FreshRSS

πŸ”’
❌ About FreshRSS
There are new available articles, click to refresh the page.
Before yesterdaySecurity

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

CISA Warns of Atlassian Confluence Hard-Coded Credential Bug Exploited in Attacks

By Ravie Lakshmanan
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on FridayΒ addedΒ the recently disclosed Atlassian security flaw to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. The vulnerability, tracked asΒ CVE-2022-26138, concerns the use of hard-coded credentials when the Questions For Confluence app is enabled in Confluence Server and Data Center

Latest Critical Atlassian Confluence Vulnerability Under Active Exploitation

By Ravie Lakshmanan
A week after Atlassian rolled out patches to contain a critical flaw in its Questions For Confluence app for Confluence Server and Confluence Data Center, the shortcoming has now come under active exploitation in the wild. The bug in question isΒ CVE-2022-26138, which concerns the use of a hard-coded password in the app that could be exploited by a remote, unauthenticated attacker to gain

Microsoft Uncovers Austrian Company Exploiting Windows and Adobe Zero-Day Exploits

By Ravie Lakshmanan
A cyber mercenary that "ostensibly sells general security and information analysis services to commercial customers" used several Windows and Adobe zero-day exploits in limited and highly-targeted attacks against European and Central American entities. The company, which Microsoft describes as a private-sector offensive actor (PSOA), is an Austria-based outfit calledΒ DSIRFΒ that's linked to the

Critical Samba bug could let anyone become Domain Admin – patch now!

By Paul Ducklin
It's a serious bug... but there's a fix for it, so you know exactly what to do!

Taking the Risk-Based Approach to Vulnerability Patching

By The Hacker News
Software vulnerabilities are a major threat to organizations today. The cost of these threats is significant, both financially and in terms of reputation.Vulnerability management and patching can easily get out of hand when the number of vulnerabilities in your organization is in the hundreds of thousands of vulnerabilities and tracked in inefficient ways, such as using Excel spreadsheets or

Mild monthly security update from Firefox – but update anyway

By Paul Ducklin
You're probably thinking we're going to say, "Don't delay/Do it today"... and that's exactly what we are saying!

Microsoft Adds Default Protection Against RDP Brute-Force Attacks in Windows 11

By Ravie Lakshmanan
Microsoft is now taking steps to prevent Remote Desktop Protocol (RDP) brute-force attacks as part of the latest builds for the Windows 11 operating system in an attempt to raise theΒ security baselineΒ to meet the evolving threat landscape. To that end, the default policy for Windows 11 builds – particularly, Insider Preview builds 22528.1000 and newer – will automatically lock accounts for 10

SonicWall Issues Patch for Critical Bug Affecting its Analytics and GMS Products

By Ravie Lakshmanan
Network security company SonicWall on Friday rolled out fixes to mitigate a critical SQL injection (SQLi) vulnerability affecting its Analytics On-Prem and Global Management System (GMS) products. The vulnerability, tracked asΒ CVE-2022-22280, is rated 9.4 for severity on the CVSS scoring system and stems from what the company describes is an "improper neutralization of special elements" used in

Microsoft Details App Sandbox Escape Bug Impacting Apple iOS, iPadOS, macOS Devices

By Ravie Lakshmanan
Microsoft on Wednesday shed light on a now patched security vulnerability affecting Apple's operating systems that, if successfully exploited, could allow attackers to escalate device privileges and deploy malware. "An attacker could take advantage of this sandbox escape vulnerability to gain elevated privileges on the affected device or execute malicious commands like installing additional

Microsoft Releases Fix for Zero-Day Flaw in July 2022 Security Patch Rollout

By Ravie Lakshmanan
Microsoft released its monthly round of Patch Tuesday updates to addressΒ 84 new security flawsΒ spanning multiple product categories, counting a zero-day vulnerability that's under active attack in the wild. Of the 84 shortcomings, four are rated Critical, and 80 are rated Important in severity. Also separately resolved by the tech giant areΒ two other bugsΒ in the Chromium-based Edge browser, one

OpenSSL fixes two β€œone-liner” crypto bugs – what you need to know

By Paul Ducklin
"As bad as Heartbleed"? We heard that concern a week ago, but we think it's less ungood than that...

Firefox 102 fixes address bar spoofing security hole (and helps with Follina!)

By Paul Ducklin
Firefox squashes a bug that helped phishers, and brings its own helping hand to Microsoft's "Follina" saga.

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

You’re invited! Join us for a live walkthrough of the β€œFollina” story…

By Paul Ducklin
Live demo, plain English, no sales pitch, just a chance to watch an attack dissected in safety. Join us if you can!

Firefox 101 is out, this time with no 0-day scares (but update anyway!)

By Paul Ducklin
After an intriguing month of Firefox releases, here's one with a bit less drama, probably to the collective relief of Mozilla's coders.

Mysterious β€œFollina” zero-day hole in Office – here’s what to do!

By Paul Ducklin
News has emerged of a "feature" in Office that has been abused as a zero-day bug to run evil code. Turning off macros doesn't help!

How Secure Is Video Conferencing?

By McAfee

As millions of people around the world practice social distancing and work their office jobs from home, video conferencing has quickly become the new norm. Whether you’reΒ attending regular work meetings, partaking in a virtual happy hour with friends, or catching up with extended familyΒ across the globe, video conferencing is a convenientΒ alternativeΒ toΒ many of the activities we can no longer doΒ in real life. But asΒ the rapid adoption of video conferencing tools and apps occurs, is security falling by the wayside?

Avoid Virtual Party Crashers

OneΒ security vulnerability that has recently made headlines is the ability for uninvitedΒ attendeesΒ to bombardΒ users’ virtual meetings.Β How? According toΒ Forbes, many users have posted their meeting invite links on social media sites like Twitter.Β An attacker can simply click on one of these links and interrupt an important conference callΒ orΒ meeting with inappropriate content.Β Β 

Ensure Data is in the Right Hands

Online conferencing tools allow users to hold virtual meetings and share files via chat. But according toΒ Security Boulevard, communicating confidential business information quickly and privately can be challenging with these tools.Β For example, users are not always immediately available, evenΒ when working from home. In fact, many parents areΒ simultaneouslyΒ doubling asΒ working parents and teachers with the recent closure of schools and childcare providers.Β If a user needs to share private information with aΒ coworkerΒ but they are unable to connect by video or phone,Β they might revert to using a messaging platform that lacks end-to-end encryption,Β a feature thatΒ prevents third-party recipients from seeing private messages. This could lead to leaks or unintended sharingΒ of confidential data, whether personal or corporate.Β What’s more, the lack of using a secure messaging platform could present a hacker with an opportunity to breach a victim’s data or device.Β Depending on the severity of this type of breach, a victim could be at risk ofΒ identityΒ theft.Β Β 

Pay Attention to Privacy Policies

With theΒ recent surge of new video conferencing users, privacy policies have been placed under a microscope. According toΒ WIRED, some online conferencing tools have had to update their policies to reflect theΒ collection of user information and meeting contentΒ used for advertising or other marketing efforts. Another privacy concern was brought to lightΒ by a video conferencing tool’s attention-tracking feature. This alertsΒ the virtual meeting hostΒ when an attendee hasn’t had the meeting window in their device foreground for 30 seconds, resulting in users feeling that their privacy has been compromised.Β Β 

How to Secure Video Conferences

As users become accustomed to working from home, video conferencing tools will continue to becomeΒ aΒ necessaryΒ avenue for virtual communication.Β But how can users do so whileΒ putting their online security first? Follow these tips toΒ helpΒ ensure that yourΒ virtualΒ meetingsΒ are safeguarded:Β Β 

Do your research

There are plenty of video conferencing tools available online. Before downloading the first one you see, do your research and check for possible security vulnerabilities around the tools.Β Does the video conferencing tool you’re considering use end-to-end encryption?Β This ensures that only meeting participantsΒ have the ability toΒ decryptΒ secure meeting content.Β Additionally, be sure to read the privacy policies listed by the video conferencing programs to find the one that isΒ the most secure and fits your needs.Β Β 

Make your meetings password protected

To ensure that only invited attendeesΒ can accessΒ your meeting,Β make sure they are password protected. For maximum safety, activate passwords for new meetings, instant meetings, personal meetings, and people joining by phone.Β 

Block users from taking control of the screen

To keep users (either welcome or unwelcome) from taking control of your screen while you’re video conferencing, select the option to block everyone except the host (you) from screen sharing.Β Β 

Turn on automatic updates

By turning on automatic updates, you are guaranteed to have all the latest security patchesΒ and enhancementsΒ for your video conferencing tool as soon as they become available.Β Β 

The post How Secure Is Video Conferencing? appeared first on McAfee Blog.

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

Microsoft patches the Patch Tuesday patch that broke authentication

By Paul Ducklin
Remember the good old days when security patches rarely needed patches? Because security patches themlelves were rare enough anyway?

US Government says: Patch VMware right now, or get off our network

By Paul Ducklin
Find and patch. Right now. If you can't patch, get it off the network. Right now! Oh, and show us what you did to comply.

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

Apple patches zero-day kernel hole and much more – update now!

By Paul Ducklin
You'll find fixes for numerous kernel-level code execution holes, including an 0-day vulnerability in many (though not all) versions.

Serious Security: Learning from curl’s latest bug update

By Paul Ducklin
Learn how to write plain-speaking and purposeful security advisories from one of the most widely-used open source tools in the world.

RubyGems supply chain rip-and-replace bug fixed – check your logs!

By Paul Ducklin
Imagine if you could assume the identity of, say, Franklin Delano Roosevelt simply by showing up and calling yourself "Frank".

ruby-1200

You didn’t leave enough space between ROSE and AND, and AND and CROWN

By Paul Ducklin
What weird Google Docs bug connects the words THEREFORE, AND, SECONDLY, WHY, BUT and BESIDES?

Android monthly updates are out – critical bugs found in critical places!

By Paul Ducklin
Android May 2022 updates are out - with some critical fixes in some critical places. Learn more...

Firefox hits 100*, fixes bugs… but no new zero-days this month

By Paul Ducklin
Despite concerns that some websites might break when Chromium and then Firefox reached version 100, the web still seems to be intact.

QNAP warns of new bugs in its Network Attached Storage devices

By Paul Ducklin
Here's what you need to know - plus some sensible advice for all the devices on your home or small biz network!

nas-1200

Critical cryptographic Java security blunder patched – update now!

By Paul Ducklin
Either know the private key and use it scrupulously in your digital signature calculation.... or just send a bunch of zeros instead.

Beanstalk cryptocurrency heist: scammer votes himself all the money

By Paul Ducklin
Voting safeguards based on commuity collateral don't work if one person can use a momentary loan to "become" 75% of the community.

Yet another Chrome zero-day emergency update – patch now!

By Paul Ducklin
The third emergency Chrome 0-day in three months - the first one was exploited by North Korea, so you might as well get this one ASAP.

Hospital robot system gets five critical security holes patched

By Paul Ducklin
Fortunately, we're not talking about a robot revolution, or about hospital AI run amuck. But these bugs could lead to ransomware, or worse...

Popular Ruby Asciidoc toolkit patched against critical vuln – get the update now!

By Paul Ducklin
A rogue line-continuation character can trick the code into validating just the second half of the line, but executing all of it.

ruby-1200

Firefox 99 is out – no major bugs, but update anyway!

By Paul Ducklin
Firefox's four-weekly updates just dropped - here's what you need to know.

Apple pushes out two emergency 0-day updates – get ’em now!

By Paul Ducklin
More Apple zero-days - mobile devices, laptops and desktops affected. Update now!

apple-1200

❌