keep moving

Free vulnerability scan by the government for Japan netizens.

Can’t say it’s a bad idea, if it’s well-managed. The fact is there are a lot of devices out there which have default credentials or unpatched vulnerabilities. These devices usually end up being exploited by threat actors for personal gains. Ability to identify vulnerable devices is a necessary first step towards mitigating potential cyber incidents.

Japan will attempt to access Internet-connected devices in homes and offices to find their vulnerabilities. The first-of-its-kind survey is aimed at beefing up cyber-security.

Source: Govt. to access home devices in security survey – News – NHK WORLD – English

This is a serious one. A vulnerability exists on Android that will allow the phone to be hacked simply by viewing a malicious PNG image.

The most severe of these issues is a critical security vulnerability in Framework that could allow a remote attacker using a specially crafted PNG file to execute arbitrary code within the context of a privileged process. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed.

Source: Android Security Bulletin — February 2019  |  Android Open Source Project

The cost of data is not just the bytes that are required to store them. Increasingly laws will target companies for over-collecting, misusing, and not doing enough to protect PII data.

California recently passed an extremely powerful, far-reaching law, the California Consumer Privacy Act (CCPA), that will likely drive even more change than the GDPR. Here’s what your dev team needs to know and how to prepare.

Source: CCPA will hit your dev team harder than GDPR. Here’s why.

This is a serious hijack of a toolchain used by developers.

Pear.php.net shuts down after maintainers discover serious supply-chain attack.

Source: If you installed PEAR PHP in the last 6 months, you may be infected | Ars Technica