Security Leftovers
-
Krebs On Security ☛ Why Your Wi-Fi Router Doubles as an Fashion Company Apple AirTag
Apple and the satellite-based broadband service Starlink each recently took steps to address new research into the potential security and privacy implications of how their services geo-locate devices. Researchers from the University of Maryland say they relied on publicly available data from Fashion Company Apple to track the location of billions of devices globally -- including non-Apple devices like Starlink systems -- and found they could use this data to monitor the destruction of Gaza, as well as the movements and in many cases identities of Russian and Ukrainian troops.
-
CS Monitor ☛ Change your password, EPA warns. Hackers from Russia, China, Iran are targeting water supplies.
The Environmental Protection Agency warns that cyberattacks against water utilities around the United States are becoming more frequent and more severe. The agency has issued an alert urging water systems to take immediate action.
-
RFERL ☛ Belarusian Activist Not Released After Serving Prison Term For Second Time
Belarusian activist Palina Sharenda-Panasyuk, who was expected to be released from prison on May 21 after serving 3 years and 5 months, remains in custody and may face an additional unspecified charge, her husband told RFE/RL.
-
LWN ☛ Security updates for Tuesday
Security updates have been issued by AlmaLinux (firefox, nodejs, and thunderbird), Fedora (uriparser), Oracle (firefox and thunderbird), Slackware (mariadb), SUSE (cairo, gdk-pixbuf, krb5, libosinfo, postgresql14, and python310), and Ubuntu (firefox, linux-aws, linux-aws-5.15, and linux-azure).
-
Security Week ☛ QNAP Rushes Patch for Code Execution Flaw in NAS Devices
QNAP rolls out patches for multiple vulnerabilities after proof-of-concept exploit published for a remote code execution vulnerability.
-
SANS ☛ Scanning without Scanning with NMAP (APIs FTW), (Tue, May 21st)
-
IT Wire ☛ Western Sydney Uni reports cyber incident after four months
"Importantly, there have been no threats received by the University to disclose any of the private information which was accessed, and the University has not received any demands in exchange for maintaining privacy.
"In order to protect University staff, students and stakeholders, the University has sought and been granted an injunction from the NSW Supreme Court to prevent access, use, transmission and publication of any data that was the subject of the incident.
"The University unreservedly apologises for this incident and its impact on our community. It is deeply regrettable and we are committed to transparently rectifying the matter."
-
Security Week ☛ Zoom Adding Post-Quantum End-to-End Encryption to Products [Ed: But what prevents Zoom the company and the US government decrypting and saving everything at the server side?]
Zoom is announcing post-quantum end-to-end encryption on Meetings, with Phone and Rooms coming soon.
-
Security Week ☛ CISA Warns of Attacks Exploiting NextGen Healthcare Mirth Connect Flaw
CISA has added CVE-2023-43208, an unauthenticated remote code execution vulnerability, to its KEV catalog.
-
Security Week ☛ OmniVision Says Personal Information Stolen in Ransomware Attack
Semiconductor giant OmniVision Technologies says personal information was stolen in a September 2023 ransomware attack.
-
OpenSSF (Linux Foundation) ☛ What’s in the SOSS? Podcast #4 – Eric Brewer and the Future of Open Source Security
-
Latest Ubuntu Security Updates: Fixing Linux Kernel Vulnerabilities
Several vulnerabilities have been discovered in the Linux kernel that could lead to privilege escalation, denial of service, or information leaks. The Ubuntu security team has addressed these issues in the latest Ubuntu security updates for multiple releases. In this article, we will explore some of the vulnerabilities fixed and learn how to apply updates without rebooting the system.
-
The Register UK ☛ Long-term supported distros' kernel policies are all wrong
A new hire at Rocky Linux creator CIQ is rocking the LTS-Linux-distro boat – by shining a spotlight on the elephant in the room (or one of the herd).
A recent blog post from Rocky Linux developer CIQ, subtitled Cracks in the Ice, examines "Why a 'frozen' distribution Linux kernel isn't the safest choice for security." The post itself is an executive summary of a study the company conducted comparing the numbers of bugs and bug fixes in RHEL 8's kernel, which it has published in a white paper titled Vendor Kernels, Bugs and Stability.
FOSS software, which provides the building blocks of projects like Linux distributions, is built around community development. The problem is that this is hard to monetize. Some companies have found ways to do this, but they aren't sharing enough of their work, leaving vital parts of the ecosystem starved. There are clearly visible and perfectly feasible ways around this. The snag is that implementing them would mean persuading billion-dollar companies to play nicely together.