FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

Fortinet Warns of Critical FortiOS SSL VPN Flaw Likely Under Active Exploitation

By Newsroom
Fortinet has disclosed a new critical security flaw in FortiOS SSL VPN that it said is likely being exploited in the wild. The vulnerability, CVE-2024-21762 (CVSS score: 9.6), allows for the execution of arbitrary code and commands. "An out-of-bounds write vulnerability [CWE-787] in FortiOS may allow a remote unauthenticated attacker to execute arbitrary code or command via specially

OpenSSL Fixes Multiple New Security Flaws with Latest Update

By Ravie Lakshmanan
The OpenSSL Project has released fixes to address several security flaws, including a high-severity bug in the open source encryption toolkit that could potentially expose users to malicious attacks. Tracked as CVE-2023-0286, the issue relates to a case of type confusion that may permit an adversary to "read memory contents or enact a denial-of-service," the maintainers said in an advisory. The

OpenSSL fixes High Severity data-stealing bug – patch now!

By Paul Ducklin
7 memory mismanagements and a timing attack. We explain all the jargon bug terminology in plain English...

CISA Warns of Flaws in Siemens, GE Digital, and Contec Industrial Control Systems

By Ravie Lakshmanan
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published four Industrial Control Systems (ICS) advisories, calling out several security flaws affecting products from Siemens, GE Digital, and Contec. The most critical of the issues have been identified in Siemens SINEC INS that could lead to remote code execution via a path traversal flaw (CVE-2022-45092, CVSS score: 9.9)

Royal Ransomware Threat Takes Aim at U.S. Healthcare System

By Ravie Lakshmanan
The U.S. Department of Health and Human Services (HHS) has cautioned of ongoing Royal ransomware attacks targeting healthcare entities in the country. "While most of the known ransomware operators have performed Ransomware-as-a-Service, Royal appears to be a private group without any affiliates while maintaining financial motivation as their goal," the agency's Health Sector Cybersecurity

Dell, HP, and Lenovo Devices Found Using Outdated OpenSSL Versions

By Ravie Lakshmanan
An analysis of firmware images across devices from Dell, HP, and Lenovo has revealed the presence of outdated versions of the OpenSSL cryptographic library, underscoring a supply chain risk. EFI Development Kit, aka EDK, is an open source implementation of the Unified Extensible Firmware Interface (UEFI), which functions as an interface between the operating system and the firmware embedded in

“This Connection Is Not Private” – What it Means and How to Protect Your Privacy

By McAfee

Have you ever been browsing online and clicked a link or search result that took you to a site that triggers a “your connection is not private” or “your connection is not secure” error code? If you’re not too interested in that particular result, you may simply move on to another result option. But if you’re tempted to visit the site anyway, you should be sure you understand what the warning means, what the risks are, and how to bypass the error if you need to.   

What does “this connection is not private” mean?

A “your connection is not private” error means that your browser cannot determine with certainty that a website has safe encryption protocols in place to protect your device and data. You can bump into this error on any device connected to the internet — computer, smartphone, or tablet.  

So, what exactly is going on when you see the “this connection is not private” error?  

For starters, it’s important to know that seeing the error is just a warning, and it does not mean any of your private information is compromised. A “your connection is not private” error means the website you were trying to visit does not have an up-to-date SSL (secure sockets layer) security certificate. 

Website owners must maintain the licensing regularly to ensure the site encryption capabilities are up to date. If the website’s SSL certificate is outdated, it means the site owners have not kept their encryption licensing current, but it doesn’t necessarily mean they are up to no good. Even major websites like LinkedIn have had momentary lapses that would throw the error. LinkedIn mistakenly let their subdomain SSL certificates lapse.  

In late 2021, a significant provider of SSL certificates, Let’s Encrypt, went out of business. When their root domain officially lapsed, it created issues for many domain names and SSL certificates owned by legitimate companies. The privacy error created problems for unwitting businesses, as many of their website visitors were rightfully concerned about site security.  

While it does not always mean a website is unsafe to browse, it should not be ignored. A secure internet connection is critical to protecting yourself online. Many nefarious websites are dangerous to visit, and this SSL certificate error will protect you from walking into them unaware.   

SSL certification standards have helped make the web a safer place to transact. It helps ensure online activities like paying bills online, ordering products, connecting to online banking, or keeping your private email accounts safe and secure. Online security continues to improve with a new Transport Layer Security (TLS) standard, which promises to be the successor protocol to SSL. 

So be careful whenever visiting sites that trigger the “connection is not private” error, as those sites can potentially make your personal data less secure and make your devices vulnerable to viruses and malware.  

Note: The “your connection is not private” error is Google Chrome‘s phrasing. Microsoft Edge or Mozilla Firefox users will instead see a “your connection is not secure” error as the warning message.   

How to fix the “connection is not private” error

If you feel confident that a website or page is safe, despite the warning from your web browser, there are a few things you can do to troubleshoot the error.  

  • Refresh the page. In some cases, the error is just a momentary glitch. Try reloading the page to rule out a temporary error.  
  • Close browser and reopen. Closing and reopening your web browser might also help clear a temporary glitch.  
  • If you’re on public WiFi, think twice. Hackers often exploit public WiFi because their routers are usually not as secure or well-maintained for security. Some public WiFi networks may not have an SSL connection, or they may limit your access to websites. You can safely browse more securely in public spaces if you have an antivirus software or virtual private network (VPN) solution. 
  • Use “Incognito” mode. The most used browsers (Google Chrome browser, Mac‘s Safari, Mozilla Firefox, and Microsoft Edge) offer an “Incognito mode” that lets you browse without data collecting in your history or cache. Open the site in a new incognito window and see if the error still appears.  
  • Clear the cache on your browser. While cookies make browsing the web more convenient and personalized, they also can hold on to sensitive information. Hackers will take advantage of cached data to try and get passwords, purchase information, and anything else they can exploit. Clear browsing data before going to a site with the “connection is not secure” error to help limit available data for hackers.  
  • Check the computer’s date and time. If you frequently see the “connection is not private” error, you should check and ensure your computer has the accurate time and date. Your computer’s clock can sometimes have time and date stamp issues and get glitchy in multiple ways. If it’s incorrect, adjust the date and set the time to the correct settings.  
  • Check your antivirus software. If your antivirus software is sensitive, you may have to disable it momentarily to bypass the error. Antivirus software protects you, so you should be careful to remember to turn the software back on again after you’ve bypassed the error.  
  • Be sure your browsers and operating systems are up to date. You should always keep your critical software and the operating system fully updated. An outdated browser can start getting buggy and can increase the occurrence of this kind of error.  
  • Research the website. Do a quick search for the company of the website you wish to visit and make sure they are a legitimate business. You can search for reviews, Better Business Bureau ratings, or check for forums to see if others are having the same issue. Be sure you are spelling the website address correctly and that you have the correct URL for the site. Hackers can take advantage of misspellings or alternative URLs to try and snare users looking for trusted brands. 
  • If it’s not you, it’s them. If you’ve tried all the troubleshooting techniques above and you still see the error, the problem is likely coming from the site itself. If you’re willing to take your chances (after clearing your browser’s cache), you can click the option to “proceed to the domain,” though it is not recommended. You may have to choose “advanced settings” and click again to visit the site.   

Remember, you are taking your chances anytime you ignore an error. As we mentioned, you could leave yourself vulnerable to hackers after your passwords, personal information, and other risks.  

How to protect your privacy when browsing online

Your data and private information are valuable to hackers, so they will continue to find new ways to try and procure it. Here are some ways to protect yourself and your data when browsing online.  

  • Antivirus solutions are, hands down, your best line of protection against hacking. Solutions like McAfee+ Ultimate offer all the tools you need to secure your data and devices.  
  • Use strong passwords and two-factor authentication when available. 
  • Delete unused browser extensions (or phone apps) to reduce access. 
  • Always keep your operating system and browsers up-to-date. You can open system preferences and choose to update your system automatically. 
  • Use a secure VPN solution to shield your data when browsing. 
  • Use your favorite browser’s incognito mode to reduce the data connected to your devices. 
  • Remove any 3rd party apps from your social media accounts — especially if you’ve recently taken a Facebook quiz or similar (also, don’t take Facebook quizzes). 
  • Engage the highest privacy settings in each of your browsers. 
  • Always check the address bar for HTTPS before sharing credit cards or other sensitive data on a website. 
  • Share less personal and private information on social media.  

Discover how McAfee keeps you and your data safe from threats

As we continue to do more critical business online, we must also do our best to address the risks of the internet’s many conveniences.  

A comprehensive cybersecurity tool like McAfee+ Ultimate can help protect you from online scams, identity theft, and phishing attempts, and ensure you always have a secure connection. McAfee helps keep your sensitive information out of the hands of hackers and can help you keep your digital data footprints lighter with personal data cleanup.  

With McAfee’s experts on your side, you can enjoy everything the web offers with the confidence of total protection. 

The post “This Connection Is Not Private” – What it Means and How to Protect Your Privacy appeared first on McAfee Blog.

The OpenSSL security update story – how can you tell what needs fixing?

By Paul Ducklin
How to Hack! Finding OpenSSL library files and accurately identifying their version numbers...

ossl-code-1200

OpenSSL patches are out – CRITICAL bug downgraded to HIGH, but patch anyway!

By Paul Ducklin
That bated-breath OpenSSL update is out! It's no longer rated CRITICAL, but we advise you to patch ASAP anyway. Here's why...

OpenSSL Releases Patch for 2 New High-Severity Vulnerabilities

By Ravie Lakshmanan
The OpenSSL project has rolled out fixes to contain two high-severity flaws in its widely used cryptography library that could result in a denial-of-service (DoS) and remote code execution. The issues, tracked as CVE-2022-3602 and CVE-2022-3786, have been described as buffer overrun vulnerabilities that can be triggered during X.509 certificate verification by supplying a specially-crafted email

OpenSSL fixes two “one-liner” crypto bugs – what you need to know

By Paul Ducklin
"As bad as Heartbleed"? We heard that concern a week ago, but we think it's less ungood than that...

OpenSSL to Release Security Patch for Remote Memory Corruption Vulnerability

By Ravie Lakshmanan
The latest version of the OpenSSL library has been discovered as susceptible to a remote memory-corruption vulnerability on select systems. The issue has been identified in OpenSSL version 3.0.4, which was released on June 21, 2022, and impacts x64 systems with the AVX-512 instruction set. OpenSSL 1.1.1 as well as OpenSSL forks BoringSSL and LibreSSL are not affected. <!--adsense--> Security

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

❌