Show Navigation
Notices tagged with security
-
#Ubuntu #security notice: #Emacs flaw allows code execution. https://ubuntu.com/security/notices/USN-5781-1 [ubuntu com]
-
#Mastodon issue for #activitypub-troll denial-of-service vulnerability. https://github.com/mastodon/mastodon/issues/21977 with 2 pull requests. https://github.com/mastodon/mastodon/pull/22025 and https://github.com/mastodon/mastodon/pull/22026
#security
-
@administrator @aab I'm just guessing, but it could be related to an exploit someone launched against #Mastodon and #Misskey yesterday. From what I read, it brought several instances to their knees. Misskey released a #security patch yesterday.
-
Tagging this thread with #Fediverse #Security ... whomever made the script obviously read some protocol docs and some source code. With just a little #JavaScript, they were able to knock some #Misskey and #Mastodon instances to their knees.
This isn't the first, and it won't be the last. Remember when someone posted a humongous image and locked up any #GNUSocial instance that tried to download the image? Remember when someone's instance was replaced by some sort of cryptocurrency site and PuSH es from your site to theirs would crash your site because of their site's response? (I'll bet I still have that domain blocked at the firewall.)
We have to stop being naive about the intentions of those in the current migration. The overwhelming majority will have benign, if not good, intentions. But a select few will have bad intentions. Among those intentions is to colonize the Fediverse with #Twitter's culture, to come here and impose that culture of anger and disrespect upon the inhabitants here ... which already happened once with the first wave of people joining #Mastodon instance, except it was Twitter and #Tumblr at that time.
-
Oh, good grief, #Microsoft. https://thehackernews.com/2022/10/microsoft-confirms-server.html [thehackernews com]
Source: https://infosec.exchange/@jerry/109213542275494102
#security #breach #Azure #cloud
-
If you are using #Element-iOS , #Element-Android , #Schildichat, or any other #Matrix client powered by matrix-sdk, upgrade now. #Security release is out.
https://nu.federati.net/url/287969 [matrix org]
-
https://nu.federati.net/url/286651 [arstechnica com]
> Researchers have unearthed a discovery that doesn’t occur all that often in the realm of malware: a mature, never-before-seen Linux backdoor that uses novel evasion techniques to conceal its presence on infected servers, in some cases even with a forensic investigation.
> On Thursday, researchers from Intezer and The BlackBerry Threat Research & Intelligence Team said that the previously undetected backdoor combines high levels of access with the ability to scrub any sign of infection from the file system, system processes, and network traffic. Dubbed Symbiote, it targets financial institutions in Brazil and was first detected in November.
/via @geniusmusing
#security #linux #backdoor #malware
-
https://nu.federati.net/url/285943 [it slashdot org] #Lenovo issues #security patches for over 100 Lenovo products.
Source: https://shitposter.club/objects/6f578473-d458-464d-92a8-086d8ce96abb
-
Some severe flaws in #Cisco small business routers. https://www.theregister.com/2022/02/04/cisco_smb_routers_critical_vulnerabilities/. [www theregister com]
At publication time, some flaws and some models had not yet been patched.
#security
-
#T-mobile #security
From 2018: https://nu.federati.net/url/282487
/via @rysiek @rysiek@mastodon.technology
-
Further info: https://news-web.php.net/php.internals/113838
And with the presumed compromise of git.php.net, all future development activities will take place on #GitHub.
#code-hosting #vcs #scm #security #git #php
-
Detecting #curl-pipe-bash from the server-side: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ [www idontplaydarts com]
#security #curl #wget #pipe #bash
-
https://nu.federati.net/url/278948 [thejournal com]
Schools are now the most targeted segment for ransomware ... make up the majority of all ransomware attacks.
#security #ransomware #k-12 #schools
-
#Mattermost devs discover unfixable (?) flaws in #Go-Lang library https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ #security
-
The Guardian's text is pretty similar to the Jerusalem Post's: https://nu.federati.net/url/278891
#US_Treasury #security #breach
-
US #cybersecurity firm #FireEye discloses breach, theft of tools https://finance.yahoo.com/news/u-cybersecurity-firm-fireeye-discloses-210424354.html [finance yahoo com]
#SEC #security #breach #filing
-
OpenSSL Releases Security Update CISA
https://us-cert.cisa.gov/ncas/current-activity/2020/12/08/openssl-releases-security-update
>OpenSSL has released a security update to address a vulnerability affecting all versions of 1.0.2 and 1.1.1 released before version 1.1.1i. An attacker could exploit this vulnerability to cause a denial-of-service condition.
openssl.org/news/secadv/20201208.txt
https://www.openssl.org/news/secadv/20201208.txt
>EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
>======================================================
>
>Severity: High
>
>The X.509 GeneralName type is a generic type for representing different types
>of names. One of those name types is known as EDIPartyName. OpenSSL provides a
>function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME
>to see if they are equal or not. This function behaves incorrectly when both
>GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash
>may occur leading to a possible denial of service attack.
>
>OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes:
>1) Comparing CRL distribution point names between an available CRL and a CRL
> distribution point embedded in an X509 certificate
>2) When verifying that a timestamp response token signer matches the timestamp
> authority name (exposed via the API functions TS_RESP_verify_response and
> TS_RESP_verify_token)
>
>If an attacker can control both items being compared then that attacker could
>trigger a crash.
>...
#OpenSSL #Security #Update
-
https://pluralistic.net/2020/12/05/trusting-trust/
> WARNING WARNING WARNING WARNING
> Security researchers are alarmed: the already-notorious Trickbot malware has been spottied probing infected computers to find out which version of UEFI they're running. This is read as evidence that Trickbot has figured out how to pull off a really scary feat.
Source: https://mamot.fr/@pluralistic/105329139472008620
#Security #UEFI #BIOS #TPM #Trusted-Computing
CC: @mangeurdenuage @geniusmusing @musicman
It's a long article, but well worth your time.
-
"So you want to get into Infosec?"
https://hackers.town/@thegibson/105243991039588873 Some links to discounted or free training in that thread.
#infosec #security #training #education
-
@aab has found something to block some traffic from unwanted portscans: https://dodweil.us/security/ufw-fail2ban-portscan.html
#security #NoteToSelf