Author: Admin
Simpson Garfinkel on creepy cryptographic action at a distance Excellent to read. One example: Consider the case of basic public-key cryptography, in which a person’s public and private keys are created together in a single operation. These two keys are not related to quantum physics, but to mathematics. When I create a virtual machine server in the Amazon cloud, I am prompted for an RSA public key that will be used to control access to the machine. Typically, I generate a public and private key pair on my laptop and upload the public key to Amazon, which stores my public…
October 30, 2024Ravi Lakshmanan Browser Security / Vulnerability A now-fixed security flaw in the Opera web browser could have allowed a malicious extension to gain unauthorized full access to private APIs. A code-named attack CrossBarkingcould enable actions such as capturing screenshots, changing browser settings and account theft, Guardio Labs said. To demonstrate the problem, the company said it managed to publish a seemingly harmless browser extension to the Chrome Web Store, which could then exploit the flaw when installed in Opera, making it an example of a cross-browser attack on the store. “This case study not only highlights the perennial…
October 30, 2024Hacker newsVulnerability / Compliance Navigating complex compliance frameworks like ISO 27001, SOC 2 or GDPR can be difficult. luckily The intruder simplifies the process by helping you address the key vulnerability management criteria these frameworks require, making your compliance much smoother. Read on to understand how to meet each framework’s requirements to keep customer data secure. How Intruder supports your compliance goals Intruder’s continuous vulnerability scanning and automated reporting help you meet the security requirements of various frameworks, including SOC 2, ISO 27001, HIPAA, Cyber Essentials and GDPR. Here are three main ways to support Intruder: 1. Easy…
October 30, 2024Ravi LakshmananCybercrime / Cryptocurrency Cybersecurity researchers have discovered a new malicious Python package that masquerades as a cryptocurrency trading tool, but contains functionality designed to steal sensitive data and siphon assets from victims’ crypto wallets. A package called “CryptoAITools” is said to have been distributed through both the Python Package Index (PyPI) and fake GitHub repositories. It was downloaded over 1300 times before being taken down by PyPI. “The malware activated automatically upon installation and targeted both Windows and macOS operating systems,” according to a new Checkmarks report published on The Hacker News. “A deceptive graphical user interface…
October 29, 2024Ravi LakshmananCybercrime / Malware The Dutch National Police, together with international partners, announced a failure in the infrastructure that fed two information thieves, who were tracked down as RedLine and MetaStealer. The takedown, which took place on October 28, 2024, is the result of an international law enforcement task force codenamed Operation Magnus with the participation of the authorities of the USA, Great Britain, Belgium, Portugal and Australia. Eurojust, in a statement published today, said the operation resulted in the shutdown of three servers in the Netherlands and the seizure of two domains. In total, more than 1,200…
October 29, 2024Ravi LakshmananAI Security / Vulnerability Just over three dozen security vulnerabilities have been discovered in various open source artificial intelligence (AI) and machine learning (ML) models, some of which could lead to remote code execution and information theft. Weaknesses identified in tools such as ChuanhuChatGPT, Lunary and LocalAI have been fixed reported as part of Protect AI’s Huntr bug bounty platform. The most serious of the flaws are two flaws affecting Lunary, a toolkit for producing large language models (LLM) – CVE-2024-7474 (CVSS Score: 9.1) – An insecure direct object reference (IDOR) vulnerability that could allow an authenticated…
Sherlock Holmes is famous for his incredible ability to sift through piles of information; it removes the irrelevant and exposes the hidden truth. His philosophy is simple but brilliant: “When you eliminate the impossible, whatever remains, no matter how improbable, must be true.” Instead of following every clue, Holmes focuses on the details that are needed to lead him to a solution. In the field of cybersecurity, vulnerability scanning reflects Holmes’s approach: Security teams are typically presented with a huge list of vulnerabilities, but not every vulnerability represents a real threat. Just as Holmes discards irrelevant clues, security teams must…
Tor users are de-anonymized by law enforcement The German police have successfully deanonymized at least four Tor users. It turns out that they monitor known Tor relays and known suspects, and use time analysis to figure out who is using which relay. Tor has is written about this. Hacker news thread. tags: deanonymization, law enforcement agencies, Tor Posted on October 29, 2024 at 7:02 am • 0 comments Bruce Schneier sidebar photo by Joe McInnis. Source link
October 29, 2024Ravi LakshmananDigital Security / Data Privacy The United States Government (USG) has issued new guidelines governing the use of the traffic light protocol (TLP) to process threat intelligence shared between the private sector, individual researchers, and federal departments and agencies. “U.S. General Management maintains a TLP label on cybersecurity information voluntarily shared by individuals, companies, or other organizations unless it is inconsistent with existing law or policy,” it said. said. “We adhere to this label because trust in data processing is a key component of cooperation with our partners.” In using these designations, the idea is to promote…
October 29, 2024Ravi LakshmananHardware Security / Vulnerability More than six years later Specter security issue impact on today’s CPU processors has been revealed, a new study has shown that the latest AMD and Intel processors are still susceptible to speculative execution attacks. attack opened by ETH Zürich researchers Johannes Wikner and Kave Razavi aims to break down the barrier of an indirect predictor of industries (IBPB) on x86 chips, an important countermeasure against speculative execution attacks. Speculative performance refers to a performance optimization feature however, modern processors execute certain instructions out of order, predicting program branching in advance, thus speeding…