Redefining Client-Side Security with the Tala Security Certified Module for NGINX Plus

2020-02-25 KENNETH 0

Redefining Client-Side Security with the Tala Security Certified Module for NGINX Plus Up to 70% of the code rendering on websites today comes not from servers at the site, but via JavaScript integrations that operate outside the site’s security controls. This architecture enriches customer experience and engagement but also introduces critical vulnerabilities that enable client‑side attacks like Magecart. To understand how we can fix this problem, let’s start with a look at how we got here. Fifteen years ago, when a user visited a website, all processing occurred on the server. The response sent to the client was mostly HTML code to be rendered, meaning the browser or client app was primarily a rendering engine. Fast‑forward a few years and two key developments have transformed the architecture of modern web applications. First, companies like Google developed cloud‑based applications like GSuite to [ more… ]

No Image

TraceProcessor 1.0.0

2020-02-25 KENNETH 0

TraceProcessor 1.0.0 TraceProcessor version 1.0.0 is now available on NuGet with the following package ID: Microsoft.Windows.EventTracing.Processing.All This release contains bug fixes, API finalization and minor enhancements since version 0.3.0. Most of these changes were released recently in version 0.4.0. (A full changelog is below). Basic usage is still the same as in version 0.1.0 and version 0.2.0. With version 1.0.0, we have stabilized the API, and following semantic versioning, no breaking changes (source or binary) will be made within the 1.x.y versions of these packages. Note that there are a few parts of the API that are in preview and under active development; they may change in future releases; namely, the following types: IEventConsumer IScheduledConsumer ICompletable ConsumerSchedule ExtendedDataItem ExtendedDataItemReadOnlySpan ICompletableTwoPassEventConsumer IFilteredEventConsumer IFilteredTwoPassEventConsumer ITwoPassEventConsumer TraceEventCallback UnparsedGenericEvent As before, if you find these packages useful, we would love to hear from you, [ more… ]

No Image

Calling for security research in Azure Sphere, now generally available

2020-02-25 KENNETH 0

Calling for security research in Azure Sphere, now generally available Today, Microsoft released Azure Sphere into General Availability (GA). Azure Sphere’s mission is to empower every organization on the planet to connect and create secured and trustworthy IoT devices. Azure Sphere is an end-to-end solution for securely connecting existing equipment and for creating new IoT devices with built-in security. The solution includes hardware, OS, and … Calling for security research in Azure Sphere, now generally available Read More » The post Calling for security research in Azure Sphere, now generally available appeared first on Microsoft Security Response Center. Source: Calling for security research in Azure Sphere, now generally available

No Image

New to Windows 10? Check out ‘Simply Windows’ videos to get up to speed

2020-02-25 KENNETH 0

New to Windows 10? Check out ‘Simply Windows’ videos to get up to speed If you’re new to Windows 10 or want to learn more about how to get the most out of it, there’s now a video series to help you get up to speed on using it: “Simply Windows.” The first five episodes are now available on a playlist, with more to follow in the coming weeks. Writers serve as friendly hosts to walk you through tasks like finding your files, getting apps from the Microsoft Store and signing in with a Microsoft account. Writers at Microsoft help bring the voice of customers directly into its products – from the words you see in your software and hardware, to learning content that helps you improve your skills, to support content when you run into a problem. Their goal [ more… ]

No Image

USN-4291-1: mod-auth-mellon vulnerability

2020-02-24 KENNETH 0

USN-4291-1: mod-auth-mellon vulnerability libapache2-mod-auth-mellon vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.10 Ubuntu 18.04 LTS Summary libapache2-mod-auth-mellon could be made to redirect users to malicious sites. Software Description libapache2-mod-auth-mellon – SAML 2.0 authentication module for Apache Details It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL. Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 19.10 libapache2-mod-auth-mellon – 0.14.2-1ubuntu1.19.10.1 Ubuntu 18.04 LTS libapache2-mod-auth-mellon – 0.13.1-1ubuntu0.2 To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References CVE-2019-13038 Source: USN-4291-1: mod-auth-mellon vulnerability