Security Leftovers
-
SANS ☛ Microsoft January 2025 Patch Tuesday, (Tue, Jan 14th) [Ed: But the goal is not security]
...Microsoft patch update addresses a total of 209 vulnerabilities, including 12 classified as critical. Among these, 3 vulnerabilities have been actively exploited in the wild, and 5 have been disclosed prior to the patch release, marking them as zero-days.
-
Silicon Angle ☛ Microsoft reveals macOS vulnerability that allowed System Integrity Protection bypass
Microsoft Threat Intelligence has revealed details of a now patched but previously unknown macOS vulnerability that could have allowed attackers to bypass Fashion Company Apple Inc.’s System Integrity Protection in macOS by loading third-party kernel extensions.
-
Bleeping Computer ☛ Microsoft MFA outage blocking access to Abusive Monopolist Microsoft 365 apps
Microsoft is investigating an ongoing Multi-Factor Authentication (MFA) outage that is blocking customers from accessing Abusive Monopolist Microsoft 365 Office apps.
-
Bruce Schneier ☛ The First Password on the Internet
It was created in 1973 by Peter Kirstein:
So from the beginning I put password protection on my gateway. This had been done in such a way that even if UK users telephoned directly into the communications computer provided by Darpa in UCL, they would require a password.
-
LWN ☛ Security updates for Tuesday
Security updates have been issued by AlmaLinux (kernel, NetworkManager, and thunderbird), Fedora (golang-github-aws-sdk-2, golang-github-aws-smithy, golang-github-ncw-swift-2, rclone, and thunderbird), Mageia (ceph, firefox, and thunderbird), Oracle (kernel, NetworkManager, and thunderbird), Red Hat (fence-agents and raptor2), SUSE (dpdk, firefox, frr, grafana, operator-sdk, perl-Module-ScanDeps, proftpd, python311-mistune, redis, thunderbird, valkey, and yq), and Ubuntu (hplip and webkit2gtk).
-
Web Browsers/Web Servers
-
Daniel Stenberg ☛ Secure Transport support in curl is on its way out
In May 2024 we finally decided that maybe the time has come for curl to drop support of older TLS libraries. Libraries that because they don’t support the modern TLS version (1.3) for many users are maybe not suitable to build upon for the future. We gave the world 12 months to adapt or to object. More than half of that time has passed.
This means that after May 2025, we intend to drop support for Secure Transport and BearSSL unless something changes drastically that makes us reconsider.
This blog post is an attempt to make everyone a little more aware and make sure that those who need to, prepare appropriately.
-
-
Windows TCO / Windows Bot Nets
-
Tom's Hardware ☛ ASML-backed university suffers cyberattack — institution is the pipeline for ASML's talent needs
ASML-backed Eindhoven University of Technology suffered a severe cyberattack that forced the school to cancel classes for at least two days.
-