Security Leftovers
-
SentinelLabs chief slams Microsoft response to Azure breach
The attackers gained access through an Azure vulnerability discovered last month by the State Department, according to anonymous officials who spoke to the Washington Post.
Microsoft has been obfuscating about the incident, most recently denying a detailed technical post about the breach by cloud security firm Wiz, after having given its blessing to the post.
Guerrero-Saade said he had the "utmost respect" for the Microsoft Threat Information Centre. "I can’t overstate my strong support for the folks at MSTIC (MISTY now?), DART, and past MSRC, admirable researchers and caring folks who do amazing things with little credit, making outsized impact on multiple fronts (like Ukraine), I admire and respect all of you," he wrote.
"Mind you most of these folks don’t get much recognition, they aren’t paid nearly as well as they should be, they’re dealing with a litany of lawyers, they don’t have conference travel budgets; if they’re not doing it for the love of their work, I’m not sure why they would."
He clarified he was not commenting on the incident because someone had asked him to. "Let me also make it clear that none have asked me to speak up, if anything I’m sure they’d probably prefer I shut my mouth and not rock a rickety boat further. However, I see an administration, leadership, and legal regime with little concern for their expertise or public good."
-
Stolen Microsoft key offered widespread access to Microsoft cloud services
The Microsoft consumer signing key stolen by Storm-0558 Chinese hackers provided them with access far beyond the Exchange Online and Outlook.com accounts that Redmond said were compromised, according to Wiz...
-
Errata Rob says US' Cyber Trust Mark will be of little use
Announced last Tuesday, the initiative claims it will help people choose smart devices that are deemed less prone to attack, with the White House saying devices covered would be smart refrigerators, TVs, climate control systems and fitness trackers among others.
A number of manufacturers have said they would support the scheme, among them Amazon, Best Buy, Google, LG Electronics, Logitech and Samsung Electronics.
-
Researchers Find ‘Backdoor’ in Encrypted Police and Military Radios
The TETRA standard is used in radios worldwide. Security researchers have found multiple vulnerabilities in the underlying cryptography and its implementation, including issues that allow for the decryption of traffic.
-
YARA Error Codes, (Sat, Jul 22nd)