Security Leftovers

posted by Roy Schestowitz on Oct 13, 2023,
updated Oct 13, 2023

• XOR Known-Plaintext Attacks

  In this blog post, we show in detail how a known-plaintext attack on XOR encoding works, and automate it with custom tools to decrypt and extract the configuration of a Cobalt Strike beacon. If you are not interested in the theory, just in the tools, go straight to the conclusion 🙂 .

• Reproducible Builds: Reproducible Builds in September 2023

  Welcome to the September 2023 report from the Reproducible Builds project

  In these reports, we outline the most important things that we have been up to over the past month. As a quick recap, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries.

• Read the Transcript: Key Legal Issues Argued in Vizio's Summary Judgment Motion

  Last Thursday, Software Freedom Conservancy took the next step in our ongoing litigation to liberate the complete, corresponding source code for Vizio televisions. Our lawyers argued on our behalf the core legal issues at the center of our case against VIzio. The motion and responses were filed in the weeks prior to the hearing and in-person oral arguments took place before Judge Sandy N. Leal of the Superior Court of California, County of Orange on Thursday, October 5, 2023.

  The motion, and consequently the hearing, focuses on two of the most critical issues of the case: (a) whether recipients of GPL'd software can enforce their rights to the corresponding source code themselves (under a legal theory known as “third-party beneficiary”) and (b) whether or not this contractual right is preempted by copyright law. The preemption issue was previously decided by a federal judge in SFC's favor (a decision which “remanded” this case back to Judge Leal). However, the federal ruling is not necessarily binding on the state court; Vizio is within their legal rights to represent it to Judge Leal.

• Top 17 Penetration Testing Tools You Need to Know in 2023

  The idea behind penetration testing is to identify security-related vulnerabilities in a software application.

• Bounty to Recover NIST’s Elliptic Curve Seeds

  This is a fun challenge:

  The NIST elliptic curves that power much of modern cryptography were generated in the late ’90s by hashing seeds provided by the NSA. How were the seeds generated? Rumor has it that they are in turn hashes of English sentences, but the person who picked them, Dr. Jerry Solinas, passed away in early 2023 leaving behind a cryptographic mystery, some conspiracy theories, and an historical password cracking challenge.

• Apple Releases iOS 16 Update to Patch Exploited Vulnerability

  Apple has released iOS 16.7.1 and iPadOS 16.7.1 to patch CVE-2023-42824, a kernel vulnerability that has been exploited in attacks.

• LinkedIn Smart Links Abused in Phishing Campaign Targeting Microsoft Accounts

  A recently observed phishing campaign targeting Microsoft accounts is using LinkedIn smart links to bypass defenses.

• SEC Investigating Progress Software Over MOVEit Hack [Ed: Windows TCO]

  Progress Software confirms the SEC has launched its own investigation into costly ransomware zero-days in the MOVEit file transfer software.

• Unpatched Vulnerabilities Expose Yifan Industrial Routers to Attacks

  Industrial routers made by Chinese company Yifan are affected by several critical vulnerabilities that can expose organizations to attacks. 

• Simpson Manufacturing Takes Systems Offline Following Cyberattack

  Simpson Manufacturing is experiencing disruptions after taking IT systems offline following a cyberattack.