SSH Configuration on Nexpose Servers Allowed Weak Encryption Algorithms
Rapid7 warned this week that its Nexpose appliances were shipped with a SSH configuration that could have let obsolete algorithms be used for key exchange.
Chris Brook
About
"Distrust and caution are the parents of security" - Benjamin Franklin
Threatpost News Wrap, June 2, 2017
Mike Mimoso and Chris Brook discuss the news of the week, including the ShadowBrokers crowdfunding attempt, errors in WannaCry, a new Wikileaks dump, last week’s Samba vulnerability, and the OneLogin breach.
OneLogin Breach Compromised Customer Data, Ability to Decrypt Encrypted Data
A breach at OneLogin appears to have compromised customer data, including the ability to decrypt encrypted data.
Senators introduced a bill last week to establish a bug bounty pilot program within the Department of Homeland Security.
Cisco is prepping fixes for two of its products affected by last week’s Samba vulnerability. Netgear has also pushed out a fix for NAS devices that were affected.
Developers behind FreeRADIUS, an open source implementation of the networking protocol RADIUS, are encouraging users to update to address an authentication bypass found in the server.
Mark Dowd discusses why certain exploit mitigations have been so successful in driving up the cost of exploit development for attackers.
Mike Mimoso and Chris Brook recap the news of the week, including the EternalRocks worm, the latest on WannaCry, a subtitle hack, and a Twitter flaw.
A recently released extension for Chrome, developed by the public key crypto database Keybase, brought end-to-end encrypted messaging to several apps this week.
Twitter fixed a flaw in its Twitter Ads service could have allowed an attacker to tweet as any user.
