Security, Privacy, and Proprietary Leftovers

posted by Roy Schestowitz on Aug 30, 2023

• More UK cops' names and photos exposed in supplier breach

  According to The Sun, which first reported on the breach, all 47,000 staff members and police officers – including senior officials, undercover and counter-terrorism cops, and officers assigned to guard the royal family – were exposed.

• Wi-Fi 7 Support Limited to Windows 11, Linux, and ChromeOS: Windows 10 will be Incompatible

  A recently disclosed Intel document has provided insights regarding the compatibility of the IEEE 802.11be standard, commonly referred to as Wi-Fi 7. According to this document, Windows 11, Linux, and ChromeOS are the only operating systems that will support Wi-Fi 7.

  Windows 10 is notably absent from this compatibility list, and this absence is corroborated by information from the source, chi11eddog, who confirmed the lack of a certified driver for Wi-Fi 7 on Windows 10. This suggests that users of older systems may encounter challenges if they plan to adopt the new WLAN standard.

• Privacy of Web PKI Revocation

  I attended a presentation at the Crypto and Privacy Village, where Matthew McPherrin presents on the various mechanisms Certificate Authorities expose to clients to clarify whether a certificate is revoked or not, and the privacy implications of those mechanisms. Matthew elaborated on Certificate Revocation Lists, Online Certificate Status Protocol (OCSP), OCSP stapling, and a superior alternative: short lived certificates. The privacy implications center around feeding the Certificate Authority unnecessary data on client behaviors as they verify whether a certificate is revoked or not.

  This talk summary is part of my DEF CON 31 series. The talks this year have sufficient depth to be shared independently and are separated for easier consumption.

• Certifiably vulnerable: Using Certificate Transparency logs for target reconnaissance

  While being able to monitor maliciously-issued certificates is a good thing, publicly logging all certificates unfortunately exposes more data than one might like. Since each certificate is pushed again to the log upon every renewal, an adversary can gauge whether a website is being actively maintained, and hence whether it has been kept up-to-date with the latest security patches.

  This inspires the question — can CT logs be used for target reconnaissance?

• Grave flaws in BGP Error handling

  This attack is not even a one-off “hit-and-run”, as the “bad” route is still stored in the peer router; when the session restarts the victim router will reset again the moment the route with the crafted payload is transmitted again. This has the potential to cause prolonged internet or peering outages.

• Security updates for Tuesday

  Security updates have been issued by Debian (flask-security and opendmarc), Fedora (qemu), Oracle (rust and rust-toolset:ol8), Red Hat (cups and libxml2), Scientific Linux (cups), SUSE (ca-certificates-mozilla, chromium, clamav, freetype2, haproxy, nodejs12, procps, and vim), and Ubuntu (faad2, json-c, libqb, linux, linux-aws, linux-lts-xenial, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-gkeop-5.15, and linux-gke, linux-ibm-5.4).

• How hacker stole R600K from Eastern Cape schools

  Last week, the Specialised Commercial Crime Court of East London, Eastern Cape, handed down a prison sentence of three years to a hacker who stole just under R600 000 from the province’s education department.

  The crime took place in 2013, when Bruce Owen, in his thirties at the time, broke into the inner workings of the Eastern Cape Department of Education’s Basic Accounting System and used it to make payments into his own bank accounts.

• Developing: Hospital Sisters Health System and Prevea Health hit by cyberattack

  Yesterday, DataBreaches received a phone call from an employee at St. Vincent Hospital in Green Bay, Wisconsin. The employee was asking if we knew anything about a cyberattack on Hospital Sisters Health System (HSHS) and stated that everything had been down for two days but the employees were not really being given information other than some assurance by the hospital that no personal information had been compromised.

• How we improved SSH connection times by up to 40%

  SSH was designed to provide secure remote access to machines, not for service-to-service communication. The protocol was designed to ensure that the connection is secured, that both parties are verified and the user is authenticated before any data is exchanged. This helps achieve two of the fundamental pillars of security: confidentiality and integrity. However, these security guarantees come at the expense of initial connection latency. Each SSH connection is required to complete the SSH handshake before the connection is available.