Security on Omid Farhang

The Frontend Is a Privileged System Now

Sat, 15 Aug 2026 23:50:00 +0330

The browser is untrusted, but the system that builds and delivers the frontend is not. Install hooks, CI identities, and release credentials make frontend delivery a production trust boundary.

The AUR Is Frozen: Inside Arch's Third Supply-Chain Attack Wave

Mon, 10 Aug 2026 12:00:00 +0330

Arch Linux froze all AUR writes after a third supply-chain attack wave, then restored pushes and adoption on August 11 with review gates. Timeline, how Atomic Arch worked, and what to do on Manjaro and other Arch-derived distros.

Modern Auth Patterns for Angular Frontends (Beyond “Just Add JWT”)

Fri, 31 Jul 2026 00:40:00 +0330

Stop storing JWTs in localStorage. Use OIDC with a BFF or reverse proxy, short-lived server-side tokens, HttpOnly cookies, and Angular interceptors and guards that do not pretend to be your security boundary.

Why Client-Side Frameworks Need Security Updates

Wed, 29 Jul 2026 00:41:00 +0330

Browser frameworks still own sanitization, request protection, and SSR isolation. Three recent Angular CVEs show why framework patches are part of every client-side app’s security boundary.

Securing Angular PWAs in 2026

Wed, 22 Jul 2026 00:42:00 +0330

Security for Angular Progressive Web Apps: HTTPS and service worker scope, cache strategies that do not leak auth-dependent data, and offline sessions without raising XSS or CSRF risk.

Dependency Risk, SBOMs, and Automated Security for Angular

Sat, 18 Jul 2026 00:45:00 +0330

Build an SBOM and CI security pipeline for Angular monorepos: npm audit, ng update --dry-run, fail on high-severity CVEs, Dependabot/Snyk, and post summaries to Slack or Mastodon.

Content Security Policy (CSP) and Angular: Practical Patterns

Wed, 15 Jul 2026 00:50:00 +0330

Ship CSP for Angular without breaking the build: report-only first, nonces via autoCsp or ngCspNonce, nginx/Apache/Cloudflare headers, and a small scanner for inline handlers, eval, and other footguns.

Advanced Security Practices for Web Applications: Implementing CSP, HSTS, and SRI

Sun, 16 Jun 2024 01:10:11 +0330

In today’s digital age, the security of web applications is of paramount importance. With cyber-attacks becoming increasingly sophisticated, web developers must implement robust security measures to protect their applications and users. This blog post explores three advanced security practices—Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and Subresource Integrity (SRI)—that can significantly enhance the security of web applications. We will delve into their implementation, use cases, and benefits, providing comprehensive guidance to help you secure your web applications effectively.

Linux Malware targets WordPress and common Plugins

Sun, 15 Jan 2023 23:55:43 +0330

Doctor Web has discovered a malicious Linux program that hacks websites based on a WordPress CMS. It exploits 30 vulnerabilities in a number of plugins and themes for this platform. If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted webpages are injected with malicious JavaScripts. As a result, when users click on any area of an attacked page, they are redirected to other sites.

What they can do?

Upon their command, it is able to perform the following actions:

End of Microsoft Windows 7 security updates from today

Tue, 10 Jan 2023 17:56:31 +0330

Starting today, January 10th, Windows 7 Enterprise and Professional operating systems will no longer receive security updates. Thus, computers that still run these OS will no longer be protected against critical vulnerabilities.

Apart from the operating system itself, browsers (both Edge and third-party browsers), as well as services from other non-Microsoft vendors, such as NVIDIA, have confirmed that they have also stopped offering new security patches in Windows 7.

Actions to be taken

You should upgrade your Microsoft Windows to newer versions, if your hardware does not support Windows 11, you may upgrade to Windows 10 or maybe consider switching to another Operation System like Linux.

Farewell Lastpass, We don't need more data breach

Thu, 29 Dec 2022 01:21:22 +0330

You’ve heard it again and again: You need to use a password manager to generate strong, unique passwords and keep track of them for you. And if you finally took the plunge with a free and mainstream option, particularly during the 2010s, it was probably LastPass. For the security service’s 25.6 million users, though, the company made a worrying announcement last week: A security incident the firm previously reported on November 30 was actually a massive and concerning data breach that exposed encrypted password vaults—the crown jewels of any password manager—along with other user data.

Cross-platform botnet targets SSH-enabled devices

Mon, 12 Dec 2022 23:37:43 +0330

Microsoft researchers found a cross-platform botnet that originates from malicious software downloads on Windows devices & succeeds in propagating to a variety of Linux-based devices by enumerating default credentials on internet-exposed SSH-enabled devices.

Microsoft researchers observed that the initial infection points related to the botnet were devices infected through the installation of malicious cracking tools that purport to acquire illegal Windows licenses. The cracking tools contain additional code that downloads and launches a fake version of svchost.exe through a PowerShell command. In some cases, the downloaded file is named svchosts.exe.

What you need to know about BERserk and Mozilla

Thu, 25 Sep 2014 22:10:46 +0000

The Intel Security Advanced Threat Research Team has discovered a critical signature forgery vulnerability in the Mozilla Network Security Services (NSS) crypto library that could allow malicious parties to set up fraudulent sites masquerading as legitimate businesses and other organizations.

The Mozilla NSS library, commonly utilized in the Firefox web browser, can also be found in Thunderbird, Seamonkey, and other Mozilla products. Dubbed “BERserk”, this vulnerability allows for attackers to forge RSA signatures, thereby allowing for the bypass of authentication to websites utilizing SSL/TLS. Given that certificates can be forged for any domain, this issue raises serious concerns around integrity and confidentiality as we traverse what we perceive to be secure websites.

New Facebook scams in 2014

Fri, 22 Aug 2014 17:03:30 +0000

So many Facebook scams in 2014 have been a little worrying even though at first they all seem innocent enough, but these are social scams to lure users in to gain money or access to computers.

One particular Facebook scam this year was the “Robin Williams goodbye video”, which was apparently made before his death. This fake BBC News video is a scam and no such video exists.

The “Robin Williams goodbye video” started to circulate on Facebook and asks users to share the video before they can watch it, DO NOT click on it. There is no video so no point on sharing it, Symantec explains in detail that when Facebook users click on the video it asks them to either fill out a survey or install an application. When the survey is complete the scammers gain money for each one completed.

The FBI is willing to pay top dollar to download some malware

Fri, 07 Feb 2014 22:45:03 +0000

The Federal Bureau of Investigation is willing to pay top dollar for the malicious, infectious software the rest of us pay to keep out of our computers, according to the Federal Business Opportunities website.

A Monday price quote request by the Investigative Analysis Unit of the agency’s Operational Technology Division is asking computer security developers and retailers to help the agency build a library of malware for an undisclosed reason, letting the companies name their price.

WordPress hardened with XSS, DoS and SSRF fixes

Tue, 25 Jun 2013 10:57:44 +0000

With the second security and maintenance release of WordPress 3.5, the developers of the popular open source blogging software have closed 12 bugs, seven of them security issues. In their announcement, the developers “strongly encourage” all users to update all their installations of the software to version 3.5.2 immediately. In addition to the fixed vulnerabilities, the new release also includes some proactive changes intended to harden the platform against attacks.

Facebook Virus That Drains Your Bank Accounts: What You Need to Know

Thu, 06 Jun 2013 08:43:10 +0000

This post has been shared originally by Malwarebytes Blog:

The word about the Zeus Trojan back on Facebook has spread as fast as the malware itself across many news sites.

Awareness and education about online dangers is essential but headlines like “Malware That Drains Your Bank Account Thriving On Facebook” instill fear while at the same time blame Facebook — something that may not be entirely justified.

Malicious links on social networking sites are nothing new (Twitter, Linkedin to name a few). They have been, and continue to be, abused by spammers to peddle fake AV or redirect to exploit sites distributing all sorts of nasties.

Iranian Hackers targeting US oil, gas, and electric companies

Sun, 26 May 2013 19:50:30 +0000

The Hacker News reported: For all the talk about China and the Syrian Electronic Army, it seems there’s another threat to U.S. cyber interests i.e. Iran. Series of potentially destructive computer attacks that have been targeting American oil, gas and electricity companies tracked back to Iran.

Iranian hackers were able to gain access to control-system software that could allow them to manipulate oil or gas pipelines. Malware have been found in the power grid that could be used to deliver malicious software to damage plants. The targets have included several American oil, gas and electricity companies, which government officials have refused to identify.

Apple closes QuickTime vulnerabilities on Windows

Thu, 23 May 2013 20:01:51 +0000

Apple has released a security update for its QuickTime media framework for Windows. Version 7.7.4 of the software closes 12 critical security holes causing memory corruption and buffer overflows when processing a number of media formats. The vulnerabilities affect Windows 7, Vista and XP SP2 or later and could be exploited to cause arbitrary code execution and application crashes.

The vulnerabilities affected the playback of MP3, H.263, H.264, TeXML, JPEG, QTIF, Sorenson Video and FPX files as well as the handling of dref, enof and mvhd atoms within the program. All of the problems were reported by researchers working with HP’s Zero Day Initiative, five of them by Tom Gallagher and Paul Bates from Microsoft.

Symantec vs AV-Comparatives, Which one do you trust?

Thu, 25 Apr 2013 18:42:01 +0000

Cross-posted from PCMag SecurityWatch:

Last week independent antivirus lab AV-Comparatives released the results of an on-demand antivirus detection test. The fact that Microsoft came in near the bottom wasn’t big news; the fact that Symantec scored even lower was surprising indeed. In a blog post released today, Symantec decried the entire practice of performing on-demand malware scanning tests, calling it “misleading.”

In the early years of antivirus testing, every test was an on-demand scanning test. Researchers would assemble a collection of known malware, run a full scan, and record the percentage of samples detected. Modern labs work hard to devise tests that more closely reflect a user’s real-world experience, taking into account the fact that the vast majority of infections enter the computer from the Internet. Symantec contends that only the real-world sort of test is valid; I don’t entirely agree.