FreshRSS

🔒
△ 🔃
☐ ☆ ✇ The Hacker News

New Terrapin Flaw Could Let Attackers Downgrade SSH Protocol Security

By Newsroom — January 1st 2024 at 09:37
Security researchers from Ruhr University Bochum have discovered a vulnerability in the Secure Shell (SSH) cryptographic network protocol that could allow an attacker to downgrade the connection's security by breaking the integrity of the secure channel. Called Terrapin (CVE-2023-48795, CVSS score: 5.9), the exploit has been described as the "first ever practically exploitable prefix
☐ ☆ ✇ The Hacker News

New OpenSSH Vulnerability Exposes Linux Systems to Remote Command Injection

By THN — July 24th 2023 at 09:10
Details have emerged about a now-patched flaw in OpenSSH that could be potentially exploited to run arbitrary commands remotely on compromised hosts under specific conditions. "This vulnerability allows a remote attacker to potentially execute arbitrary commands on vulnerable OpenSSH's forwarded ssh-agent," Saeed Abbasi, manager of vulnerability research at Qualys, said in an analysis last week.
☐ ☆ ✇ The Hacker News

New Cryptocurrency Mining Campaign Targets Linux Systems and IoT Devices

By Ravie Lakshmanan — June 23rd 2023 at 07:30
Internet-facing Linux systems and Internet of Things (IoT) devices are being targeted as part of a new campaign designed to illicitly mine cryptocurrency. "The threat actors behind the attack use a backdoor that deploys a wide array of tools and components such as rootkits and an IRC bot to steal device resources for mining operations," Microsoft threat intelligence researcher Rotem Sde-Or said.
☐ ☆ ✇ The Hacker News

Notorious Cyber Gang FIN7 Returns With Cl0p Ransomware in New Wave of Attacks

By Ravie Lakshmanan — May 20th 2023 at 06:49
The notorious cybercrime group known as FIN7 has been observed deploying Cl0p (aka Clop) ransomware, marking the threat actor's first ransomware campaign since late 2021. Microsoft, which detected the activity in April 2023, is tracking the financially motivated actor under its new taxonomy Sangria Tempest. "In these recent attacks, Sangria Tempest uses the PowerShell script POWERTRASH to load
☐ ☆ ✇ Naked Security

S3 Ep121: Can you get hacked and then prosecuted for it? [Audio + Text]

By Paul Ducklin — February 9th 2023 at 19:41
Latest epsiode. Listen now!

☐ ☆ ✇ The Hacker News

OpenSSH Releases Patch for New Pre-Auth Double Free Vulnerability

By Ravie Lakshmanan — February 6th 2023 at 09:55
The maintainers of OpenSSH have released OpenSSH 9.2 to address a number of security bugs, including a memory safety vulnerability in the OpenSSH server (sshd). Tracked as CVE-2023-25136, the shortcoming has been classified as a pre-authentication double free vulnerability that was introduced in version 9.1. "This is not believed to be exploitable, and it occurs in the unprivileged pre-auth
☐ ☆ ✇ Naked Security

OpenSSH fixes double-free memory bug that’s pokable over the network

By Paul Ducklin — February 3rd 2023 at 17:59
It's a bug fix for a bug fix. A memory leak was turned into a double-free that has now been turned into correct code...

☐ ☆ ✇ Naked Security

OpenSSH goes Post-Quantum, switches to qubit-busting crypto by default

By Paul Ducklin — April 11th 2022 at 16:58
Useful quantum computers might not actually be possible. But what if they are? And what if they arrive, say, tomorrow?

cat-1200

❌