Security

Escape Docker Container Using waitid() | CVE-2017-5123 | Twistlock

https://www.twistlock.com/2017/12/27/escaping-docker-container-using-waitid-cve-2017-5123/ In 2017 alone, 434 linux kernel exploits where found, and as you have seen in this post, kernel exploits can be devastating for containerized environments. This is because containers share the same kernel as the host, thus trusting the built-in protection mechanisms alone isn’t sufficient. Make sure your kernel is always updated on all

‘Kernel memory leaking’ Intel processor design flaw

https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/ A fundamental design flaw in Intel’s processor chips related to virtual memory system (Intel x86-64 hardware) allows normal user programs (even JavaScript in web browsers) to discern to some extent the layout or contents of protected kernel memory areas. It is understood the bug is present in modern Intel processors produced in the past decade. It appears a

Cyber security trends for 2018

Year 2017 was bad cybersecurity year, and it is expected new Cybersecurity Dangers Will Spike in 2018. Security situation was so bad in 2017 that it was though that We’re hitting rock bottom in cyber, but I fear that we have nit yet hit the bottom, and thing will still get worse until they start

The Art of Human Hacking

https://xeushack.com/the-art-of-human-hacking/ Now that we’ve been introduced to social engineering, it’s time to learn about the vulnerabilities in the system we’re trying to hack into: humans. Social engineering is all about making someone do something that they’re not supposed to do. 

Linux antivirus and anti malware: 8 top tools | CSO Online

https://www.csoonline.com/article/3238884/linux/linux-antivirus-and-anti-malware-8-top-tools.html  By most estimates, more than 50 percent of web servers on the internet are running some version of Linux or a related *nix. That should be enough to drive home how critical it is to the ongoing success of the Information Age that you analyze, identify, and eradicate malware on or passing through your

Virtual security

New IT term of the day: Virtual security: Manufacturers claim their products are secure. In reality they are not. Related post:  http://www.epanorama.net/newepa/2017/12/01/were-hitting-rock-bottom-in-cyber-lets-do-something-techcrunch/

We’re hitting rock bottom in cyber — let’s do something | TechCrunch

https://techcrunch.com/2017/11/29/were-hitting-rock-bottom-in-cyber-lets-do-something/?ncid=rss&utm_source=tcfbpage&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&sr_share=facebook When it comes to the cybersecurity problem, where is rock bottom? Was it WannaCry, a ransomware attack. Or similar and perhaps even worse attack that hit just weeks later? Was it the Yahoo breaches? Or Equifax and Uber? Intel and Apple leaving our computer management accounts wide open? Banking computer systems hacked and many millions stolen? Or critical infrastructure hackers

Permissionless data slurping: Why Google’s latest bombshell matters • The Register

https://www.theregister.co.uk/2017/11/22/permissionless_data_slurping_google/ Somebody else than just your mobile operator gets to know where you are: According to an old Chinese proverb: “When a wise man points at the Moon, an idiot looks at his finger.” Google may have been hoping that you were examining a finger, not reading a Quartz story yesterday, which reveals how Android phones send