Security Leftovers
-
Below: World Writable Directory in /var/log/below Allows Local Privilege Escalation (CVE-2025-27591)
Below is a tool for recording and displaying system data like hardware utilization and cgroup information on Linux. In January 2025, Below was packaged and submitted to openSUSE Tumbleweed. Below runs as a systemd service with
rootprivileges. The SUSE security team monitors additions and changes to systemd service unit files in openSUSE Tumbleweed, and through this we noticed problematic log directory permissions applied in Below’s code. -
LWN ☛ Security updates for Wednesday
Security updates have been issued by Debian (libmodbus), Fedora (thunderbird and vyper), Mageia (firefox, nss, python-django, python-jinja2, and thunderbird, thunderbird-l10n), Oracle (bind, kernel, rsync, and tigervnc), Red Hat (.NET 8.0, .NET 9.0, and libxml2), SUSE (iniparser and kernel), and Ubuntu (dotnet8, dotnet9, freerdp2, jinja2, libreoffice, linux, linux-hwe, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-kvm, linux-oracle, linux-kvm, and opensc).
-
Dark Reading ☛ Car Exploit Allows You to Spy on Drivers in Real Time
The Pioneer DMH-WT7600NEX is a thousand-dollar aftermarket IVI, typically used to zhuzh up head units in 2010s-era consumer vehicles. But it carries a kind of bring-your-own-device (BYOD) risk to the family SUV.
At Pwn2Own Automotive 2024, NCC Group security researchers Alex Plaskett and McCaulay Hudson combined a trio of zero-day exploits together to burrow inside of the Pioneer DMH and plant spyware capable of exfiltrating a variety of data: phone call and browsing histories, Wi-Fi passwords, geolocations, and more. And because it pulled all that data in real time, Hudson notes, "you could just watch a driver, for example, driving down the street, and see their GPS location moving. Or if they were making a call, you could see who they made the call to."
-
Windows TCO / Windows Bot Nets
-
Scoop News Group ☛ Lazarus Group deceives developers with 6 new malicious npm packages [Ed: npm is Microsoft]
Socket researchers said the malware-ridden packages were collectively downloaded over 330 times. Microsoft's proprietary prison GitHub removed all of the malicious packages Wednesday.
-