Menu

Category Archives: Security

Articles about security

Several security issues were fixed in OpenEXR.

Several security issues were fixed in OpenEXR.

Do you want speed or security as expected? Spectre CPU defenses can cripple performance on Linux in tests
APNIC left a dump from its Whois SQL database in a public Google Cloud bucket
It’s 2021 and a printf format string in a wireless network’s name can break iPhone Wi-Fi
Wegmans Exposes Customer Data in Misconfigured Databases
Bugs in NVIDIA’s Jetson Chipset Opens Door to DoS Attacks, Data Theft
Ex-NSA bigwig Chris Inglis appointed America’s national cyber director by Senate
Embryology Data Breach Follows Fertility Clinic Ransomware Hit
Racist malware blocks The Pirate Bay by tampering with victims’ Windows hosts file
Agent Tesla RAT Returns in COVID-19 Vax Phish
iPhone Wi-Fi Crushed by Weird Network

Introduction It’s important for a business to be prepared with an exercised business continuity and disaster recovery (BC/DR) plan plan before its hit with ransomware so that it can resume operations as quickly as possible. Key steps and solutions should be followed to prepare and respond to cyber threats or attacks against your organization. It […]

No, you’re not talking to Jason Statham
North Korean hackers exploit VPN bug to gain access to South Korean Atomic Energy Research Institute

Several security issues were fixed in Apache HTTP Server.

Secure Linux Hosting for Businesses>
What Is Threat Intelligence?>
RHEL and CentOS 7 Users Get New Kernel Security Update to Fix Intel Graphics Flaws>
Firefox 89.0.1 Released to Improve WebRender Performance, Fix Scrollbars on GTK Themes>

Several security issues were fixed in Apache HTTP Server.

Several security issues were fixed in Dovecot.

State‑sponsored or financially motivated: Is there any difference anymore?

What does the increasingly fuzzy line between traditional cybercrime and attacks attributed to state-backed groups mean for the future of the threat landscape? The post State‑sponsored or financially motivated: Is there any difference anymore? appeared first on WeLiveSecurity

Sharpen your cybersecurity skills, however and wherever works for you, with these SANS Institute courses
South Korea’s nuclear research agency breached by North Korea-affiliated cyberattackers, says malware analyst group

Update radare2 to 5.3.1 Also fixes CVS-2021-32613 —- bump to radare2 5.3.0 fixes CVE-2021-32613

Update radare2 to 5.3.1 Also fixes CVS-2021-32613 —- bump to radare2 5.3.0 fixes CVE-2021-32613

Update radare2 to 5.3.1 Also fixes CVS-2021-32613 —- bump to radare2 5.3.0 fixes CVE-2021-32613

Backport fix for CVE-2021-3589 and a heap buffer overflow.

Backport fix for CVE-2021-3589 and a heap buffer overflow.

security update

security update

It was discovered that the previous upload of the package prosody versioned 0.9.12-2+deb9u3 introduced a regression in the mod_auth_internal_hashed module. Big thanks to Andre Bianchi for the reporting an issue and for testing the update.

Update to 1.6.15 Security If an authenticated client connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur. Affects versions 1.6 to 2.0.10 inclusive.

CVE-2021-3560 mitigation

Backport fix for CVE-2021-33503.

2.0.11 Security If an authenticated client connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur. Affects versions 1.6 to 2.0.10 inclusive. Broker Fix possible crash having just upgraded from 1.6 if per_listener_settings true is set, and a SIGHUP is sent to the broker before a client has […]

This updates nettle to the latest upstream release 3.7.3, which contains security fix for RSA decryption: https://lists.lysator.liu.se/pipermail/nettle- bugs/2021/009545.html

Most health apps engage in unhealthy data‑harvesting habits

Most medical and fitness apps in Google Play have tracking capabilities enabled and their data collection practices aren’t transparent The post Most health apps engage in unhealthy data‑harvesting habits appeared first on WeLiveSecurity

What’s Making Your Company a Ransomware Sitting Duck
Repairmen suspected of installing ransomware on customers’ PCs. Arrests in South Korea
Carnival Cruise Cyber-Torpedoed by Cyberattack

The package connman before version 1.40-1 is vulnerable to arbitrary code execution.

The package grub before version 2:2.06-1 is vulnerable to multiple issues including access restriction bypass and arbitrary code execution.

The package go before version 2:1.16.5-1 is vulnerable to multiple issues including insufficient validation, url request injection and denial of service.

Multiple security vulnerabilities were discovered in Tor, a connection-based low-latency anonymous communication system, which could result in denial of service or spoofing.

Insider Versus Outsider: Navigating Top Data Loss Threats
CREST president Ian Glover to retire after 13 years – but where’s the transparency, bossman?
‘Oddball’ Malware Blocks Access to Pirated Software
Faux ‘DarkSide’ Gang Takes Aim at Global Energy, Food Sectors
Poltergeist attack could leave autonomous vehicles blind to obstacles – or haunt them with new ones
5 essential things to do before ransomware strikes

By failing to prepare you are preparing to fail – here’s what you can do today to minimize the impact of a potential ransomware attack in the future The post 5 essential things to do before ransomware strikes appeared first on WeLiveSecurity

Several security issues were fixed in GRUB 2.

Google dishes out homemade SLSA, a recipe to thwart software supply-chain attacks

An update that solves two vulnerabilities and has one errata is now available.

Clop Raid: A Big Win in the War on Ransomware?
Ex-Brave staffer launches GDPR sueball in Germany over tech giants’ real-time bidding for ad inventory
Cisco Smart Switches Riddled with Severe Security Holes
Geek Squad Vishing Attack Bypasses Email Security to Hit 25K Mailboxes
OSINT 101: What is open source intelligence and how is it used?

OSINT can be used by anyone, both for good and bad ends – here’s how defenders can use it to keep ahead of attackers The post OSINT 101: What is open source intelligence and how is it used? appeared first on WeLiveSecurity

CVS Health Records for 1.1 Billion Customers Exposed
Tim Cook: Sideloading is a disaster and proposed App Store reforms would harm user privacy and security

Several security issues were fixed in libxml2.

Threat Actors Use Google Docs to Host Phishing Attacks
Hiccup in Akamai’s DDoS Mitigation Service Triggers Massive String of Outages

The package python-django before version 3.2.4-1 is vulnerable to multiple issues including insufficient validation and directory traversal.

The package radare2 before version 5.3.1-1 is vulnerable to denial of service.

The package thefuck before version 3.31-1 is vulnerable to arbitrary file overwrite.

The package aspnet-runtime-3.1 before version 3.1.16.sdk116-1 is vulnerable to denial of service.

The package aspnet-runtime before version 5.0.7.sdk204-1 is vulnerable to denial of service.

Smashing Security podcast #232: Zoomolympics and language matters
Biden to Putin: Get your ransomware gangs under control and don’t you dare cyber-attack our infrastructure
South Korea has a huge problem with digital sex crimes against women says Human Rights Watch
GPRS-era mobile data encryption algorithm GEA/1 was ‘weak by design’, still lingers in today’s phones

security update

School teacher accused of pocketing $1m+ in insider trading using tips from Silicon Valley pal
IKEA Fined $1.2M for Elaborate ‘Spying System’
Exclusive Ransomware Poll: 80% of Victims Don’t Pay Up
Microsoft takes down large‑scale BEC operation

The fraudsters ran their campaigns from the cloud and used phishing and email forwarding rules to steal their targets’ financial information. The post Microsoft takes down large‑scale BEC operation appeared first on WeLiveSecurity

Takeaways from the Colonial Pipeline Ransomware Attack
Ryuk ransomware recovery cost us $8.1m and counting, says Baltimore school authority
Euros-Driven Football Fever Nets Dumb Passwords
We’ve found another reason not to use Microsoft’s Paint 3D – researchers
Cuffed: Ukraine police collar six Clop ransomware gang suspects in joint raids with South Korean cops
5 Tips to Prevent and Mitigate Ransomware Attacks
Avaddon Ransomware Gang Evaporates Amid Global Crackdowns  
Papa don’t breach: UK data watchdog fines that other pizza place £10,000 over unsolicited marketing blitz

Upstream details at : https://access.redhat.com/errata/RHSA-2018:3140

Upstream details at : https://access.redhat.com/errata/RHSA-2021:1512

Researchers: Booming Cyber-Underground Market for Initial-Access Brokers
Peloton Bike+ Bug Gives Hackers Complete Control

Several security issues were fixed in BlueZ.

What is Azure Confidential Ledger?

Several security issues were fixed in BlueZ.

An update for gupnp is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An update for openvswitch2.11 is now available for Red Hat OpenStack Platform 13 (Queens). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

Alibaba suffers billion-item data leak of usernames and mobile numbers
Millions of Connected Cameras Open to Eavesdropping
Zoll Defibrillator Dashboard would execute contents of random Excel files ordinary users could import
Malicious PDFs Flood the Web, Lead to Password-Snarfing