> TODAY'S SUMMARY (4 articles)
In recent cybersecurity news, a significant data breach at La Poste subsidiary Maileva has affected 22 million individuals in France, exposing sensitive personal information. Additionally, a secret stealer malware targeting GitHub repositories was reported, highlighting the ongoing risks in software development environments. The compromise of the Claude Code extension was linked to a stolen access key from the Fireworks AI platform, illustrating the dangers of credential exposure. Overall, attackers are shifting focus beyond traditional vulnerabilities, increasingly targeting user credentials and access keys to exploit software and services. This trend emphasizes the need for enhanced security measures and awareness in both corporate and individual contexts.
|
// AI-powered summary generated at 12:00
Using a pic of the cartoon character SpongeBob SquarePants, a researcher figures out an approach to bypass Windows Hello facial-recognition security
CISA head wants to encourage public–private operational collaboration and information sharing with new initiatives
Summary The NPU device’s kernel driver implements a set of ioctl handlers one of which uses unsanitized user data as an index into a function pointer array. The user provided values can exceed the boundaries of the legitimate array and might cause user controlled values to be called as function poin...
While the internet itself might not actually be a series of tubes, hospitals that connect to the internet do use pneumatic tubes that could potentially be at risk
Joint Cyber Defense Collaborative will see US government working with tech’s key players
Summary The NPU device’s kernel driver implements a custom mmap handler that exposes trusted kernel data to user space. These exposed structures contain sensitive data, including kernel pointers, which can be controlled by a user process. The content of these structures is inherently trusted by the...
Illy speaks out after enduring almost two years of “malicious abuse” from cyber-stalker
Cyber-criminals target Americans in receipt of unemployment insurance benefits
Summary Due to a bug in the way mappings are closed it is possible to free a kmallocated memory chunk arbitrary times. This vulnerability can be used to craft a use after free scenario against any kernel structure that is allocated from the kmalloc-64 cache. There is rich public literature on how su...
Research by CSET reveals worrying potential for GPT-3 to spread disinformation
Users of popular underground forums are finding ways to bend the rules
Summary The NPU device’s kernel driver implements a set of ioctl handlers one of which uses unsanitized user data as an offset to retrieve a kernel structure. Fields of the structure are written with user provided values. A malicious actor can use this vulnerability to overwrite kernel memory with c...
Tenable discovery highlights continued software supply chain risk
US bears the brunt of most malicious activity in H1 2021, says Accenture
Summary In a previous advisory we disclosed multiple vulnerabilities within the NPU device’s mmap handler and discussed how it exposes sensitive kernel data. This advisory focuses on the implementation errors in the same handler. The mapping function ignores the requested size parameter and fails to...
IBM X-Force researchers claim that Iranian nation-state attacker continues to be successful using the same tactics, year after year
With the volume of security advisories set to grow, it's important to know what assets are not at risk from vulnerability
Samsung’s neural processing framework has received a lot of attention from the security community since its introduction. Hardware isolation vulnerabilities have been demonstrated, both on the NPU and DSP cores (1, 2), that could be used to compromise the kernel. The surrounding kernel code was also...
While Apple pays well, researchers at Black Hat argue there is a clear lack of transparency on when, or even if, reported vulnerabilities will be fixed
With lights and beds controlled by Wi-Fi, what could go wrong? Apparently, a lot.