Windows TCO and Security Leftovers
-
Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 285 released
The diffoscope maintainers are pleased to announce the release of diffoscope version
285. This version includes the following changes: [...] -
Michael Ablassmeier: sshcont
Due to circumstances:
sshcont: ssh daemon that starts and enters a throwaway docker container for testing
-
Hanno Boeck ☛ Private Keys in the Fortigate Leak
KeysA few days ago, a download link for a leak of configuration files for Fortigate/Fortinet devices was posted on an Internet forum. It appears that the data was collected in 2022 due to a security vulnerability known as CVE-2022-40684. According to a blog post by Fortinet in 2022, they were already aware of active exploitation of the issue back then. It was first reported by heise, a post by Kevin Beaumont contains further info.
What has not been widely recognized is that this leak also contains TLS and SSH private keys. As I am developing badkeys, a tool to identify insecure and compromised keys, this caught my attention. (The following analysis is based on an incomplete subset of the leak. I may update the post if I get access to more complete information.)
The leaked configurations contain keys looking like this (not an actual key from the leak): [...]
-
Windows TCO / Windows Bot Nets
-
Pro Publica ☛ Biden Executive Order Aims to Strengthen U.S. Cybersecurity [Ed: Biden did not ban Microsoft, somehow... ]
-
Security Week ☛ US Government Agencies Call for Closing the Software Understanding Gap
The cybersecurity agency CISA and other government agencies are calling to action for the US to take the necessary steps to improve cybersecurity by closing the software understanding gap.
This gap is the result of manufacturers building software that mission owners and operators lack the adequate capacity to verify, meaning that they cannot fully understand the software.
-
Security Week ☛ Vulnerabilities in SimpleHelp Remote Access Software May Lead to System Compromise
The attacker could execute remote commands on Linux systems, or gain remote code execution on Windows by overwriting SimpleHelp executables and libraries.
“Admins also have the ability to interact with any connected customer machines or access customer machines directly if unattended access is configured,” Horizon3.ai says.
-
The Register UK ☛ Medusa ransomware group claims attack on Gateshead Council
Medusa's site indicates that it's demanding a $600,000 ransom payment for the deletion of data, although security experts routinely warn that criminals' promises to delete data are rarely genuine.
The Register requested further details from Gateshead Council but it declined to provide them.
-
YLE ☛ Finnish government's ICT centre announces 138 job cuts
When the talks were first announced in October, Valtori said up to 160 jobs were under threat.
-