Malware Devil

Wednesday, March 31, 2021

How to Secure the Home Branch Office

home branch Zix

Amid the pandemic, most workforces have shifted to remote work and home offices; essentially, transforming their living rooms into corporate branch offices. From a convenience and health perspective, this has worked well, for the most part. However, the convenience of working from home has put a lot of responsibility on corporate IT folks to ensure..

The post How to Secure the Home Branch Office appeared first on Security Boulevard.

Read More

The post How to Secure the Home Branch Office appeared first on Malware Devil.



https://malwaredevil.com/2021/03/31/how-to-secure-the-home-branch-office/?utm_source=rss&utm_medium=rss&utm_campaign=how-to-secure-the-home-branch-office

Building Immunity at AppSec Insertion Points

AppSec Changing Face of Web Application Security

The fundamentals of a formal, effective application security plan should start with business objectives, tools, processes and most of all, data, with the primary driver for securing applications focused on protecting data. While it is important to surgically address the insecurities in a mission-critical application, it is equally important to continuously upskill the development and..

The post Building Immunity at AppSec Insertion Points appeared first on Security Boulevard.

Read More

The post Building Immunity at AppSec Insertion Points appeared first on Malware Devil.



https://malwaredevil.com/2021/03/31/building-immunity-at-appsec-insertion-points/?utm_source=rss&utm_medium=rss&utm_campaign=building-immunity-at-appsec-insertion-points

ISC Stormcast For Wednesday, March 31st, 2021 https://isc.sans.edu/podcastdetail.html?id=7436, (Wed, Mar 31st)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Read More

The post ISC Stormcast For Wednesday, March 31st, 2021 https://isc.sans.edu/podcastdetail.html?id=7436, (Wed, Mar 31st) appeared first on Malware Devil.



https://malwaredevil.com/2021/03/31/isc-stormcast-for-wednesday-march-31st-2021-https-isc-sans-edu-podcastdetail-htmlid7436-wed-mar-31st/?utm_source=rss&utm_medium=rss&utm_campaign=isc-stormcast-for-wednesday-march-31st-2021-https-isc-sans-edu-podcastdetail-htmlid7436-wed-mar-31st

ESB-2021.1088 – [Appliance] F5OS: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2021.1088
             Multiple dnsmasq vulnerabilities CVE-2020-25684,
                    CVE-2020-25685, and CVE-2020-25686
                               31 March 2021

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           F5OS
Publisher:         F5 Networks
Operating System:  Network Appliance
Impact/Access:     Provide Misleading Information -- Remote/Unauthenticated
                   Reduced Security               -- Remote/Unauthenticated
Resolution:        Mitigation
CVE Names:         CVE-2020-25686 CVE-2020-25685 CVE-2020-25684

Reference:         ESB-2021.0987
                   ESB-2021.0864
                   ESB-2021.0699
                   ESB-2021.0283

Original Bulletin: 
   https://support.f5.com/csp/article/K98221124

- --------------------------BEGIN INCLUDED TEXT--------------------

K98221124: Multiple dnsmasq vulnerabilities CVE-2020-25684, CVE-2020-25685, and
CVE-2020-25686

Original Publication Date: 31 Mar, 2021

Security Advisory Description

o CVE-2020-25684

    A flaw was found in dnsmasq before version 2.83. When getting a reply from
    a forwarded query, dnsmasq checks in the forward.c:reply_query() if the
    reply destination address/port is used by the pending forwarded queries.
    However, it does not use the address/port to retrieve the exact forwarded
    query, substantially reducing the number of attempts an attacker on the
    network would have to perform to forge a reply and get it accepted by
    dnsmasq. This issue contrasts with RFC5452, which specifies a query's
    attributes that all must be used to match a reply. This flaw allows an
    attacker to perform a DNS Cache Poisoning attack. If chained with
    CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful
    attack is reduced. The highest threat from this vulnerability is to data
    integrity.

  o CVE-2020-25685

    A flaw was found in dnsmasq before version 2.83. When getting a reply from
    a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the
    forwarded query that matches the reply, by only using a weak hash of the
    query name. Due to the weak hash (CRC32 when dnsmasq is compiled without
    DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find
    several different domains all having the same hash, substantially reducing
    the number of attempts they would have to perform to forge a reply and get
    it accepted by dnsmasq. This is in contrast with RFC5452, which specifies
    that the query name is one of the attributes of a query that must be used
    to match a reply. This flaw could be abused to perform a DNS Cache
    Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a
    successful attack is reduced. The highest threat from this vulnerability is
    to data integrity.

  o CVE-2020-25686

    A flaw was found in dnsmasq before version 2.83. When receiving a query,
    dnsmasq does not check for an existing pending request for the same name
    and forwards a new request. By default, a maximum of 150 pending queries
    can be sent to upstream servers, so there can be at most 150 queries for
    the same name. This flaw allows an off-path attacker on the network to
    substantially reduce the number of attempts that it would have to perform
    to forge a reply and have it accepted by dnsmasq. This issue is mentioned
    in the "Birthday Attacks" section of RFC5452. If chained with
    CVE-2020-25684, the attack complexity of a successful attack is reduced.
    The highest threat from this vulnerability is to data integrity.

Impact

CVE-2020-25684

This flaw allows an attacker to perform a DNS Cache Poisoning attack. If
chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a
successful attack is reduced. The highest threat from this vulnerability is to
data integrity. The attacker needs access to the mgmt network of the velocity
chassis to inject these invalid replies.

CVE-2020-25685

This flaw allows an attacker to perform a DNS Cache Poisoning attack. If
chained with CVE-2020-25684, the attack complexity of a successful attack is
reduced. The highest threat from this vulnerability is to data integrity. The
attacker needs access to the mgmt network of the velocity chassis to inject
these invalid replies.

CVE-2020-25686

This flaw allows an off-path attacker on the network to substantially reduce
the number of attempts to forge a reply and for dnsmasq to accept the reply.
RFC5452 mentions this issue in the Birthday Attacks section. If chained with
CVE-2020-25684, the attack complexity of a successful attack is reduced. The
highest threat from this vulnerability is to data integrity. The attacker needs
access to the mgmt network of the velocity chassis to inject these invalid
replies.

Security Advisory Status

F5 Product Development has assigned ID 989425 (F5OS) to this vulnerability.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases, point releases, or
hotfixes that address the vulnerability, refer to the following table. For more
information about security advisory versioning, refer to K51812227:
Understanding security advisory versioning.

+------------+------+--------------+----------+----------+------+-------------+
|            |      |Versions known|Fixes     |          |CVSSv3|Vulnerable   |
|Product     |Branch|to be         |introduced|Severity  |score^|component or |
|            |      |vulnerable^1  |in        |          |2     |feature      |
+------------+------+--------------+----------+----------+------+-------------+
|            |16.x  |None          |Not       |          |      |             |
|            |      |              |applicable|          |      |             |
|            +------+--------------+----------+          |      |             |
|            |15.x  |None          |Not       |          |      |             |
|            |      |              |applicable|          |      |             |
|            +------+--------------+----------+          |      |             |
|            |14.x  |None          |Not       |          |      |             |
|BIG-IP (All |      |              |applicable|Not       |      |             |
|modules)    +------+--------------+----------+vulnerable|None  |None         |
|            |13.x  |None          |Not       |          |      |             |
|            |      |              |applicable|          |      |             |
|            +------+--------------+----------+          |      |             |
|            |12.x  |None          |Not       |          |      |             |
|            |      |              |applicable|          |      |             |
|            +------+--------------+----------+          |      |             |
|            |11.x  |None          |Not       |          |      |             |
|            |      |              |applicable|          |      |             |
+------------+------+--------------+----------+----------+------+-------------+
|            |8.x   |None          |Not       |          |      |             |
|            |      |              |applicable|          |      |             |
|BIG-IQ      +------+--------------+----------+          |      |             |
|Centralized |7.x   |None          |Not       |Not       |None  |None         |
|Management  |      |              |applicable|vulnerable|      |             |
|            +------+--------------+----------+          |      |             |
|            |6.x   |None          |Not       |          |      |             |
|            |      |              |applicable|          |      |             |
+------------+------+--------------+----------+----------+------+-------------+
|F5OS        |1.x   |1.0.0 - 1.1.0 |None      |Medium    |4.0   |dnsmasq      |
+------------+------+--------------+----------+----------+------+-------------+
|Traffix SDC |5.x   |None          |Not       |Not       |None  |None         |
|            |      |              |applicable|vulnerable|      |             |
+------------+------+--------------+----------+----------+------+-------------+

^1F5 only evaluates software versions that have not yet reached the End of
Technical Support (EoTS) phase of their lifecycle.

^2The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by installing a version listed in
the Fixes introduced in column. If the Fixes introduced in column does not list
a version for your branch, then no update candidate currently exists for that
branch and F5 recommends upgrading to a version with the fix (refer to the
table).

If the Fixes introduced in column lists a version prior to the one you are
running, in the same branch, then your version should have the fix.

Mitigation

To mitigate this vulnerability, do not configure DNS servers on the VELOS
chassis system.

Supplemental Information

o K41942608: Overview of AskF5 security advisory articles
  o K4602: Overview of the F5 security vulnerability response policy
  o K4918: Overview of the F5 critical issue hotfix policy
  o K8986: F5 software lifecycle policy
  o K9970: Subscribing to email notifications regarding F5 products
  o K9957: Creating a custom RSS feed to view new and updated documents

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYGOtCONLKJtyKPYoAQhN7hAAhXpXdrPnQQrfcGvHoZmi4UlCRjqMrLU6
IayCUqqzNKXt75NmBOc0xWb9M4HvGz9qsczUwbPz+5SRRqSHa5gyx9BkI5HHCALr
h+hoLFAVDyGMH0uooX+PftK2evFO8NGWC992VANQX+t6ydEOx4eULt6SRCz3O9BQ
u3KpwmnBZ92P620QtvKT9JRFy94NgG0M8Kv6r9F2UPUTVII1ZZLgu2teNbIGTN4X
+QuG1itUYw8Q96VUUnPnBzqvNcOjBiJY2AG50bpf5/3ILb8eh4NjWt2oZz3x3dd8
orFSNCbjNi1TNEq0qc3XzX6pDwpjd5KEmgud/kvW51bxqkViCqlckWwHo81y0D0w
H5xuq1dMcb8VE5Ec8RFPTIkuB51FHROrIosYTh+dLrwhER9ipbdGqUiftk2Ih3rq
elhZ/oNDRREfZwK4gZy+yDwuAA0CpSEPBbwAuvAo0++owQdQgYhxdYS2/NLn2YEq
Gqmy4TUXtRjszGzH+9wzF5GjJJiGTJGd/g/9OmUCbtbcjZB7GGIn3PZ4RH/hT/mt
K4AZjE8WZMsUCKVKNFvoVeh/70NFoIRvqzQG9jNJj/wfQyqRHC608oIy25KYJSMS
hjp1an+9n8NvrccJyjQ95FOnwc7xbhFGzPHEbPW11syTVXQPwj35Cckc8kid2iAs
MJlK74VUGpc=
=Sp8h
-----END PGP SIGNATURE-----

Read More

The post ESB-2021.1088 – [Appliance] F5OS: Multiple vulnerabilities appeared first on Malware Devil.



https://malwaredevil.com/2021/03/31/esb-2021-1088-appliance-f5os-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-1088-appliance-f5os-multiple-vulnerabilities

ESB-2021.1087 – [Win][UNIX/Linux][Virtual] VMWare Products: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2021.1087
  VMSA-2021-0004 - VMware vRealize Operations updates address Server Side
         Request Forgery and Arbitrary File Write vulnerabilities
                               31 March 2021

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           VMware vRealize Operations
                   VMware Cloud Foundation
                   vRealize Suite Lifecycle Manager
Publisher:         VMWare
Operating System:  Virtualisation
                   UNIX variants (UNIX, Linux, OSX)
                   Windows
Impact/Access:     Access Privileged Data -- Remote/Unauthenticated
                   Create Arbitrary Files -- Existing Account      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2021-21983 CVE-2021-21975 

Original Bulletin: 
   https://www.vmware.com/security/advisories/VMSA-2021-0004.html

- --------------------------BEGIN INCLUDED TEXT--------------------

Advisory ID: VMSA-2021-0004
CVSSv3 Range: 7.2 - 8.6
Issue Date: 2021-03-30
Updated On: 2021-03-30 (Initial Advisory)
CVE(s): CVE-2021-21975, CVE-2021-21983
Synopsis: VMware vRealize Operations updates address Server Side Request
Forgery and Arbitrary File Write vulnerabilities (CVE-2021-21975,
CVE-2021-21983)


1. Impacted Products

  o VMware vRealize Operations
  o VMware Cloud Foundation
  o vRealize Suite Lifecycle Manager

2. Introduction

Multiple vulnerabilities in VMware vRealize Operations were privately reported
to VMware. Patches and Workarounds are available to address these
vulnerabilities in impacted VMware products. 

3a. Server Side Request Forgery in vRealize Operations Manager API
(CVE-2021-21975)

Description

The vRealize Operations Manager API contains a Server Side Request
Forgery. VMware has evaluated this issue to be of 'Important' severity with a
maximum CVSSv3 base score of 8.6.

Known Attack Vectors

A malicious actor with network access to the vRealize Operations Manager API
can perform a Server Side Request Forgery attack to steal administrative
credentials.

Resolution

To remediate CVE-2021-21975 apply the updates listed in the 'Fixed Version'
column of the 'Response Matrix' below to impacted deployments.

Workarounds

Workarounds for CVE-2021-21975 have been listed in the 'Workarounds' column of
the 'Response Matrix' below.

Additional Documentation

A FAQ was created which is listed in the 'Additional Documentation' column of
the 'Response Matrix' below.

Acknowledgements

VMware would like to thank Egor Dimitrenko of Positive Technologies for
reporting this vulnerability to us.

3b. Arbitrary file write vulnerability in vRealize Operations Manager API
(CVE-2021-21983)

Description

The vRealize Operations Manager API contains an arbitrary file write
vulnerability. VMware has evaluated this issue to be of 'Important' severity
with a maximum CVSSv3 base score of 7.2.

Known Attack Vectors

An authenticated malicious actor with network access to the vRealize Operations
Manager API can write files to arbitrary locations on the underlying photon
operating system.

Resolution

To remediate CVE-2021-21983 apply the updates listed in the 'Fixed Version'
column of the 'Response Matrix' below to affected deployments.

Workarounds

Workarounds for CVE-2021-21983 have been listed in the 'Workarounds' column of
the 'Response Matrix' below.

Additional Documentation

A FAQ was created which is listed in the 'Additional Documentation' column of
the 'Response Matrix' below.

Acknowledgements

VMware would like to thank Egor Dimitrenko of Positive Technologies for
reporting this vulnerability to us.

Notes

None.

Response Matrix:

Product    Version Running CVE Identifier  CVSSv3 Severity Fixed   Workarounds Additional
                   On                                      Version             Documentation
vRealize                   CVE-2021-21975, 7.2 -
Operations 8.3.0   Any     CVE-2021-21983  8.6    critical KB83210 KB83210     FAQ
Manager
vRealize                   CVE-2021-21975, 7.2 -
Operations 8.2.0   Any     CVE-2021-21983  8.6    critical KB83095 KB83095     FAQ
Manager
vRealize   8.1.1,          CVE-2021-21975, 7.2 -
Operations 8.1.0   Any     CVE-2021-21983  8.6    critical KB83094 KB83094     FAQ
Manager
vRealize   8.0.1,          CVE-2021-21975, 7.2 -
Operations 8.0.0   Any     CVE-2021-21983  8.6    critical KB83093 KB83093     FAQ
Manager
vRealize                   CVE-2021-21975, 7.2 -
Operations 7.5.0   Any     CVE-2021-21983  8.6    critical KB82367 KB82367     FAQ
Manager

Impacted Product Suites that Deploy Response Matrix Components:

Product    Version Running CVE Identifier  CVSSv3 Severity Fixed   Workarounds Additional
                   On                                      Version             Documentation
                                                                   See
VMware                                                             'Response
Cloud      4.x     Any     CVE-2021-21975, 7.2 -  critical KB83260 Matrix'     FAQ
Foundation                 CVE-2021-21983  8.6                     workaround
(vROps)                                                            column
                                                                   above
                                                                   See
VMware                                                             'Response
Cloud      3.x     Any     CVE-2021-21975, 7.2 -  critical KB83260 Matrix'     FAQ
Foundation                 CVE-2021-21983  8.6                     workaround
(vROps)                                                            column
                                                                   above
vRealize                                                           See
Suite                                                              'Response
Lifecycle  8.x     Any     CVE-2021-21975, 7.2 -  critical KB83260 Matrix'     FAQ
Manager                    CVE-2021-21983  8.6                     workaround
(vROps)                                                            column
                                                                   above

4. References

 

vRealize Operations Manager
8.3.0: https://kb.vmware.com/s/article/83210
8.2.0: https://kb.vmware.com/s/article/83095
8.1.1: https://kb.vmware.com/s/article/83094
8.0.1: https://kb.vmware.com/s/article/83093
7.5.0: https://kb.vmware.com/s/article/82367

VMware Cloud Foundation (vROps)
4.x/3.x: https://kb.vmware.com/s/article/83260

vRealize Suite Lifecycle Manager (vROps)
8.x: https://kb.vmware.com/s/article/83260

FIRST CVSSv3 Calculator:
CVE-2021-21975 - https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/
PR:N/UI:N/S:C/C:H/I:N/A:N
CVE-2021-21983 - https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/
PR:H/UI:N/S:U/C:H/I:H/A:H

Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21975
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21983

 

5. Change Log

2021-03-30: VMSA-2020-0004
Initial security advisory.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYGOrw+NLKJtyKPYoAQhdjA/8C5q6/+zt0FeYFVl9qNBdmCAoIEL7KnKv
b7O6VzJ+FwrjAfjiTdOkg9ExEF4mqv6G8B3OpndHhsPEaBRA//zqFiNFJuI8+5JQ
YRLtFPuK0gbkXHDdxd3EIGbg+df9dcpOV1AshkEuW8AGRiTK1YvbLbqKjJUgtKaH
sy6pfQjQYpeVNnXtfZXcbPtQiSdHsHuuh8qMJEdyhJAf5O8TnuUHLxgHkMXYTGCj
xuL3+AYqusZ6WdCgsnWQpUDBs/uuO99l5hNUxg+PzyS/ChUoW8E087j13fKwjBAA
oq5kJ1yI5ncH9c5tAB2MJP1gEQpDBrGlzO7bKYvW5Y0lWVRR/gZIjXxnjwkbRDQp
4L2jptVIoQfdrnGzX3A5YlAiYdGDnGqzubbsPc5Qqd8oYMwxhYHEnErN0gWAlJJG
exsLMr0BnO1IU1OF/Z6Gx3VMmcyTP2LCn0zucyWDTIJoaPzSEIaBtDalGVYbN0Kw
PMlL5cONMFB02rR2oqF6ve9bCT1XJAIJBYrx8+Xx5XbwVGOBtHMXEy8bVIEjoY8Q
QTiOlS6lOGivbjxf8C2EC0yhZ7L+6yqXOw+et/tMb0fQyGmX2prOs1EWfvqyyAX5
VfxMQ7PulRvlkirY6K8+WbAQSMrE6NsUppLUnMrN+WjRgrXr3N2gA8Gg5e5GOXd2
jpgabv1bOYY=
=cnHn
-----END PGP SIGNATURE-----

Read More

The post ESB-2021.1087 – [Win][UNIX/Linux][Virtual] VMWare Products: Multiple vulnerabilities appeared first on Malware Devil.



https://malwaredevil.com/2021/03/31/esb-2021-1087-winunix-linuxvirtual-vmware-products-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-1087-winunix-linuxvirtual-vmware-products-multiple-vulnerabilities

Manufacturing Has the Lowest Percentage of High-Severity Flaws but Needs to Improve Time to Remediation

The past 12 months have been especially challenging for the manufacturing industry. The pandemic affected in-person manufacturing jobs as well as supply and demand, causing many manufacturing companies to shut their doors or lay off valuable employees. Recognizing the vulnerable state of manufacturing companies, cybercriminals saw manufacturing as an easy target. In fact, the manufacturing industry saw an 11 percent increase in cyberattacks in 2020.

And even more concerning, our recent State of Software Security v11 (SOSS) report found that, when compared to other industries, the manufacturing industry ranks last for fix-rate and median time to remediate security flaws. That means that the manufacturing industry has security flaws in applications that aren???t getting resolved in a timely manner. And more lingering flaws mean more opportunity for a cyberattack.

That said, it is reassuring to see that the manufacturing industry falls in the middle of the pack for the percentage of applications with flaws and ??? even better ??? has the lowest portion of applications with high-severity flaws.

Manufacturing SOSS

What are some steps that the manufacturing industry can take to improve its fix rate and half-life?

When reviewing the SOSS data, there are several factors contributing to the low fix rate and time to remediation. Some of the factors are simply the ???nature??? of the applications and can???t necessarily be changed. For example, applications in the manufacturing industry tend to be large and have a high flaw density. But there are several factors that can be ???nurtured??? to improve fix rate and time to remediation, like scanning via API, scan frequency, and using software composition analysis (SCA) with static analysis (SAST).

Manufacturing SOSS half life data

Just by scanning applications for flaws more frequently, industries improved their time to remediation by 22 days. By leveraging APIs, industries improved time to remediation by 18 days. It really comes down to adopting and implementing DevSecOps best practices.

And while talking about flaws, it???s important to note that the most common security flaws in the manufacturing industry are information leakage, CRLF injection, and code quality. Credentials management is also surprisingly common, perhaps due to the fact manufacturing used to not require authorization for applications.

For more information on software security trends in the manufacturing industry, check out The State of Software Security Industry Snapshot.

The post Manufacturing Has the Lowest Percentage of High-Severity Flaws but Needs to Improve Time to Remediation appeared first on Security Boulevard.

Read More

The post Manufacturing Has the Lowest Percentage of High-Severity Flaws but Needs to Improve Time to Remediation appeared first on Malware Devil.



https://malwaredevil.com/2021/03/31/manufacturing-has-the-lowest-percentage-of-high-severity-flaws-but-needs-to-improve-time-to-remediation/?utm_source=rss&utm_medium=rss&utm_campaign=manufacturing-has-the-lowest-percentage-of-high-severity-flaws-but-needs-to-improve-time-to-remediation

Tuesday, March 30, 2021

Internet Safety Tips for Seniors and Scams to Watch Out for

According to a Pew Research Center survey, about 66% of Americans are over the age of 65 and many of them are online.

The post Internet Safety Tips for Seniors and Scams to Watch Out for appeared first on Security Boulevard.

Read More

The post Internet Safety Tips for Seniors and Scams to Watch Out for appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/internet-safety-tips-for-seniors-and-scams-to-watch-out-for/?utm_source=rss&utm_medium=rss&utm_campaign=internet-safety-tips-for-seniors-and-scams-to-watch-out-for

Developing a Risk Management Approach to Cybersecurity

By now most CISOs understand that focusing your cybersecurity program on regulatory compliance is no longer sufficient. Meeting …

The post Developing a Risk Management Approach to Cybersecurity appeared first on Hyperproof.

The post Developing a Risk Management Approach to Cybersecurity appeared first on Security Boulevard.

Read More

The post Developing a Risk Management Approach to Cybersecurity appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/developing-a-risk-management-approach-to-cybersecurity/?utm_source=rss&utm_medium=rss&utm_campaign=developing-a-risk-management-approach-to-cybersecurity

The Security Digest: #54

Hello and welcome to TSD, your weekly blog post with top of mind security issues. TSD began as an internal newsletter 1 year ago that …

The post The Security Digest: #54 appeared first on Cyral.

The post The Security Digest: #54 appeared first on Security Boulevard.

Read More

The post The Security Digest: #54 appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/the-security-digest-54/?utm_source=rss&utm_medium=rss&utm_campaign=the-security-digest-54

Exploiting Embedded Linux Devices Through the JTAG Interface

With the explosion of internet-of-things (IoT) and connected, industrial IoT (IIoT), and connected, smart home devices, it is getting harder and harder to find things that don’t have some sort of embedded operating system and connectivity today. While connected devices can streamline productivity and provide a variety of benefits, they also expose you to risk. […]

The post Exploiting Embedded Linux Devices Through the JTAG Interface appeared first on TechSpective.

The post Exploiting Embedded Linux Devices Through the JTAG Interface appeared first on Security Boulevard.

Read More

The post Exploiting Embedded Linux Devices Through the JTAG Interface appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/exploiting-embedded-linux-devices-through-the-jtag-interface/?utm_source=rss&utm_medium=rss&utm_campaign=exploiting-embedded-linux-devices-through-the-jtag-interface

Ziggy Ransomware Gang Offers Refunds to Victims

Ziggy joins Fonix ransomware group and shuts down, with apologies to targets.
Read More

The post Ziggy Ransomware Gang Offers Refunds to Victims appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/ziggy-ransomware-gang-offers-refunds-to-victims/?utm_source=rss&utm_medium=rss&utm_campaign=ziggy-ransomware-gang-offers-refunds-to-victims

Malicious Docker Cryptomining Images Rack Up 20M Downloads

Publicly available cloud images are spreading Monero-mining malware to unsuspecting cloud developers.
Read More

The post Malicious Docker Cryptomining Images Rack Up 20M Downloads appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/malicious-docker-cryptomining-images-rack-up-20m-downloads/?utm_source=rss&utm_medium=rss&utm_campaign=malicious-docker-cryptomining-images-rack-up-20m-downloads

Microsoft, PhP, Apple Store, & Video Game Cheats – SWN #111

This week, Dr. Doug talks Microsoft, Apple Store, PhP, Video Game Cheating, Joe Biden’s executive order, & the return of Jason Wood for Expert Commentary!

Time Stamps:

1:22 – Software vendors would have to disclose breaches to U.S. government users under new order: draft

3:33 – Pair of Apex Legends Players Banned for DDoS Server Attack

6:17 – PHP Infiltrated with Backdoor Malware

7:27 – Microsoft Offers Up To $30K For Teams Bugs

8:00 – Windows 10 KB5000842 cumulative update fixes

8:51 – Ransomware admin is refunding victims their ransom payments

11:49 – He believed Apple’s App Store was safe.

23:36 – Weird Tweet From U.S. Strategic Command

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn111

The post Microsoft, PhP, Apple Store, & Video Game Cheats – SWN #111 appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/microsoft-php-apple-store-video-game-cheats-swn-111/?utm_source=rss&utm_medium=rss&utm_campaign=microsoft-php-apple-store-video-game-cheats-swn-111

Network Security News Summary for Wednesday March 31st, 2021

TLS Survey; Perl Netmask Vulnerability; VMWare vRealize; pre-pw0ned docker images

Old TLS Versions: Gone but not Forgotten
https://isc.sans.edu/forums/diary/Old+TLS+versions+gone+but+not+forgotten+well+not+really+gone+either/27260/

Perl Netmask Vulnerability
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/

VMWare vRealize Vulnerability
https://www.vmware.com/security/advisories/VMSA-2021-0004.html

Pre-P0wned Docker Containers
https://unit42.paloaltonetworks.com/malicious-cryptojacking-images/

keywords: pre-pwoned docker; docker; xmrig; miner; vmware; vrealie; ssrf; perl; netmask; tls; shodan

The post Network Security News Summary for Wednesday March 31st, 2021 appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/network-security-news-summary-for-wednesday-march-31st-2021/?utm_source=rss&utm_medium=rss&utm_campaign=network-security-news-summary-for-wednesday-march-31st-2021

Vulnerability Management is Still a Mess – Part 2 – Rafal Los – SCW #67

In the second segment, the SCW hosts will continue the discussion with Raf and hopefully come up with some guidance on what can be done to make vulnerability management work better.
Visit https://www.securityweekly.com/scw for all the latest episodes!
Show Notes: https://securityweekly.com/scw67

The post Vulnerability Management is Still a Mess – Part 2 – Rafal Los – SCW #67 appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/vulnerability-management-is-still-a-mess-part-2-rafal-los-scw-67/?utm_source=rss&utm_medium=rss&utm_campaign=vulnerability-management-is-still-a-mess-part-2-rafal-los-scw-67

Whistleblower: Ubiquiti Breach “Catastrophic”

On Jan. 11, Ubiquiti Inc. [NYSE:UI] — a major vendor of cloud-enabled Internet of Things (IoT) devices such as routers, network video recorders and security cameras — disclosed that a breach involving a third-party cloud provider had exposed customer account credentials. Now a source who participated in the incident response to that breach alleges Ubiquiti massively downplayed a “catastrophic” incident to minimize the hit to its stock price, and that the third-party cloud provider claim was a fabrication.

The post Whistleblower: Ubiquiti Breach “Catastrophic” appeared first on Security Boulevard.

Read More

The post Whistleblower: Ubiquiti Breach “Catastrophic” appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/whistleblower-ubiquiti-breach-catastrophic-2/?utm_source=rss&utm_medium=rss&utm_campaign=whistleblower-ubiquiti-breach-catastrophic-2

ESB-2021.1080 – [RedHat] Quarkus: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2021.1080
        Red Hat build of Quarkus 1.11.6 release and security update
                               30 March 2021

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Quarkus
Publisher:         Red Hat
Operating System:  Red Hat
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Denial of Service               -- Remote/Unauthenticated
                   Access Confidential Data        -- Remote/Unauthenticated
                   Reduced Security                -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2021-20218 CVE-2020-26238 CVE-2020-25724
                   CVE-2020-25633  

Reference:         ESB-2021.1053
                   ESB-2021.0442

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2021:1004

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat build of Quarkus 1.11.6 release and security update
Advisory ID:       RHSA-2021:1004-01
Product:           Red Hat build of Quarkus
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1004
Issue date:        2021-03-29
CVE Names:         CVE-2020-25633 CVE-2020-25724 CVE-2020-26238 
                   CVE-2021-20218 
=====================================================================

1. Summary:

An update is now available for Red Hat build of Quarkus.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability. For
more information, see the CVE links in the References section.

2. Description:

This release of Red Hat build of Quarkus 1.11.6 includes security updates,
bug fixes, and enhancements. For more information, see the release notes
page listed in the References section.

Security Fix(es):

* cron-utils: template injection allows attackers to inject arbitrary Java
EL expressions leading to remote code execution (CVE-2020-26238)

* resteasy-client: potential sensitive information leakage in JAX-RS
RESTEasy Client's WebApplicationException handling (CVE-2020-25633)

* fabric8-kubernetes-client: vulnerable to a path traversal leading to
integrity and availability compromise (CVE-2021-20218)

* resteasy: information disclosure via HTTP response reuse (CVE-2020-25724)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgements, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

The References section of this erratum contains a download link for the
update. You must be logged in to download the update.

4. Bugs fixed (https://bugzilla.redhat.com/):

1879042 - CVE-2020-25633 resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling
1899354 - CVE-2020-25724 resteasy: information disclosure via HTTP response reuse
1901655 - CVE-2020-26238 cron-utils: template injection allows attackers to inject arbitrary Java EL expressions leading to remote code execution
1923405 - CVE-2021-20218 fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise

5. References:

https://access.redhat.com/security/cve/CVE-2020-25633
https://access.redhat.com/security/cve/CVE-2020-25724
https://access.redhat.com/security/cve/CVE-2020-26238
https://access.redhat.com/security/cve/CVE-2021-20218
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus&downloadType=distributions&version=1.11.6
https://access.redhat.com/documentation/en-us/red_hat_build_of_quarkus/1.11/
https://access.redhat.com/articles/4966181

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYGG2idzjgjWX9erEAQgaew//V6fcra4vFHh4IO7bqOUNj2UGo/1CoYrM
HN7Si/9vGnOx1B/ztvW8yEeiVLJS3ffKdZvYwlZG1rXpC52NF2ZDydh8GBEphi6C
l1UR5pHzA7E6xX8aXl7P7IYcu/9zvESYdhYJvhQmdKhZ8a3TyBEULZdIkj2hkwBr
QL0EjAvr61XgMbmCzRpN4A0tdL9hO+8GDU65wwNoQUoVS08sGpagFOQ57kvqnSlG
Eet7Yw0t3y7ITHHlExi9qvpOa9jASlzo8f7ZQbzFUW8UNK4cp9OI7RpYA6vMGWIh
blJ6ihqVMyLn9ebxVNd2jRG1FZRpMj8nu/q02e7ASQZiPKGZ19xfTLthzzlQGH4Q
QWMyGl+3wJ1KtLKpecmu3oh/kjV9kmDXczbDbhTBotD2VIMfRDVgdIxImaj1eIf8
eqeW6SBHh8iN/qnFMT5g+bYqjLNzJDidpVB88OXQcWNlHfvscjbTLZlbsWx1WCb7
shlV7Pj4FPOoSIx2Pqo9Kc/3jsNVJcgN6knjE60Es9FIN/2vuFq+IkIk0wBX9f1Q
e9qOEtMj2/CI5uaW850n1oo+z/BaHSPgN16F7Ga9chO2JPOFs3HyxjNNUo3+rmSi
Au+iHO+cYuM9b9+ghrENE0ULltILqTvZRteXqhRUOfUk9pVEYt3raCahQ34F5ICx
lU1Ue4+T9QU=
=Z7Rn
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYGJkm+NLKJtyKPYoAQgPIQ//UHVho9TH78hT56570pmNgt7YHZKP3iYb
wzi/By2xLWjVGS8oiYEaPzfoUgJXH2OgcBdV0emmj4WlsC5gA3J0icDOt9efIXP/
6Xy1P0RSbSJPcfYALPsWRVIxMW4TtZ+IAlHfutEpNZdmEdPfnut1RrQ8ly15NmLk
2y4b04v9nJcGMt5zvx7n63T/T1HRqQqfYcIZDJTTpOTmi3dj2Rdjc/NQ2JIiUUIT
TBv7puadIPgikEfPxt90D//APH+Ks7vO8WpFj2H4qVVhq6LfrgpztyUUkyvBFjMZ
ljPPboL8IiApovnm9aD70fwL6zQxfp0Rv9rPmAZ/9MyyodahMq8MSlUw3SoyJu+S
njwYLHhhWriXK1gSg6WTnokaSx/0YtsG2A7WM6wT80JYQeaiwF6YU76kN6Hgoo0Y
Tjz8zdAVSK5Sujc6xTTQzQUmeuRRv2o50ilmf219dmhRgqAVDTd6kfBtPrhMLk9l
goBeUV2mvQhwl1qAJEgqdDmjOglliJ/Wu/p+ejuRZ5oERVOOG1Agmt9FSnBRGp9w
WvgfK44C3RKJ/jYoH9wpkSOAqk2Gu5kDnh4Xkqd+fJPtG/1aHdb+IWpIZ0qeE2be
G5o5De5NiZqY/duTHhiEx84zOYSJ3U9UZx0eYT2E40XY2GZVCtUixeh5D//s7vzH
hue3heqf7uM=
=AqsM
-----END PGP SIGNATURE-----

Read More

The post ESB-2021.1080 – [RedHat] Quarkus: Multiple vulnerabilities appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/esb-2021-1080-redhat-quarkus-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-1080-redhat-quarkus-multiple-vulnerabilities

ESB-2021.1078 – [Ubuntu] WebKitGTK: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2021.1078
                   USN-4894-1: WebKitGTK vulnerabilities
                               30 March 2021

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           WebKitGTK
Publisher:         Ubuntu
Operating System:  Ubuntu
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Denial of Service               -- Remote with User Interaction
                   Provide Misleading Information  -- Remote with User Interaction
                   Unauthorised Access             -- Remote with User Interaction
                   Reduced Security                -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2021-1870 CVE-2021-1801 CVE-2021-1799
                   CVE-2021-1789 CVE-2021-1765 CVE-2020-29623
                   CVE-2020-27918  

Reference:         ESB-2021.1071

Original Bulletin: 
   https://ubuntu.com/security/notices/USN-4894-1

- --------------------------BEGIN INCLUDED TEXT--------------------

USN-4894-1: WebKitGTK vulnerabilities
29 March 2021

Several security issues were fixed in WebKitGTK.
Releases

  o Ubuntu 20.10
  o Ubuntu 20.04 LTS
  o Ubuntu 18.04 LTS

Packages

  o webkit2gtk - Web content engine library for GTK+

Details

A large number of security issues were discovered in the WebKitGTK Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.

Update instructions

The problem can be corrected by updating your system to the following package
versions:

Ubuntu 20.10

  o libwebkit2gtk-4.0-37 - 2.30.6-0ubuntu0.20.10.1
  o libjavascriptcoregtk-4.0-18 - 2.30.6-0ubuntu0.20.10.1

Ubuntu 20.04

  o libwebkit2gtk-4.0-37 - 2.30.6-0ubuntu0.20.04.1
  o libjavascriptcoregtk-4.0-18 - 2.30.6-0ubuntu0.20.04.1

Ubuntu 18.04

  o libwebkit2gtk-4.0-37 - 2.30.6-0ubuntu0.18.04.1
  o libjavascriptcoregtk-4.0-18 - 2.30.6-0ubuntu0.18.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK, such as Epiphany, to make all the necessary changes.

References

  o CVE-2021-1765
  o CVE-2020-27918
  o CVE-2021-1870
  o CVE-2021-1801
  o CVE-2020-29623
  o CVE-2021-1789
  o CVE-2021-1799

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYGJkB+NLKJtyKPYoAQjHnA/9EAzJ/axr1STwwpNaNuaRdIdtUhZqhUcJ
8XtEEEsK6y5RkBIii+5fJp7YErLUUSJzfrW6FY/zVx77fAnwrc5v2BSxeCokmxZ5
7VZ066nGKZlUMT8Uhxzq9ZD75rzq7lfQq2/M1a2gB2XcEAXIQmWnWDm2oMZqqkOv
PQhXSJJMLsjtCLDm+T5AikrgpumAiihfpLLlpg0kHs8WQ8JKPftk25sVGb2TeoYD
vxze59aGrPgkePAZqiiyAKOuD6/B+/aUVg6p61ffkdQkdXaKT7x/T6jPCzm4Bpzd
7FRP/rFFo/hjJ/H1obLSdpbBwgJZhi6grijdVB0FcnmB+rYEXh8VfOWekrYB4uq3
+RvTB9dzZwd0bOzsqtHsUjfxBS84vJ182IdUA1Yos9ZWBLoAUCVIP1kGYv4PrKXC
HkTr8B0Q21d53KgpaEyYgcqsLpJFZv2JGLcwEnY5dBHDKkGboTG2h43L/1ueeRkj
0ulOpV0we6mTEJO9GoJP7StWrfA7/d0lIWeeMhBH3BF5MFRtD4f1PkJiv+c5xWuf
W5hlQOLbnYHMjTiLpBLlC5aALp5MUjB/sBhFBsx8ZfOlhTCRqIhy8RysFQ4UVlZp
SRyzT+LLZkqkqK6Hp1vhusjVJ5R2cu70P4CKxu0N2Fb+LX9fD6ToQ0EqHPy24ChO
uHOJaREoOsM=
=98as
-----END PGP SIGNATURE-----

Read More

The post ESB-2021.1078 – [Ubuntu] WebKitGTK: Multiple vulnerabilities appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/esb-2021-1078-ubuntu-webkitgtk-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-1078-ubuntu-webkitgtk-multiple-vulnerabilities

The one reason your iPhone needs a VPN

For years, Apple has marketed its iPhone as the more secure, more private option when compared to other smart phones, which do not, by default, include an end-to-end encrypted messaging app, warn users repeatedly about app location requests, or provide a privacy-forward Single Sign-On feature.

But, while Apple has taken several, commendable steps into protecting users, the company’s reach only goes so far, which means that it alone cannot stop threat actors from snooping on users’ unencrypted web traffic, poorly configured apps from leaking user data to rogue WiFi networks, or mobile phone carriers from selling user data to make money.

For those problems, iPhone users would greatly benefit from using a Virtual Private Network (VPN). A VPN creates an encrypted “tunnel” between your phone and somebody you trust, such as the company you work for, or your VPN provider. Your phone traffic is routed through the tunnel, where it’s protected from surveillance, before joining the internet.

Using a VPN on an iPhone can bolster the overall privacy and security that users have come to expect from the Cupertino-based phone maker, which has literally gone to court to fight back against efforts to downgrade its mobile operating system’s security.

If there’s one reason users need to use a VPN with their iPhones, it’s this: A VPN can protect where Apple cannot. Below are a list of reasons why you need a VPN on your Apple iPhone:

VPNs encrypt your iPhone’s web activity

The Internet is a complex place, with countless servers hosting trillions of web pages, visited by billions of machines every day. When you use the Internet, there are some safeguards in place for protecting your online activity, but those safeguards are incomplete and they aren’t the work of Apple. Expecting Apple to protect all of your Internet traffic is like expecting Ford to make safer highways.

Because of this, when you use an iPhone to browse online, you could still be vulnerable to threat actors snooping on your Internet traffic when you use a public WiFi network, like when working at a cafe, staying at a hotel, or waiting for a flight at the airport.

Using a VPN on your phone can protect you against those attacks, in exactly the same way it would if you were browsing the web on your laptop or desktop machine. You get the same security and the same privacy boosts, no matter the device. This is crucial because, as users begin to spend more time navigating the Internet on their phones, they are spending more time connecting to it from untrusted environments, over somebody else’s WiFi.

The good news for Internet users is that there is a long-standing effort to encrypt the entirety of the web. But although great strides have been made in the last decade, it’s important to remember that the Internet today is not yet reliably private or secure. Whilst lots of web pages are served over HTTPS (the secure form of HTTP) many are not, and most DNS lookups–which reveal the names of the websites you’re visiting–are vulnerable to snooping.

The better news is that, until the entirety of the web is encrypted, a VPN will fill in the gaps and provide much of the security online that Apple can’t control. Remember, the iPhone’s security can only go so far.

VPNs encrypt your iPhone’s app traffic

Encrypting your iPhone’s web activity while browsing online is good, but realistically, many of your iPhone apps are connecting to the Internet on a near round-the-clock basis, crunching data in the Cloud, and refreshing in the background to check for notifications and updates. Just because these connections aren’t happening through a browser doesn’t mean that threat actors are any less interested in it.

In fact, the vulnerabilities of many poorly configured apps are likely too many to count. Time after time, studies of different types of apps have shown too many are either missing the encryption necessary to protect you, or that it exists in a weak, flawed or broken state. And, most alarmingly, there is no way for users to tell the good apps from the bad ones without specialist knowledge and equipment.

Just like the web, there is only so much that Apple can do to protect you from apps that communicate insecurely. But, again, a VPN can help plug the gaps in your apps’ encryption by wrapping it all in a protective tunnel.

VPNs stop your carrier from monetizing your data

Protecting your Internet activity from eavesdropping doesn’t just defang threat actors, it also prevents your mobile service carrier from making an extra buck at your expense of your privacy. At least in the United States, mobile service carriers like Verizon, AT&T, and T-Mobile can look at your Internet activity–including what you look at, what apps you’ve downloaded, and how you interact with certain services– and then bundle that activity into profiles that it can then sell for advertising purposes.

If this sounds wrong to you, you’re not alone. And if you think that mobile carriers wouldn’t abuse your data, think again. Last year, the US Federal Communications Commission announced a collective $200 million in fines against Verizon, AT&T, Sprint, and T-Mobile for those companies’ sale of user location data without users’ consent.

A VPN on iPhone will hide a great deal of your Internet activity from your mobile carrier, in the exact same way that it hides your online activity from your Internet Service Provider. Your carrier is on the outside of the VPN’s tunnel and can’t look inside it. Take a stand for your privacy and reclaim your Internet activity for yourself.

By now, it should be clear that using a VPN with an iPhone isn’t futile, or redundant, or useless. In fact, it’s a great way to bolster your security and your privacy.

The post The one reason your iPhone needs a VPN appeared first on Malware Devil.



https://malwaredevil.com/2021/03/29/the-one-reason-your-iphone-needs-a-vpn-9/?utm_source=rss&utm_medium=rss&utm_campaign=the-one-reason-your-iphone-needs-a-vpn-9

5 Teen Internet Safety Tips

How could our teens live without their smartphones, laptops, and other devices that allow them to go online, communicate and have fun with their friends in a safe manner?  We have provided five (5) tips they should remember.

The post 5 Teen Internet Safety Tips appeared first on Security Boulevard.

Read More

The post 5 Teen Internet Safety Tips appeared first on Malware Devil.



https://malwaredevil.com/2021/03/30/5-teen-internet-safety-tips/?utm_source=rss&utm_medium=rss&utm_campaign=5-teen-internet-safety-tips

Barbary Pirates and Russian Cybercrime

In 1801, the United States had a small Navy. Thomas Jefferson deployed almost half that Navy—three frigates and a schooner—to the Barbary C...