Security Leftovers

posted by Roy Schestowitz on Oct 14, 2023

• Reproducible Builds (diffoscope): diffoscope 251 released

  The diffoscope maintainers are pleased to announce the release of diffoscope version 251. This version includes the following changes: [...]

• An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit

  In April this year Google's Threat Analysis Group, in collaboration with Amnesty International, discovered an in-the-wild iPhone zero-day exploit chain being used in targeted attacks delivered via malicious link.

• The Hamas-Israeli war is also being fought in cyberspace

  The war between Hamas and Israel is also raging across the cybersecurity realm, with various malware exploits, disinformation campaigns and recruitment of citizen hackers seen on both sides of the conflict.

• CISA Now Flagging Vulnerabilities, Misconfigurations Exploited by Ransomware

  CISA is now flagging vulnerabilities and misconfigurations that are known to be exploited in ransomware attacks.

• New repository aims to illuminate open-source package vulnerabilities and malicious code

  The Open Source Security Foundation today launched its Malicious Packages Repository, an open-source system for collecting and publishing cross-ecosystem reports of malicious packages. Claimed to be the first open-source system of its type, the repository was created in response to the rising number of attacks that include malicious open-source packages.

• WordPress 6.3.2 – Maintenance and Security release

  This security and maintenance release features 19 bug fixes on Core, 22 bug fixes for the Block Editor, and 8 security fixes. WordPress 6.3.2 is a short-cycle release. You can review a summary of the maintenance updates in this release by reading the Release Candidate announcement.

• Hacking the High School Grading System

  Interesting New York Times article about high-school students hacking the grading system.

  What’s not helping? The policies many school districts are adopting that make it nearly impossible for low-performing students to fail—they have a grading floor under them, they know it, and that allows them to game the system.

  Several teachers whom I spoke with or who responded to my questionnaire mentioned policies stating that students cannot get lower than a 50 percent on any assignment, even if the work was never done, in some cases. A teacher from Chapel Hill, N.C., who filled in the questionnaire’s “name” field with “No, no, no,” said the 50 percent floor and “NO attendance enforcement” leads to a scenario where “we get students who skip over 100 days, have a 50 percent, complete a couple of assignments to tip over into 59.5 percent and then pass.”...

• Across U.S., Chinese Bitcoin Mines Draw National Security Scrutiny [Ed: Microsoft is not a security authority, Microsoft is the company which enables the Chinese military to infiltrate governments, businesses, politicians etc.]

  Microsoft reported one site in Wyoming because of its proximity to a data center and nuclear missile base. Records show other cryptocurrency facilities have ties to the Chinese state.

• Uncloaking Fake Search Ads

  Search engine ads are not always as they seem. Cybercriminals can take advantage of the ability to precisely target potential victims, tricking them into clicking malicious links prominently displayed before the intended legitimate destination.

  This blog post takes a detailed look at the increasingly sophisticated usage of the technique known as cloaking, which is used to surreptitiously direct users to malicious URLs from search adverts displaying legitimate URLs of real companies.

• Juniper Networks Patches Over 30 Vulnerabilities in Junos OS

  Juniper Networks patches over 30 vulnerabilities in Junos OS and Junos OS Evolved, including nine high-severity bugs.

• Dozens of Squid Proxy Vulnerabilities Remain Unpatched 2 Years After Disclosure

  Dozens of Squid caching proxy vulnerabilities remain unpatched two years after a researcher reported them to developers.

• EPA calls off cyber regulations for water sector

  The announcement is a major blow to the Biden administration's efforts to improve the cybersecurity of U.S. critical infrastructure.

• Microsoft: October Windows 10 security updates fail to install