A panel of experts debate what needs to be done to combat the increasing growth and impact of ransomware
Reading isn't always good for you, as a hacker reveals that a malicious eBook could potentially lead to a very bad day for a victim
Summary The NPU device’s kernel driver implements a set of ioctl handlers one of which uses unsanitized user data as an index into a function pointer array. The user provided values can exceed the boundaries of the legitimate array and might cause user controlled values to be called as function poin...
Three Disney workers were among 17 suspects arrested in Florida’s Operation Child Protector
NSA analyst who leaked details of drone strikes carried out under Obama gets 45-month sentence
Summary The NPU device’s kernel driver implements a custom mmap handler that exposes trusted kernel data to user space. These exposed structures contain sensitive data, including kernel pointers, which can be controlled by a user process. The content of these structures is inherently trusted by the...
Flawed server exposes email addresses of more than 355,000 students and teaching staff
Apple's new features are designed to protect children from child abuse materials
Summary Due to a bug in the way mappings are closed it is possible to free a kmallocated memory chunk arbitrary times. This vulnerability can be used to craft a use after free scenario against any kernel structure that is allocated from the kmalloc-64 cache. There is rich public literature on how su...
Personal data of more than three million people were compromised by a misconfigured bucket
The Secretary of the U.S. Department of Homeland Security identifies the future of the internet as a challenge of two very different visions
Summary The NPU device’s kernel driver implements a set of ioctl handlers one of which uses unsanitized user data as an offset to retrieve a kernel structure. Fields of the structure are written with user provided values. A malicious actor can use this vulnerability to overwrite kernel memory with c...
DBREACH—Database Reconnaissance and Exfiltration via Adaptive Compression Heuristics—is a new theoretical attack that could one day be much more than theoretical
Using a pic of the cartoon character SpongeBob SquarePants, a researcher figures out an approach to bypass Windows Hello facial-recognition security
Summary In a previous advisory we disclosed multiple vulnerabilities within the NPU device’s mmap handler and discussed how it exposes sensitive kernel data. This advisory focuses on the implementation errors in the same handler. The mapping function ignores the requested size parameter and fails to...
CISA head wants to encourage public–private operational collaboration and information sharing with new initiatives
While the internet itself might not actually be a series of tubes, hospitals that connect to the internet do use pneumatic tubes that could potentially be at risk
Samsung’s neural processing framework has received a lot of attention from the security community since its introduction. Hardware isolation vulnerabilities have been demonstrated, both on the NPU and DSP cores (1, 2), that could be used to compromise the kernel. The surrounding kernel code was also...
Joint Cyber Defense Collaborative will see US government working with tech’s key players
Illy speaks out after enduring almost two years of “malicious abuse” from cyber-stalker