Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for How identification, ...

 Privacy

It happens to every one of us every day. We are constantly identified, authenticated, and authorized by various systems. And yet, many people confuse the meanings of these words, often using the terms identification or authorization when, in fact, they are talking about authentication. That’s no big deal as long   show more ...  

as it is just an everyday conversation and both sides understand what they are talking about. It is always better to know the meaning of the words you use, though, and sooner or later, you will run into a geek who will drive you crazy with clarifications, whether it’s authorization versus authentication, fewer or less, which or that, and so on. So, what do the terms identification, authentication, and authorization mean, and how do the processes differ from one another? First, we will consult Wikipedia: “Identification is the act of indicating a person or thing’s identity.” “Authentication is the act of proving […] the identity of a computer system user” (for example, by comparing the password entered with the password stored in the database). “Authorization is the function of specifying access rights/privileges to resources.” You can see why people who aren’t really familiar with the concepts might mix them up. Using raccoons to explain identification, authentication, and authorization Now, for greater simplicity, let’s use an example. Let’s say a user wants to log in to their Google account. Google works well as an example because its login process is neatly broken into several basic steps. Here is what it looks like: First, the system asks for a login. The user enters one and the system recognizes it as a real login. This is identification. Google then asks for a password. The user provides it, and if the password entered matches the password stored, then the system agrees that the user indeed seems to be real. This is authentication. In most cases, Google then asks for a one-time verification code from a text message or authenticator app, too. If the user enters that correctly as well, the system will finally agree that he or she is the real owner of the account. This is two-factor authentication. Finally, the system gives the user the right to read messages in their inbox and such. This is authorization. Authentication without prior identification makes no sense; it would be pointless to start checking before the system knew whose authenticity to verify. One has to introduce oneself first. Along the same lines, identification without authentication would be silly. Anyone could enter any login that existed in the database — the system would need the password. But someone could sneak a peek at the password or just guess it. Asking for further proof that only the real user can have, such as a one-time verification code, is better. By contrast, authorization without identification, let alone authentication, is quite possible. For example, you can provide public access to your document in Google Drive, so that it is available to anyone. In that case you might see a notice saying that your document is being viewed by an anonymous raccoon. Even though the raccoon is anonymous, the system did authorize it — that is, grant it the right to view the document. However, if you had given the read right only to certain users, the raccoon would have had to get identified (by providing its login), then authenticated (by providing the password and a one-time verification code) to gain the right to read the document (authorization). When it comes to reading the contents of your mailbox, Google will never authorize an anonymous raccoon to read your messages The raccoon would have to introduce itself as you, with your login and password, at which point it would no longer be an anonymous raccoon; Google would identify it as you. So, now you know in what ways identification is different from authentication and authorization. One more important point: Authentication is perhaps the key process in terms of the security of your account. If you are using a weak password for authentication, a raccoon could hijack your account. Therefore: Create strong and unique passwords for all of your accounts. If you have trouble remembering your passwords, a password manager has your back. It can help with generating passwords, too. Activate two-factor authentication, with one-time verification codes in text messages or an authenticator application, for every service that supports it. Otherwise, some anonymous raccoon that got its paws on your password will be able to read your secret correspondence or do something even nastier.

 Trends, Reports, Analysis

Web-phishing targeting various online services almost doubled during the COVID-19 pandemic: it accounted for 46 percent of the total number of fake web pages, Group-IB reveals.

 Trends, Reports, Analysis

Australia scored number eight out of 30 major nations for "cyber intent" in the National Cyber Power Index 2020 (NCPI) published earlier this month, but only number 16 for "cyber capability".

 Feed

This Metasploit module exploits command injection vulnerabilities and an insecure default sudo configuration on VyOS versions 1.0.0 through 1.1.8 to execute arbitrary system commands as root. VyOS features a restricted-shell system shell intended for use by low privilege users with operator privileges. This module   show more ...  

exploits a vulnerability in the telnet command to break out of the restricted shell, then uses sudo to exploit a command injection vulnerability in /opt/vyatta/bin/sudo-users/vyatta-show-lldp.pl to execute commands with root privileges. This module has been tested successfully on VyOS 1.1.8 amd64 and VyOS 1.0.0 i386.

 Feed

Ubuntu Security Notice 4520-1 - It was discovered that Exim SpamAssassin does not properly handle configuration strings. An attacker could possibly use this issue to execute arbitrary code.

 Feed

B-swiss 3 Digital Signage System version 3.6.5 suffers from an authenticated arbitrary PHP code execution vulnerability. The vulnerability is caused due to the improper verification of uploaded files in index.php script thru the rec_poza POST parameter. This can be exploited to execute arbitrary PHP code by uploading   show more ...  

a malicious PHP script file that will be stored in the /usr/users directory. Due to an undocumented and hidden maintenance account admin_m which has the highest privileges in the application, an attacker can use these hard-coded credentials to authenticate and use the vulnerable image upload functionality to execute code on the server.

 Feed

Ubuntu Security Notice 4521-1 - It was discovered that pam_tacplus did not properly manage shared secrets if DEBUG loglevel and journald are used. A remote attacker could use this issue to expose sensitive information.

 Feed

Red Hat Security Advisory 2020-3780-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

 Feed

Ubuntu Security Notice 4522-1 - It was discovered that noVNC did not properly manage certain messages, resulting in the remote VNC server injecting arbitrary HTML into the noVNC web page. An attacker could use this issue to conduct cross-site scripting attacks.

 Feed

German authorities last week disclosed that a ransomware attack on the University Hospital of Düsseldorf (UKD) caused a failure of IT systems, resulting in the death of a woman who had to be sent to another hospital that was 20 miles away. The incident marks the first recorded casualty as a consequence of cyberattacks on critical healthcare facilities, which has ramped up in recent months. The

 Industry Intel

Reading Time: ~ 2 min. Magecart Launches Largest E-commerce Attack to Date Roughly 2000 e-commerce sites were compromised in the latest Magecart campaign targeting an out-of-date version of Magento software. It’s believed an additional 95,000 sites that haven’t patched to the latest Magento version could also be   show more ...  

targeted by the payment skimming malware. The campaign began last Friday and by Monday had stolen data from over 1,900 stores serving tens of thousands of customers. Staples Delivery System Responsible for Data Breach Nearly two weeks after being contacted by a cybersecurity firm regarding their use of unsecured VPN servers, Staples has released a statement about a data breach that stemmed from a flaw in their delivery systems. Because Staples’ delivery tracking system required only an order number to pull up the entire order summary, customers were able to enter any number around their own order and access payment and other sensitive information belonging to other Staples customers. While the company has since resolved the flaw, it seems they have not yet contacted victims whose information was exposed. Staffing Firm Suffers Second Ransomware Attack in 2020 Artech Information Systems, a global IT staffing firm, has recently fallen victim to their second ransomware attack of the year. Following a January attack by the REvil ransomware group, which released a small portion of company data after not receiving a ransom payment, Artech has now been infiltrated by the MAZE group, likely using a prior backdoor to the systems. Secondary ransomware attacks typically stem from improper resolution of the initial attack that leaves a system an easy target for another group. Misconfigured Elasticsearch Exposes Over 100,000 Razer Customers A security researcher found an unsecured Elasticsearch cluster late last month containing highly sensitive information for over 100,000 Razer customers. The exposed data contained personally identifiable information and order details with everything but the actual payment card data. Fortunately, Razer was quick to resolve the issue after being notified and set up an email worried customers could contact for more information. SunCrypt Ransomware Targets University Hospital New Jersey (UHNJ) Over 240GB of data was allegedly stolen from the University Hospital New Jersey after a SunCrypt ransomware attack. The attack was likely initiated against university systems shortly after a TrickBot infection last month compromised systems. The owners of SunCrypt have already released 1.7GB of the stolen data, which equates to roughly 48,000 documents containing highly sensitive personal information on patients and employees. The post Cyber News Rundown: Magecart Massive Attack appeared first on Webroot Blog.

2020-09
Aggregator history
Monday, September 21
TUE
WED
THU
FRI
SAT
SUN
MON
SeptemberOctoberNovember