Clik here to view.
phpcms 2008 type.php 前台代码注入getshell漏洞分析
phpcms 2008 type.php 前台代码注入getshell漏洞分析 tpye.php中: <?php require dirname(__FILE__).'/include/common.inc.php'; ... if(empty($template)) $template = 'type'; ... include template('phpcms', $template);...
View ArticlePutting the MITRE ATT&CK Evaluation into Context
Today, MITRE published the results of their first public EDR product evaluation. This effort was a collaboration between MITRE and seven EDR vendors to understand how various products can be used to...
View ArticleOpenShift Commons Briefing: Container Deployment and Security Best Practices...
OpenShift Commons Briefing Summary In this briefing, Twistlock’s John Morello and Red Hat’s Dirk Herrmann gave an in-depth look at the recent NIST Special Publication SP800-190 on Container Security...
View ArticleBlue Helix’s BHEX Exchange Raises $15 Million to Reshape Crypto Trading...
A decentralised platform aimed at providing a custody and clearing product for crypto assets has seen its BHEX Exchange raise $15 million in funding. The new funding for Blue Helix came from the likes...
View ArticleClik here to view.
The Likelihood of a Cyber Attack Compared
While the cost of acyber attack is often discussed, we seldom hear about just how common these attacks actually are. Numerous security experts believe that a cyber attack or breach of catastrophic...
View ArticleIoT Security in the Shodan Age
Introduction The landscape of IoT has been changed completely since the appearance of Shodan, a search engine that lets users find Internet-connected devices such as traffic lights, webcams, routers,...
View ArticleMarriott hotel chain reveals data breach that affected 500 million customers
Facepalm:Another day, another data breach―and this one’s a biggie. Hotel chain Marriott has announced “a data security incident” that saw the details of around 500 million guests stolen from its...
View ArticleClik here to view.
A new Security Header: Clear Site Data
I was debating whether or not to call Clear Site Data a Security Header but in the end I decided I would. During the use of a web app we can leave various pieces of data in the browser that we'd like...
View Article多项网络安全行动获美国2018年政府创新奖
2018年11月1日，美国联邦政府公布了其2018年政府创新奖项，共有36个公共部门的创新项目荣获此奖项。 涉及网络安全领域的部分获奖成果如下： （1）密苏里州国民警卫队网络团队（MOCNET）...
View ArticleMarriott Hotel Data Breach: Ongoing Since 2014
Marriott said that a massive data breach of its guest reservation system has left up to 500 million guests’ data exposed and available for the taking. Worse, the attackers may have had access to the...
View ArticleClik here to view.
神奇的数字“3”：一次翻转3个比特即可实现Rowhammer攻击
来自荷兰的一组研究人员已经证实，可以避开纠错码（ECC）保护机制来执行Rowhammer内存操纵攻击。 什么是Rowhammer？ 早在2015年，谷歌的Project Zero团队就曾发现，可以反复对相邻行中的存储单元进行充电和放电，来改变单个存储单元的值。如果攻击者准确地知道要攻击的位置，他们就可以更改特定位置，将指令或命令注入内存中，或是授予访问权限以访问包含敏感信息的受限制部分。...
View ArticleE-commerce sites warned of heightened DDoS threat
Distributed denial of service (DDoS) attacks reached their highest levels in November on two of the busiest online trading days of the year, statistics show. On Black Friday, DDoS protection provider...
View ArticleClik here to view.
Hacker们如何看待2019年区块链技术的发展与挑战
原标题：Hacker们如何看待2019年区块链技术的发展与挑战 2018年区块链技术的发展受到了非常瞩目的关注，是区块链产业爆发又波澜动荡的一年。近来币圈趋冷，熊市当道，有人认为区块链已然“凉凉”，也有人仍对区块链技术深信不疑。说到底，区块链是一项新兴的前沿技术，我们更想知道各界 Hacker 对于区块链发展现状的判断以及对于前景的思考，他们如何看待 2019 年区块链技术的发展与挑战。 11 月...
View ArticleClik here to view.
攻防最前线：新型蠕虫BLADABINDI可通过移动驱动器传播无文件后门
BLADABINDI，也被称为njRAT或Njw0rm，是一种远程访问木马（RAT），具有众多后门功能――从键盘记录到执行分布式拒绝服务（DDoS）。自首次出现以来，该木马就已经在各种网络间谍活动中被重新编译和使用。事实上，BLADABINDI的可定制性以及可以在暗网地下黑市购买到的特性使得它成为一个广泛存在的威胁。举个例子：在上周，趋势科技就遇到了一种蠕虫病毒（由趋势科技检测为Worm.Win32...
View ArticleClik here to view.
Marriott's Starwood Data Breach - 5 Steps to Protect your Data
What can you do if you’re one of the 500 million Marriott International Inc. guests affected by the massive data breach announced today? According to the company’s announcement , the breach affects...
View ArticleClik here to view.
Firefox security: rel=noopener for target=_blank
Mozilla is testing a new security feature in Firefox Nightly currently that adds rel="noopener" automatically to links that use target="_blank". Target="_blank" instructs browsers to open the link...
View ArticleClik here to view.
Making Kubernetes a Reality for Financial Services
Terry Shea Terry Shea is Chief Revenue Officer for Kublr, the most comprehensive enterprise Kubernetes platform. The financial services industry has traditionally been very technology dependent, but...
View ArticleClik here to view.
Marriott International: Hackers Accessed the records of 500 Million Users
Add to favorites “There are two components needed to decrypt the payment card numbers, and at this point, Marriott has not been able to rule out the possibility that both were taken” Hotel and lodging...
View ArticleClik here to view.
Newsmaker Interview: Katie Moussouris on Improving Bug Bounty Programs
The bug bounty “queen” Katie Moussouris discusses the biggest mistakes that companies launching these programs are making. Bug bounty programs continue to increase in popularity but that popularity has...
View ArticleMarriott Starwood hotel data breach FAQ: What 500 million hacked guests need...
It’s been a couple of months since a major company unveiled a data breach that affected millions of people , so it’s time for a new one. The Marriot hotel chain has announced a major database breach...
View Article
