Security Leftovers
-
Security updates for Monday
Security updates have been issued by Arch Linux (xz), Debian (libvirt, mediawiki, util-linux, and xz-utils), Fedora (apache-commons-configuration, cockpit, ghc-base64, ghc-hakyll, ghc-isocline, ghc-toml-parser, gitit, gnutls, pandoc, pandoc-cli, patat, podman-tui, prometheus-podman-exporter, seamonkey, suricata, and xen), Gentoo (XZ utils), Mageia (aide & mhash, emacs, microcode, opensc, and squid), Red Hat (ruby:3.1), and SUSE (kanidm and qpid-proton).
-
The Kent Stater ☛ Exclusive: Hackers stole Russian prisoner database to avenge death of Navalny
Within hours of opposition leader Alexey Navalny’s death in February in a Russian prison, a group of anti-Kremlin hackers went looking for revenge. Using their access to a computer network tied to Russia’s prison system, the hackers plastered a photo of Navalny on the hacked prison contractor’s website [...]
-
RFERL ☛ Report: Anti-Kremlin Hackers Stole Russian Prisoner Database To Avenge Navalny
Hackers claim to have broken into the Russian prisoner database and displayed pictures of anti-Kremlin activist Aleksei Navalny while also stealing information on hundreds of thousands of Russian prisoners and their relatives, CNN reported on April 1.
-
Open Source Security (Audio Show) ☛ Episode 422 – Do you have a security.txt file?
Josh and Kurt talk about the security.txt file. It’s not new, but it’s not something we’ve discussed before. It’s a great idea, an easy format, and well defined. It’s not high on many of our todo lists, but it’s something worth doing.
-
Security Week ☛ ‘WallEscape’ GNU/Linux Vulnerability Leaks User Passwords
A vulnerability in util-linux, a core utilities package in GNU/Linux systems, allows attackers to leak user passwords and modify the clipboard.
-
Neowin ☛ Microsoft has a preview of its Offline Security Intelligence Update for GNU/Linux endpoints [Ed: Microsoft puts back doors in thing; the last thing anyone needs to turn to Microsoft for is security]
Microsoft has announced it has launched a public preview of its new Offline Security Intelligence Update.
-
Federal News Network ☛ HHS looks to create ‘one-stop shop’ for healthcare cybersecurity [Ed: So they will need to dump Microsoft for good]
The Department of Health and Human Services is aiming to better organize its healthcare cybersecurity resources and programs.
-
APNIC ☛ Smargaft harnesses EtherHiding for stealthy C2 hosting
Guest Post: New botnet uses the Binance Smart Chain to host command and control servers and infect shell scripts like a virus to achieve persistence.
-
Security Week ☛ ‘Vultur’ Android Malware Gets Extensive Device Interaction Capabilities
NCC Group researchers warn that the Android banking malware ‘Vultur’ has been updated with device interaction and file tampering capabilities.
-
The Register UK ☛ OWASP discloses breach due to a Wiki web server misconfig • The Register