news
Security and Windows TCO / Microsoft Breaches
-
SANS ☛ HTTP Request Signatures, (Mon, Sep 8th)
-
Security Week ☛ Chinese Spies Impersonated US Lawmaker to Deliver Malware to Trade Groups: Report
China’s APT41 sent out malicious emails on behalf of Rep. John Moolenaar to collect information ahead of US-China trade talks.
-
LWN ☛ Security updates for Monday
Security updates have been issued by Debian (chromium, libhtp, modsecurity-apache, shibboleth-sp, and wireless-regdb), Fedora (chromium, kea, tcpreplay, and yq), Mageia (rootcerts, nspr, nss & firefox and thunderbird), Red Hat (python3), and SUSE (7zip, chromedriver, go1.25, libQt5Pdf5, libsixel-bash-completion, libsoup2, libwireshark18, netty, rav1e, and trivy).
-
Wladimir Palant ☛ A look at a P2P camera (LookCam app)
I’ve got my hands on an internet-connected camera and decided to take a closer look, having already read about security issues with similar cameras. What I found far exceeded my expectations: fake access controls, bogus protocol encryption, completely unprotected cloud uploads and firmware riddled with security flaws. One could even say that these cameras are Murphy’s Law turned solid: everything that could be done wrong has been done wrong here. While there is considerable prior research on these and similar cameras that outlines some of the flaws, I felt that the combination of severe flaws is reason enough to publish an article of my own.
My findings should apply to any camera that can be managed via the LookCam app. This includes cameras meant to be used with less popular apps of the same developer: tcam, CloudWayCam, VDP, AIBoxcam, IP System. Note that the LookCamPro app, while visually very similar, is technically quite different. It also uses the PPPP protocol for low-level communication but otherwise doesn’t seem to be related, and the corresponding devices are unlikely to suffer from the same flaws.
-
Windows TCO / Microsoft Breaches
-
LWN ☛ [Microsoft] npm debug and chalk packages compromised (Aikido)
The Aikido blog describes
an apparently ongoing series of phishing attacks against [Microsoft] npm package
maintainers, resulting in the uploading of compromised versions of heavily
used packages: [...]
-
Security Week ☛ GitHub Workflows Attack Affects Hundreds of Repos, Thousands of Secrets
A supply chain attack called GhostAction has enabled threat actors to steal secrets and exploit them.
-
Security Week ☛ Salesloft Microsoft's proprietary prison GitHub Account Compromised Months Before Salesfarce Attack
The list of impacted cybersecurity firms has been expanded to include BeyondTrust, Bugcrowd, CyberArk, Cato Networks, JFrog, and Rubrik.
-
Scoop News Group ☛ Salesloft Drift security incident started with undetected Microsoft's proprietary prison GitHub access
The company said a threat actor accessed and snooped around its account for months, then stole OAuth tokens for Drift integrations from its cloud environment.
-