Archive for the ‘Security’ Category

System76 will disable Intel Management engine on its Linux laptops via firmware update

System76 is one a handful of companies that sells computers that run Linux software out of the box. But like most PCs that have shipped with Intel’s Core processors in the past few years, System76 laptops include Intel’s Management Engine firmware. Intel recently confirmed a major security vulnerability affecting those chips and it’s working with […]

66 Percent of Popular Android Cryptocurrency Apps Don’t Use Encryption

High-Tech Bridge used its free mobile app analysis software, called Mobile X-Ray, to peek under the hood of the top 30 cryptocurrency apps in the Google Play store at three different popularity levels: apps with up to 100,000 downloads, up to 500,000 downloads, and apps with more than 500,000 downloads. So, a total of 90 […]

Former DHS employee had 246000 DHS employee records at home to sell. DHS waits 3 months(!) to notify employees.

The sensitive personal information of 246,000 Department of Homeland Security employees was found on the home computer server of a DHS employee in May, according to documents obtained by USA TODAY. Also discovered on the server was a copy of 159,000 case files from the inspector general’s investigative case management system, which suspects in an […]

As Apple fixes macOS root password hole, here’s what went wrong (note: get patching!)

The patch addresses a flaw in its operating system that allows anyone sitting at a Mac to gain administrator access by entering “root” as the username and leaving the password box blank in authentication prompts. This works when altering system settings, logging into the machine, and accessing it remotely via VNC, RDP, screen sharing, and […]

Using heart size by scanning using doppler radar as a biometric

Forget fingerprint computer identification or retinal scanning. A University at Buffalo-led team has developed a computer security system using the dimensions of your heart as your identifier. The system uses low-level Doppler radar to measure your heart, and then continually monitors your heart to make sure no one else has stepped in to run your […]

Imgur: 1.7m accounts breached in 2014

On November 23, Imgur was notified of a potential security breach that occurred in 2014 that affected the email addresses and passwords of 1.7 million user accounts. Imgur

Intel: We’ve found severe bugs in secretive unpatchable Management Engine, affecting millions

Thanks to an investigation by third-party researchers into Intel’s hidden firmware in certain chips, Intel decided to audit its firmware and on Monday confirmed it had found 11 severe bugs that affect millions of computers and servers. The flaws affect Management Engine (ME), Trusted Execution Engine (TXE), and Server Platform Services (SPS). Intel discovered the […]

Loakes shoes hacked, fluffs the explanation

This is more than a little embarrassing for a business that supplies handmade leather goods to the British royal family. Founded in 1880 by brothers Thomas, John and William Loake, the firm has since sold more than 50 million pairs of Goodyear welted shoes in more than 50 countries. […] Loake strangely described described the […]

Bluetooth Hack Affects 20 Million Amazon Echo and Google Home Devices

A series of recently disclosed critical Bluetooth flaws that affect billions of Android, iOS, Windows and Linux devices have now been discovered in millions of AI-based voice-activated personal assistants, including Google Home and Amazon Echo.As estimated during the discovery of this devastating threat, several IoT and smart devices whose operating systems are often updated less […]

Intel’s super-secret Management Engine firmware breached via USB

Getting into and hijacking the Management Engine means you can take full control of a box, underneath and out of sight of whatever OS, hypervisor or antivirus is installed. This powerful God-mode technology is barely documented and supposedly locked down to prevent miscreants from hijacking and exploiting the engine to silently spy on users or […]

LavaRand in Production: The Nitty-Gritty Technical Details or How Cloudflare uses a wall of lava lamps to protect the internet

There’s a wall of lava lamps in the lobby of our San Francisco office. We use it for cryptography. Here are the nitty-gritty technical details. […] In cryptography, the term random means unpredictable. That is, a process for generating random bits is secure if an attacker is unable to predict the next bit with greater […]

Linux Has a USB Driver Security Problem. 79 of them. Fortunately, they require physical access.

“All of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine,” Konovalov said. Konovalov has found a total of 79 Linux USB-related bugsThe 14 flaws are actually part of a larger list of 79 flaws Konovalov found in Linux kernel USB drivers during the […]

Signed Malware: using digital certificates to circumvent malware checks

Digitally signed malware can bypass system protection mechanisms that install or launch only programs with valid signatures. It can also evade anti-virus programs, which often forego scanning signed binaries. Known from advanced threats such as Stuxnet and Flame, this type of abuse has not been measured systematically in the broader malware landscape. In particular, the […]

Millions of South Africans’ personal information may have been leaked online

The personal information of more than 30 million South Africans has apparently been leaked online. This is according to Australian security researcher and creator of ‘Have I Been Pwned’, Troy Hunt. His website allows people to check if their personal information has been compromised in a data breach.He took to Twitter on Tuesday to say […]

Virtually everyone in Malaysia pwned in telco, govt data hack spree

Information on 46.2 million cellphone accounts was slurped from Malaysians telecoms providers. To put that in context, the population of Malaysia is 31.2 million; obviously, some people have more than one number.The stolen telco records include people’s mobile phone numbers, SIM card details, device serial numbers, and home addresses, all of which are useful to […]

Mozilla Wants to Distrust Dutch HTTPS Provider Because of Local Dystopian Law (Sleepnetwet)

If the plan is approved, Firefox will not trust certificates issued by the Staat der Nederlanden (State of the Netherlands) Certificate  Authority (CA). This CA is operated by PKIOverheid/Logius, a division of the Ministry of Interior and Kingdom Relations, which is the same ministry that oversees the AIVD intelligence service. New law givers Dutch govt […]

IBM broke its cloud by letting three domain names expire

Back in September, IBM was left red-faced when its global load balancer and reverse DNS services fell over for 21 hours.At the time, IBM blamed the outage on a third-party domain name registrar that was transferring some domains to another registrar. The sending registrar, IBM said, accidentally put the domains in a “hold state” that […]

Purism Librem Laptops Completely Disable Intel’s Management Engine

The Management Engine (ME), part of Intel AMT, is a separate CPU that can run and control a computer even when powered off. The ME has been the bane of the security market since 2008 on all Intel based CPUs, with publicly released exploits against it, is now disabled by default on all Purism Librem […]

Uber’s iOS App was given Secret Permissions by Apple That Allowed It to Record Your Phone Screen

To improve functionality between Uber’s app and the Apple Watch, Apple allowed Uber to use a powerful tool that could record a user’s iPhone screen, even if Uber’s app was only running in the background, security researchers told Gizmodo. After the researchers discovered the tool, Uber said it is no longer in use and will […]

Equifax operates site to access salary and employer history using an SSN + DoB (which you can find in the Equifax dump)

Incredibly, this same division makes it simple to access detailed salary and employment history on a large portion of Americans using little more than someone’s Social Security number and date of birth — both data elements that were stolen in the recent breach at Equifax. At issue is a service provided by Equifax’s TALX division […]

T-Mobile Website Allowed Hackers to Access Your Account Data With Just Your Phone Number

Until last week, a bug on a T-Mobile website let hackers access personal data such as email address, a customer’s T-Mobile account number, and the phone’s IMSI, a standardized unique number that identifies subscribers. On Friday, a day after Motherboard asked T-Mobile about the issue, the company fixed the bug. The flaw, which was discovered […]

Secret F-35, P-8, C-130 data stolen in Australian defence contractor hack | why it’s a great idea to entrust personal data to governments (not)

In November 2016, the Australian Signals Directorate (ASD) was alerted by a “partner organisation” that an attacker had gained access to the network of a 50-person aerospace engineering firm that subcontracts to the Department of Defence. Restricted technical information on the F-35 Joint Strike Fighter, the P-8 Poseidon maritime patrol aircraft, the C-130 transport aircraft, […]

Equifax, TransUnion and 1000 other sites serving malware due to fireclick.js / 3rd party script

Equifax’s website is once again infected, this time with malvertising. Further investigation reveals TransUnion was also targeted. Source: Malvertising on Equifax, TransUnion tied to third party script Equifax, TransUnion Websites Served Up Adware, Malware

Disqus discovers its comments tool was hacked in 2012. 17.5m accounts involved, 2/3rds without passwords.

Disqus has confirmed its web commenting system was hacked. The company, which builds and provides a web-based comment plugin for news websites, said Friday that hackers stole more than 17.5 million email addresses in a data breach in July 2012. About a third of those accounts contained passwords, salted and hashed using the weak SHA-1 […]

BLE is weak and can be used to map and hack sex toys, hearing aids. The rise of screwdriving

Using your favourite BLE sniffing hardware (we used a Bluefruit but an Ubertooth is just as great) you can visualise the BLE packets in Wireshark. In this case we can see the app has caused the Hush to start vibrating when the handle 0x000e has “Vibrate:5” written to it. We can also start to replay […]

 
Skip to toolbar