Gonçalo Valério @dethos@s.ovalerio.net

"Endlessh: an SSH Tarpit"

https://nullprogram.com/blog/2019/03/22/

👍 nice idea, might try it someday

#security

"Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years"

https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/

😱

#security #infosec

An example of the File Content Disclosure one:

https://twitter.com/iblueconnection/status/1107702203349979136

#security #netsec #appsec

"Four Wikipedias to ‘black out’ over EU Copyright Directive"

https://wikimediafoundation.org/2019/03/20/four-wikipedias-to-black-out-over-eu-copyright-directive/

I think all of them should have participated in the protest

#article13 #eu #eucopyrightdirective #europe

"Discovering a zero day and getting code execution on Mozilla's AWS Network"

https://blog.assetnote.io/bug-bounty/2019/03/19/rce-on-mozilla-zero-day-webpagetest/

The issue was on the webpagetest project but it was a nice read nevertheless.

#security #netsec

"Gearbest Hack: Hundreds of Thousands Affected Daily by Huge Data Breach"

https://www.vpnmentor.com/blog/gearbest-hack/

Always knew that a large amount of these privacy policies we see on many websites are just boilerplate and complete BS.

#security #databreach #infosec #netsec

Some recently disclosed vulnerabilities rails developers should be aware of:

- Denial of Service Vulnerability in Action View - https://seclists.org/oss-sec/2019/q1/177

- File Content Disclosure in Action View - https://seclists.org/oss-sec/2019/q1/178

- Possible Remote Code Execution Exploit in Rails Development Mode - https://seclists.org/oss-sec/2019/q1/176

Upgrade your apps.

#rails #ror #security #netsec #appsec #ruby

"Why is no one signing their emails?"

https://arp242.net/weblog/signing-emails.html

Good point. We should push for this to be more common.

#security #email

"3 million vehicles can be unlocked remotely via trivially discovered web API vulnerability"

https://www.pentestpartners.com/security-blog/gone-in-six-seconds-exploiting-car-alarms/

"unhackable" is a very strong word.

#security #netsec #appsec

Very interesting chat about "DevOps at Amazon":

https://www.youtube.com/watch?v=FlZm3nFMIAM

#devops #devsecops #security #software

https://www.youtube.com/watch?v=CyUh9wOp_Rw

#europe #eu #article13

Password Managers: Under the Hood of Secrets Management

https://www.securityevaluators.com/casestudies/password-manager-hacking/

It would be nice read a similar analysis for password managers that also run on Linux such as: keepassX, keepassXC, pass, etc.

#security #infosec #password-manager #passwords

"Incidents — Trends from the Trenches"

https://m.subbu.org/incidents-trends-from-the-trenches-e2f8497d52ed

An overview about the causes of production incidents