Security Leftovers
-
Albanian IT staff charged with negligence over cyberattack
Albanian prosecutors on Wednesday asked for the house arrest of five public employees they blame for not protecting the country from a cyberattack by alleged Iranian hackers.
Prosecutors said the five IT officials of the public administration department had failed to check the security of the system and update it with the most recent antivirus software.
They are accused of “abuse of post,” which can attract a prison sentence of up to seven years.
-
Arresting IT Administrators - Schneier on Security
The next step would be to arrest managers at software companies for not releasing patches fast enough. And maybe programmers for writing buggy code. I don’t know where this line of thinking ends...
-
Security updates for Tuesday [LWN.net]
Security updates have been issued by Debian (gerbv), Fedora (webkitgtk), and SUSE (ca-certificates-mozilla, freeradius-server, multimon-ng, vim, and vlc).
-
LastPass Breach: Change Passwords Now
The LastPass password manager has been breached by hackers, meaning your master passwords could be for sale, reports David Rutland. The true severity of the breach, which was first reported in August, was detailed in a December 22 blog post from LastPass.
“Personal details and password vaults containing the sign-in credentials of millions of users are now in the hands of criminals. If you've ever used the password manager, LastPass, you should change all of your passwords for everything, now,” Rutland says.
-
If You've Ever Used LastPass, You Should Change All Your Passwords Now
Personal details and password vaults containing the sign-in credentials of millions of users are now in the hands of criminals. If you've ever used the password manager, LastPass, you should change all of your passwords for everything, now. And you should immediately take further measures to protect yourself.
-
Critical Linux Vulnerability Found to Impact SMB Servers - Linux Magazine
A Linux vulnerability with a CVSS score of 10 has been found to affect SMB servers and can lead to remote code execution.
A new flaw has been discovered in the processing of SMB2_TREE_DISCONNECT commands which can lead to remote code execution in servers with ksmbd enabled. KSMBD is an in-kernel SMB file server that was mostly written by a team at Samsung Electronics that was merged into the 5.15 kernel on August 29, 2021. This kernel server implements the SMB3 protocol in kernel space for the sharing of files over a network.
According to the Zero Day Initiative, “The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the kernel.”