πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
🦿 Digital driver's licenses: Are they secure enough for us to trust? 🦿

States should use a privacy by design approach instead of creating a new system to track purchases and other activities, according to security experts.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2021-43172 β€Ό

NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a new child CA that only consists of another CA using a different RRDP repository, a malicious CA can create a chain of CAs of de-facto infinite length. Routinator prior to version 0.10.2 did not contain a limit on the length of such a chain and will therefore continue to process this chain forever. As a result, the validation run will never finish, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43173 β€Ό

In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out value for RRDP connections, this time-out was only applied to individual read or write operations rather than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can continuously extend the time it takes for the request to finish. Since validation will only continue once the update of an RRDP repository has concluded, this delay will cause validation to stall, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43174 β€Ό

NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element.

πŸ“– Read

via "National Vulnerability Database".
🦿 Kaspersky finds 31% increase in "smart" DDoS attacks 🦿

The security company expects these attacks to keep rising through the end of the year.

πŸ“– Read

via "Tech Republic".
πŸ•΄ Why Self-Learning AI Is Changing the Paradigm of ICS Security πŸ•΄

By focusing on the organization rather than the threat, AI can identify subtle changes in your digital environment that point to a cyber threat.

πŸ“– Read

via "Dark Reading".
❌ Not Punny: Angling Direct Breach Cripples Retailer for Days   ❌

A U.K. fishing retailer’s site has been hijacked and redirected to Pornhub.

πŸ“– Read

via "Threat Post".
β™ŸοΈ Microsoft Patch Tuesday, November 2021 Edition β™ŸοΈ

Microsoft Corp. today released updates to quash at least 55 security bugs in its Windows operating systems and other software. Two of the patches address vulnerabilities that are already being used in active attacks online, and four of the flaws were disclosed publicly before today -- potentially giving adversaries a head start in figuring out how to exploit them.

πŸ“– Read

via "Krebs on Security".
🦿 Security pros say federal government should do more to protect and secure private sector 🦿

A full 95% of professionals surveyed by Tripwire believe the government should play a bigger role in securing non-governmental companies.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-28419 β€Ό

During installation with certain driver software or application packages an arbitrary code execution could occur.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-20119 β€Ό

The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the administrator password.

πŸ“– Read

via "National Vulnerability Database".
❌ Microsoft Nov. Patch Tuesday Fixes Six Zero-Days, 55 Bugs ❌

Experts urged users to prioritize patches for Microsoft Exchange and Excel, those favorite platforms so frequently targeted by cybercriminals and nation-state actors.

πŸ“– Read

via "Threat Post".
🦿 It's time to dump Chrome as your default browser on Android 🦿

Jack Wallen makes his case for Android users to switch from Chrome as their default browsers. He also shows you how.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2021-43569 β€Ό

The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43570 β€Ό

The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43572 β€Ό

The verify function in the Stark Bank Python ECDSA library (ecdsa-python) 2.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43568 β€Ό

The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43571 β€Ό

The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Are You Planning for the Quantum, Transhumanist Threat? πŸ•΄

Breaking encryption in a day and hacking without visible devices are two threats that could become a reality in the next decade and beyond, experts say.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Microsoft Fixes Exchange Server Zero-Day πŸ•΄

November security update contains patches for 55 bugs β€” including six zero-days across various products.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-43575 β€Ό

** DISPUTED ** KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information, a similar issue to CVE-2021-36799. NOTE: The vendor disputes this because it is not the responsibility of the ETS to securely store cryptographic key material when it is not being exported.

πŸ“– Read

via "National Vulnerability Database".