Aggregator

null 2.0 - Call for Initiative

null - The Open Security Community
5 years 10 months ago
Take up the initiative, start a null chapter in your city We are starting the new era of our open security community as null 2.0 and we would like to make an open appeal to all the people who want to be a part of this wonderful security community.

谈谈云服务和 SLA

Sukka's Blog
5 years 10 months ago
云服务在宣传时往往会强调：永远在线、永远可用、永不丢失。但是我们心里都明白，现实离这个差远了。GitHub 在过去 30 天累计宕机 5 次，这已经是非常严重的事故了。既然如此，我们应该信赖云计算以及其他 PaaS、SaaS 业务么？如何衡量一个云服务的可靠程度？
Sukka

How Credential Stuffing Is Evolving

F5 Labs
5 years 10 months ago
Cred stuffing isn't going away. Shape's Jarrod Overson writes for InformationSecurityBuzz, examining the ROI of cred stuffing for attackers, and the evolution to "imitation attacks".

Remotely debugging Firefox instances

Embrace The Red
5 years 10 months ago

Previously I talked about remotely debugging Chrome, and we also covered the latest Microsoft Edge browser along the way.

These features allow an adversary to gain access to authentication tokens and cookies. See MITRE ATT&CK Technique T1539: Steal Web Session Cookie as well for this.

What about Firefox?

For a while I was wondering if (my favorite) browser Firefox has such debugging features as well, and how one could detect malware trying to exploit it.

Managed ad