Gonçalo Valério @dethos@s.ovalerio.net

Malicious JavaScript in image metadata used to steal data; then, images are used again to exfiltrate data:

https://blog.malwarebytes.com/threat-analysis/2020/06/web-skimmer-hides-within-exif-metadata-exfiltrates-credit-cards-via-image-files/

– Malware uses Exif metadata to inject JavaScript that steals data.
– Afterward, the data is exfiltrated as an image via GET/POST to another server.
– As a server admin, frequently update the server software, and monitor file integrity + network traffic. Moreover, set a strict Content Security Policy.

#malware #image #metadata #exif #infosec #security

OWASP Chapters All Day (June 2020):
In case you missed it, there is a collection of recent OWASP talks. The topics include security-relevant HTTP response headers, lessons learned for incident response teams (CSIRT/PSIRT), and hardening code/systems.

https://owasp.org/www-community/pages/social/chapters_all_day/schedule/

#owasp #infosec #talks #security #cybersecurity

Design vs. Users

This is a great example of why open source is the only thing that's really worth investing your time into long term.

"Because Synthing is free and doesn’t depend on server-side storage, they don’t need to put weird or unnatural restrictions on you."

https://tonsky.me/blog/syncthing/

The upcoming "Feature Policy" is now called "Permissions Policy":

https://w3c.github.io/webappsec-feature-policy/

We already updated the relevant part of our Web server security series: https://infosec-handbook.eu/blog/wss3-tls-headers/#ex-headers

Keep in mind that the Permissions Policy isn't supported by most web browsers, so you don't need to set it at the moment. Clients ignore it.

#FeaturePolicy #PermissionsPolicy #webserver #security #infosec #cybersecurity

Achieving accessibility through simplicity

https://sourcehut.org/blog/2020-05-27-accessibility-through-simplicity/