Ecuador’s Attempt to Resettle Edward Snowden

Read Time:21 Second

Someone hacked the Ecuadorian embassy in Moscow and found a document related to Ecuador’s 2013 efforts to bring Edward Snowden there. If you remember, Snowden was traveling from Hong Kong to somewhere when the US revoked his passport, stranding him in Russia. In the document, Ecuador asks Russia to provide Snowden with safe passage to come to Ecuador.

It’s hard to believe this all happened almost ten years ago.

Read More

grafana-8.5.6-1.fc37

Read Time:36 Second

FEDORA-2022-a054b2bc7a

Packages in this update:

grafana-8.5.6-1.fc37

Update description:

Automatic update for grafana-8.5.6-1.fc37.

Changelog

* Wed Jun 29 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 8.5.6-1
– update to 8.5.6 tagged upstream community sources, see CHANGELOG
– updated license to AGPLv3
– place commented sample config file in /etc/grafana/grafana.ini
– enable Go modules in build process
– adapt Node.js bundling to yarn v3 and Zero Install feature
* Sun Jun 19 2022 Robert-André Mauchin <zebob.m@gmail.com> – 7.5.15-3
– Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191,
CVE-2022-29526, CVE-2022-30629

Read More

A guide to teaching cybersecurity skills to special needs students

Read Time:3 Minute, 32 Second

This blog was written by an independent guest blogger.

Schools and colleges were the worst hit by cyberattacks during the global health crisis in 2020. According to a report by GCN, ransomware attacks alone affected over 1,680 schools, colleges, and universities in the US. Such attacks also targeted 44% of educational institutions across the world. Schools worldwide are back to normal sessions and for many learners, that means spending hours online studying, doing homework, and submitting assignments. 

While online learning guarantees convenience, flexibility, and affordability, it presents a major safety concern. Many teachers worry about securing schools as they transition to e-learning. Fortunately, there are plenty of useful guides for helping children stay safe online. The only downside is that these guides assume all young internet users possess the same skill levels. So, how do you teach online safety to children with learning disabilities? Keep reading to learn a few tips on how to teach students with special needs important cybersecurity skills.

Discourage sharing of important information

Online safety concerns for teachers and parents include cyberbullying, posting a lot of information, close interaction with strangers, and online scams. One of the best ways to improve student safety online is by discouraging sharing of important information via suspicious emails or links. Inform your students that any information they share online is public. 

Details students shouldn’t share on the internet include real names, phone numbers, home address, school name, and photos. Consider writing a do not share list and post it on your students’ computers. Having a visual list helps your students remember who they can talk to online and what to post. 

Teach proper use of devices and apps

Setting up limits on what content your students with special needs should access is an important step to keeping them safe from cybercriminals. To achieve the best outcome, teach students how to adjust device settings to enhance data privacy. It’s also wise to set up filters to filter search results and install virus protection software. 

Other important cybersecurity best practices for students include setting strong passwords and encrypting data on all Internet-enabled devices. Don’t forget to update malware software to ensure operating systems are up to date and advise students never to open links or attachments from strangers. Also, teach the proper use of password managers to prevent data breaches. Since password managers store login information in encrypted databases, students don’t need to write passwords in books where people can access them quickly. 

Embrace gamification

Students with learning disabilities like dyslexia, ADHD, and autism have unique learning needs. For instance, when teaching neurodivergent students online and in person, you need to use different approaches. Avoid a one-size-fits-all teaching technique because some students will understand better through visuals, others study well with the help of text-speech software, interactive whiteboards, and voice dictation apps. 

You can also improve your students’ cybersecurity skills through gamification. There are many reasons special needs students love online games to learn various things, including internet safety. Gamification designed for children with learning challenges is fun and provides engaging content. Examples of cybersecurity games for kids include Interland, Privacy Pirates, Cyber Defense Quiz, and Internet Safety Hangman. 

Discuss the risk of misinformation 

While cyberbullying and interacting too much with strangers are legitimate concerns, misinformation is the most worrying online threat for students with special needs. Children with speech and language challenges, processing, and behavioral challenges may have difficulty discerning facts from fiction posted online. Based on the information consumed online, some learners will argue that some facts are fake. For instance, your student might be adamant about the fact that people landing on the moon is fake after watching a conspiracy theory video online. As a teacher or parent, you can protect students from misinformation by sharing links to reputable websites where they can fact-check information. 

Protecting children from cyberattacks while learning online is a concern for many parents and teachers. To enhance online safety for learners with learning challenges, parents and teachers should discourage sharing of sensitive information. It’s also crucial to emphasize the importance of device and app settings, teach cybersecurity through gamification, and share reputable sources of information to avoid misinformation. 

Read More

How and why threat actors target Microsoft Active Directory

Read Time:36 Second

Microsoft Active Directory debuted 22 years ago. In computer age, that’s old technology. Threat actors like old technology because it often has legacy code or processes that are not secured to modern standards or organizations have not kept up with patches and recommended settings.

Derek Melber, chief technology and security strategist for Tenable, discussed Active Directory risks at this year’s RSA conference. Attackers target domains. If they see a device joined to Active Directory, they will continue with the attack. If they don’t see a domain-joined machine, they will go on to another workstation. Below are some examples of how attackers can exploit legacy Active Directory vulnerabilities

To read this article in full, please click here

Read More

Why more zero-day vulnerabilities are being found in the wild

Read Time:41 Second

The number of zero-days exploited in the wild has been high over the past year and a half, with different kinds of actors using them. These vulnerabilities, which are unknown to the software maker, are leveraged by both state-sponsored groups and ransomware gangs.

During the first half of this year, Google Project Zero counted almost 20 zero-days, most of which target products built by Microsoft, Apple and Google, with browsers and operating systems taking up large chunks. In addition, a critical remote code execution vulnerability was found in Atlassian’s Confluence Server, which continues to be exploited. But in 2021, the number of in-the-wild zero-days was even higher. Project Zero found 58 vulnerabilities, while Mandiant detected 80–more than double compared to 2020.

To read this article in full, please click here

Read More

php-laminas-diactoros2-2.11.1-1.fc36

Read Time:2 Minute, 2 Second

FEDORA-2022-6506ad6b68

Packages in this update:

php-laminas-diactoros2-2.11.1-1.fc36

Update description:

Release Notes for 2.11.1

This is a SECURITY release. All users are encouraged to upgrade immediately.

Added

This release adds features to allow filtering a ServerRequest as generated by LaminasDiactorosServerRequestFactory::fromGlobals() for the purposes of initialization. Examples include:

Adding a request identifier.
Using X-Forwarded-* headers to modify the URL to represent the original client request.

The features are based on a new interface, LaminasDiactororsServerRequestFilterFilterServerRequestInterface, which defines a single method:

public function __invoke(
PsrHttpMessageServerRequestInterface $request
): PsrHttpMessageServerRequestInterface

We provide two implementations, as follows:

LaminasDiactorosServerRequestFilterDoNotFilter will return the provided request verbatim.
LaminasDiactorosServerRequestFilterFilterUsingXForwardedHeaders has named constructors that allow you to define how and when X-Forwarded- headers are used to modify the URI instance associated with the request. These methods are:
* trustAny(): this method generates a filter instance that will trust all X-Forwarded-
headers from any source.
* trustReservedSubnets(array $trustedHeaders = ?): this method generates a filter instance that only modifies the URL if the IP address of the requesting server is from a reserved, private subnet (localhost; classes A, B, and C subnets; and IPv6 private and local-link subnets). By default, it will trust all X-Forwarded- headers from these sources, but you may specify a list to allow via the $trustedHeaders argument.
* trustProxies(array $proxyCIDRList, array $trustedHeaders = ?): this method will generate a filter instance that only modifies the URL if the requesting server matches an entry in the $proxyCIDRList. These entries may be IP addresses, or any IPv4 or IPv6 CIDR subnets. By default, it will trust all X-Forwarded-
headers from these sources, but you may specify a list to allow via the $trustedHeaders argument.

ServerRequestFactory::fromGlobals() now accepts a FilterServerRequestInterface instance as the optional argument $requestFilter. If none is provided, it uses one as produced by FilterUsingXForwardedHeaders::trustReservedSubnets().

Deprecated

The function LaminasDiactorosmarshalUriFromSapi() is deprecated, and no longer used internally.

Changed

LaminasDiactorosServerRequestFactory::fromGlobals() no longer consumes marshalUriFromSapi(), and instead inlines an alternate implementation. The new implementation does not consider X-Forwarded- headers by default when generating the associated URI instance. Internally, if no FilterServerRequestInterface implementation is provided, it defaults to using an instance returned by FilterUsingXForwardeHeaders::trustReservedSubnets(). If you previously relied on X-Forwarded- headers, you MAY need to update your code to use either the FilterUsingXForwardedHeaders::trustAny() or FilterUsingXForwardedHeaders::trustProxies() methods to generate a filter to use with ServerRequestFactory::fromGlobals().

Fixed

Fixes CVE-2022-31109

Read More