Security Leftovers
-
LWN ☛ Security updates for Friday
Security updates have been issued by Fedora (chromium, grub2, httpd, kernel, libcoap, matrix-synapse, python-pip, and rust-pythonize), Red Hat (kernel and libxml2), SUSE (kernel), and Ubuntu (eglibc, glibc and php7.4, php8.1, php8.2).
-
YLE ☛ Kivimäki to appeal 6-year hacking, extortion sentence
Aleksanteri Kivimäki was found guilty of an array of charges earlier this week, including more than 21,300 counts of attempted aggravated extortion.
-
Nobuto Murata: No, you can't downgrade T14 Gen 3 AMD's UEFI BIOS even when Secure Rollback Prevention is turned off
The bottom line is that there is a new configuration called “AMD Secure Processor Rollback protection” on recent AMD systems in addition to “Secure Rollback Prevention” (BIOS rollback protection). If it’s enabled by a vendor, you cannot downgrade the UEFI BIOS revisions once you install a one with security vulnerability fixes.
-
Bruce Schneier ☛ Rare Interviews with Enigma Cryptanalyst Marian Rejewski
The Polish Embassy has posted a series of short interview segments with Marian Rejewski, the first person to crack the Enigma.
Details from his biography.
-
Pen Test Partners ☛ Vulnerabilities that (mostly) aren’t: LUCKY13
TL;DR LUCKY13 is more an attack than a vulnerability LUCKY13 was patched over a decade ago … so it’s really unlikely that your server is vulnerable now
-
Dark Reading ☛ Chip Giants Finalize Specs Baking Security Into Silicon [Ed: More nonsense and snakeoil]
Caliptra 1.0 offers a blueprint for integrating security features directly into microprocessors.