Re: Google Translator affected by Cross-Site Scripting vulnerability

Posted by Gynvael Coldwind on Nov 28

Hi Francisco,

Unfortunately your disclosure is factually wrong.

Please note that even the packet you are citing says “Host:
translate.googleusercontent.com” – this is not the same domain as
translate.google.es (or translate.google.com), therefore, due to the
JavaScript same-origin policy (
https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy)
it’s a different origin. Which means that scripts executed from…

BlackArch Linux: New ISOs and Guide released

Posted by Black Arch on Nov 28

Dear list,

Today, we released new BlackArch Linux ISOs which include more than 1300
tools and comes with lots of improvements. The armv6h and armv7h
repositories
are filled with about 1150 tools. We have also released the BlackArch Linux
guide.

A short ChangeLog of the Live-ISOs:

– added more than 100 new tools
– updated system packages
– included linux kernel 4.2.5
– updated all tools
– updated menu entries for window…

You have new fax, document 0000892447

You have received a new fax.

To view it please open the attachment.

Scanned in:        18 seconds
Resolution:        200 DPI
Date:              Fri, 27 Nov 2015 13:40:15 +0300
Scanned by:        Lance Watkins
Filesize:          104 Kb
Document name:     document-0000892447.doc
Pages:             6

Thanks for using Interfax service!



Talking toys bring connected Christmas closer

Many parents will have noticed the invasion of talking, AI-enabled toys hitting the shelves this holiday season. Once inanimate, mute objects on which we had to project personalities, movement and more, the latest high-tech toys are increasingly learning to think for themselves – with sometimes worrying consequences.

One of the most talked about recent examples of such a toy is Barbie. The beloved companion of many, Barbie recently became more interactive than ever with the launch of a Wi-Fi connected version that listens, replies and learns over time. As anyone who has heard Barbie’s suggestion to hold a “pizza party!” will well know, the power of speech isn’t new to the doll – the latest release however is branching out considerably further, combining Wi-Fi and ‘machine learning’ to be able to have entire conversations with playmates.

Much like Siri or Cortana, Hello Barbie is mic’d up and connected to a server in the Cloud which analyzes what is said to the doll and then selects an appropriate response. Learning as she goes along, Barbie mimics a real life friend by remembering details that she can drop into future replies.

While this might be every kid’s dream, it’s likely to be a real cause for concern for the more privacy and security conscious parents among us.

Much of the technology we use on a daily basis is now equipped to ‘listen’ to us in a similar manner in order to facilitate easier, more human interaction. As already mentioned, the most obvious example of this are personal assistants like Siri and Cortana which sit on our mobile devices and activate at our command. An easy enough use case to understand. What can be alarming however, is when technology not traditionally designed to listen to us is enabled to. Smart TVs, for example, have been in the press recently due to their ability to listen to conversations, capture the data and relay it to third parties. Even connected baby monitors have been called out due to their susceptibility to hacking.

As with any connected device, the debated risk is that Hello Barbie could offer an easier in for hackers attempting to intercept your Wi-Fi network. While ToyTalk which manages the toy’s cloud connection emphasizes the security measures it has taken, it also admits that ‘no device is 100% secure.’ On top of their security concerns, parents might also wonder what is happening to the data being captured as their child chats away to Barbie. Is it being stored anywhere? Yes. Is anyone listening to it? Yes. Will that child end up being bombarded with advertising for other talking toys?  Hopefully not – according to ToyTalk, it does share recordings with third-party vendors, but only to improve their products. In any case, it sounds like any secret told to Barbie in confidence won’t stay that way for long!

Whether you like it or not, talking toys could be here to stay. This year, Elemental Path launched CogniToys – talking and listening dinosaurs enabled by IBM’s Watson, the famous artificially intelligent computer able to ‘understand’ human language. Another example is Ubooly, a cuddly bear described as the ‘Learning Toy that Listens’, becoming interactive once connected to a smartphone or tablet. Though only two examples, it’s just a matter of time before more of these toys hit the shelves.

So how do you feel about toys that listen? Will you be letting Barbie say hello to your child? With Christmas just around the corner, it’s worth considering the security implications of the latest high-tech toys available this season, and how connected you want your child to be.

IRS Releases First in a Series of Tax Security Tips

Original release date: November 27, 2015

The Internal Revenue Service (IRS) has released the first in a series of tips intended to increase public awareness of how to protect personal and financial data online and at home. A new tip will be available each Monday through the start of the tax season in January, and will continue through the April tax deadline.

The first tip focuses on seven simple steps to secure your computer when conducting business online. US-CERT encourages users and administrators to review IRS Security Awareness Tax Tip Number 1 for additional information.


This product is provided subject to this Notification and this Privacy & Use policy.

Red Hat Security Advisory 2015-2517-01

Red Hat Security Advisory 2015-2517-01 – Apache Commons Collections is a library built upon Java JDK classes by providing new interfaces, implementations and utilities. It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.