exploits   1727

« earlier    

Metasploitable is a a VM that is built from the ground up with a large amount of security vulnerabilities.
cyber  security  VM  tools  exploits 
5 days ago by bonuswavepilot
Metasploit Unleashed - Free Online Ethical Hacking Course
Metasploit Unleashed (MSFU) is a Free Online Ethical Hacking Course by Offensive Security, which benefits Hackers for Charity. Learn how to use Metasploit.
infosec  hacking  course  security  metasploit  Bookmarks_Bar  education  exploits  oscp  penetration-testing 
5 weeks ago by tranqy
_The Ballot is Busted Before the Blockchain: A Security Analysis of Voatz, the First Internet Voting Application Used in U.S. Federal Elections_
tl;dr: it doesn't do well. US voting infrastructure continues to be garbage.

'In the 2018 midterm elections, West Virginia became the first state in the U.S. to allow select voters to cast their ballot on a mobile phone via a proprietary app called “Voatz.”
Although there is no public formal description of Voatz’s security model, the company claims that election security and
integrity are maintained through the use of a permissioned blockchain, biometrics, a mixnet, and hardware-backed key
storage modules on the user’s device. In this work, we present the first public security analysis of Voatz, based on a reverse engineering of their Android application and the minimal available documentation of the system. We performed a cleanroom reimplementation of Voatz’s server and present an analysis of the election process as visible from the app itself.
We find that Voatz has vulnerabilities that allow different kinds of adversaries to alter, stop, or expose a user’s vote,
including a sidechannel attack in which a completely passive network adversary can potentially recover a user’s secret ballot. We additionally find that Voatz has a number of privacy issues stemming from their use of third party services for
crucial app functionality. Our findings serve as a concrete illustration of the common wisdom against Internet voting,
and of the importance of transparency to the legitimacy of elections.'
voting  e-voting  voatz  security  exploits  android  papers  reverse-engineering 
6 weeks ago by jm
A Different Type of Card Fraud: Anatomy of a PAN Enumeration Attack
excellent explanation of a new kind of credit card fraud - and also a great ad for privacy.com. Brute-force attacks against cards, basically
attacks  via:briankrebs  privacy.com  security  exploits  credit-cards 
6 weeks ago by jm
Critical Bluetooth Vulnerability in Android (CVE-2020-0022) – BlueFrag
On Android 8.0 to 9.0, a remote attacker within proximity can silently execute arbitrary code with the privileges of the Bluetooth daemon as long as Bluetooth is enabled. No user interaction is required and only the Bluetooth MAC address of the target devices has to be known. For some devices, the Bluetooth MAC address can be deduced from the WiFi MAC address. This vulnerability can lead to theft of personal data and could potentially be used to spread malware (Short-Distance Worm).
On Android 10, this vulnerability is not exploitable for technical reasons and only results in a crash of the Bluetooth daemon.
bluetooth  android  security  exploits  worms 
6 weeks ago by jm
Who Broke the SHA1 Algorithm (And What Does It Mean for Bitcoin)? - CoinDesk
A long-standing bitcoin bounty on finding a SHA1 collision attack was just claimed. But what are the larger implications for the community?
sha1  infosec  security  cryptography  crypto  gnupg  pgp  gpg  exploits  hash.collision  lol.buttcoin 
8 weeks ago by po

« earlier    

related tags

0-day  2fa  afk  android  apple  applications  assembly  attacks  blackhat  blog  bluetooth  book  bookmarks_bar  browser  bug-bounties  builds  china  course  credit-cards  crown-of-sorrow  crypto  cryptography  ctf  cve  cyber  database  debugging  destiny  destiny2  development  digital-services  digital-signature  docker  dps  e-voting  ecc  education  esp32  esp8266  exotics  exploit  exploitsdb  fail  farming  fido  fips  flaws  free  games  garden-of-salvation  gnupg  gpg  guides  hack  hacking  hacks  hardware  hash.collision  home-automation  http  industry  infosec  internet.of.shit  ios  iot  iphone  jailbreak  javascript  kernel  kubernetes  linux  local  lol.buttcoin  malware  market  memory_corruption  metasploit  moments-of-triumph  mqtt  networking  oscp  outages  p0  papers  penetration-testing  pentesting  pgp  php  poc  privacy.com  programming  python  quests  ransomware  reference  remote  research  reverse-engineering  reverseengineering  reversing  risks  routers  scourge-of-the-past  scripting  security  service  sga  sha1  shadowkeep  shellcode  sqlite  surveillance  technology  tools  travelex  tutorials  usb  v8  vectors  video  vm  voatz  voting  vpnfilter  vulnerabilities  vulnerability  walkthroughs  weapons  web  windows  worms  xss  xsshunter  yubikey  zip  zip_bomb 

Copy this bookmark: