Security Leftovers

posted by Roy Schestowitz on Apr 12, 2023

• Notes from IETF 116

  NTP security, transition mechanisms, TCP delayed ACKs, alternate name systems, and more from IETF 116.

• Adobe Plugs Gaping Security Holes in Reader, Acrobat

  Adobe documents 56 security defects in multiple products, some serious enough to expose Windows and macOS users to code execution attacks.

• London Councils & pirate books. Google dorking for subdomain takeovers

  TL;DR Google dorks found me an exploited DigitalOcean subdomain takeover on London Councils’ .gov.uk domain It used a meta refresh to redirect to a site hosting unprovenanced PDFs...

• Ransomware gangs increasingly deploy zero-days to maximize attacks [Ed: Microsoft 'security' = bug doors]

  Microsoft issued a patch for a zero-day that researchers at Kaspersky said was used to deliver Nokoyawa ransomware.

• On the heels of the US cyber strategy, CISA set to release secure by design principles [Ed: But CISA is also a proponent of back doors, so... be careful what you wish for]

  CISA Director Jen Easterly said the agency plans to release the principles this week to encourage more safe coding practices.

• Microsoft releases 97 fixes on Patch Tuesday; one for a zero-day

  Narang said while this was the only flaw exploited in the wild, Microsoft has rated nearly 90% of the vulnerabilities as Exploitation Less Likely, while just 9.3% of flaws were rated as Exploitation More Likely.

• Microsoft Patches Another Already-Exploited Windows Zero-Day

  For the second month in a row, Microsoft patches an already-exploited vulnerability in its flagship Windows operating system.

• Microsoft April 2023 Patch Tuesday, (Tue, Apr 11th)

  This month we got patches for 114 vulnerabilities. Of these, 7 are critical, and 1 is already being exploited, according to Microsoft.

• Google debuts new API for detecting open-source security vulnerabilities

  Google LLC is releasing an application programming interface that will enable developers to scan the open-source code they use for vulnerabilities and other issues. The deps.dev API, as it’s called, debuted today. It extends an open-source cybersecurity project called deps.dev that Google launched in 2021.

• Little-known Israeli vendor found selling dangerous iPhone spyware [Ed: Microsoft Corp. is criminals. Citizen Lab working with criminals is not good and they try to distract from Microsoft's own crimes. As if big criminal, fine. Small one, bad.]

  New reports released today from Microsoft Corp. and Citizen Lab...

• Microsoft Azure Users Warned of Potential Shared Key Authorization Abuse [Ed: Microsoft Azure essentially cracked again]

  Microsoft Azure shared key authorization can be exploited to access business data and achieve remote code execution.

• ICS Patch Tuesday: Siemens, Schneider Electric Address Dozens of Vulnerabilities

  Siemens and Schneider Electric’s Patch Tuesday advisories for April 2023 address a total of 38 vulnerabilities found in their products.

• Sweet QuaDreams: A First Look at Spyware Vendor QuaDream’s Exploits, Victims, and Customers

  At least five civil society victims of QuaDream’s spyware and exploits were identified in North America, Central Asia, Southeast Asia, Europe, and the Middle East. Victims include journalists, political opposition figures, and an NGO worker. Traces of a suspected iOS 14 zero-click exploit used to deploy QuaDream’s spyware.

• Scamwatch: 'Fraudsters targeted me after my insurer suffered a data breach'

  Our expert helps a reader whose bank details were compromised

• NatWest phishing scam: how to spot a dodgy bank email

  Look out for a scam email that claims the phone number on your account has been changed

• Amazon issues warning to customers amid growing threat of impersonation scams

  Follow these tips to spot and avoid phishing calls and messages

• Car Thieves Hacking the CAN Bus

  Car thieves are injecting malicious software into a car's network through wires in the headlights (or taillights) that fool the car into believing that the electronic key is nearby.

  News articles.

• Yum Brands Discloses Data Breach Following Ransomware Attack

  KFC and Taco Bell parent company Yum Brands says personal information was compromised in a January 2023 ransomware attack.

• Apple Rolls Out Zero-Day Patches to Older iOS, macOS Devices

  Three days after announcing patches for new zero-days affecting iOS and macOS, Apple released fixes for devices running older operating system versions.