Security: Microsoft Failures, Patches, Fakes, and More

posted by Roy Schestowitz on Oct 21, 2022

• Microsoft leaked 2.4TB of data belonging to sensitive customer. Critics are furious | Ars Technica

  Microsoft is facing criticism for the way it disclosed a recent security lapse that exposed what a security company said was 2.4 terabytes of data that included signed invoices and contracts, contact information, and emails of 65,000 current or prospective customers spanning five years.

  The data, according to a disclosure published Wednesday by security firm SOCRadar, spanned the years 2017 to August 2022. The trove included proof-of-execution and statement of work documents, user information, product orders/offers, project details, personally identifiable information, and documents that may reveal intellectual property. SOCRadar said it found the information in a single data bucket that was the result of a misconfigured Azure Blob Storage.

• 10 Best Free and Low-Cost SSL Certificate Authorities

  Implementing an SSL certificate on your website is no longer considered a luxury. It not only boosts your website security by encrypting communication exchanged between site visitors and your website, but also improves your site’s SEO ranking. In addition, it helps you in PCI/DSS compliance if you are hosting a platform that accepts payment card data.

• Battle with Bots Prompts Mass Purge of Amazon, Apple Employee Accounts on LinkedIn

  On October 10, 2022, there were 576,562 LinkedIn accounts that listed their current employer as Apple Inc. The next day, half of those profiles no longer existed. A similarly dramatic drop in the number of LinkedIn profiles claiming employment at Amazon comes as LinkedIn is struggling to combat a significant uptick in the creation of fake employee accounts that pair AI-generated profile photos with text lifted from legitimate users.

• Security updates for Friday [LWN.net]

  Security updates have been issued by Fedora (poppler), Oracle (firefox and thunderbird), Red Hat (firefox, java-1.8.0-openjdk, java-11-openjdk, and java-17-openjdk), SUSE (bind, clone-master-clean-up, grafana, libksba, python3, tiff, and v4l2loopback), and Ubuntu (libreoffice).

• Effecting positive change in the Internet of Things | Pen Test Partners

  We started our journey back in the day when the IoT was in its infancy. Our first published research was in June 2015 with a post about extracting the Wi-Fi PSK from Fitbit’s Aria weighing scales. This led to a challenging disclosure process with Fitbit, though it ended positively and constructively, with Fitbit supporting our efforts to educate and improve cyber security. This included us delivering workshops and briefings at the world-famous DEFCON and BlackHat hacking conferences.

  Seven years on and the security challenges that IoT device manufacturers, IoT platform providers and API coders fail to handle have not gone away. The growth in the market for smart ‘things’ and the persistence of poor practice has amplified the problems. Our ever increasing catalogue of IoT security research (160+ posts and counting) is anecdotal evidence of this. That’s not to say that some responsible manufacturers haven’t listened. There are many great examples of secure smart devices but it’s not ubiquitous.

• Cisco Releases Security Update for Cisco Identity Services Engine� | CISA

  Cisco has released a security update to address vulnerabilities affecting Cisco Identity Services Engine (ISE). A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing high and low severity vulnerabilities, see the Cisco Security Advisories page.

• Adversarial ML Attack that Secretly Gives a Language Model a Point of View

  Machine learning security is extraordinarily difficult because the attacks are so varied—and it seems that each new one is weirder than the next. Here’s the latest: a training-time attack that forces the model to exhibit a point of view: Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasures.”

• High-Tech Cars Are Killing the Auto Repair Shop

  Over the past decade, cars have gotten more complex and computerized. Each vehicle is now studded with sensors, packed with hundreds or thousands of computer chips, and controlled by software. Auto industry insiders have waxed poetic about the safety benefits of the “software-defined vehicle”—which also enables revenue-boosting data collection and subscriptions that make it safer to be an auto executive too.

  Less talked about are the consequences of computerized cars at the auto shop. Fixing complex vehicles requires increasingly expert and expensive knowledge, and tools that are in limited supply. It’s part of the same trend that has driven some farmers to hack their own tractors and triggered legal fights over what rights consumers have over their own vehicles.