Cyber Security, InfoSec and Privacy

Interesting articles to show the technology involved in hacking and the ethics of individual privacy in a digital age

By Tom Falk

Technology
Unpatchable security flaw found in popular SoC boards
ZDNet - Catalin Cimpanu
Xilinx Zynq UltraScale+ SoCs are normally used in automotive, aviation, consumer electronics, industrial, and military components. Security …
Technology
Backdoor found in Webmin, a popular web-based utility for managing Unix servers
ZDNet - Catalin Cimpanu
Backdoored Webmin versions were available for download for more than a year through the official site. A backdoor mechanism was found in Webmin, a …
VLC Media Player 3.0.8 Released with 13 Security Fixes
bleepingcomputer.com - Lawrence Abrams
VideoLan has released VLC Media Player 3.0.8 and it is now available for Windows, Mac, and Linux. This release fixed 13 security vulnerabilities as …
Equifax
61 impacted versions of Apache Struts left off security advisories
sophos.com - Lisa Vaas
Security researchers have reviewed security advisories for Apache Struts and found that two dozen of them inaccurately listed affected versions for …
Technology
Degrading Tor network performance only costs a few thousand dollars per month
ZDNet - Catalin Cimpanu
Attackers can flood Tor's bridges with just $17k/month, Tor's load balancers for only $2.8k/month, academics say. Threat actors or nation-states …
Facial Recognition
Manchester City warned against using facial recognition on fans
The Guardian - Maya Wolfe-Robinson
Manchester City have been cautioned against the introduction of facial recognition technology, which a civil rights group says would risk “normalising a mass surveillance tool”. The reigning Premier League
Ip Address
If it has an IP address, it's a vulnerability - Video | ZDNet
ZDNet
Justin Fier, director of threat intel and analysis at Darktrace, talks with Tonya Hall about cyber threats -- what they are, what devices they come …
APIs
Webmin 0day remote code execution
firosolutions.com - Firo Solutions LTD
A zero day has been released for the system administrator tool webmin Today’s exploit of the day is one affecting the popular system administrator …
Facial Recognition
‘It's techno-racism’: Detroit is quietly using facial recognition to make arrests
Guardian US - Tom Perkins in Detroit
For the last two years, Detroit police have been quietly utilizing controversial and unreliable facial recognition technology to make arrests in the city. The news, revealed in May in a Georgetown University
Windows 10
A look at the Windows 10 exploit Google Zero disclosed this week
Ars Technica - Jim Salter
This privilege escalation vulnerability has lurked within Windows for 20 years. On Tuesday, Tavis Ormandy of Google's Project Zero released an exploit …
Spearphishing
Top tip: Don't upload your confidential biz files to free malware-scanning websites – everything is public
theregister.co.uk - Shaun Nichols
Companies are inadvertently leaving confidential files on the internet for anyone to download – after uploading the documents to malware-scanning …
Technology
People Are Becoming More Reluctant To Share Personal Data, Survey Reveals
Forbes - Marty Swant
A new report suggests Americans are increasingly less likely to share their data with companies—perhaps a sign that marketers should focus not just on regulatory compliance but also on explaining how why
Kaspersky Lab
Kaspersky Antivirus Software Exposed Millions to Web Tracking
Tom's Guide - Paul Wagenseil
Kaspersky antivirus software let websites track users for years, a German journalist revealed today (Aug. 15). Ronald Eikenberg of c't magazine …
Technology
A new clothing line confuses automated license plate readers
MIT Technology Review - Charlotte Jee
Garments from Adversarial Fashion feed junk data into surveillance cameras, in an effort to make their databases less effective. The news: Hacker and …
U.S. Politics
Trump Administration Asks Congress to Reauthorize N.S.A.’s Deactivated Call Records Program
The New York Times
XSS
Serious flaws in six printer brands discovered, fixed
sophos.com - Danny Bradbury
There are many ways to compromise company data, but IT teams often overlook one of the most serious: the humble printer. It sits in the corner, …
Huawei
Huawei employees caught intercepting messages to spy for African government
androidcentral.com - Joe Maring
• Some Huawei employees were caught intercepting messages for the African government. • The messages were used to spy on political opponents in Uganda and …
Amazon Web Services
Amazon’s Creepy Surveillance Tech Can Now Detect Fear
Vanity Fair - Eric Lutz
Rekognition’s new feature is already being criticized by privacy experts. Amazon Web Services announced this week that it has made “improvements” to its Rekognition facial analysis software, including
Internet of Things
Weak consumer IoT security threatens enterprise systems
VentureBeat - Martine Paris
What’s keeping Stanford professor Zakir Durumeric up at night? It’s the risk that your smart appliances, connected TV, Wi-Fi printer, and ISP-provided router are being co-opted by diabolical botnets seeking
Data Breaches
New Data Breach Has Exposed Millions Of Fingerprint And Facial Recognition Records: Report
Forbes
It has been coming for some time, but now the major breach of a biometric database has actually been reported—facial recognition records, fingerprints, log data and personal information has all been found
8 New HTTP/2 Implementation Flaws Expose Websites to DoS Attacks
thehackernews.com - Mohit Kumar
Various implementations of HTTP/2, the latest version of the HTTP network protocol, have been found vulnerable to multiple security vulnerabilities …
WhatsApp
The ultimate guide to WhatsApp’s powerful privacy options
Fast Company - Michael Grothaus
WhatsApp encrypts your chats, and that’s great. But for true privacy, you need to tweak the app to keep Facebook, stalkers—and even friends—from snooping. WhatsApp is the most popular messaging app in
Bluetooth
New Bluetooth KNOB Flaw Lets Attackers Manipulate Traffic
bleepingcomputer.com - Lawrence Abrams
A new Bluetooth vulnerability named "KNOB" has been disclosed that allow attackers to more easily brute force the encryption key used during pairing …
Microsoft Edge
Microsoft August 2019 Patch Tuesday fixes 93 security bugs
ZDNet - Catalin Cimpanu
Of the 93 vulnerabilities Microsoft patched today, 29 are rated Critical and 64 are rated Important in severity. On the second Tuesday of the month -- …
Steam vulnerability reportedly exposes Windows gamers to system hijacking
ZDNet - Charlie Osborne
The researcher was asked not to disclose the bug but did so anyway. How the latest gaming AI beat world champions of poker The Steam gaming platform …
Facebook Messenger
Facebook paid contractors to transcribe Messenger calls
CNET - by Corinne Reichert
The social network says it halted the process last week.
Google Discloses 20-Year-Old Unpatched Flaw Affecting All Versions of Windows
thehackernews.com - Swati Khandelwal
A Google security researcher has just disclosed details of a 20-year-old unpatched high-severity vulnerability affecting all versions of Microsoft …
Kubernetes
PSA: Update your Azure Kubernetes Service (AKS) service principal’s password
medium.com - Damien Retzinger
I had just stepped out for dinner when my phone started buzzing like mad: Incident Opened, Error percentage (More than none), Error percentage > 0% …