6 posts
The Hot Take: Its really telling when they do this stuff. So was it a backdoor for some three lettered agency?
Microsoft's GitHub bans security researcher who posted zero-day Windows exploits
Read the full articleThe Hot Take: Linux becoming a target with people migrating over to it for sure.
Qualys's Threat Research Unit (TRU) has discovered and published a logic flaw in Linux kernel "that permits an unprivileged local user to disclose sensitive files and execute arbitrary commands as root on default installations of several major distributions." Friday their blog pointed out "The bug has resided in mainline Linux since November 2016 (v4.10-rc1)." "Upstream patches and distribution updates are already available." Working exploits are circulating publicly, and administrators should apply vendor kernel updates without…
Read the full articleThe Hot Take: SMS/TXT is going to cause some pain for sure.
For years, typing in a six-digit code sent to your phone has been the universal standard for verifying your identity online. But that era is officially coming to an end in the Windows ecosystem. In a statement to Windows Latest, Microsoft independently confirmed that it’ll stop sending SMS codes for personal accounts. Now, first spotted by Windows Latest, Microsoft has officially announced that it is pulling the plug on SMS codes for personal accounts. According to a support document quietly published earlier this year, the company is…
Read the full articleThe Hot Take: WTH Microslop.
Microsoft Bitlocker-protected drives can be opened with just some files on a stick
Read the full articleThe Hot Take: As Linux gains market share just put a target on its back for compromise.
A new report from Sonatype identifies 21,764 malicious open source packages in the first quarter of the year, up 21 percent from the same period last year and bringing the total logged since 2017 to 1,346,867. The npm registry continues to be the target of most new malicious attacks, at 75 percent, seeing the equivalent of 46 malicious packages per day, with the quarter defined by credential theft, host reconnaissance, and staged payload delivery aimed at developer and CI/CD environments. Python package index PyPI saw 18 percent of total…
Read the full articleThe Hot Take: More GPU security issues, #FUN.
Two new Rowhammer attacks for GPUs have been discovered that can cause bit flips in VRAM to gain arbitrary read/write access over it. These attacks target page files and the page directory that are otherwise protected from electrical disturbance by the driver. By "massaging" these data structures into vulnerable regions where a bit flip can occur, the attacker can access even the CPU memory.
Read the full article