A brief history of software vulnerabilities in vehicles (Update 2023)
A brief history of software vulnerabilities in vehicles (Update 2023)
Read MoreA brief history of software vulnerabilities in vehicles (Update 2023)
Read MoreToday is Cyber Monday , a day when all webshops (and not only) give big discounts to many products they sell. Even if the discount campaigns of some webshops are incredible and too good to let it go, you should think twice before giving the order: the discount is for a product that everybody wants and seems very hard to find. Think of PS5, latest XBOX, etc…. the discount is waaaaayyy too big to miss you haven’t seen that website/webshop before you haven’t bought from that webshop before you haven’t seen on the Internet any review about that webshop you are being requested to give your personal details, card or bank PIN number If you answered YES to at least one, then STOP right here, right NOW. As a rule of thumb If something is too good to be true, then probably it isn’t! How can you recognize if a webshop is fake or fraud? Transform the 5 statements above in questions and ask yourself. Is the discount for a product that everybody wants and seems very hard to find? Why would any shop (online or offline) exactly the product that everybody wants at almost any price, reduce it…
While I was looking after some resources for a presentation, I found this interesting lecture from ENISA. Advancing Software Security in the EU Download PDF document, 622 KB This study discusses some key elements of software security and provides a concise overview of the most relevant existing approaches and standards while identifying shortcomings associated with the secure software development landscape, related to different inherent aspects of the process. Lastly, it provides a number of practical considerations relevant to the different aspects of software development within the newly established EU cybersecurity certification framework and the EU cybersecurity certification schemes. Fundamental security principles are often overlooked during software development. This is because Security is a non functional feature. Functional requirements are about behaviour of the system towards the outside world (e.g. a user), whereas non-functional requirements are mainly about the internal mechanisms. Many of the security requirements are non-functional; for example on how to store passwords in a database. Security requirements originate from different sources, such as – explicit functional and non-functional requests from user(s), – requirements and obligations originating from the underlying legal framework – requirements that are considered as best practices, company policies, in widely accepted guidelines, from threat…
I have a plugin that prevents multiple unsuccessful logins. As can be seen, the spammers try several combinations like: admin (the default), then site name, and several others. It is critical to create a user name that is different than the obvious names, especially the default username “admin”. Another interesting thing is that I get both IPv4 as well as IPv6 IP addresses. More and more IPv6. Also, a spammer will continuously try to hack you, because they have automated scripts. So, it makes sense to block them for a longer time. For example, I use these settings: The plugin I am using is “Limit Login Attempts Reloaded”. I am not affiliated with them in any way.
ISC2 requires a recertification every 3 years. For this, you need to pay your fees and to make proof that you were active in the profession. This can be done by submitting for review the work that has been done in this certification cycle. And here are all 3 with links:
Ever wondered why do you get one of these popups for your Windows program, despite of the fact that it is signed with a standard code signing certificate ? Applications that are signed with a standard code signing certificates need to have a positive reputation in order to pass the Smart Screen filter. Microsoft establishes the reputation of an executable based upon the number of installations world wide of the same application. Since you haven’t published your application as yet (and therefore the reputation hasn’t been established as yet), the Smart Screen will continue to flag the application. If you have a standard code signing certificate, some time will be needed for your application to build trust. Microsoft affirms that an Extended Validation (EV) Code Signing Certificate allows to skip this period of trust building. According to Microsoft, extended validation certificates allow the developer to immediately establish reputation with SmartScreen. Otherwise, for some time, until your application builds trust, the users will see a warning like “Windows Defender Smartscreen prevented an unrecognized app from starting. Running this app might put your PC at risk.”, with the two buttons: “Run anyway” and “Don’t run”. In newer Windows version you see the…
European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS: Vote here . Yes, it is a Google Form… but there is no malware or spam 🙂 Don’t forget to vote IT_SecurityNews! The seventh annual European Cybersecurity Blogger Awards sponsored by Qualys and powered by Eskenzi PR, will be bestowed upon the best cybersecurity bloggers, podcasters, Tweeters, Instagrammers and vloggers in a live virtual event on Tuesday 2nd June 2020. Visit IT Security news and the Twitter account.
Updated in 2023: 2023: Sam Curry: Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More Kia, Honda, Infiniti, Nissan, Acura Fully remote lock, unlock, engine start, engine stop, precision locate, flash headlights, and honk vehicles using only the VIN number Fully remote account takeover and PII disclosure via VIN number (name, phone number, email address, physical address) Ability to lock users out of remotely managing their vehicle, change ownership For Kia’s specifically, we could remotely access the 360-view camera and view live images from the car Mercedes-Benz Access to hundreds of mission-critical internal applications via improperly configured SSO, including… Multiple Github instances behind SSO Company-wide internal chat tool, ability to join nearly any channel SonarQube, Jenkins, misc. build servers Internal cloud deployment services for managing AWS instances Internal Vehicle related APIs Remote Code Execution on multiple systems Memory leaks leading to employee/customer PII disclosure, account access Hyundai, Genesis Fully remote lock, unlock, engine start, engine stop, precision locate, flash headlights, and honk vehicles using only the victim email address Fully remote account takeover and PII disclosure via victim email address (name, phone number, email address, physical address) Ability to lock users out of…
My domain mustaca.com is hosted at Strato.de. I received several such emails, showing that somebody really scrapes the next for finding targets of various ISPs. Lieber Kunde, Wir informieren Sie, dass die Domain mustaca.com ausläuft. Wie kann man sich erneuern ? Der Erneuerungs Vorgang ist schnell und einfach: bestellen Sie einfach online und bezahlen Sie dafür. https://rechnung.strato.de Um die Bestellübersicht und den Betrag, den Sie bezahlen möchten, zu sehen, können Sie sich von dieser Seite erneuern. Was passiert, wenn ich mich nicht erneuere ? Im Falle einer Nichterneuerung werden die Dienste am Tag nach dem Ablauf deaktiviert und die Domain wird nicht mehr sichtbar. Herzliche Grüße STRATO AG Pascalstrae 10 10587 Berlin ———————————————————————— Vorsitzender des Aufsichtsrates: René Obermann Vorstand: Dr. Christian Being (Vorsitz), Christoph Steffens, René Wienholtz Amtsgericht Berlin-Charlottenburg HRB 79450 And this is how the page looks like:
Starting March 1, 2018, Windows Defender Antivirus and other Microsoft security products will classify programs that display coercive messages as unwanted software, which will be detected and removed. If you’re a software developer and want to validate the detection of your programs, visit the Windows Defender Security Intelligence portal. Unwanted software Identifying and analyzing unwanted software is a complex challenge. New forms of unwanted software are constantly under development. The same technology that can make software unwanted also appears in software that you want to keep and use (such as antivirus or antimalware software). It’s not always possible to automatically determine whether a program is something you want to keep or something you want to remove. Evaluation criteria Microsoft researchers use the following categories to determine whether to add a program to the definition library, and what classification type, risk level, and recommendation to give it: Unwanted behavior: The software runs unwanted processes or programs on your PC, does not display adequate disclosures about its behavior or obtain adequate consent, prevents you from controlling its actions while it runs on your computer, prevents you from uninstalling or removing the program, prevents you from viewing or modifying browser features or settings, makes misleading or inaccurate claims…