Feb 17 2021

“ScamClub” gang outed for exploiting iPhone browser bug to spew ads

Category: Smart Phone,Web Security — DISC @ 3:51 pm
“ScamClub” gang outed for exploiting iPhone browser bug to spew ads

Digital ad company Confiant, which claims to “improve the digital marketing experience” for online advertisers by knowing about and getting rid of malicious and unwanted ads, has just published an analysis of a malvertising group it calls ScamClub.

According to Confiant, this group is behind a massive number of those annoying and scammy popup campaigns you will almost certainly have seen, where you visit an apparently honest web page and then get pestered with online surveys.

We’ve warned our readers many times about the risks of online surveys â€“ even ones that don’t obviously or explicitly lead to attempted malware infections.

At best, you will often end up giving away a surprising amount of personal data, typically in return for a minuscule chance of winning a free product (fancy phones, high-value gift cards and games consoles are typically used as lures).

“ScamClub” gang outed for exploiting iPhone browser bug to spew ads

Tags: browser bug

Feb 17 2021

Browser Tracking Using Favicons

Category: Web Security — DISC @ 1:56 pm
Browser Tracking Using Favicons

Interesting research on persistent web tracking using favicons. (For those who don’t know, favicons are those tiny icons that appear in browser tabs next to the page name.)

Abstract: The privacy threats of online tracking have garnered considerable attention in recent years from researchers and practitioners alike. This has resulted in users becoming more privacy-cautious and browser vendors gradually adopting countermeasures to mitigate certain forms of cookie-based and cookie-less tracking. Nonetheless, the complexity and feature-rich nature of modern browsers often lead to the deployment of seemingly innocuous functionality that can be readily abused by adversaries. In this paper we introduce a novel tracking mechanism that misuses a simple yet ubiquitous browser feature: favicons. In more detail, a website can track users across browsing sessions by storing a tracking identifier as a set of entries in the browser’s dedicated favicon cache, where each entry corresponds to a specific subdomain. In subsequent user visits the website can reconstruct the identifier by observing which favicons are requested by the browser while the user is automatically and rapidly redirected through a series of subdomains. More importantly, the caching of favicons in modern browsers exhibits several unique characteristics that render this tracking vector particularly powerful, as it is persistent (not affected by users clearing their browser data), non-destructive (reconstructing the identifier in subsequent visits does not alter the existing combination of cached entries), and even crosses the isolation of the incognito mode. We experimentally evaluate several aspects of our attack, and present a series of optimization techniques that render our attack practical. We find that combining our favicon-based tracking technique with immutable browser-fingerprinting attributes that do not change over time allows a website to reconstruct a 32-bit tracking identifier in 2 seconds. Furthermore,our attack works in all major browsers that use a favicon cache, including Chrome and Safari. Due to the severity of our attack we propose changes to browsers’ favicon caching behavior that can prevent this form of tracking, and have disclosed our findings to browser vendors who are currently exploring appropriate mitigation strategies.

Source: Browser Tracking Using Favicons

Feb 14 2021

PayPal addresses reflected XSS bug in user wallet currency converter

Category: Web Security — DISC @ 11:49 am
PayPal addresses reflected XSS bug in user wallet currency converter

PayPal has fixed a reflected cross-site scripting (XSS) vulnerability that was discovered in the currency converter feature of user wallets on February 19, 2020, close one year ago.

The ‘reflected XSS and CSP bypass’ vulnerability was reported by the bug bounty hunter “Cr33pb0y” through the HackerOne platform.

“An endpoint used for currency conversion was found to suffer from a reflected XSS vulnerability, where user input was not being properly sanitized in a parameter in the URL. This could lead to a malicious user injecting malicious JavaScript, HTML, or any other type of code that the browser may execute. The malicious script will execute in the browser page DOM of another user typically without their knowledge or consent.” reads the summary published by PayPal.

PayPal has implemented additional validation checks and sanitizer controls for user input in the currency exchange feature before being returned in the response.

According to PayPal, the flaw resided in the currency conversion endpoint and was caused by a failure to properly sanitize the input in a parameter in the URL. 

An attacker could have exploited the flaw to inject malicious code (JavaScript, HTML, or any other language) that will be executed within the browser. 

Tags: wallet currency converter, XSS bug

Feb 12 2021

Microsoft warns of the rise of web shell attacks

Category: PowerShell Security,Web Security — DISC @ 2:29 pm
Microsoft warns of the rise of web shell attacks

An Introduction to Web Shells

Tags: Web Shell

Feb 09 2021

Malicious Chrome sync feature can help hackers steal your data

Category: Web Security — DISC @ 4:33 pm
Malicious Chrome sync feature can help hackers steal your data
Subscribe to DISC InfoSec blog by Email

Feb 09 2021

How Venturing Into The Shady Side of The Dark Web Will Most Likely Get You Scammed or Arrested

Category: Deepfakes,Web Security — DISC @ 12:36 pm
How Venturing Into The Shady Side of The Dark Web Will Most Likely Get You Scammed or Arrested

The internet has come to be so developed, complex and ‘intelligent’ that, at present, you could say it is alive (like Skynet or The Matrix predicted?). Billions of people are online, every day, using the internet for work, entertainment, advice, you name it -it’s probably on the internet. We are now in the age of Artificial Intelligence and Big Data (or A.I for short). This period is an evolution, a transformation in the digital industry. Not only are petabytes of data being circulated on the internet (millions of terabytes); with A.I and Big Data all of this data is being put to use. This is effectively teaching the internet about user behavior, increasing the knowledge-base and making the internet into a neural-network able to ‘think’ for itself.

That’s all fine and dandy, but what about the dark side of the internet? Well, the evolution of the internet has spread so wide on countless digital channels and platforms, that the need to regulate and police the internet has risen. On such a vast network, there are countless dark organizations and cybercriminals looking to use the practicality of the internet as a communication tool for illegal activity. This can mean hacking and stealing data in the virtual realm, and it can also translate to the worst kinds of illicit activity imaginable in the physical realm.

So, let’s look at what lies beneath, in the underground world beneath the internet which is called the Deep Web. Then we’ll go even deeper down, and find out why the Dark Web is a dangerous and hostile place.

Tags: dark web

Feb 08 2021

Holistic InfoSec For Web Developers

Category: Information Security,Web Security — DISC @ 11:22 pm
Holistic InfoSec For Web Developers: Physical and People (Fascicle 0) by [Kim Carter, Russ McRee, Leanne Carter, Simon Bennetts]

This book begins by taking the reader to the 30,000′ view, so you can start to see the entire security landscape. I then attempt to explain a very simple threat modelling approach that I believe Bruce Schneier created, called the Sensible Security Model (SSM). We take the learnings from the first chapter and apply them to lower levels. I detail how to setup a security focussed distribution with all the tools and configuration options required for working through the book. We then walk through the Process and Practises that the attacker often execute, and we take the learnings from that and train the defenders on how they can bring the finding of defects from the most expensive place to the cheapest place, within your Sprint cycles.

The rest of the book focusses on the specific area on the cover of this book.

My intention with “Holistic Info-Sec for Web Developers” is in many ways to help you answer your own questions and show you that creating systems and arming people to withstand the types of attacks commonly encountered today is not our of reach of mere mortals. That by simply lifting the lower hanging fruit for an attacker often means they will move on to an easier target. Unless they are specifically targeting you. In which case you should find many of the risks and countermeasures I address, affective for increasing the difficulty for your attacker, and thus dramatically increasing your chances of defence and counter-attack.

Fascicle 0 focusses on:

1. The chosen threat modelling approach
2. Setting up your tool-belt
3. The process of penetration testing
4. A collection of processes and practises formulated from penetration testing, useful for augmenting each and every Scrum Sprint
5. Physical and People security

Holistic InfoSec For Web Developers: Physical and People

Tags: InfoSec for Web Developer

Feb 05 2021

Chrome zero-day browser bug found

Category: Web Security,Zero day — DISC @ 10:20 am
Chrome zero-day browser bug found – patch now!

Tags: Chrome zero-day

Feb 03 2021

2 new zero-day vulnerabilities in WordPress Plugin

Category: Web Security — DISC @ 3:14 pm

TIM’s Red Team Research (RTR) discovered 2 new zero-day vulnerabilities in WordPress Plugin Limit Login Attempts Reloaded
Rtfm: Red Team Field Manual

Tags: Red team, Red team research

Jan 30 2021

Penetration Testing

Category: App Security,Web Security — DISC @ 5:29 pm

Penetration Testing is a method that many companies follow in order to minimize their security breaches. This is a controlled way of hiring a professional who will try to hack your system and show you the loopholes that you should fix.

Before doing a penetration test, it is mandatory to have an agreement that will explicitly mention the following parameters −

>what will be the time of penetration test,

>where will be the IP source of the attack, and

>what will be the penetration fields of the system.

Penetration testing is conducted by professional ethical hackers who mainly use commercial, open-source tools, automate tools and manual checks. There are no restrictions; the most important objective here is to uncover as many security flaws as possible.

Source: to download a pdf copy of Burp Suite Cookbook

Jan 30 2021

Domain for programming website Perl.com hijacked

Category: Web Security — DISC @ 12:23 pm
Domain for programming website Perl.com hijacked

Jan 29 2021

The mystery of the missing Perl website

Category: Web Security — DISC @ 7:43 pm
The mystery of the missing Perl website

Jan 26 2021

Open source tool was incorrectly labeled as a threat by Chrome’s Safe Browsing

Category: Web Security — DISC @ 4:12 pm

Jan 21 2021

WordPress Security: The Ultimate Guide

Category: Information Security,Web Security — DISC @ 2:49 pm

WordPress Security: The Ultimate Guide

WordPress security can be intimidating, but it doesn’t hhttps://ithemes.com/wordpress-security-the-ultimate-guide/?ave to be. In this comprehensive guide to WordPress security, we’ve simplified the basics of securing your WordPress website so that any non-technical person can understand and protect their website from hacker attacks.

This guide to WordPress security is broken down into 10 easily digestible sections. Each section will guide you through a specific aspect of WordPress security. By the end of the guide, you will learn the different types of vulnerabilities, the motives of hackers, and how to secure everything from your server to the individual users of your WordPress website.

Source: WordPress Security: The Ultimate Guide

Dec 11 2020

Brave browser-maker launches privacy-friendly news reader

Category: Information Privacy,Web Security — DISC @ 12:20 am

By design, Brave Today doesn’t let the company or third parties build user profiles.

Brave Software, maker of the Brave Web browser, is introducing a news reader that’s designed to protect user privacy by preventing parties—both internal and third party—from tracking the sites, articles, and story topics people view.

Brave Today, as the service is called, is using technology that the company says sets it apart from news services offered by Google and Facebook. It’s designed to deliver personalized news feeds in a way that leaves no trail for Brave, ISPs, and third parties to track. The new service is part of Brave’s strategy of differentiating its browser as more privacy-friendly than its competitors’.

Key to Brave Today is a new content delivery network the company is unveiling. Typically, news services use a single CDN to cache content and then serve it to users. This allows the CDN or the service using it to see both the IP address and news feed of each user, and over time, that data can help services build detailed profiles of a person’s interests.

The Brave Today CDN takes a different approach. It’s designed in a way that separates a user’s IP address from the content they request. One entity offers a load-balancing service that receives TLS-encrypted traffic from the user. The load balancer then passes the traffic on to the CDN that processes the request.

The load balancer knows the user’s IP address, but because the request is encrypted, it has no visibility into the content the user is seeking. The CDN, meanwhile, sees only the request but has no way of knowing the IP address that’s making it. Responses are delivered in reverse order. To prevent the data from being combined, Brave says that it will use one provider for load balancing and a different one for content delivery.

Source: Brave browser-maker launches privacy-friendly news reader



Brave Browser-Maker Launches Privacy-Friendly News Reader podcast
httpv://www.youtube.com/watch?v=LynCc0Hl-i8




Nov 03 2020

Privacy-focused Brave browser grew over 130% in the past year

Category: Information Privacy,Web Security — DISC @ 1:07 pm

Brave Browser, the privacy-focused web browser, announced today that it grew in usage by over 130% in its first year of the release of its ‘Stable’ version.

Source: Privacy-focused Brave browser grew over 130% in the past year



Brave Browser Review 2020: Should you make the switch?
httpv://www.youtube.com/watch?v=cQuTwpUFIXU&ab_channel=dottotech



Why you should download Brave Browser NOW!




Tags: data privacy, Information Privacy, loss of privacy

Sep 21 2020

Guard your data with these privacy-focused search engines & browsers

Category: Information Privacy,Web Security — DISC @ 12:11 pm

Tracking allows the companies to improve their algorithm and app experience, but this experience comes at the cost of your digital data. In this guide, we’re going to focus on the search engines and browsers that you’ll want to use if you care about your online privacy.

Popular search engines and browsers do a great job at finding and browsing content on the web, but can do a better job at protecting your privacy while doing so.

With your data being the digital currency of our times, websites, advertisers, browsers, and search engines track your behavior your on the web to deliver tailored advertising, improve their algorithms, or improve their services.

Privacy-focused search engines

Below are the best privacy-focused search engines that do not track your searchers or display advertisements based on your cookies or interests.

Source: Guard your data with these privacy-focused search engines & browsers


Download a Security Risk Assessment Steps paper!

Security Risk assessment Quiz – Find Out How Your security risk assessment Stands Up!

DISC InfoSec 🔒 securing the business 🔒 via latest InfoSec titles

Subscribe to DISC InfoSec blog by Email

👉 Download a Virtual CISO (#vCISO) and Security Advisory Fact Sheet & Cybersecurity Cheat Sheet




Sep 17 2020

iOS 14 default app settings automatically reset to Mail and Safari after reboot – 9to5Mac

Category: cyber security,Security and privacy Law,Web Security — DISC @ 11:53 pm

One of the new features in iOS 14 is the ability to change the default email or browser app to a third-party alternative such as Chrome, Edge, or Outlook. A bug in the first public release of iOS 14, however, causes your default browser or mail app setting to reset to Mail or Safari when [
]

Source: iOS 14 default app settings automatically reset to Mail and Safari after reboot – 9to5Mac

In the version of iOS 14 released to the public this week, there is a massive caveat to the new default browser and settings. If you reboot your iPhone or iPad, the default app setting will reset to Apple’s first-party Mail and Safari applications.

What this means is that if you set Chrome as the default browser, but then your iPhone dies or you need to reboot it, Safari will once again become the default browser app until you go back into the Settings app and make the change again. The same applies to email apps such as Microsoft Outlook and Spark as well.

This is almost certainly some sort of bug on Apple’s side, because it is affecting email and browser apps from multiple companies including Google, Microsoft, and Readdle. On Twitter, a Google Chrome engineer has acknowledged the problem, though the ball is likely in Apple’s court to roll out some sort of fix — unless this is bizarrely the intended behavior.




Aug 26 2020

Safari Bug That Allows Stealing Data Disclosed After Apple Delays A Patch

Category: data security,Web Security — DISC @ 10:37 pm

Apple planned to release a fix for the Safari bug by Spring 2021, delaying it for one year. The bug allows stealing local data files.

Source: Safari Bug That Allows Stealing Data Disclosed After Apple Delays A Patch







Data Loss/Leak Prevention | Security Basics
httpv://www.youtube.com/watch?v=5CU9KYA-sz8





Aug 25 2020

Expert discloses unpatched Safari flaw that allows stealing local files

Category: Security vulnerabilities,Web Security — DISC @ 10:19 pm

A researcher disclosed technical details of an unpatched vulnerability in Apple’s Safari web browser that can be exploited to steal files from the targeted system.

Source: Expert discloses unpatched Safari flaw that allows stealing local files


Download a Security Risk Assessment Steps paper!

Security Risk assessment Quiz – Find Out How Your security risk assessment Stands Up!

DISC InfoSec 🔒 securing the business 🔒 via latest InfoSec titles

Subscribe to DISC InfoSec blog by Email

👉 Download a Virtual CISO (#vCISO) and Security Advisory Fact Sheet & Cybersecurity Cheat Sheet




« Previous Page — Next Page »