Fear, Uncertainty, Doubt and Security Leftovers

posted by Roy Schestowitz on Jul 14, 2023

• Linux distributors, open source developers warned to update Ghostscript [Ed: It's a bad flaw, but they make it sound like a "Linux" issue; it's CVE-2023-36664 with CVSS score of 9.8, but it has nothing to do with Linux; triggering this flaw is not easy. To corporate, Microsoft-funded media, everything that's not Microsoft is just "Linux" when it comes to bad news.]]

  Linux distributors and application developers using the open-source Ghostscript interpreter for the PostScript language and PDFs are being urged to apply the latest security patch for the utility after the discovery of a major hole.

  This vulnerability, CVE-2023-36664, was assigned a CVSS score of 9.8, and could allow for code execution caused by Ghostscript mishandling permission validation for pipe devices.

• New PyLoose Linux malware mines crypto directly from memory [Ed: Wiz comes from Microsoft and this site is connected to Microsoft. The issue here is the program, not Linux, and they should focus on how to gets itself onto systems. Microsoft has a massive fiasco when it comes to security this week (Microsoft it trying to blame "China"), so it could use a distraction or topic change.]

  PyLoose is a relatively simple Python script with a precompiled, base64-encoded XMRig miner, a widely abused open-source tool that uses CPU power to solve complex algorithms required for cryptomining.

• Security updates for Thursday [LWN.net]

  Security updates have been issued by Debian (ruby-doorkeeper), Fedora (mingw-nsis and thunderbird), Red Hat (bind9.16, nodejs, nodejs:16, nodejs:18, python38:3.8 and python38-devel:3.8, and rh-nodejs14-nodejs), Slackware (krb5), SUSE (geoipupdate, installation-images, libqt5-qtbase, python-Django1, and skopeo), and Ubuntu (knot-resolver, lib3mf, linux, linux-aws, linux-kvm, linux-lowlatency, linux-raspi, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-azure, linux-gcp, linux-ibm, linux-oracle, linux-azure-fde, linux-xilinx-zynqmp, and scipy).

• Owner of BreachForums pleads guilty in federal court to a charge that shocks everyone

  When the arrest of Conor Fitzpatrick, aka “Pompompurin,” was made known on March 17, 2023, the members of Breached.vc (“BreachForums”) were shocked to learn from court filings how poor their forum owner’s OpSec was and that he had already admitted to law enforcement that he was known as “Pompompurin” and was the owner of BreachForums. It seemed very likely that with all the evidence law enforcement had and his own admissions, “Pom” would likely plead guilty in hopes of some reduced charges or sentencing.

• Millions of personal records unprotected in flawed telemedicine application software

  QuickBlox, a software development framework used in telemedicine and finance, was found to have several critical security flaws, according to a joint study from computer and network security research firms Check Point Research and Claroty Team82 published July 12.

  QuickBlox’s video and chat features are commonly used in mainstream telemedicine applications and platforms. The researchers analyzed a mobile telemedicine application from an undisclosed organization that uses QuickBlox’s framework to provide chat and video services for patients to connect with physicians. The research revealed existing vulnerabilities that worsened when combined with QuickBlox’s framework.

• Bjorka strikes again? 34 million Indonesian Passports Exposed in a Massive Immigration Directorate Data Breach

  Over 34 million Indonesian passports were leaked in a massive data breach impacting the country’s Immigration Directorate General at the Ministry of Law and Human Rights.

  Cybersecurity researcher and founder of Ethical Hacker Indonesia, Teguh Aprianto, disclosed the breach on his Twitter account @secgron, attributing the attack to a hacktivist identified as Bjorka.

• FTC investigates OpenAI over data leak and ChatGPT’s inaccuracy

  The Federal Trade Commission has opened an expansive investigation into OpenAI, probing whether the maker of the popular ChatGPT bot has run afoul of consumer protection laws by putting personal reputations and data at risk.

  The agency this week sent the San Francisco company a 20-page demand for records about how it addresses risks related to its AI models, according to a document reviewed by The Washington Post. The salvo represents the most potent regulatory threat to date to OpenAI’s business in the United States, as the company goes on a global charm offensive to shape the future of artificial intelligence policy.