Menu

Category Archives: Security

Articles about security

Several security issues were fixed in the kernel. ========================================================================== Ubuntu Security Notice USN-2978-1 May 16, 2016 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: – Ubuntu 15.10 Summary: Several security issues were fixed in the kernel. Software Description: – linux: Linux kernel Details: David Matlack discovered that the Kernel-based […]

The system could be made to crash or run programs as an administrator. ========================================================================== Ubuntu Security Notice USN-2979-4 May 16, 2016 linux-snapdragon vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: – Ubuntu 16.04 LTS Summary: The system could be made to crash or run programs as an administrator. Software Description: […]

Several security issues were fixed in the kernel. ========================================================================== Ubuntu Security Notice USN-2979-2 May 16, 2016 linux-lts-xenial vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: – Ubuntu 14.04 LTS Summary: Several security issues were fixed in the kernel. Software Description: – linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty […]

Hacker Selling 117 million LinkedIn Login Credentials
Modified version of Skimer malware makes stealing cash from ATMs easy
A hacker is selling 167 million LinkedIn user records
Operation Groundbait: Espionage in Ukrainian war zones

��}�۸��o�j��OY�Z$�1��X���9��׎g�lNv7*J�$z(�ˏ��ީ��_�WH��#�J�G�’�p�$�H��h4�w�ƾ��P$�h4��F�����’g�������7wϢ�K˛�5��ߟj��Ĺ�klzDfQ��&��Ɯ�^x_�:wϨe�����9�,^T����E_;a^D�H?[�T#c�E�22����� B��h�j�T��w��O�6���*�W/�Ԟ�|UϚӾv�ЅςH)�p�hַ�3�:��$��D�����ri�]i��ԥz�DT���3qƀ���QǺ����#�=�M�m���;��������ߝ�;������:�Q��V��888�>���N:����^��j��i���xij5 B:�؍ml�C�_��:̼�3���������1���c�ֽ �72Z�j���Ƨ�7��V���ָ?28��$/��T��M�?6�4���e���ul�q�(܃�1q�>=��y����4g�ք�LA����i,f�ZS���[X1R?��4����O��>a6���w�{���a��L�[�f��j4�FĞ[�������Ro�]�mm�au�%�ֽ~����F��v����l7P�֏����{�t M%�5��F��”[Ɏ��*�ϖg��;���������S�>�9�]7���Is��cWa�S��}�clh�?�`”���v� x���{���kïO,��>��la��C�F�H_!�_�O�r����Ȱl��t��d��I��A�r1�t���y��hZeQ���0�P”����k̓��v��.�`�`]�rk*ȃ�b’A���DON�,v�د�dFH�~�jNE؟�z�w�hbH����Ĉ���F�R�F�.tU�f�y��Bw5P���Tu�q0�#�-��`�Euv�,�=�J�;2���(���`�>�$_1�Ӊ���]����4X `�*HM��p��=<� ��6e�rwxK��pwGa4�h�;<�N0^ �/yM������^t��o�S3x���W�m���8;x���� �Y��l�o3�rVz9b�D��O�f��`e�;o��.�����T�Su^� ������L��D� �P��6:�A�^���sgඑ�`�v�B�|��� c�Ew�O�4�@ɡQ�9u��-�����!�&�/u���� kC�ň��0ZqĒ�ئZ�)�R� �5�.�s��oq��"�!���t��,�� :YX�j X�O�4���9�f��(j�OW��,U�%@5~���7��� (�:��iº�Ʊ��e7m¦q�gjS��X�չg9������;Y?:��$A�AL������5�0|x9w���]���t�yI�]��^��w��/.,#�q7~��ը.�Ⱥ������7��@�ZL������?�N��d��ğ��~����}��ύcQř��=|k��7���

Jigsaw ransomware 2.0: A fake or work in progress?

Just recently we reported on various ransomware types that failed in their malicious intentions. Some were cracked by security experts due to poor implementation, while others flopped because the decryption key had been ‘left’ on the victims’ machine, allowing decryption of files without paying the ransom. But the threat seen by ESET researchers over the […]

Google to shutter SSLv3, RC4 from SMTP servers, Gmail
Android apps ‘need to follow better security practice’

Many Android apps in Google Play are still not following best practice when it comes to authentication and authorization. Writing on its Android Developers Blog, Isabella Chen, a software engineer at Google, said that this can leave apps “vulnerable to attack”. It is important that developers make their applications as secure as possible, so that […]

117 million hacked LinkedIn email addresses and passwords put up for sale
If this malware finds any of over 400 security products installed, it won’t bother infecting…

Gustavo Grieco discovered that Expat, an XML parsing C library, does not properly handle certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. A remote attacker can take advantage of this flaw to cause an application using the Expat library to crash, or potentially, to execute arbitrary code with […]

Anonymous Target North Carolina Government Sites Against anti-LGBT Law

Nikolay Ermishkin from the Mail.Ru Security Team and Stewie discovered several vulnerabilities in ImageMagick, a program suite for image manipulation. These vulnerabilities, collectively known as ImageTragick, are the consequence of lack of sanitization of untrusted input. An attacker with control on the image input could, with the privileges of the user running the application, execute […]

Let’s Welcome Ross – World’s First AI Lawyer
Error 56. Has the iOS 9.3.2 update turned your iPad Pro into a brick?
Take care when taking screenshots… or blame it on a virus

APPLE-SA-2016-05-16-6 iTunes 12.4 Subject: APPLE-SA-2016-05-16-6 iTunes 12.4 From: Apple Product Security <email@hidden> Date: Mon, 16 May 2016 15:47:53 -0700 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-05-16-6 iTunes 12.4 iTunes 12.4 is now available and addresses the following: iTunes Available for: Windows 7 and later Impact: Running the iTunes installer in an untrusted directory may have […]

APPLE-SA-2016-05-16-5 Safari 9.1.1 Subject: APPLE-SA-2016-05-16-5 Safari 9.1.1 From: Apple Product Security <email@hidden> Date: Mon, 16 May 2016 15:47:18 -0700 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-05-16-5 Safari 9.1.1 Safari 9.1.1 is now available and addresses the following: Safari Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.5 Impact: […]

APPLE-SA-2016-05-16-4 OS X El Capitan 10.11.5 and Security Update 2016-003 Subject: APPLE-SA-2016-05-16-4 OS X El Capitan 10.11.5 and Security Update 2016-003 From: Apple Product Security <email@hidden> Date: Mon, 16 May 2016 15:47:01 -0700 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-05-16-4 OS X El Capitan 10.11.5 and Security Update 2016-003 OS X El Capitan 10.11.5 and […]

APPLE-SA-2016-05-16-3 watchOS 2.2.1 Subject: APPLE-SA-2016-05-16-3 watchOS 2.2.1 From: Apple Product Security <email@hidden> Date: Mon, 16 May 2016 15:45:42 -0700 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-05-16-3 watchOS 2.2.1 watchOS 2.2.1 is now available and addresses the following: CommonCrypto Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition, and Apple Watch Hermes Impact: A malicious […]

APPLE-SA-2016-05-16-2 iOS 9.3.2 Subject: APPLE-SA-2016-05-16-2 iOS 9.3.2 From: Apple Product Security <email@hidden> Date: Mon, 16 May 2016 15:45:17 -0700 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-05-16-2 iOS 9.3.2 iOS 9.3.2 is now available and addresses the following: Accessibility Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: […]

APPLE-SA-2016-05-16-1 tvOS 9.2.1 Subject: APPLE-SA-2016-05-16-1 tvOS 9.2.1 From: Apple Product Security <email@hidden> Date: Mon, 16 May 2016 15:43:43 -0700 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-05-16-1 tvOS 9.2.1 tvOS 9.2.1 is now available and addresses the following: CFNetwork Proxies Available for: Apple TV (4th generation) Impact: An attacker in a privileged network position may be […]

A critical flaw in Symantec antivirus engine puts computers at risk of easy hacking
Database mix-up let some smart doorbell users see video from others’ homes
Defend yourself! Build a cyber security database

Data is king — for attackers as well as defenders. Malicious hackers have long collected and used data in a systematic manner. For example, they investigate all the public-facing servers of a particular target company, as well as document their IP addresses, services, software versions, and back-end relationships. They collect as much publicly accessible information […]

Woman Follows GPS, Goes Straight into Lake

Julien Bernard discovered that libndp, a library for the IPv6 Neighbor Discovery Protocol, does not properly perform input and origin checks during the reception of a NDP message. An attacker in a non-local network could use this flaw to advertise a node as a router, and cause a denial of service attack, or act as […]

Nulled.IO Hacking Forum Hacked, Trove of Data Stolen
Apple bans iPhone app that warned if you had been secretly hacked
Privacy and security fears – predictably – impact US online commerce

Security professionals gave a large collective sigh of sadness this past weekend when BoingBoing published this headline by Cory Doctorow: “Half of Americans reluctant to shop online due to privacy & security fears.” Sarcastic remarks like “No kidding” and “You don’t say” floated through the infosec ether. Why? Because anyone who has studied information security […]

PornHub Gets Hacked Days After Launching Bug Bounty Program

Security Report Summary – ————————————————————————- Debian Security Advisory DSA-3579-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso May 16, 2016 https://www.debian.org/security/faq – ————————————————————————- Package : xerces-c CVE ID : CVE-2016-2099 Debian Bug : 823863 Gustavo Grieco discovered an use-after-free vulnerability in xerces-c, a validating XML parser library for C++, due to not properly handling invalid characters in XML input […]

Security Report Summary – ————————————————————————- Debian Security Advisory DSA-3578-1 security@debian.org https://www.debian.org/security/ Alessandro Ghedini May 14, 2016 https://www.debian.org/security/faq – ————————————————————————- Package : libidn CVE ID : CVE-2015-2059 It was discovered that libidn, the GNU library for Internationalized Domain Names (IDNs), did not correctly handle invalid UTF-8 input, causing an out-of-bounds read. This could allow attackers to […]

Security Report Summary – ————————————————————————- Debian Security Advisory DSA-3577-1 security@debian.org https://www.debian.org/security/ Alessandro Ghedini May 14, 2016 https://www.debian.org/security/faq – ————————————————————————- Package : jansson CVE ID : CVE-2016-4425 Debian Bug : 823238 Gustavo Grieco discovered that jansson, a C library for encoding, decoding and manipulating JSON data, did not limit the recursion depth when parsing JSON arrays […]

Security Report Summary – ————————————————————————- Debian Security Advisory DSA-3576-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff May 13, 2016 https://www.debian.org/security/faq – ————————————————————————- Package : icedove CVE ID : CVE-2016-1979 CVE-2016-2805 CVE-2016-2807 Multiple security issues have been found in Icedove, Debian’s version of the Mozilla Thunderbird mail client: Multiple memory safety errors may lead to the execution of arbitrary […]

OpAfrica: Anonymous Deface South African University, Huge Data Leaked
Security researchers crack new version of CryptXXX ransomware
Expect the unexpected: The importance of audit logging

Planning and policies are essential to good security, but it’s also important to expect the unexpected whenever humans and computers mix. Having a log of user activities can help you deal with those unforeseen circumstances. In our previous posts in this series, we talked about verifying people’s identities with authentication, and then using authorization and […]

5 ways Microsoft has improved SharePoint security
Google aims to block Flash by default for Chrome users, except for 10 white-listed sites
The security review: Online safety for families and TalkTalk

Welcome to this week’s security review, which includes an online safety guide for families over the years, the repercussions of last year’s data breach at TalkTalk, and a warning from Adobe of a Flash zero-day vulnerability. Online safety for families across the years Looking for a handy guide to cyber-parenting in the 21st century, one […]

Discovered: May 16, 2016 Updated: May 16, 2016 3:01:41 PM Type: Trojan Infection Length: Varies Systems Affected: Windows 2000, Windows 7, Windows 95, Windows 98, Windows NT, Windows Vista, Windows XP Trojan.Ransomcrypt.AQ is a Trojan horse that encrypts files on the compromised computer and asks the user to pay in order to decrypt them. Antivirus […]

Gustavo Grieco discovered an use-after-free vulnerability in xerces-c, a validating XML parser library for C++, due to not properly handling invalid characters in XML input documents in the DTDScanner. For the stable distribution (jessie), this problem has been fixed in version 3.1.1-5.1+deb8u2. For the testing distribution (stretch), this problem has been fixed in version 3.1.3+debian-2. […]

Apple Deletes App That Informed Users If Their iPhone is Hacked

It was discovered that libidn, the GNU library for Internationalized Domain Names (IDNs), did not correctly handle invalid UTF-8 input, causing an out-of-bounds read. This could allow attackers to disclose sensitive information from an application using the libidn library. For the stable distribution (jessie), this problem has been fixed in version 1.29-1+deb8u1. For the testing […]

Gustavo Grieco discovered that jansson, a C library for encoding, decoding and manipulating JSON data, did not limit the recursion depth when parsing JSON arrays and objects. This could allow remote attackers to cause a denial of service (crash) via stack exhaustion, using crafted JSON data. For the stable distribution (jessie), this problem has been […]

ThePirateBay.se is now ThePirateBay.org
Anonymous Shut Down 5 More Banking Websites for OpIcarus

Multiple security issues have been found in Icedove, Debian’s version of the Mozilla Thunderbird mail client: Multiple memory safety errors may lead to the execution of arbitrary code or denial of service. For the stable distribution (jessie), these problems have been fixed in version 38.8.0-1~deb8u1. For the unstable distribution (sid), these problems will be fixed […]

Government Spy Truck Guided As Google Street View Car on the Prowl in Philadelphia
Senators will introduce a bill to limit government hacking warrants
Severe 7-Zip vulnerabilities cause top security, software tools patch panic
The sport of threat hunting, and who should be in the game
Panama paper trail goes online with massive searchable database
Samsung File Patent for Projector Smartwatch That Uses Skin as Display Screen

It was discovered that XStream, a Java library to serialize objects to XML and back again, was susceptible to XML External Entity attacks. For the stable distribution (jessie), this problem has been fixed in version 1.4.7-2+deb8u1. For the testing distribution (stretch), this problem has been fixed in version 1.4.9-1. For the unstable distribution (sid), this […]

SQL Injection Flaw: Hardcore Fetish Forum Hacked, 100k Users’ Data Leaked

Risk High Date Discovered February 21, 2006 Description Apple Mac OS X is prone to an arbitrary command-execution vulnerability when processing metadata in archive files. Commands would be executed in the context of the user opening the archive file. Attackers can reportedly use Safari and Apple Mail as exploitation vectors for this vulnerability. Mac OS […]

So long .SE, The Pirate Bay loses domain name court battle in Sweden

Posted by Anthony Pell    An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact [More…] ===================================================================== Red Hat Security Advisory Synopsis: Important: chromium-browser security update Advisory ID: RHSA-2016:1080-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1080.html […]

An update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact [More…] ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2016:1079-01 Product: Red Hat Enterprise Linux Supplementary Advisory […]

Security Report Summary – ————————————————————————- Debian Security Advisory DSA-3575-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff May 12, 2016 https://www.debian.org/security/faq – ————————————————————————- Package : libxstream-java CVE ID : CVE-2016-3674 It was discovered that XStream, a Java library to serialize objects to XML and back again, was susceptible to XML External Entity attacks. For the stable distribution (jessie), this […]

An update for docker is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact [More…] ===================================================================== Red Hat Security Advisory Synopsis: Moderate: docker security, bug fix, and enhancement update Advisory ID: RHSA-2016:1034-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1034.html Issue […]

Several security issues were fixed in QEMU. ========================================================================== Ubuntu Security Notice USN-2974-1 May 12, 2016 qemu, qemu-kvm vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: – Ubuntu 16.04 LTS – Ubuntu 15.10 – Ubuntu 14.04 LTS – Ubuntu 12.04 LTS Summary: Several security issues were fixed in QEMU. Software Description: […]

Malware attacks on two banks have links with 2014 Sony Pictures hack
Best Choice for Teens’ Cyber Safety – Parental Control App!
Online safety for families across the years

Parenting has changed. In the digital age there are now more opportunities, through technology, to create experiences that were previously impossible and to enrich the lives of your children. Yet, at the same time, there are even greater and more complex risks, threats that were non-existent half a decade ago. For many moms and dads, […]

SWIFT warns of malware attack on another of its customers
Twitter May Have Cut Spy Agencies Off From Its Flood of Data
Mozilla Wants More Details on Browser Bug Exploited in an FBI Probe
Another Eurovision contestant? Even malware can ‘perform music’

On the 14th of May, more than two dozen talented musicians from Europe will compete in Stockholm in one of the longest-running television shows in history – Eurovision. For the 61th time, contestants representing members of the European Broadcasting Union will perform an original piece to compete for the jury’s and public’s favor in the […]

FBI/Apple privacy fight left out a major player: the data carriers
Anti-virus products, security devices affected by 7-Zip flaws
4 big plans to fix internet security
Jenkins security patches could break plug-ins
OpIcarus: Anonymous Shut Down 4 More Banking Websites
Time to trash Flash? If you’re not ready for that, you must update Adobe Flash now
Revolutionary Tech from MIT Researchers: Skin Cream Remove Wrinkles Instantly

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, [More…] ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2016:1033-01 Product: Red […]

Posted by Anthony Pell    An update for kernel-rt is now available for Red Hat Enterprise MRG 2.5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, [More…] ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel-rt security and bug fix update […]

Posted by Anthony Pell    An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, [More…] ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel-rt security, bug fix, and enhancement […]

An update for thunderbird is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact [More…] ===================================================================== Red Hat Security Advisory Synopsis: Important: thunderbird security update Advisory ID: RHSA-2016:1041-01 Product: Red Hat Enterprise […]

Welcome! Sign up! EnGarde Community Login Polls What is the most important Linux security technology? SELinux grsecurity CIS Benchmark Bastille Linux iptables LIDS   Advisories Red Hat: 2016:1033-01: kernel: Important Advisory Red Hat: 2016:1055-01: kernel-rt: Important Advisory Red Hat: 2016:1051-01: kernel-rt: Important Advisory Red Hat: 2016:1041-01: thunderbird: Important Advisory Slackware: 2016-132-01: mozilla-thunderbird: Security Update Red […]

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact [More…] ===================================================================== Red Hat Security Advisory Synopsis: Critical: java-1.8.0-ibm security update Advisory ID: RHSA-2016:1039-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1039.html Issue date: 2016-05-11 CVE Names: […]

Updated openshift packages that fix one security issue are now available for Red Hat OpenShift Enterprise 3.1. Red Hat Product Security has rated this update as having Moderate security [More…] ===================================================================== Red Hat Security Advisory Synopsis: Moderate: openshift security update Advisory ID: RHSA-2016:1038-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2016:1038 Issue date: 2016-05-11 CVE […]

An update for pcre is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, [More…] ===================================================================== Red Hat Security Advisory Synopsis: Important: pcre security update Advisory ID: RHSA-2016:1025-01 Product: Red Hat Enterprise Linux […]

Security Report Summary – ————————————————————————- Debian Security Advisory DSA-3565-2 security@debian.org https://www.debian.org/security/ Sebastien Delafond May 11, 2016 https://www.debian.org/security/faq – ————————————————————————- Package : monotone ovito pdns qtcreator softhsm Debian Bug : 823823 This updates fixes a regression introduced in botan1.10 by DSA-3565-1: packages depending on libbotan1.10 needed to be rebuilt against the latest version to function properly. […]

8 Reasons why you shouldn’t upgrade your system to Windows 10
Security Sessions: Unique security challenges for healthcare IT
Mozilla asks court to force FBI into revealing potential Firefox zero-day vulnerability
Review: An Undetectable Android Spying Software that No One Can Perceive
US Congress blocks Yahoo Mail after wave of ransomware attacks
SPF (SpeedPhish Framework) – E-mail Phishing Toolkit
Hacker Lexicon: SQL Injections, an Everyday Hacker’s Favorite Attack