[ News | Blogs | Reddits | Lists | Media | ? ] HoneyDB
  [ privacy | malware | research | vendor ]

Risk and Cyber
Delivering Security at Scale: From Artisanal to Industrial
You Only Get 3 Metrics - Which Ones Would You Pick?
The Illusion of Choice : A Review
People and Security Incentives
Handling Complexity
Fighting Security Entropy
Attack Surface Management
Software Security is More than Vulnerabilities
Data Security and Data Governance
The 6 Fundamental Forces of Information Security Risk
The Daily Swig | Cybersecurity news and views
We’re going teetotal: It’s goodbye to The Daily Swig
Bug Bounty Radar // The latest bug bounty programs for March 2023
Indian transport ministry flaws potentially allowed creation of counterfeit driving licenses
Password managers: A rough guide to enterprise secret platforms
Chromium bug allowed SameSite cookie bypass on Android devices
Deserialized web security roundup: Twitter 2FA backlash, GoDaddy suffers years-long attack campaign, and XSS Hunter adds e2e encryption
NIST plots biggest ever reform of Cybersecurity Framework
Cisco ClamAV anti-malware scanner vulnerable to serious security flaw
CVSS system criticized for failure to address real-world impact
‘Most web API flaws are missed by standard security tests’ – Corey J Ball on securing a neglected attack vector
AWS Security Blog
New eBook: 5 Keys to Secure Enterprise Messaging
Announcing the AWS Blueprint for Ransomware Defense
Updated whitepaper available: Architecting for PCI DSS Segmentation and Scoping on AWS
AWS Security Profile: Ritesh Desai, GM, AWS Secrets Manager
Get custom data into Amazon Security Lake through ingesting Azure activity logs
Amazon Security Lake is now generally available
Exclude cipher suites at the API gateway using a Network Load Balancer security policy
Faster AWS cloud connections with TLS 1.3
Stronger together: Highlights from RSA Conference 2023
Your guide to the threat detection and incident response track at re:Inforce 2023
Darknet – Hacking Tools, Hacker News & Cyber Security
padre – Padding Oracle Attack Exploiter Tool
Privacy Implications of Web 3.0 and Darknets
DataSurgeon – Extract Sensitive Information (PII) From Logs
Pwnagotchi – Maximize Crackable WPA Key Material For Bettercap
HardCIDR – Network CIDR and Range Discovery Tool
Socialscan – Command-Line Tool To Check For Email And Social Media Username Usage
CFRipper – CloudFormation Security Scanning & Audit Tool
CredNinja – Test Credential Validity of Dumped Credentials or Hashes
assetfinder – Find Related Domains and Subdomains
Karkinos – Beginner Friendly Penetration Testing Tool
leastprivilege.com
What’s going on?
The Future of IdentityServer
Flexible Access Token Validation in ASP.NET Core
Refresh Tokens in IdentityServer4 v4
Announcing IdentityServer4 v4.0
Resource Access in IdentityServer4 v4 and going forward
I don’t like Identity Tokens
The JWT Profile for OAuth 2.0 Access Tokens (and IdentityServer)
Updates on our Workshops
Automatic Token Management for ASP.NET Core and Worker Services 1.0
Blog – Fox-IT International blog
From Backup to Backdoor: Exploitation of CVE-2022-36537 in R1Soft Server Backup Manager
CVE-2022-27510, CVE-2022-27518 – Measuring Citrix ADC & Gateway version adoption on the Internet
Encryption Does Not Equal Invisibility – Detecting Anomalous TLS Certificates with the Half-Space-Trees Algorithm
SnapMC skips ransomware, steals data
Abusing cloud services to fly under the radar
StreamDivert: Relaying (specific) network connections
WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group
LDAPFragger: Command and Control over LDAP attributes
Office 365: prone to security breaches?
Using Anomaly Detection to find malicious domains
Positive Technologies - learn and secure
PHDays 10 IDS Bypass contest: writeup and solutions
APT31 new dropper. Target destinations: Mongolia, Russia, the U.S., and elsewhere
How to detect a cyberattack and prevent money theft
Troy Hunt's Blog
Weekly Update 350
Weekly Update 349
Weekly Update 348
Weekly Update 347
Weekly Update 346
Divorce
Weekly Update 345
Weekly Update 344
Join my Twitter Subscription for the Inside Word on Data Breaches
Weekly Update 343
Schneier on Security
Friday Squid Blogging: Squid Chromolithographs
Open-Source LLMs
On the Catastrophic Risk of AI
Chinese Hacking of US Critical Infrastructure
Brute-Forcing a Fingerprint Reader
Friday Squid Blogging: Online Cephalopod Course
Expeditionary Cyberspace Operations
On the Poisoning of LLMs
Indiana, Iowa, and Tennessee Pass Comprehensive Privacy Laws
Credible Handwriting Machine
Security Blog | Pen Test Partners
EFB vulnerability in Lufthansa’s Lido eRouteManual
All your building are belong to us
It’s always DNS, here’s why…
Netflix MH370: The plane that wasn’t hacked
Bullied by Bugcrowd over Kape CyberGhost disclosure
London Councils & pirate books. Google dorking for subdomain takeovers
Carbon reduction at PTP
Monetising hacking by shorting commodity shipments
Finding forensics breadcrumbs in Android image storage
Causing incidents with in-flight entertainment systems
Red Hat Security
Improving supply chain resiliency with Red Hat Trusted Software Supply Chain
Confidential Containers on Azure with OpenShift: A technical deep dive
Confidential computing use cases
Attestation in confidential computing
Confidential computing primer
The future of Red Hat security data
The State of Kubernetes Security in 2023
Deploying confidential containers on the public cloud
Learn about Confidential Containers
Demystifying risk using CVEs and CVSS
Pedro Félix's shared memory
Reactive streams: a play in multiple acts
RFC 8252 and OAuth 2.0 for Native Apps
Accessing the HTTP Context on ASP.NET Core
Should I PUT or should I POST? (Darling you gotta let me know)
Health check APIs, 500 status codes and media types
On contracts and HTTP APIs
Focus on the representation semantics, leave the transfer semantics to HTTP
Client-side development on OS X using Windows hosted HTTP Web APIs
Using multiple IIS server certificates on Windows 7
The OpenID Connect Cast of Characters
Comments on:
Google Online Security Blog
Announcing the Chrome Browser Full Chain Exploit Bonus
Adding Chrome Browser Cloud Management remediation actions in Splunk using Alert Actions
Time to challenge yourself in the 2023 Google CTF!
Google Trust Services ACME API available to all users at no cost
Announcing the launch of GUAC v0.1
How the Chrome Root Program Keeps Users Safe
New Android & Google Device Vulnerability Reward Program Initiatives
$22k awarded to SBFT ‘23 fuzzing competition winners
Introducing a new way to buzz for eBPF vulnerabilities
I/O 2023: What's new in Android security and privacy
360 Netlab Blog - Network Security Research Lab at 360
Heads up! Xdr33, A Variant Of CIA’s HIVE Attack Kit Emerges
警惕：魔改后的CIA攻击套件Hive进入黑灰产领域
快讯：使用21个漏洞传播的DDoS家族WSzero已经发展到第4个版本
P2P Botnets: Review - Status - Continuous Monitoring
P2P 僵尸网络：回顾·现状·持续监测
Fodcha Is Coming Back, Raising A Wave of Ransom DDoS
卷土重来的DDoS狂魔：Fodcha僵尸网络再次露出獠牙
PureCrypter is busy pumping out various malicious malware families
PureCrypter Loader持续活跃，已经传播了10多个其它家族
A new botnet Orchard Generates DGA Domains with Bitcoin Transaction Information
Microsoft Security Blog
Cyber Signals: Shifting tactics fuel surge in business email compromise
Microsoft Security highlights from RSA Conference 2023
How Microsoft can help you go passwordless this World Password Day
Forrester names Microsoft a Leader in 2023 Infrastructure-as-a-Service Platform Native Security report
Why you should practice rollbacks to prevent data loss in a ransomware attack
Healthy security habits to fight credential breaches: Cyberattack Series
Microsoft announces the 2023 Microsoft Security Excellence Awards winners
Stay compliant and protect sensitive data with Zero Trust security
Getting started with the CDMC framework—Microsoft’s guide to cloud data management
Microsoft Entra delivers 240 percent ROI, according to new Forrester study
Krebs on Security
Ask Fitis, the Bear: Real Crooks Sign Their Malware
Discord Admins Hacked by Malicious Bookmarks
Phishing Domains Tanked After Meta Sued Freenom
Interview With a Crypto Scam Investment Spammer
Russian Hacker “Wazawaka” Indicted for Ransomware
Re-Victimization from Police-Auctioned Cell Phones
Microsoft Patch Tuesday, May 2023 Edition
Feds Take Down 13 More DDoS-for-Hire Services
$10M Is Yours If You Can Get This Guy to Leave Russia
Promising Jobs at the U.S. Postal Service, ‘US Job Services’ Leaks Customer Data
tl;dr sec
[tl;dr sec] #184 - Public Cloud Security Breaches, OWASP Top 10 for LLMs, Living Off the Orchard: macOS Binaries
[tl;dr sec] #183 - The 3 Metrics to Focus On, Build a Purple Team Lab, Damn Vulnerable Android and iOS Apps
[tl;dr sec] #182 - Cloud Native Security Talks, AI Attack Surface Map, Attacking and securing cloud identities in managed Kubernetes
[tl;dr sec] #181 - Awesome CloudSec Labs, Red Team Infra in 2023, Privilege Escalation in EKS
[tl;dr sec] #180 - Scaling AppSec, tl;dr sec Swag 🤯, GCP Pentesting Guide
[tl;dr sec] #179 - BSidesSF Summaries, Attacking Kubernetes, OpenAI + Burp Suite
[tl;dr sec] #178 - DevOps Threat Matrix, LLMs in Security, Supply Chain Security
[tl;dr sec] #177 - AWS KMS Threat Model, DOM Invader, Forensics in the Cloud
[tl;dr sec] #176 - Cloud Security Atlas, Semgrep + AI, Finding Malicious PyPi packages
[tl;dr sec] #175 - The Future of Security Engineering, Awesome Kubernetes Threat Detection, ChatGPT Plugins
Security Intelligence
Detecting Insider Threats: Leverage User Behavior Analytics
Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It
Increasingly Sophisticated Cyberattacks Target Healthcare
Ransomware Renaissance 2023: The Definitive Guide to Stay Safer
Machine Learning Applications in the Cybersecurity Space
BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration
Now Social Engineering Attackers Have AI. Do You? 
Despite Tech Layoffs, Cybersecurity Positions are Hiring
How I Got Started: White Hat Hacker
Heads Up CEO! Cyber Risk Influences Company Credit Ratings
Project Zero
Release of a Technical Report into Intel Trust Domain Extensions
Multiple Internet to Baseband Remote Code Execution Vulnerabilities in Exynos Modems
Exploiting null-dereferences in the Linux kernel
DER Entitlements: The (Brief) Return of the Psychic Paper
Exploiting CVE-2022-42703 - Bringing back the stack attack
Mind the Gap
A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain
Gregor Samsa: Exploiting Java's XML Signature Verification
RC4 Is Still Considered Harmful
The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)
Mozilla Security Blog
Updated GPG key for signing Firefox Releases
Upgrading Mozilla’s Root Store Policy to Version 2.8
Revocation Reason Codes for TLS Server Certificates
Preventing secrets from leaking through Clipboard
Improving the Quality of Publicly Trusted Intermediate CA Certificates with Enhanced Oversight and Automation
Securing the proxy API for Firefox add-ons
Firefox 93 features an improved SmartBlock and new Referrer Tracking Protections
Firefox 93 protects against Insecure Downloads
Securing Connections: Disabling 3DES in Firefox 93
Mozilla VPN Security Audit
Cofense
Cofense Named Most Innovative Cybersecurity Company by Cybersecurity Excellence Awards
Cybersecurity Threats Against Small and Medium Sized Businesses: What You Need to Know to Protect Your Business 
SuperMailer Abuse Explodes, Now Responsible for 14% of All Credential Phish Discovered in Inboxes
Summer-Time Scams: The Return of Vacation-Request Phishing Emails
Threat Actors Impersonate Email Security Providers to Steal User Credentials
Top Malware Trends of April
Phishing Attack Alert: Suncorp Bank Impersonation Scams 
Cofense Earns 2023 Top Rated Award by TrustRadius
Man-in-the-Middle (MitM) attacks reaching inboxes increase 35% since 2022
The Art of Deception: Microsoft Phish Redirects Victims to a Catering Voice Recording
CyberWatch
It’s Cybersecurity Awareness Month!
Welcome Back
Hackfest 2021 N1ghtmar3s Edition
What I did on my Pandemic Summer Vacation 2021
Comparing Chinese APTs in Software Supply Chain Attacks
The Diana Initiative 2021
Let the truth be told
Today is for them
My Happy 2nd Dose Day!