news
Security Leftovers
-
LWN ☛ Security updates for Friday
Security updates have been issued by AlmaLinux (git, kernel, nginx:1.24, and sudo), Fedora (dpkg, java-21-openjdk, java-25-openjdk, java-latest-openjdk, and valkey), Oracle (apache-commons-vfs, sudo, tigervnc, and xorg-x11-server), Red Hat (kernel, krb5, and openssh), SUSE (gnutls, ImageMagick, iputils, kernel-livepatch-MICRO-6-0-RT_Update_10, kubernetes1.18, libarchive, ovmf, python, and salt), and Ubuntu (iputils, linux-aws-6.14, linux-raspi, openjdk-21, and openjdk-24).
-
Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 302 released
The diffoscope maintainers are pleased to announce the release of diffoscope version
302. This version includes the following changes: [...] -
Security Week ☛ Mitel Patches Critical Flaw in Enterprise Communication Platform
An authentication bypass vulnerability in Mitel MiVoice MX-ONE could allow attackers to access user or admin accounts on the system.
-
Security Week ☛ UK Student Sentenced to Prison for Selling Phishing Kits
Ollie Holman was sentenced to prison for selling over 1,000 phishing kits that caused estimated losses of over $134 million.
-
Security Week ☛ In Other News: $30k Surveillance Giant Google Cloud Build Flaw, Louis Vuitton Breach Update, Attack Surface Growth
Noteworthy stories that might have slipped under the radar: Surveillance Giant Google Cloud Build vulnerability earns researcher big bounty, more countries hit by Louis Vuitton data breach, organizations’ attack surface is increasing.
-
Security Week ☛ No Patch for Flaw Exposing Hundreds of LG Cameras to Remote Hacking
LG Innotek LNV5110R security cameras are affected by a vulnerability that can be exploited for unauthenticated remote code execution.
-
Security Week ☛ US Targets North Korea’s Illicit Funds: $15M Rewards Offered as American Woman Jailed in IT Worker Scam
Christina Chapman was sentenced to prison for helping North Korean IT workers infiltrate US companies and running a laptop farm for them.
-
Tom's Hardware ☛ Hacker plants three strains of malware in a Steam Early Access game called Chemia — security company found crypto-jacking infostealers and a backdoor to install yet more malware in the future
Prodaft said the Steam Early Access game contains the Fickle Stealer, Vidar Stealer, and HijackLoader malware.
-
Pen Test Partners ☛ Android Services 101
TL;DR What are Android services? Android splits its communications into multiple components, some of which we’ve written about before. One of these components is service, which is a generic component that runs in a background thread. It can be communicated with by the local program through common IPC mechanisms.
-
SANS ☛ Sinkholing Suspicious Scripts or Executables on Linux, (Fri, Jul 25th)
-
Mobile Systems/Mobile Applications
-
Silicon Angle ☛ Malware-as-a-service turns Android hacking into a plug-and-play business
The report, “Renting Android Malware Is Getting Easier – and Cheaper,” written by iVerify research fellow Daniel Kelley, explores how services are slashing the technical barrier to entry, allowing virtually anyone with a Telegram account and a few hundred dollars to launch sophisticated attacks.
-