news
Security Leftovers
-
Trail of Bits ☛ A deep dive into Axiom’s Halo2 circuits
Over two audits in 2023, we reviewed a blockchain system developed by Axiom that allows computing over the entire history of Ethereum, all verified by zero-knowledge proofs (ZKPs) on-chain using ZK-verified elliptic curve and SNARK recursion operations. This system is built using the Halo2 framework—a complex, emerging technology that presents many challenges when building a secure application, including potential under-constrained issues resulting from its low-level API.
-
Russell Coker ☛ Russell Coker: Machine Learning Security
I just read an interesting blog post about ML security recommended by Bruce Schneier [1].
This approach of having 2 Hey Hi (AI) systems where one processes user input and the second performs actions on quarantined data is good and solves some real problems. But I think the bigger issue is the need to do this.
-
LWN ☛ Security updates for Friday
Security updates have been issued by AlmaLinux (.NET 8.0, .NET 9.0, firefox, ghostscript, gstreamer1-plugins-bad-free, libsoup3, mingw-freetype, perl, ruby, sqlite, thunderbird, unbound, valkey, and xz), Debian (chromium, firefox-esr, libavif, linux-6.1, modsecurity-apache, mydumper, systemd, and thunderbird), Fedora (coreutils, dnsdist, docker-buildx, maturin, mingw-python-flask, mingw-python-flit-core, ruff, rust-hashlink, rust-rusqlite, and thunderbird), Red Hat (pcs), SUSE (augeas, brltty, brotli, ca-certificates-mozilla, dnsdist, glibc, grub2, kernel, libsoup, libsoup2, libxml2, open-vm-tools, perl, postgresql13, postgresql15, postgresql16, postgresql17, python-cryptography, python-httpcore, python-h11, python311, runc, s390-tools, slurm, slurm_20_11, slurm_22_05, slurm_23_02, slurm_24_11, tomcat, and webkit2gtk3), and Ubuntu (linux-aws).
-
Security Week ☛ CISA Releases Guidance on SIEM and SOAR Implementation
The guidance outlines the benefits and challenges or SIEM and SOAR platforms, and shares implementation recommendations.
-
Information Security Media Group, Corporation ☛ Linux Zero-Day Vulnerability Discovered Using Frontier AI [Ed: Misleading hype; this is an smb2 issue that would be hard to exploit in real-world scenarios, it's "hey hi" hype]