PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Zoom đối mặt với một loạt vấn đề an ninh và quyền riêng tư

blog.viettelcybersecurity.com | blog | #credential-theft | #windows | #privacy | #covid-19 | #zoom | #unc-injection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Zoom's pandemic-era popularity exposed flaws including UNC path injection stealing Windows NTLM credentials, plus broader privacy concerns researchers disclosed as usage surged.
Published
Collected

Related coverage

blog · netspi.com
Zoom Vulnerabilities: Making Sense of it All
With Zoom usage spiking during COVID-19, this piece explains why static personal meeting IDs, missing passwords, and absent rate limiting enabled Zoombombing, and what settings reduce the risk.
tool · github.com
LogonStealer: Windows Credential Provider DLL for Stealing Plaintext Passwords via CredProvDataModel Hooks
Demonstrates an effective post-exploitation technique targeting the modern Windows 11 WinRT logon architecture to harvest plaintext credentials while bypassing PPL.
blog · blog.viettelcybersecurity.com
Bảo đảm ATTT bằng biện pháp quản lý truy cập đặc quyền trong Y tế
Thycotic Centrify advisor Joseph Carson argues that with hospitals overloaded by COVID-19 and healthcare attacks rising, privileged access management is a key safeguard for sensitive patient data.
blog · blog.viettelcybersecurity.com
Zero trust: Đảm bảo ATTT khi làm việc từ xa
Lookout's Hank Schless explains why Zero Trust is essential for remote work, arguing no device should be trusted until proven secure, especially mobile endpoints accessing cloud resources.
blog · blog.viettelcybersecurity.com
Một thế giới không còn quyền riêng tư và vấn đề về quản trị dữ liệu
Thycotic's Joseph Carson argues privacy is eroding amid ubiquitous surveillance, calling for stronger regulation, least-privilege practices and transparent data governance.
blog · blog.viettelcybersecurity.com
533 triệu tài khoản Facebook bị lộ lọt thông tin cá nhân
Personal data of 533 million Facebook users, scraped via a 2019 vulnerability, was posted free on a hacking forum, including phone numbers of Zuckerberg and other executives who used Signal.
Back