Aggregator

New and improved Security Update Guide!

Microsoft Update Tuesday
4 years 5 months ago
We’re excited to announce a significant update to the Security Update Guide, our one-stop site for information about all security updates provided by Microsoft. This new version will provide a more intuitive user experience to help protect our customers regardless of what Microsoft products or services they use in their environment.

How to Start Growing and Never Stop

The Akamai Blog
4 years 5 months ago
My heritage is Sri Lankan. But, at the age of 15 I moved to France as a refugee, fleeing a civil war. Starting a new life from scratch in France, without speaking French, was certainly an interesting journey. But I was lucky enough to have support from my parents. They lived by the mantra of "when there's a will, there's a way". And that helped get me into the French education system, where I completed high school and University, before moving to the UK to start my professional career in IT.
Akamai

Machine Learning Attack Series: Backdooring models

Embrace The Red
4 years 5 months ago
This post is part of a series about machine learning and artificial intelligence. Click on the blog tag “huskyai” to see related posts. Overview: How Husky AI was built, threat modeled and operationalized Attacks: The attacks I want to investigate, learn about, and try out Mitigations: Ways to prevent and detect the backdooring threat During threat modeling we identified that an adversary might tamper with model files. From a technical point of view this means an adversary gained access to the model file used in production and is able overwrite it.

腾讯代码安全检查Xcheck

腾讯代码安全检查Xcheck
4 years 5 months ago
Xcheck是一个由腾讯公司CSIG质量部代码安全检查团队自研的静态应用安全测试(SAST，Static application security testing)工具，致力于挖掘代码中隐藏的安全风险，提升代码安全质量。

Machine Learning Attack Series: Perturbations to misclassify existing images

Embrace The Red
4 years 5 months ago
This post is part of a series about machine learning and artificial intelligence. Click on the blog tag “huskyai” to see related posts. Overview: How Husky AI was built, threat modeled and operationalized Attacks: The attacks I want to investigate, learn about, and try out The previous post covered some neat smart fuzzing techniques to improve generation of fake husky images. The goal of this post is to take an existing image of the plush bunny below, modify it and have the model identify it as a husky.

Maximizing Qname Minimization: A New Chapter in DNS Protocol Evolution

Verisign Security Blog
4 years 5 months ago

Data privacy and security experts tell us that applying the “need to know” principle enhances privacy and security, because it reduces the amount of information potentially disclosed to a service provider — or to other parties — to the minimum the service provider requires to perform a service.  This principle is at the heart of […]

The post Maximizing Qname Minimization: A New Chapter in DNS Protocol Evolution appeared first on Verisign Blog.

Matt Thomas

ARL(资产侦察灯塔系统)-源码搭建 - Zhengjim

zhengjim
4 years 5 months ago
freebuf能力中心开源了一套资产扫描系统(https://github.com/TophantTechnology/ARL)，提供docker版，但并无源码搭建的文档(无完整文档)。于是在星光哥及小明哥指导下完成源码搭建，在这里记录一下。 环境 centos7.6 2h4g 搭建过程 首先从gi
Zhengjim

Headwinds and Tailwinds - Cycling For Climate Awareness in a Global Pandemic

The Akamai Blog
4 years 5 months ago
If you told me at the beginning of 2020 that I'd be cycling 250 miles in the remote Upper Peninsula of Michigan, fundraising for an organization called "Climate Ride", and wearing a face mask to go grocery shopping - I would not have believed you. Yet, since March 2020, we've all been living the reality of the Covid-19 pandemic. Social distancing, total lock-down for some, living and working from home, and dealing with a narrowed life experience.
Akamai

开源信息收集周报#57

情报小蜜蜂
4 years 5 months ago
本报告部分引自Week in OSINT栏目，每周推荐好玩实用的工具，站点，技巧，文章等，适用于任何领域的研究人员，分析测试人员。

Write a simple HTTPS server use Go

童话
4 years 5 months ago
0x00 前言

为了研究HTTPS的通信原理，随决定实现一个简易的 HTTPS 服务器，用最精简的代码可以专注于针对

TonghuaRoot

Machine Learning Attack Series: Smart brute forcing

Embrace The Red
4 years 5 months ago
This post is part of a series about machine learning and artificial intelligence. Click on the blog tag “huskyai” to see related posts. There are the two main sections of the series - more content will be added over time: Overview: How Husky AI was built, threat modeled and operationalized Attacks: The attacks I want to investigate, learn about, and try out The previous post covered basic tests to trick the image recognition model.

物联网安全之MQTT渗透实战

BaCde's Blog
4 years 5 months ago

上一篇 物联网安全之MQTT协议安全 主要介绍了MQTT安全的一些基础知识。今天将在上一篇基础上来说说实战中MQTT的利用。

在整个物联网或车联网架构中，MQTT的部分通常应用在移动端、管理端、Web端、设备端。而MQTT协议中的三种角色是发布者（PUBLISHER）、订阅者（SUBCRIBER）、代理（BROKER）。发布者（PUBLISHER）和订阅者（SUBCRIBER）通过代理（BROKER）来发布和订阅消息。这两个角色在实际场景中主要应用是移动端、Web端、设备端；代理（BROKER）一般是服务器，可以由activemq、hivemq、emqx等许多软件来搭建。在开发过程中，不同的设备，技术特点也有所不同。其使用的协议除了mqtt外，Web端通常使用websocket的方式来进行收发消息。

EMQ X Broker 场景 0x00 获取MQTT认证信息

目前对于MQTT的开发中的安全还尚未受到广泛关注，这使得有多种方式在移动端、Web端、设备端获取到MQTT的认证与连接信息。通过获取的信息来进一步实现越权访问、发布恶意内容等攻击。

Managed ad