Security Leftovers
-
iTWire - Helping Optus spin breach fallout: the AFR shows the way
One reason why a company like Singtel Optus can leak customer data in a breach that is, by all accounts, its own fault and then avoid being held to account is because of the media's fawning coverage.
A typical example can be seen in Friday's Australian Financial Review, which carried an interview about what the Optus chairman Paul O’Sullivan has learnt from the breach. Of course, it's good to know that the man has learnt something.
For context, Optus has been dragged kicking and screaming to pledge that it would pay for replacing the passports that were leaked. Only this morning, the ABC reported that the company had been made to extend this to holders of foreign passports as well – after the matter had been ventilated on the 7.30 program.
The telco is still refusing to pay for the replacement of driving licences, only expressing a willingness to pay for the administration expenses associated with issuing these forms of ID.
-
diffoscope 226 released
The diffoscope maintainers are pleased to announce the release of diffoscope version 226. This version includes the following changes:
[ Christopher Baines ] * Add an lzip comparator with tests.
[ Chris Lamb ] * Add support for comparing the "text" content of HTML files using html2text. (Closes: #1022209, reproducible-builds/diffoscope#318) * Misc/test improvements: * Drop the ALLOWED_TEST_FILES test; it's mostly just annoying. * Drop other copyright notices from lzip.py and test_lzip.py. * Use assert_diff helper in test_lzip.py. * Pylint tests/test_source.py.
[ Mattia Rizzolo ] * Add lzip to debian dependencies. -
CISA Warns of Critical Vulnerabilities in 3 Industrial Control System Software
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published three Industrial Control Systems (ICS) advisories about multiple vulnerabilities in software from ETIC Telecom, Nokia, and Delta Industrial Automation.
Prominent among them is a set of three flaws affecting ETIC Telecom's Remote Access Server (RAS), which "could allow an attacker to obtain sensitive information and compromise the vulnerable device and other connected machines," CISA said.