Security Leftovers
-
iTWire - Medibank says access to some systems restored after breach [Ed: Microsoft TCO]
Medibank says access to some systems restored after breach The Medibank Group, which announced on Thursday it had suffered a data breach, says it has now restored access to its ahm and international student policy systems.
In an update, the company said on Friday an investigation into the incident was still going on.
In its initial announcement, the company said it had isolated some customer-facing systems after it discovered a breach of its systems.
Medibank chief executive David Koczkar said: “We apologise for the disruption this incident caused some of our customers yesterday, but we have made good progress with our systems overnight.
[...]
Medibank was initially hosted by Telstra, first on Linux and Apache, and later moved to Microsoft's Internet Information Server.
-
Hacking Automobile Keyless Entry Systems - Schneier on Security
The article doesn’t say how the hacking tool got installed into cars. Were there crooked auto mechanics, dealers, or something else?
-
GnuPG 2.3.8 released [LWN.net]
Version 2.3.8 of the GNU Privacy Guard is out. It contains a few new features but the real purpose is to fix CVE-2022-3515, an integer overflow vulnerability that can be exploited remotely for code execution via a, for example, malicious S/MIME attachment. Note that the actual vulnerability is in the libksba library, which is normally packaged separately on Linux systems.
-
blog.ipfire.org - Global PKI considered harmful: A plaidoyer for using DANE
If you have been following the IT security news, you might have come across these headlines: Earlier this year, Russia creates its own TLS certificate authority to bypass sanctions, entering production in September. On July 6th, digital security giant and root CA operator Entrust informed its customers about having been breached by a ransomware gang. Both news have seen a decent amount of attention, but one thing they tell us in common has received considerable less coverage: That the global PKI ecosystem, which virtually all internet users (have to) trust, is actually not trustworthy at all.