Notices by infosec-handbook.eu (infosechandbook@mastodon.at), page 2

Most consumer routers don't make use of modern security features of Linux:

https://cyber-itl.org/assets/papers/2018/build_safety_of_software_in_28_popular_home_routers.pdf (PDF file)

– 28 popular routers don't make use of ASLR (Address Space Layout Randomization), DEP (Data Execution Prevention), RELRO (RELocation Read-Only), and stack guards
– report contains Asus, D-Link, Linksys, Netgear, Synology, TP-Link, and Trendnet routers

#router #security #infosec #cybersecurity #aslr #dep #relro #linux #stack

Nearly 19,500 Orange LiveBox ADSL modems are leaking WiFi credentials:

https://www.zdnet.com/article/over-19000-orange-modems-are-leaking-wifi-credentials/

– vulnerability (CVE-2018-20377) allows a remote attacker to obtain the WiFi password and SSID for the modem's internal WiFi network just by accessing the modem's get_getnetworkconf.cgi
– nearly all modems are located in France and Spain
– see also https://github.com/zadewg/LIVEBOX-0DAY

#modem #adsl #orange #livebox #vulnerability #infosec #cybersecurity #security

Benefits of our experimental Dat mirror:

– you don't need to connect to a centralized hosting provider
– you can seed all files of our blog by yourself and support P2P hosting
– you can download a full local copy of our blog
– you can read our content even if our blog is down (e.g. due to maintenance)

#p2p #dat #datproject #blog #decentralized #infosechandbook #infosec #cybersecurity

Mastodon :mastodon: security:

864 out of 2050 Mastodon instances (which report their version according to instances.social) are still running vulnerable Mastodon server software (< 2.4.4).

See also:
https://mastodon.at/@infosechandbook/100597698990522530

#mastodon #security #vulnerability #infosec #security #cybersecurity

Ad-blocker uBlock Origin got per-site JavaScript master switch:

https://github.com/gorhill/uBlock/releases/tag/1.17.0

#ublockorigin #ublock #adblock #adblocker #javascript #js #privacy

"A Formal Security Analysis of the Signal Messaging Protocol", Extended Version November 2017 (University of Oxford, MacMaster University)

https://eprint.iacr.org/2016/1013.pdf

#signal #protocol #infosec #cybersecurity #security

Critical security vulnerability in XMPP messenger Conversations 2.

Conversations 2.x users should immediately update to 2.1.4.

Conversations 1.x and Conversations Legacy are officially not affected.

Source: iNPUTmice via Twitter

#conversations #xmpp #vulnerability