Advisories
-
Friday Squid Blogging: Safe Quick Undercarriage Immobilization Device
Fifteen years ago I blogged about a different SQUID. Here’s an update: Fleeing drivers are a common problem for law enforcement. They just won’t stop unless persuaded—persuaded by bullets, barriers, spikes, or snares. Each option is risky business. Shooting up a fugitive’s car is one possibility. But what if children or hostages are in it?…
-
FCC Proposes Stricter Cybersecurity Rules for US Telecoms
The Salt Typhoon hack against US telecommunications firms has prompted the FCC to suggest stricter security rules to protect the sector from future cyber threats Read More
-
Detecting Pegasus Infections
This tool seems to do a pretty good job. The company’s Mobile Threat Hunting feature uses a combination of malware signature-based detection, heuristics, and machine learning to look for anomalies in iOS and Android device activity or telltale signs of spyware infection. For paying iVerify customers, the tool regularly checks devices for potential compromise. But…
-
Romania Exposes TikTok Propaganda Campaign Supporting Pro-Russian Candidate
Cǎlin Georgescu went from polling around 1% a month before the Romanian presidential election to winning the first round Read More
-
Deloitte Denies Breach, Claims Cyber-Attack Targeted Single Client
Despite claims by Brain Cipher that the ransomware gang had targeted Deloitte, the consultancy firm says its systems have not been affected Read More
-
pytest-8.3.4-1.fc41
FEDORA-2024-b747462264 Packages in this update: pytest-8.3.4-1.fc41 Update description: Update to pytest 8.3.4 Read More
-
Europol Dismantles Major Online Fraud Platform in Major Blow to Fraudsters
A European law enforcement operation took down a specialized online marketplace that operated as a central hub for the trade of illegally obtained information Read More
-
ZDI-24-1643: (Pwn2Own) iXsystems TrueNAS tarfile.extractall Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-11944. Read More
-
ZDI-24-1644: (Pwn2Own) iXsystems TrueNAS fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability
This vulnerability allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.1. The following CVEs are assigned: CVE-2024-11946. Read More
-
ZDI-24-1645: Progress Software WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2024-46909. Read More