Trivial authentication bypass in libssh leaves servers wide open | Ars Technica: "A search on Shodan showed 6,351 sites using libssh, but knowing how meaningful the results are is challenging. For one thing, the search probably isn’t exhaustive. And for another, as is the case with GitHub, the use of libssh doesn’t automatically make a site vulnerable."

Labels: security is hard

'Synthetic Click' attack re-emerges in macOS High Sierra at Defcon: "A vulnerability has been discovered in macOS that could allow an attacker to impersonate a mouse click, enabling for it to bypass security prompts and completely compromise a Mac, a flaw that was found by accident. "

Labels: security fail, security is hard

Google launches “Shielded VMs” to protect cloud servers from rootkits, data theft | Ars Technica: "Both Microsoft and Google have launched confidential computing technologies; Microsoft's Azure Confidential Compute was announced last September, and Google's Asylo framework was launched in beta in May. These platforms run application containers in "trusted execution environments"—enclaves that prevent access to the data within those instances from being read by anything running on the underlying operating system or virtual environment."

Labels: 1984, security is hard, security policy

Smartphone app that allows credit card skimming ‘real risk’ to consumers: experts - National | Globalnews.ca: "A smartphone app, which allows the user to read credit card information through wallets and purses, is cause for concern amongst consumers that carry credit cards with radio-frequency identification (RFID) technology, according to experts.

The free app, available on the Samsung Galaxy S3 through the Google Play store, allows the phone to read the RFID chip on a credit card, picking up the cardholder’s name, credit card number and expiry date, according to a CBC investigation."

Labels: security is hard

YubiKey NEO's physical NFC key can now unlock apps on iPhone 7 & later: "Taking advantage of the more open NFC access on iPhones made possible with iOS 11, Yubico has announced that its physical YubiKey NEO authentication key can now be used to unlock compatible iOS apps. "

Labels: authentication, ludicrous speed, security is hard

Intel promises fix for new 'Variant 4' Meltdown, Spectre vulnerability: "Industry woes over Meltdown and Spectre continued this week when Google and Microsoft on Monday revealed a newly discovered silicon-level vulnerability impacting chips used in millions of computers, including those marketed by Apple. "

Labels: security fail, security flaw, security is hard, software fail

Every major OS maker misread Intel's docs. Now their kernels can be hijacked or crashed • The Register: "Every major OS maker misread Intel's docs. Now their kernels can be hijacked or crashed"

Labels: security flaw, security is hard

Drive-by Rowhammer attack uses GPU to compromise an Android phone | Ars Technica: "Over the past few years, there has been a steady evolution in Rowhammer, the once largely theoretical attack that exploits physical defects in memory chips to tamper with the security of the devices they run on. On Thursday, researchers are unveiling the most practical demonstration yet of Rowhammer's power and reach: an exploit that remotely executes malicious code on Android phones by harnessing their graphical processors."

Labels: security flaw, security is hard

Found: New Android malware with never-before-seen spying capabilities | Ars Technica: "Now, in a discovery that underscores the growing arms race among competing malware developers, researchers have uncovered a new Android spying platform that includes location-based audio recording and other features that have never been seen in the wild before."

Labels: security is hard

Guilty: NSA bloke who took home exploits at the heart of Kaspersky antivirus slurp row • The Register: "Kaspersky Lab has denied any wrongdoing in the matter or illicit ties to Russian intelligence. The security vendor also pointed out Pho's machine was infected with loads of malware, meaning any miscreant could have stolen Uncle Sam's cyber-weapons."

Labels: security flaw, security is hard

Israeli spies 'watched Russian agents breach Kaspersky software' - BBC News: "Israeli spies looked on as Russian hackers breached Kaspersky cyber-security software two years ago, US media report. The Russians were allegedly attempting to gather data on US intelligence programs, according to the New York Times and Washington Post."

Labels: security is hard

Deloitte is a sitting duck: Key systems with RDP open, VPN and proxy 'login details leaked' • The Register: "In addition, it appears that a Deloitte employee uploaded company proxy login credentials to his public Google+ page. The information was up there for over six months – and was removed in the past few minutes."

Labels: security fail, security is hard

macOS's Keychain vulnerability reported earlier in Sept., Apple patch likely coming soon: "The Keychain password vulnerability affecting multiple versions of macOS —including High Sierra —was reported to Apple on Sept. 7, and will likely be patched by the company in the near future, according to the security researcher who first publicized the issue. "

Labels: security is hard

Rowhammer RAM attack adapted to hit flash storage • The Register: "It's Rowhammer, Jim, but not as we know it: IBM boffins have taken the DRAM-bit-flipping-as-attack-vector trick found by Google and applied it to MLC NAND Flash."

Labels: security flaw, security is hard

Google refuses comment on 'aggressive deployment' of Android spyware app in Play store: "Google has taken action to curb the spread of Android malware based on "SonicSpy" that besides just exfiltrating personal data from the phone, had the ability to silently record audio, take photos with the camera, make calls, and send text messages."

Labels: security is hard

Firmware update blunder bricks hundreds of home 'smart' locks • The Register

Labels: security fail, security is hard

Banking trojan executes when targets hover over link in PowerPoint doc | Ars Technica

Labels: security flaw, security is hard

You’ll never guess where Russian spies are hiding their control servers | Ars Technica: "A Russian-speaking hacking group that, for years, has targeted governments around the world is experimenting with a clever new method that uses social media sites to conceal espionage malware once it infects a network of interest."

Labels: security is hard

Android execs get technical talking updates, Project Treble, Linux, and more | Ars Technica: "Part of it is that we can see the scale, we kind of knew we were going to hit 2 billion users this year. Conveniently, we hit it before I/O. You start thinking about the scale of it, the impact of the product, and—it sounds grandiose, but—the responsibility you have to make sure it's good. For the release this year, rather than, "What are we releasing to make a phone good in 2017?," it was more like "What are we doing to Android to make sure Android is in a great place in the next 5 to 10 years?""

Labels: security is hard

Russian RATs bite Handbrake OSX download mirror • The Register: "“Anyone who has installed HandBrake for Mac needs to verify their system is not infected with a Trojan. You have 50/50 chance if you've downloaded HandBrake during this period,” the note states. Windows users aren't affected."

Labels: security exploit, security is hard