Dependency manager used in millions of apps leaves a bitter taste CocoaPods, an open-source dependency manager used in over three million applications coded in Swift and Objective-C, left thousands of packages exposed and ready for takeover for nearly a decade…
Tag: The Register – Security
Baddies hijack Korean ERP vendor’s update systems to spew malware
Notorious ‘Andariel’ crew takes a bite of HotCroissant backdoor for fresh attack A South Korean ERP vendor’s product update server has been attacked and used to deliver malware instead of product updates, according to local infosec outfit AhnLab.… This article…
Nasty regreSSHion bug in OpenSSH puts roughly 700K Linux boxes at risk
Full system takeovers on the cards, for those with enough patience to pull it off Glibc-based Linux systems are vulnerable to a new bug (CVE-2024-6387) in OpenSSH’s server (sshd) and should upgrade to the latest version.… This article has been…
Nasty regreSSHion bug in OpenSSH puts around 700K Linux boxes at risk
Full system takeovers on the cards, for those with enough patience to pull it off Glibc-based Linux systems are vulnerable to a new bug (CVE-2024-6387) in OpenSSH’s server (sshd) and should upgrade to the latest version.… This article has been…
Juniper Networks flings out emergency patches for perfect 10 router vuln
Get ’em while they’re hot A critical vulnerability affecting Juniper Networks routers forced the vendor to issue emergency patches last week, and users are advised to apply them as soon as possible.… This article has been indexed from The Register…
Poyfill.io claims reveal new cracks in supply chain, but how deep do they go?
There will always be bad actors in the system. We can always learn from the drama they create Opinion Libraries. Hushed temples to the civilizing power of knowledge, or launchpads of global destruction? Yep, another word tech has borrowed and…
CISA director: US is ‘not afraid’ to shout about Big Tech’s security failings
Jen Easterly hopes CSRB’s Microsoft report won’t impede future private sector collaboration CISA director Jen Easterly says the Cybersecurity Safety Review Board (CSRB) “is not afraid to say when something is amiss” in response to questions about fears around private…
Police allege ‘evil twin’ of in-flight Wi-Fi used to steal passenger’s credentials
Fasten your seat belts, secure your tray table, and try not to give away your passwords Australia’s Federal Police (AFP) has charged a man with running a fake Wi-Fi networks on at least one commercial flight and using it to…
Indonesian government didn’t have backups of ransomwared data, because DR was only an option
President has ordered a datacenter audit and made backups mandatory Indonesia’s president Joko Widodo has ordered an audit of government datacenters after it was revealed that most of the data they store is not backed up.… This article has been…
Microsoft tells yet more customers their emails have been stolen
Plus: US auto dealers still offline; Conti coders sanction; Rabbit R1 hardcoded API keys; and more security in brief It took a while, but Microsoft has told customers that the Russian criminals who compromised its systems earlier this year made…
CISA looked at C/C++ projects and found a lot of C/C++ code. Wanna redo any of it in Rust?
So, so many lines of memory-unsafe routines in crucial open source, and unsafe dependencies The US government’s Cybersecurity and Infrastructure Security Agency (CISA) has analyzed 172 critical open source projects and found that more than half contain code written in…
TeamViewer says Russia broke into its corp IT network
Same APT29 crew that hit Microsoft and SolarWinds. How close were we to a mega backdoor situation? TeamViewer says it was Russian intelligence that broke into its systems this week.… This article has been indexed from The Register – Security…
Unlock the future of security
Join our exclusive webinar on identity security Webinar In today’s rapidly evolving digital landscape, securing identities is more critical than ever.… This article has been indexed from The Register – Security Read the original article: Unlock the future of security
Google cuts ties with Entrust in Chrome over trust issues
Move comes weeks after Mozilla blasted certificate authority for failings Google is severing its trust in Entrust after what it describes as a protracted period of failures around compliance and general improvements.… This article has been indexed from The Register…
Microsoft hits snooze again on security certificate renewal
Seeing weird warnings in Microsoft 365 and Office Online? That’ll be why Microsoft has expiration issues with its TLS certificates, resulting in unwanted security warnings.… This article has been indexed from The Register – Security Read the original article: Microsoft…
‘Skeleton Key’ attack unlocks the worst of AI, says Microsoft
Simple jailbreak prompt can bypass safety guardrails on major models Microsoft on Thursday published details about Skeleton Key – a technique that bypasses the guardrails used by makers of AI models to prevent their generative chatbots from creating harmful content.……
Polyfill.io owner punches back at ‘malicious defamation’ amid domain shutdown
No supply-chain attacks to see over here! After having its website shut down, the polyfill.io owner is fighting back against claims it smuggled suspicious code onto websites all across the internet.… This article has been indexed from The Register –…
TeamViewer can’t bring itself to say someone broke into its network – but it happened
Says customer data, prod environment not affected as NCC sounds alarm TeamViewer on Thursday said its security team just “detected an irregularity” within one of its networks – which is a fancy way of saying someone broke in.… This article…
US lawmakers wave red flags over Chinese drone dominance
Congressman warns tech is getting the ‘Huawei Playbook’ treatment US Congress members warned against Chinese dominance of the drone industry on Wednesday, elevating the threat posed by Beijing’s control of the technology as similar to that of semiconductors and ships.……
Korean telco allegedly infected its P2P users with malware
KT may have had an entire team dedicated to infecting its own customers A South Korean media outlet has alleged that local telco KT deliberately infected some customers with malware due to their excessive use of peer-to-peer (P2P) downloading tools.……