Sombody needs that right into their face. Sometime repeatedly.
threat actor = someone who wants to punch you in the face
from the tweet
threat = the punch being thrown
vulnerability = your inability to defend against the punch
risk = the likelihood of getting punched in the face
acceptable risk = your willingness to be punched in the face
risk management = your ability to see the punch coming
Also, Ricki Burke made the original Authors Casey Ellis tweet into T-Shirts:
Remember Intel’s Spectre? Now Intel’s Core Ring-Interconnect can be exploited to extract encryption keys.
Google’s Project Zero drops a hand full of Zero Day vulnerabilities for the iPhone at Black Hat 2019. Apparently one of them isn’t patched yet. Interaction-less Attack Surface in this context means, it’s wormable, executing code with no human interaction.
Source: Look, No Hands! — The Remote, Interaction-less Attack Surface of the iPhone
Until recently, notepad.exe was considered safe in terms of security vulnerability, mostly for its lack of features and therefore lack of attack surface. Until Vulnerability researcher at Google, Tavis Ormandy, took a closer look and popped a shell from notepad.exe.
Awesome.
Quick:
https://twitter.com/hdmoore/status/598644158664814592
Security researchers say the zero-day flaw affects “millions” of machines in datacenters around the world.
Security researchers found a flaw in QEMU, dating back to 2004. Lots of virtualization platforms inherited the bug. Since virtualization powers the cloud, this has some potential.
Quelle: Bigger than Heartbleed, ‘Venom’ security vulnerability threatens most datacenters | ZDNet
Filippo Valsorda wrote a test to check whether your PC is vulnerable through the Superfish Malware, that Lenovo decided to preinstall on it’s devices.
Check here if you trust the Superfish CA.