Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Interactive world ma ...

 Special Projects

Need to represent data in a way that really grabs attention? That calls for an infographic. Preferably interactive. Preferably global. And most preferable of all, encompassing the entire planet. Here are six world maps that could suck you in for hours (so don’t open them if you have urgent business to attend to).   show more ...  

Everyone else, welcome to our list of top Internet globes. Google Earth: The one and only https://earth.google.com/ It’s scary to think that Google launched its Earth project 20 years ago. The map grew and changed, became popular, and then seemed to fall out of fashion — unjustly, it has to be said. The current version not only lets you scour any piece of land to find your home, but also now features 3D models of the planet’s top architectural monuments and geographical wonders. Anyone sick of gazing at the Sydney Opera House or the Eiffel Tower can take a computer-generated flight over the Alps or the Himalayas. The app includes virtual tours for those cooped up at home because of the pandemic, as well as handy tools for measuring distances and calculating areas. LeoLabs: Everything in orbit https://platform.leolabs.space/visualization This globe will appeal to prophets of doom and fans of conspiracy and espionage theories: The map tracks all of the satellites (and what they are turning into, i.e., space debris) currently orbiting our planet. You can zoom in and hover your mouse cursor over any object to find out its name and type (satellite, debris, or something else). Detailed satellite information, sadly, is not provided, but you can do your own online search based on names. Ventusky: Weather at your fingertips https://www.ventusky.com/ Nothing to talk about? That’s what the weather’s for! This map provides real-time visualizations of meteorological data for any location on Earth. On the left-hand side, you can select temperature, cloud cover, pressure, precipitation, humidity, air quality — anything that goes on outside. On the right, you can change the units of measurement so as not to wrestle with inches versus centimeters or Fahrenheit versus Celsius. The timeline at the bottom offers a rudimentary weather forecast. Our favorite pastime at the moment is checking the temperature in Verkhoyansk, that well-known vacation spot and an excellent data point for anyone who complains “it’s a bit chilly today.” Flightradar24: Everything about aircraft https://www.flightradar24.com/ For those frustrated with the lack of detailed satellite data in LeoLabs’ visualisation, welcome to Flightradar24. Here you can find out about almost any aircraft currently in flight or about to take off, in real time. That includes information about the airline, place of departure and destination, model, altitude, speed, and route progress. Besides being incredibly interesting, the service has practical benefits for those who like to keep everything under control. Say you’re meeting someone at the airport: Just enter the flight number on the Flightradar24 to learn the plane’s precise landing time. Flight info on the airport website is for wimps. Paid subscribers get to see a more comprehensive flight history, with aircraft serial number, vertical speed, outboard temperature, and a bunch of other stats for true aviation geeks. Incidentally, a similar map exists for seagoing vessels. And even though the Ever Given blockage has long been cleared, it’s still fascinating to watch the marine traffic through the Suez Canal. TheTrueSize: Which is bigger, Greenland or India? https://thetruesize.com/ The greatest ever illusionist is not David Blaine or your bank manager, but Gerardus Mercator. There are other ways to project a sphere onto a plane, but the world map familiar to everyone since childhood is his. Print out the map and try to stick it evenly onto a globe, however, and you’ll drift off course — and as you get closer to the poles, the size mismatch only increases. The trick is, with the Mercator projection, the horizontal dimensions in the extreme northern and southern latitudes have to be stretched, which causes Greenland and Africa to look roughly equal in size. TheTrueSize lets you take any country — from that same Mercator projection — and drag it around the map to make objective comparisons. Just type a country’s name in the search bar, and when it’s highlighted on the map, drag it to a different part of the world to see, for example, Mexico’s real size relative to Europe, or the Democratic Republic of the Congo’s to Alaska. Not recommended for users from Greenland. Earth 2050: Glimpse the future https://2050.earth/ It’s our very own predictions of the future, all in one interactive globe. Choose a planning horizon (to 2030, 2040, or 2050) and find out which fruits of progress will ripen. Check out when the first underwater farms, transformer apartments, and Martian colonies — or even (don’t hold your breath) Half-Life 3 — will appear. Some predictions come from professional futurologists, others from users. So if you feel like the map is missing something, we encourage you to share your vision. Note that submissions are moderated, so please try to keep them within the laws of physics.

image for ‘Trojan Source’ ...

 Latest Warnings

Virtually all compilers — programs that transform human-readable source code into computer-executable machine code — are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected, new research released today warns. The   show more ...  

vulnerability disclosure was coordinated with multiple organizations, some of whom are now releasing updates to address the security weakness. Researchers with the University of Cambridge discovered a bug that affects most computer code compilers and many software development environments. At issue is a component of the digital text encoding standard Unicode, which allows computers to exchange information regardless of the language used. Unicode currently defines more than 143,000 characters across 154 different language scripts (in addition to many non-script character sets, such as emojis). Specifically, the weakness involves Unicode’s bi-directional or “Bidi” algorithm, which handles displaying text that includes mixed scripts with different display orders, such as Arabic — which is read right to left — and English (left to right). But computer systems need to have a deterministic way of resolving conflicting directionality in text. Enter the “Bidi override,” which can be used to make left-to-right text read right-to-left, and vice versa. “In some scenarios, the default ordering set by the Bidi Algorithm may not be sufficient,” the Cambridge researchers wrote. “For these cases, Bidi override control characters enable switching the display ordering of groups of characters.” Bidi overrides enable even single-script characters to be displayed in an order different from their logical encoding. As the researchers point out, this fact has previously been exploited to disguise the file extensions of malware disseminated via email. Here’s the problem: Most programming languages let you put these Bidi overrides in comments and strings. This is bad because most programming languages allow comments within which all text — including control characters — is ignored by compilers and interpreters. Also, it’s bad because most programming languages allow string literals that may contain arbitrary characters, including control characters. “So you can use them in source code that appears innocuous to a human reviewer [that] can actually do something nasty,” said Ross Anderson, a professor of computer security at Cambridge and co-author of the research. “That’s bad news for projects like Linux and Webkit that accept contributions from random people, subject them to manual review, then incorporate them into critical code. This vulnerability is, as far as I know, the first one to affect almost everything.” The research paper, which dubbed the vulnerability “Trojan Source,” notes that while both comments and strings will have syntax-specific semantics indicating their start and end, these bounds are not respected by Bidi overrides. From the paper: “Therefore, by placing Bidi override characters exclusively within comments and strings, we can smuggle them into source code in a manner that most compilers will accept. Our key insight is that we can reorder source code characters in such a way that the resulting display order also represents syntactically valid source code.” “Bringing all this together, we arrive at a novel supply-chain attack on source code. By injecting Unicode Bidi override characters into comments and strings, an adversary can produce syntactically-valid source code in most modern languages for which the display order of characters presents logic that diverges from the real logic. In effect, we anagram program A into program B.” Anderson said such an attack could be challenging for a human code reviewer to detect, as the rendered source code looks perfectly acceptable. “If the change in logic is subtle enough to go undetected in subsequent testing, an adversary could introduce targeted vulnerabilities without being detected,” he said. Equally concerning is that Bidi override characters persist through the copy-and-paste functions on most modern browsers, editors, and operating systems. “Any developer who copies code from an untrusted source into a protected code base may inadvertently introduce an invisible vulnerability,” Anderson told KrebsOnSecurity. “Such code copying is a significant source of real-world security exploits.” Image: XKCD.com/2347/ Matthew Green, an associate professor at the Johns Hopkins Information Security Institute, said the Cambridge research clearly shows that most compilers can be tricked with Unicode into processing code in a different way than a reader would expect it to be processed. “Before reading this paper, the idea that Unicode could be exploited in some way wouldn’t have surprised me,” Green told KrebsOnSecurity. “What does surprise me is how many compilers will happily parse Unicode without any defenses, and how effective their right-to-left encoding technique is at sneaking code into codebases. That’s a really clever trick I didn’t even know was possible. Yikes.” Green said the good news is that the researchers conducted a widespread vulnerability scan, but were unable to find evidence that anyone was exploiting this. Yet. “The bad news is that there were no defenses to it, and now that people know about it they might start exploiting it,” Green said. “Hopefully compiler and code editor developers will patch this quickly! But since some people don’t update their development tools regularly there will be some risk for a while at least.” Nicholas Weaver, a lecturer at the computer science department at University of California, Berkeley, said the Cambridge research presents “a very simple, elegant set of attacks that could make supply chain attacks much, much worse.” “It is already hard for humans to tell ‘this is OK’ from ‘this is evil’ in source code,” Weaver said. “With this attack, you can use the shift in directionality to change how things render with comments and strings so that, for example ‘This is okay” is how it renders, but ‘This is’ okay is how it exists in the code. This fortunately has a very easy signature to scan for, so compilers can [detect] it if they encounter it in the future.” The latter half of the Cambridge paper is a fascinating case study on the complexities of orchestrating vulnerability disclosure with so many affected programming languages and software firms. The researchers said they offered a 99-day embargo period following their initial disclosure to allow affected products to be repaired with software updates. “We met a variety of responses ranging from patching commitments and bug bounties to quick dismissal and references to legal policies,” the researchers wrote. “Of the nineteen software suppliers with whom we engaged, seven used an outsourced platform for receiving vulnerability disclosures, six had dedicated web portals for vulnerability disclosures, four accepted disclosures via PGP-encrypted email, and two accepted disclosures only via non-PGP email. They all confirmed receipt of our disclosure, and ultimately nine of them committed to releasing a patch.” Eleven of the recipients had bug bounty programs offering payment for vulnerability disclosures. But of these, only five paid bounties, with an average payment of $2,246 and a range of $4,475, the researchers reported. Anderson said so far about half of the organizations maintaining the affected computer programming languages contacted have promised patches. Others are dragging their feet. “We’ll monitor their deployment over the next few days,” Anderson said. “We also expect action from Github, Gitlab and Atlassian, so their tools should detect attacks on code in languages that still lack bidi character filtering.” As for what needs to be done about Trojan Source, the researchers urge governments and firms that rely on critical software to identify their suppliers’ posture, exert pressure on them to implement adequate defenses, and ensure that any gaps are covered by controls elsewhere in their toolchain. “The fact that the Trojan Source vulnerability affects almost all computer languages makes it a rare opportunity for a system-wide and ecologically valid cross-platform and cross-vendor comparison of responses,” the paper concludes. “As powerful supply-chain attacks can be launched easily using these techniques, it is essential for organizations that participate in a software supply chain to implement defenses.” Weaver called the research “really good work at stopping something before it becomes a problem.” “The coordinated disclosure lessons are an excellent study in what it takes to fix these problems,” he said. “The vulnerability is real but also highlights the even larger vulnerability of the shifting stand of dependencies and packages that our modern code relies on.” Rust has released a security advisory for this security weakness, which is being tracked as CVE-2021-42574 and CVE-2021-42694. Additional security advisories from other affected languages will be added as updates here. The Trojan Source research paper is available here (PDF).

 Malware and Vulnerabilities

Cybercriminals are flooding to use the Snake password-stealing trojan, making it one of the popular malware families used in attacks. Snake has been active since November 2020.

 Companies to Watch

Under the terms of the agreement, RED74 will continue to be based in New Jersey but will become a wholly owned subsidiary of Cerberus Sentinel, which is sited in Scottsdale, Arizona.

 Breaches and Incidents

UMass Memorial Health is the latest large healthcare network to report an email phishing incident that potentially compromised hundreds of thousands of individuals' protected health information.

 Security Products & Services

Google introduced Private Set Membership (PSM), a cryptographic protocol that helps clients check whether a specific identifier is present in a list held by a server, in a privacy-preserving manner.

 Feed

Red Hat Security Advisory 2021-4033-01 - The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

 Feed

Red Hat Security Advisory 2021-4034-01 - The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

 Feed

Red Hat Security Advisory 2021-4035-01 - The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

 Feed

Red Hat Security Advisory 2021-4039-01 - The GNU Compiler Collection is a portable compiler suite with support for various programming languages, including C, C++, and Fortran. The devtoolset-10-gcc packages provide the Red Hat Developer Toolset 10 version of GCC, as well as related libraries.

 Feed

Red Hat Security Advisory 2021-4036-01 - The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

 Feed

Red Hat Security Advisory 2021-4038-01 - The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

 Feed

Red Hat Security Advisory 2021-4037-01 - The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

 Feed

Cybersecurity researchers disclosed details of what they say is the "largest botnet" observed in the wild in the last six years, infecting over 1.6 million devices primarily located in China, with the goal of launching distributed denial-of-service (DDoS) attacks and inserting advertisements into HTTP websites visited by unsuspecting users. Qihoo 360's Netlab security team dubbed the botnet "

 Feed

Multiple vulnerabilities have been disclosed in Hitachi Vantara's Pentaho Business Analytics software that could be abused by malicious actors to upload arbitrary data files and even execute arbitrary code on the underlying host system of the application. The security weaknesses were reported by researchers Alberto Favero from German cybersecurity firm Hawsec and Altion Malka from Census Labs

 Feed

There is often confusion between Cloud Access Security Brokers (CASB) and SaaS Security Posture Management (SSPM) solutions, as both are designed to address security issues within SaaS applications. CASBs protect sensitive data by implementing multiple security policy enforcements to safeguard critical data. For identifying and classifying sensitive information, like Personally Identifiable

 Feed

A novel class of vulnerabilities could be leveraged by threat actors to inject visually deceptive malware in a way that's semantically permissible but alters the logic defined by the source code, effectively opening the door to more first-party and supply chain risks. Dubbed "Trojan Source attacks," the technique "exploits subtleties in text-encoding standards such as Unicode to produce source

 Feed only

Graham Cluley Security News is sponsored this week by the folks at Recorded Future. Thanks to the great team there for their support! With organizations facing an unprecedented level of attacks targeting their employees, partners, and customers, strong identity authentication is more important than ever An   show more ...  

intelligence-driven approach to identity protection disrupts adversaries before damage … Continue reading "Prevent identity fraud and disupt attackers with Recorded Future Identity Intelligence"

2021-11
Aggregator history
Monday, November 01
MON
TUE
WED
THU
FRI
SAT
SUN
NovemberDecemberJanuary