Read Time:6 Second
A number of popular crypto wallet providers have been affected by the vulnerabilities, including Coinbase WaaS, Zengo and Binance
Daily Archives: August 9, 2023
How to Create an Efficient Governance Control Program
Read Time:6 Second
You need to account for several factors when building an efficient governance control program. Here’s how CIS SecureSuite can help.
Rhysida Ransomware Analysis Reveals Vice Society Connection
Read Time:5 Second
Check Point highlighted the necessity of understanding the the entire attack process of ransomware groups
Breach Connected to MOVEit Flaw Affects Missouri Medicaid Recipients
Read Time:4 Second
Information involved in the incident includes names, dates of birth and medical claims information
High-Severity Access Control Vulnerability Found in Spring WebFlux
USN-6243-2: Graphite-Web regression
Read Time:41 Second
USN-6243-1 fixed vulnerabilities in Graphite-Web. It was discovered that the
applied fix was incomplete. This update fixes the problem.
Original advisory details:
It was discovered that Graphite-Web incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to perform
server-side request forgery and obtain sensitive information. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-18638)
It was discovered that Graphite-Web incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to perform
cross site scripting and obtain sensitive information. (CVE-2022-4728,
CVE-2022-4729, CVE-2022-4730)
USN-4336-3: GNU binutils vulnerabilities
Read Time:21 Second
USN-4336-1 fixed several vulnerabilities in GNU. This update provides
the corresponding update for Ubuntu 14.04 LTS.
Original advisory details:
It was discovered that GNU binutils contained a large number of security
issues. If a user or automated system were tricked into processing a
specially-crafted file, a remote attacker could cause GNU binutils to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Using Machine Learning to Detect Keystrokes
Read Time:50 Second
Researchers have trained a ML model to detect keystrokes by sound with 95% accuracy.
“A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards”
Abstract: With recent developments in deep learning, the ubiquity of microphones and the rise in online services via personal devices, acoustic side channel attacks present a greater threat to keyboards than ever. This paper presents a practical implementation of a state-of-the-art deep learning model in order to classify laptop keystrokes, using a smartphone integrated microphone. When trained on keystrokes recorded by a nearby phone, the classifier achieved an accuracy of 95%, the highest accuracy seen without the use of a language model. When trained on keystrokes recorded using the video-conferencing software Zoom, an accuracy of 93% was achieved, a new best for the medium. Our results prove the practicality of these side channel attacks via off-the-shelf equipment and algorithms. We discuss a series of mitigation methods to protect users against these series of attacks.
News article.
Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution
Read Time:43 Second
Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.
Adobe Acrobat is used to view, create, print, and manage PDF files.
Adobe Reader is used to view, create, print, and manage PDF files
Adobe Commerce is an offering that provides companies with a flexible and scalable end-to-end plate form to manage commerce experiences of their customers.
Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Northern Ireland Police Officers Vulnerable After Data Leak
Read Time:5 Second
The accidental release of PSNI police officers’ names and department has raised huge safety fears