Security Leftovers
-
Google AMP Abused in Phishing Attacks Aimed at Enterprise Users
Threat actors are using Google AMP URLs in phishing campaigns as a new detection evasion tactic.
-
Firefox 116 Patches High-Severity Vulnerabilities [Ed: Microsoft Windows TCO]
Firefox 116 was released with patches for 14 CVEs, including nine high-severity vulnerabilities, some of which can lead to remote code execution or sandbox escapes.
-
Ivanti Zero-Day Exploited by APT Since at Least April in Norwegian Government Attack
The recently patched Ivanti EPMM zero-day CVE-2023-35078 has been exploited to hack the Norwegian government since at least April 2023.
-
Socket Scores $20M as Investors Bet on Software Supply Chain Security Startups
San Francisco startup Socket raises $20 million as investors continue to bet on companies in the open source software security category.
-
Microsoft says Russia-linked hackers behind dozens of Teams phishing attacks [Ed: Microsoft gets cracked again, tries to blame "Russia", as usual (not its own shoddy products)]
A Russian government-linked hacking group took aim at dozens of global organizations with a campaign to steal login credentials by engaging users in Microsoft Teams chats pretending to be from technical support, Microsoft researchers said on Wednesday.
These "highly targeted" social engineering attacks have affected "fewer than 40 unique global organizations" since late May, Microsoft researchers said in a blog, adding that the company was investigating.
-
Project Zero on Arm MTE
Google's Project Zero has spent some time studying the Arm memory tagging extension (MTE), support for which was merged into the 5.10 kernel, and posted the results...
-
Summary: MTE As Implemented
In mid-2022, Project Zero was provided with access to pre-production hardware implementing the ARM MTE specification. This blog post series is based on that review, and includes general conclusions about the effectiveness of MTE as implemented, specifically in the context of preventing the exploitation of memory-safety vulnerabilities.
Despite its limitations, MTE is still by far the most promising path forward for improving C/C++ software security in 2023. The ability of MTE to detect memory corruption exploitation at the first dangerous access provides a significant improvement in diagnostic and potential security effectiveness. In comparison, most other proposed approaches rely on blocking later stages in the exploitation process, for example various hardware-assisted CFI approaches which aim to block invalid control-flow transfers.
-
Security updates for Wednesday [LWN.net]
Security updates have been issued by Debian (bouncycastle), Fedora (firefox), Red Hat (cjose, curl, iperf3, kernel, kernel-rt, kpatch-patch, libeconf, libxml2, mod_auth_openidc:2.3, openssh, and python-requests), SUSE (firefox, jtidy, libredwg, openssl, salt, SUSE Manager Client Tools, and SUSE Manager Salt Bundle), and Ubuntu (firefox).
-
Authorities dealt with leak of data for 2 million Egyptian patients: Health minister
Minister of Health and Population Khaled Abdel-Ghaffar confirmed that the security agencies have dealt with the leak of the personal data of 2 million Egyptian patients which are being sold online.
In statements to the local news website Cairo 24, Abdel-Ghaffar said the leak occurred two months ago, stressing that the authorities will take all necessary measures to protect the privacy of patients.
The leak was first reported on 23 July by Falcon Feeds, a cyber security firm that tracks data breaches on the dark web.
-
NITDA warns of cyber-attack on Nigerian government infrastructure [Ed: In today's Orwellian media "cyber-attack" just means breach, getting cracked. It's a euphemism and symptom of using Microsoft.]
The National Information Technology Development Agency (NIDTA) has alerted the public of the activities of cyber criminals targeting important digital infrastructure in the country.
This was disclosed via a press statement signed by the head of corporate affairs and external relations Mrs. Hadiza Umar this afternoon.