pwnagotchi – Maximize Crackable WPA Key Material For Bettercap
HardCIDR – Network CIDR and Range Discovery Tool
Socialscan – Command-Line Tool To Check For Email And Social Media Username Usage
CFRipper – CloudFormation Security Scanning & Audit Tool
CredNinja – Test Credential Validity of Dumped Credentials or Hashes
leastprivilege.com
What’s going on?
The Future of IdentityServer
Flexible Access Token Validation in ASP.NET Core
Refresh Tokens in IdentityServer4 v4
Announcing IdentityServer4 v4.0
Resource Access in IdentityServer4 v4 and going forward
I don’t like Identity Tokens
The JWT Profile for OAuth 2.0 Access Tokens (and IdentityServer)
Updates on our Workshops
Automatic Token Management for ASP.NET Core and Worker Services 1.0
Blog – Fox-IT International blog
From Backup to Backdoor: Exploitation of CVE-2022-36537 in R1Soft Server Backup Manager
CVE-2022-27510, CVE-2022-27518 – Measuring Citrix ADC & Gateway version adoption on the Internet
Encryption Does Not Equal Invisibility – Detecting Anomalous TLS Certificates with the Half-Space-Trees Algorithm
SnapMC skips ransomware, steals data
StreamDivert: Relaying (specific) network connections
WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group
LDAPFragger: Command and Control over LDAP attributes
Office 365: prone to security breaches?
Using Anomaly Detection to find malicious domains
Syncing yourself to Global Administrator in Azure Active Directory
Positive Technologies - learn and secure
PHDays 10 IDS Bypass contest: writeup and solutions
APT31 new dropper. Target destinations: Mongolia, Russia, the U.S., and elsewhere
How to detect a cyberattack and prevent money theft
Troy Hunt's Blog
Weekly Update 396
Weekly Update 395
Weekly Update 394
Weekly Update 393
Weekly Update 392
Inside the Massive Alleged AT&T Data Breach
Weekly Update 391
Welcoming the Liechtenstein Government to Have I Been Pwned
Weekly Update 390
Welcoming the German Government to Have I Been Pwned
Schneier on Security
Microsoft and Security Incentives
Using Legitimate GitHub URLs for Malware
Friday Squid Blogging: Squid Trackers
Other Attempts to Take Over Open Source Projects
Using AI-Generated Legislative Amendments as a Delaying Technique
X.com Automatically Changing Link Text but Not URLs
New Lattice Cryptanalytic Technique
Upcoming Speaking Engagements
Friday Squid Blogging: The Awfulness of Squid Fishing Boats
Smuggling Gold by Disguising it as Machine Parts
Security Blog | Pen Test Partners
Can ships be hacked?
Navigating the perilous waters of conference invitations
The big play of autonomous vehicles
Living off the land with native SSH and split tunnelling
Advice for manufacturers on the coming PSTI regulation
No fix KrbRelay VMware style
Cyber security for Credit Unions 101
QR Phishing. Fact or Fiction?
Android Content Providers 101
Ski & bike helmets protect your head, not location or voice
Red Hat Security
4 use cases for AI in cyber security
Connect hybrid cloud Kubernetes with F5 multicloud networking and Red Hat OpenShift for optimized security footprints
Learn about trends and best practices from top security experts at Red Hat and NIST's Cybersecurity Open Forum
Red Hat Enterprise Linux 7: End of compliance content on June 30, 2024
Pedro Félix's shared memory
Reactive streams: a play in multiple acts
RFC 8252 and OAuth 2.0 for Native Apps
Accessing the HTTP Context on ASP.NET Core
Should I PUT or should I POST? (Darling you gotta let me know)
Health check APIs, 500 status codes and media types
On contracts and HTTP APIs
Focus on the representation semantics, leave the transfer semantics to HTTP
Client-side development on OS X using Windows hosted HTTP Web APIs
Using multiple IIS server certificates on Windows 7
The OpenID Connect Cast of Characters
Comments on:
Google Online Security Blog
Prevent Generative AI Data Leaks with Chrome Enterprise DLP
How we built the new Find My Device network with user security and privacy in mind
Google Public DNS’s approach to fight against cache poisoning attacks
Address Sanitizer for Bare-metal Firmware
Real-time, privacy-preserving URL protection
Vulnerability Reward Program: 2023 Year in Review
Secure by Design: Google’s Perspective on Memory Safety
Piloting new ways of protecting Android users from financial fraud
Improving Interoperability Between Rust and C++
UN Cybercrime Treaty Could Endanger Web Security
360 Netlab Blog - Network Security Research Lab at 360
Heads up! Xdr33, A Variant Of CIA’s HIVE Attack Kit Emerges
警惕：魔改后的CIA攻击套件Hive进入黑灰产领域
快讯：使用21个漏洞传播的DDoS家族WSzero已经发展到第4个版本
P2P Botnets: Review - Status - Continuous Monitoring
P2P 僵尸网络：回顾·现状·持续监测
Fodcha Is Coming Back, Raising A Wave of Ransom DDoS
卷土重来的DDoS狂魔：Fodcha僵尸网络再次露出獠牙
PureCrypter is busy pumping out various malicious malware families
PureCrypter Loader持续活跃，已经传播了10多个其它家族
A new botnet Orchard Generates DGA Domains with Bitcoin Transaction Information
Microsoft Security Blog
Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters
New Microsoft guidance for the DoD Zero Trust Strategy
​​Microsoft recognized as a Leader in the Forrester Wave™: Workforce Identity Platform, Q1 2024
How Microsoft discovers and mitigates evolving attacks against AI guardrails
Explore Microsoft’s AI innovations at RSA Conference 2024
Get end-to-end protection with Microsoft’s unified security operations platform, now in public preview
Microsoft Priva announces new solutions to help modernize your privacy program
The foundation for responsible analytics with Microsoft Purview
​​Frost & Sullivan names Microsoft a Leader in the Frost Radar™: Managed Detection and Response, 2024
How Microsoft Incident Response and Microsoft Defender for Identity work together to detect and respond to cyberthreats
Krebs on Security
Russian FSB Counterintelligence Chief Gets 9 Years in Cybercrime Bribery Scheme
Who Stole 3.6M Tax Records from South Carolina?
Crickets from Chirp Systems in Smart Lock Key Leak
Why CISA is Warning CISOs About a Breach at Sisense
Twitter’s Clumsy Pivot to X.com Is a Gift to Phishers
April’s Patch Tuesday Brings Record Number of Fixes
Fake Lawsuit Threat Exposes Privnote Phishing Sites
‘The Manipulaters’ Improve Phishing, Still Fail at Opsec
Thread Hijacking: Phishes That Prey on Your Curiosity
Recent ‘MFA Bombing’ Attacks Targeting Apple Users
tl;dr sec
[tl;dr sec] #227 - Securing GitHub Actions, State of DevSecOps, Paved Road Webinar
[tl;dr sec] #226 - Negotiation Tips & Interview Questions, Paved Road, awesome-secure-defaults
[tl;dr sec] #225- XZ Backdoor, GitHub CSO Interview, SpecterOps Con
[tl;dr sec] #224 - Google on BeyondCorp, Threat Modeling, AWS Cross-Account Attacks
Keep Hackers Out of Your Kubernetes Cluster with These 5 Simple Tricks!
[tl;dr sec] #223 - AI Auto-fixes, Mapping CloudTrail to Incidents, VS Code Extensions for Security
[tl;dr sec] #222 - NSA's Top 10 Cloud Security Strategies, Secure by Design, Claude 3 + Fuzzing
[tl;dr sec] #221 - Hacking Google AI for $50K, Detecting Secrets in Videos, Securing Medicare & Medicaid
[tl;dr sec] #220 - Detecting Manual AWS Actions, AI Threat Models, Living Off the False Positive
[tl;dr sec] #219 - IR in AWS, SOC Interview Questions, LLM Hackbots
Security Intelligence
Passwords, passkeys and familiarity bias
Unpacking the NIST cybersecurity framework 2.0
What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?
Obtaining security clearance: Hurdles and requirements
Ransomware payouts hit all-time high, but that’s not the whole story
What should an AI ethics governance framework look like?
Why security orchestration, automation and response (SOAR) is fundamental to a security platform
Cloud security uncertainty: Do you know where your data is?
GenAI: The next frontier in AI security threats
The evolution of a CISO: How the role has changed
Project Zero
The Windows Registry Adventure #2: A brief history of the feature
The Windows Registry Adventure #1: Introduction and research results
First handset with MTE on the market
An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit
Analyzing a Modern In-the-wild Android Exploit
Summary: MTE As Implemented
MTE As Implemented, Part 2: Mitigation Case Studies
MTE As Implemented, Part 3: The Kernel
MTE As Implemented, Part 1: Implementation Testing
Release of a Technical Report into Intel Trust Domain Extensions
Mozilla Security Blog
Rapidly Leveling up Firefox Security
Mozilla VPN Security Audit 2023
Version 2.9 of the Mozilla Root Store Policy
Updated GPG key for signing Firefox Releases
Upgrading Mozilla’s Root Store Policy to Version 2.8
Revocation Reason Codes for TLS Server Certificates
Preventing secrets from leaking through Clipboard
Improving the Quality of Publicly Trusted Intermediate CA Certificates with Enhanced Oversight and Automation
Securing the proxy API for Firefox add-ons
Firefox 93 features an improved SmartBlock and new Referrer Tracking Protections
Cofense
Phishing Detection and Response: What You Need to Know
Agent Tesla: The Punches Keep Coming
Recently Updated Rhadamanthys Stealer Delivered in Federal Bureau of Transportation Campaign 
Midnight Blizzard APT Group’s Attack on Microsoft and What It Means for Email Security 
New Cofense Vision UI Dashboard Unveiled: Actionable ROI at a Glance
SVG Files Abused in Emerging Campaigns
Annual State of Email Security by the Numbers
Car Insurance Emails Drives for NetSupport RAT Infection 
New MaaS InfoStealer Malware Campaign Targeting Oil & Gas Sector
Cofense Annual Report Indicates 105% Increase in Malicious Emails Bypassing Secure Email Gateways
CyberWatch
It’s Cybersecurity Awareness Month!
Welcome Back
Hackfest 2021 N1ghtmar3s Edition
What I did on my Pandemic Summer Vacation 2021
Comparing Chinese APTs in Software Supply Chain Attacks
The Diana Initiative 2021
Let the truth be told
Today is for them
My Happy 2nd Dose Day!