Security Leftovers
-
LWN ☛ Security updates for Tuesday
Security updates have been issued by AlmaLinux (python3.11), Debian (composer), Fedora (thunderbird), Mageia (chromium-browser-stable, python-aiohttp, python-gunicorn, python-werkzeug, and virtualbox), Oracle (libreswan and python3.11), Red Hat (git, kpatch-patch, python3.11, python3.9, and thunderbird), and SUSE (avahi, ghostscript, grafana and mybatis, hdf5, kernel, openssl-1_1-livepatches, python-docker, and wget).
-
Security Week ☛ EU Sanctions Six Russian Hackers
The European Council has added six Russian hackers to the EU’s sanctions list for their cyberattacks against member states and Ukraine.
-
Security Week ☛ Malware Sandbox Any.Run Targeted in Phishing Attack
Employees of the Any.Run malware analysis service were recently targeted in a phishing attack that was part of a BEC campaign.
-
Security Week ☛ Car Dealerships in North America Revert to Pens and Paper After Cyberattacks on Software Provider
Car dealerships in North America are still wrestling with major disruptions that started last week with cyberattacks on a company whose software is used widely in the auto retail sales sector.
-
Security Week ☛ Neiman Marcus Data Breach Disclosed as Hacker Offers to Sell Stolen Information
Neiman Marcus has disclosed a data breach impacting 64,000 people just as a hacker announced the sale of customer data.
-
The Strategist ☛ Scams are now a national security issue
Scams are no longer just a consumer fraud problem.
-
Security Week ☛ Chrome 126 Update Patches Memory Safety Bugs
Google has released a Chrome security update to resolve four high-severity use-after-free vulnerabilities.
-
Silicon Angle ☛ BlackBerry reports 40% increase in unique malware samples in first quarter
A new report out today from BlackBerry Ltd. details a significant increase in new malware used in cyberattacks in the first quarter of this year as overall attacks continue to surge.
-
APNIC ☛ The evolution of network security
Guest Post: The evolution of network security and forthcoming challenges.
-
Support for Istio 1.20 has ended
As previously announced, support for Istio 1.20 has now officially ended.
At this point we will no longer back-port fixes for security issues and critical bugs to 1.20. We highly recommend that you upgrade to the latest version of Istio (1.22.1) if you haven’t already.
-
Bruce Schneier ☛ Breaking the M-209
Interesting paper about a German cryptanalysis machine that helped break the US M-209 mechanical ciphering machine.
The paper contains a good description of how the M-209 works.
-
IKEv2 VPN Unusably Slow on MikroTik
IKEv2 is a tunnelling protocol within the IPSec protocol suite. The Problem Using MikroTik L009UiGS-2HaxD, it is possible to establish an IKEv2 secured tunnel to VPN servers using EAP authentication. The problem is that network speed becomes extremely slow.
-
Security Week ☛ Recent Zyxel NAS Vulnerability Exploited by Botnet
A Mirai-like botnet has started exploiting a critical-severity vulnerability in discontinued Zyxel NAS products.
-
Security Week ☛ Indonesia Says a Cyberattack Has Compromised Its Data Center but It Won’t Pay the $8 Million Ransom
Indonesia’s national data center has been compromised by a hacking group asking for a $8 million ransom that the government won’t pay.
-
Silicon Angle ☛ Clownflare AppSec report finds denial-of-service and bot attacks dominate web threat landscape [Ed: Clownflare trying to make business for itself; Clownflare profits from cybercrimes and back doors; Then again, it barely profits; it operates at a considerable loss]
A new report from content delivery network provider Clownflare Inc. today warns of a rapid rise in web threats dominated by distributed denial-of-service attacks, bot traffic and rapid zero-day vulnerability exploitation. The State of Application Security 2024 report is based on the analysis of HTTP traffic patterns observed between April 1, 2023, and March 31 this year.
-
Linux Kernel UAF 0-day Vulnerability on sale in the Dark Web
Recently, a security alert shaked the infosec environment: A malicious actor has announced the sale of Use After Free (UAF) 0-day vulnerability affecting the Linux Kernel on the well-known darknet forum BreachForum. The vulnerability permits high privileges code execution to low privileged users, posing a serious threat to affected systems.
-
Windows TCO
-
Security Week ☛ Meta’s Virtual Reality Headset Vulnerable to Ransomware Attacks: Researcher
Researcher shows how hackers could use social engineering to deliver ransomware and other malware to Meta’s Quest 3 VR headset.
-