When repairing things you own may make you an outlaw

How do you balance the right to repair with the requirement to remain secure?

The post When repairing things you own may make you an outlaw appeared first on WeLiveSecurity

/by

5 reasons why (not only) financial companies struggle with cybersecurity

Why do many organizations have a hard time keeping up with the evolving threat landscape and effectively managing their cyber-risks?

The post 5 reasons why (not only) financial companies struggle with cybersecurity appeared first on WeLiveSecurity

/by

Week in security with Tony Anscombe

A banking trojan masquerades as Clubhouse for Android – The implications of the Verkada breach – A zero-day patched in Chrome

The post Week in security with Tony Anscombe appeared first on WeLiveSecurity

/by

7 steps to staying safe and secure on Twitter

Follow these easy steps to prevent your Twitter account from being hacked and to remain safe while tweeting

The post 7 steps to staying safe and secure on Twitter appeared first on WeLiveSecurity

/by

Trust your surveillance? Why hacked cameras are very bad

When a breach captures a part of us that is unchangeable, does it mean that we have allowed technology to pry too deeply into our lives?

The post Trust your surveillance? Why hacked cameras are very bad appeared first on WeLiveSecurity

/by

Trust your surveillance? Why hacked cameras are very bad

When a breach captures a part of us that is unchangeable, does it mean that we have allowed technology to pry too deeply into our lives?

The post Trust your surveillance? Why hacked cameras are very bad appeared first on WeLiveSecurity

/by

FBI: Cybercrime losses topped US$4.2 billion in 2020

The Bureau received over 28,000 reports of COVID-19-themed scams last year

The post FBI: Cybercrime losses topped US$4.2 billion in 2020 appeared first on WeLiveSecurity

/by

Beware Android trojan posing as Clubhouse app

The malware can grab login credentials for more than 450 apps and bypass SMS-based two-factor authentication

The post Beware Android trojan posing as Clubhouse app appeared first on WeLiveSecurity

/by

Announcing the winners of the 2020 GCP VRP Prize

Posted by Harshvardhan Sharma, Information Security Engineer, Google 


We first announced the GCP VRP Prize in 2019 to encourage security researchers to focus on the security of Google Cloud Platform (GCP), in turn helping us make GCP more secure for our users, customers, and the internet at large. In the first iteration of the prize, we awarded $100,000 to the winning write-up about a security vulnerability in GCP. We also announced that we would reward the top 6 submissions in 2020 and increased the total prize money to $313,337.

2020 turned out to be an amazing year for the Google Vulnerability Reward Program. We received many high-quality vulnerability reports from our talented and prolific vulnerability researchers.

Vulnerability reports received year-over-year

This trend was reflected in the submissions we received for the GCP VRP Prize. After careful evaluation of the many innovative and high-impact vulnerability write-ups we received this year, we are excited to announce the winners of the 2020 GCP VRP Prize:

  • First Prize, $133,337: Ezequiel Pereira for the report and write-up RCE in Google Cloud Deployment Manager. The bug discovered by Ezequiel allowed him to make requests to internal Google services, authenticated as a privileged service account. Here’s a video that gives more details about the bug and the discovery process.

  • Second Prize, $73,331: David Nechuta for the report and write-up 31k$ SSRF in Google Cloud Monitoring led to metadata exposure. David found a Server-side Request Forgery (SSRF) bug in Google Cloud Monitoring’s uptime check feature. The bug could have been used to leak the authentication token of the service account used for these checks.
  • Third Prize, $73,331: Dylan Ayrey and Allison Donovan for the report and write-up Fixing a Google Vulnerability. They pointed out issues in the default permissions associated with some of the service accounts used by GCP services.
  • Fourth Prize, $31,337: Bastien Chatelard for the report and write-up Escaping GKE gVisor sandboxing using metadata. Bastien discovered a bug in the GKE gVisor sandbox’s network policy implementation due to which the Google Compute Engine metadata API was accessible. 
  • Fifth Prize, $1,001: Brad Geesaman for the report and write-up CVE-2020-15157 “ContainerDrip” Write-up. The bug could allow an attacker to trick containerd into leaking instance metadata by supplying a malicious container image manifest.
  • Sixth Prize, $1,000: Chris Moberly for the report and write-up Privilege Escalation in Google Cloud Platform’s OS Login. The report demonstrates how an attacker can use DHCP poisoning to escalate their privileges on a Google Compute Engine VM.

Congratulations to all the winners! If we have piqued your interest and you would like to enter the competition for a GCP VRP Prize in 2021, here’s a reminder on the requirements.

  • Find a vulnerability in a GCP product (check out Google Cloud Free Program to get started)
  • Report it to the VRP (you might get rewarded for it on top of the GCP VRP Prize!)
  • Create a public write-up
  • Submit it here

Make sure to submit your VRP reports and write-ups before December 31, 2021 at 11:59 GMT. Good luck! You can learn more about the prize for this year here. We can’t wait to see what our talented vulnerability researchers come up with this year!

/by

Google fixes Chrome zero‑day bug exploited in the wild

The latest update patches a total of five vulnerabilities affecting the browser’s desktop versions

The post Google fixes Chrome zero‑day bug exploited in the wild appeared first on WeLiveSecurity

/by