Security Leftovers
-
Netcraft ☛ Mule-as-a-Service Infrastructure Exposed
New Threat Intelligence confirms connections underpinning pig butchering and investment scams
Much like companies in the legitimate economy, criminals also specialize: focusing on their core strengths and using third-party Software-as-a-Service platforms and tools to outsource the rest of the business or criminal infrastructure needed. These Crime-as-a-Service providers continue to evolve, from bulletproof hosting to Phishing-as-a-Service (PhaaS).
-
Reproducible Builds: Reproducible Builds in July 2024
Welcome to the July 2024 report from the Reproducible Builds project!
-
OpenSSF (Linux Foundation) ☛ What’s Next for Open Source? Workshop Highlights and Calls to Action to Inspire Progress for Global Sustainability
In July, a historic moment took place for open source, where it took center stage at the two-day "OSPOs for Good" symposium at the United Nations. Co-hosted by Kenya and Germany, experts from the worlds of open source, government, and NGOs came together to learn and share how open source is being used to address global challenges, including the 17 Sustainable Development Goals (SDGs).
-
TecMint ☛ Parrot OS: Security-Focused Linux Distro for Security and Privacy
It comes with a complete set of tools for IT security, digital forensics, and everything that you need to develop your own programs or protect your privacy online.
-
LWN ☛ 0.0.0.0 Day: Exploiting Localhost Hey Hi (AI) From the Browser (Oligo Security)
The Oligo Security blog discloses
a web-browser vulnerability that has been named "0.0.0.0 day". In short,
browsers will allow JavaScript code to open connections to the all-zeroes
IPv4 address; the result is that any port that is open on the local host
can be accessed by a remote site. "When services use localhost, they
assume a constrained environment. This assumption, which can (as in the
case of this vulnerability) be faulty, results in insecure server
implementations."
-
Hackaday ☛ Kickflips And Buffer Slips: An Exploit In Tony Hawk’s Pro Skater
[Ryan Miceli] wanted to build some reverse engineering skills by finding a new exploit for an original Xbox. Where he ended up was an exploit that worked across the network, across several games, and several different consoles. But it all started with an unbounded strcpy in Tony Hawk Pro Skater (THPS).
-
LWN ☛ Security updates for Thursday
Security updates have been issued by AlmaLinux (freeradius and freeradius:3.0), Debian (chromium, odoo, and roundcube), Fedora (microcode_ctl, mingw-qt5-qtbase, mingw-qt6-qtbase, opentofu, orc, python-setuptools, and vim), Gentoo (Nokogiri), Oracle (kernel), Red Hat (go-toolset:rhel8, golang, kernel, krb5, libtiff, python-setuptools, and python39:3.9 and python39-devel:3.9), SUSE (python-Django), and Ubuntu (krb5).
-
Windows TCO
-
Security Week ☛ CrowdStrike Dismisses Claims of Exploitability in Falcon Sensor Bug
CrowdStrike dismissed claims that the Falcon EDR sensor bug could be exploited for privilege escalation or remote code execution.
-