Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Top-4 outdated techn ...

 Business

In August 2022, Japanese Minister of Digital Affairs, Taro Kono, declared war on old storage media such as floppy disks. The original Japanese-language document provides a simple analysis of Japanese legislation, which to this day still has nearly 1900 references to outdated storage media, most of which belong in a   show more ...  

museum. They include ordinary floppy disks, optical recording media, common definitions like magneto-optical drive and even magnetic tape. This means that, in some cases, organizations or individuals need to file certain information on an old medium, which is, to say the least, inconvenient. Diskettes are not mandatory in all cases, but judging by certain statements made by Taro Kono, a relatively recently appointed to his post, retro technology is still used more often in Japan than it should be. Is using outdated technology a problem? Try to imagine yourself as someone who suddenly needs to file an official document on a floppy disk, with no other option given at all. Could you find at least one floppy disk at home? And how about a floppy-disk drive to put it in? The author of this article has both, so this is being written from the position of unconditional love for retro technology. But its important to remember that obsolete tech is simply inconvenient for critical tasks — and sometimes even unsafe. Lets try and analyze some of the most well-known cases when old devices turn out to be needed years or decades after they were made. Diskettes What are they? Among the first data carriers for PCs. Eight inches in diameter, the first floppy disks were developed in the 1960s. In 1976, smaller 5.25-inch floppy disks were invented. This size was inherited by later optical media such as Blu-Ray disks. In the early 1980s, Sony developed more effective 3.5-inch diskettes, and for most of the 1990s they were the most popular form of data exchange among computer users. The maximum amount of data that fits onto a single 3.5-inch floppy disk is 1.44 MB. Okay, sometimes you could write more, but now were talking about the most compatible version that could be read in the floppy drive of any personal computer 25 years ago. Three floppy disk versions: 8-inch, 5.25-inch, and 3.5-inch. Source. Floppy disks were so universal for computers in the 1980–90s that all other attempts to create something either more reliable or with increased capacity failed to catch on — until CD-R and CD-RW optical media became available. Even in the early 2000s, a disk drive came as standard on most desktop PCs. Early attempts to retire floppy disks were made back in the late 1990s: with their revolutionary design, Apple iMacs came with an optical drive only and no disk drive. It was only later — some 15 years ago —  when floppy disks finally did become obsolete. Many Microsoft Word documents couldnt even fit onto a disk, so it was much easier to save files onto a flash drive or CD. There was also the matter of reliability: floppy disks were known to suddenly lose data when you needed it most. However, thanks to their long lifespan, floppy disks are still available today. Floppy drives are too. Connected via USB, they are even supported in the latest versions of operating systems. Nevertheless, diskettes today should only be used for exercises in nostalgia. It takes about a minute to save just a megabyte of data to one: embarrassingly slow. Yet there are times when you have to use floppy disks. In 2016, the U.S. issued a rather dull report on a topic familiar to us: on the use of old technology in government institutions, and the need to combat this phenomenon. Certain media outlets extracted a remarkable fact from it. The American nuclear arsenal control system was still using floppy disks, and not the later ones, but the original eight-inch type. 8-inch floppy disks were, until recently, used to control the U.S. nuclear arsenal. Source. In 2019, those floppy disks were replaced with more contemporary technology, but the system itself, based on an IBM Series/1 computer from the 1970s, is still in operation. This is a good example why old media is still used. Its not out of love for antiquity, but because theres no other option. Specialized computer systems built decades ago are very expensive to replace or modernize, so, as long as an antique does what it needs to do and can be repaired if required, it remains in operation. Heres another example. In 2020, Pen Test Partners examined a decommissioned Boeing 747 and found that a floppy drive that was used to update the navigation system. While that was a surprise to safety professionals, for those in aircraft maintenance, its all in a days work. You can read more about this here, for example. Boeing 747s still get critical updates via floppy disks. Source. Why does this happen? An airplane has a very long service life — decades. At the same time, aviation has some of the most stringent safety requirements. During an aircrafts lifetime, its engines and even parts of its fuselage can be replaced multiple times. But the electronics generally remain intact. Of course, newer aircraft versions no longer use floppy disks. But in older, still reliable and well-maintained aircraft, the computer systems that help pilots usually remain unchanged. Upgrading those computer systems is more difficult because every change requires numerous safety tests. And it doesnt stop there. Pilots are specifically trained to use avionics of a particular modification. Maintenance specialists at airports and technical centers are trained likewise around the world. So you cant just update those systems when it takes your fancy. Which means its often easier to buy a new aircraft when the time comes to renew the fleet. Fax, aka facsimile communication What is it? Basically, technology for transmitting copies of documents using a phone line. Fax machines are a direct descendant of the telegraph — a method of sending text messages through wires. Both technologies originated in the 19th century, and by the beginning of the 20th century, the means of sending not just individual letters, but free-form handwritten notes and even photographs, was reasonably well perfected. Commercial use of faxes began about half a century ago. Any consumer or company could then receive and send photocopies of documents over telephone wires. A typical fax machine from the early 1990s. Source. Fax evolved in parallel with modems, and many of the later technologies of both these devices had much in common. The fundamental difference was that modems required a computer, but a fax was a self-sufficient machine. Many modems, with a special program on a PC, could act as a fax machine. In todays terms, a fax machine contained a document scanner, a printer, and a modem. If you needed to send a document, you scanned it, entered the recipients phone number, and a digital copy (in rather average quality, usually monochrome) was wired. Before the arrival of the internet, this was quite a reliable way of document sharing over distances. Potential clients could get a price list, or a copy of a contract, and it could be sent back signed and stamped. Curiously, still today in some countries a signed document sent by fax is considered legally binding, whereas that same document, signed, scanned and sent by e-mail, may not be counted as evidence in court, for example. Theres not a single reason to use a fax machine in the 21st century. Its easier to send a document by e-mail or take a photo and share it in a messenger. If you need to verify the identity of a documents creator, theres electronic digital signature technology. Nevertheless, faxes are still used rather a lot in some regions, including in Japan. There, employees not having a fax at home ran into work communication issues during the covid-19 pandemic. It turned out that for many its difficult to change established communication processes with clients or colleagues, without losing necessary contacts; its easier to continue using outdated technology. In addition, the age factor plays a role for fax machines: the older people get, the harder it is for them to master new computer systems; while the old ones work just fine. The fax machine in our top-4 is probably the simplest retro-technology of all four. If for some reason you need to use one, you can have a real machine in the office. But you can also fully emulate a fax on a virtual server. Its connected to a virtual phone line, and is in fact a simple data transmission channel over the internet. So, unlike with aircraft, its possible to place legacy tech on a modern track, where it works with no trouble. Typewriter What is it? Essentially, an ancient text processor: a way of creating typewritten manuscripts, and one of the oldest technologies that seriously influenced the evolution of computers. The typewriter is a great technological achievement, and was almost fully formed at the end of the 19th century. Every computer has vestiges of this earlier development. The typical QWERTY layout was standardized in the 1890s. The shift key gets its name from a mechanical function in a typewriter, where the whole set of bits that print characters on paper through an ink ribbon is shifted upward to type capital letters. Typing was the first thing that personal computers made more convenient in the 1970s and 1980s. On some electronic typewriters, you could enter and edit a single line of text on a small character display, if required. A computer allows you to create an entire multi-page document before printing it off. It can contain characters from different alphabets. And not just letters, but graphics, and even images. You dont even have to print the document on a printer: you can send it to an editor, boss or client electronically. On a floppy disk, for example! A typical mechanical typewriter from the 1970s. Source. Still, mechanical typewriters do have important advantages: they can be operated without electricity, they cannot be infected with a virus, and their data storage device wont fail. However, documents are more likely to be damaged by fire, flood or small rodents. After numerous scandals related to cyber-espionage, some media reported that certain state authorities of different countries (for example, Russia and Germany) were buying typewriters to handle the most sensitive information. Indeed, you could say that the most secure computer is no computer at all. And in some cases, this level of information protection is probably entirely justified. But for mere mortals, the typewriter has long been an artifact from the past, used for entertainment or creating a special atmosphere of creativity. You cannot be distracted by pictures from social networks if your word processor cant connect to the internet. A notable fact is that a typewriter may be safe from a cyberattack, but it does not ensure anonymity. In the event of an investigation, its easy enough to match a document to a particular typewriter based on minor defects in the typed characters, or even by the way a particular person hits the keys. Old computers Outside specialized systems, outdated government procedures and the like, most retro technologies need to be used for the two reasons already described above; that is, either moving over to new hardware is very expensive, or just inconvenient as everyone is set in their ways. Last year, a YouTuber described how an elderly campsite owner still uses an Atari ST from 1986 to run his business. Frans Bos, from the Netherlands, wrote his own software to keep track of visitors, bookkeeping, and other things. And still today (or at least in 2021 when the video was shot) he still uses his ancient software, because it does the job. There are more complicated, more common, and considerably less romantic examples. A machine-tool controlled by software written for MS-DOS and thus only working with a corresponding PC, for example. Also, this is extremely common when it comes to servicing relatively old cars. They have a built-in computer, but the software to communicate with it requires Windows 98 or Windows XP, and preferably with hardware from twenty years ago. Even large car manufacturers are forced to keep ancient PCs in stock, just in case a customer comes to them with a repair request. Legacy technology is used plenty in industry, where computerized devices cost millions or tens of millions of dollars and last for decades. At the other end of the spectrum, you will often find a laptop from the early 2000s running long-unsupported diagnostic programs at your nearest car service center. Often hidden from sight, ancient technology is at work in organizations. Somewhere in a dusty closet, a system administrators PC from the 1990s is doing its thing with software written by someone who has long since retired. And only when it gets accidentally unplugged does it become clear that a companys profits are bound to this museum piece. Advanced protection of junk Lets look at all these artifacts from a security perspective. Is it possible to transmit a malicious file on a floppy disk? Yes, easily, and thats actually how viruses started to spread — even before the internet era. Yet modern malicious code might not fit onto a floppy disk, as some malware now takes up dozens of megabytes. Ancient malware, on the contrary, may not run on modern operating systems. Perhaps the greatest danger is posed by simply old computers, especially if theyre connected to a companys local network or even the internet. Older operating systems, like Windows XP, have not received updates for many years. On the other hand, vulnerabilities in them are well known. Yes, a would-be hacker would likely have to bone up on the equipment to hack such an ancient PC. But it wouldnt take long. And there are plenty of ready-made tools to exploit the numerous holes in the software. Thus, its easy to imagine how a hacker could gain access to an entire enterprise network using an outdated and vulnerable computer, even if the rest of the infrastructure is up to date. Perhaps the greatest danger from such a scenario is posed for medical institutions. Reliable and still current devices for diagnosing patients, monitoring pulse, temperature and blood pressure, and regulating medication, all run on outdated software. Maliciously disabling such systems, for example in order to demand a ransom, could cost someones life. So, floppy disks are not the problem. Theyre just inconvenient to handle. The real problem is that floppy disks usually come with an outdated computer. If the use of such old systems is vital, then its imperative to isolate them from the rest of the network so that theyre not the Achilles heel of the entire IT infrastructure. Its desirable to use a security solution that can at least scan archived data carriers and is able to neutralize malware of the appropriate age. Kaspersky solutions do an excellent job of this, most often identifying viruses of the past through behavioral analysis. It can be difficult to part with familiar work tools youve had years. But sometimes its simply necessary when an old solution, by definition, no longer provides the necessary level of security. Despite the fact that modern software and services are taking up more disk space over time and requiring ever more powerful hardware, they also provide increased reliability in most cases. For example, it might be a simple data backup, unattainable in the case of a paper archive of typewritten documents. Finally, we have some useful advice. If the authorities in your country require you to use floppy disks, keep them away from smartphones — especially the latest iPhone models. The powerful magnets hidden in a phone case can accidentally wipe all the data stored on an old disk!

image for Microsoft Patch Tues ...

 Latest Warnings

Microsoft today released updates to fix at least 85 security holes in its Windows operating systems and related software, including a new zero-day vulnerability in all supported versions of Windows that is being actively exploited. However, noticeably absent from this month’s Patch Tuesday are any updates to   show more ...  

address a pair of zero-day flaws being exploited this past month in Microsoft Exchange Server. The new zero-day flaw– CVE-2022-41033 — is an “elevation of privilege” bug in the Windows COM+ event service, which provides system notifications when users logon or logoff. Microsoft says the flaw is being actively exploited, and that it was reported by an anonymous individual. “Despite its relatively low score in comparison to other vulnerabilities patched today, this one should be at the top of everyone’s list to quickly patch,” said Kevin Breen, director of cyber threat research at Immersive Labs. “This specific vulnerability is a local privilege escalation, which means that an attacker would already need to have code execution on a host to use this exploit. Privilege escalation vulnerabilities are a common occurrence in almost every security compromise. Attackers will seek to gain SYSTEM or domain-level access in order to disable security tools, grab credentials with tools like Mimkatz and move laterally across the network. Indeed, Satnam Narang, senior staff research engineer at Tenable, notes that almost half of the security flaws Microsoft patched this week are elevation of privilege bugs. Some privilege escalation bugs can be particularly scary. One example is CVE-2022-37968, which affects organizations running Kubernetes clusters on Azure and earned a CVSS score of 10.0 — the most severe score possible. Microsoft says that to exploit this vulnerability an attacker would need to know the randomly generated DNS endpoint for an Azure Arc-enabled Kubernetes cluster. But that may not be such a tall order, says Breen, who notes that a number of free and commercial DNS discovery services now make it easy to find this information on potential targets. Late last month, Microsoft acknowledged that attackers were exploiting two previously unknown vulnerabilities in Exchange Server. Paired together, the two flaws are known as “ProxyNotShell” and they can be chained to allow remote code execution on Exchange Server systems. Microsoft said it was expediting work on official patches for the Exchange bugs, and it urged affected customers to enable certain settings to mitigate the threat from the attacks. However, those mitigation steps were soon shown to be ineffective, and Microsoft has been adjusting them on a daily basis nearly each since then. The lack of Exchange patches leaves a lot of Microsoft customers exposed. Security firm Rapid7 said that as of early September 2022 the company observed more than 190,000 potentially vulnerable instances of Exchange Server exposed to the Internet. “While Microsoft confirmed the zero-days and issued guidance faster than they have in the past, there are still no patches nearly two weeks out from initial disclosure,” said Caitlin Condon, senior manager of vulnerability research at Rapid7. “Despite high hopes that today’s Patch Tuesday release would contain fixes for the vulnerabilities, Exchange Server is conspicuously missing from the initial list of October 2022 security updates. Microsoft’s recommended rule for blocking known attack patterns has been bypassed multiple times, emphasizing the necessity of a true fix.” Adobe also released security updates to fix 29 vulnerabilities across a variety of products, including Acrobat and Reader, ColdFusion, Commerce and Magento. Adobe said it is not aware of active attacks against any of these flaws. For a closer look at the patches released by Microsoft today and indexed by severity and other metrics, check out the always-useful Patch Tuesday roundup from the SANS Internet Storm Center. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: AskWoody.com usually has the lowdown on any patches that may be causing problems for Windows users. As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.

 Malware and Vulnerabilities

The BlackByte ransomware group began to leverage a new technique - Bring Your Own Driver. Through this, hackers can bypass the security walls of over 1,000 drivers used by security solutions. The vulnerable drivers are signed with a valid certificate and run with high privileges on the system.

 Govt., Critical Infrastructure

Australian carrier Optus's recent data breach will be investigated by two regulators, the double trouble likely an indicator of the nation's displeasure at the incident – which saw almost ten million locals' personal data exposed online.

 Identity Theft, Fraud, Scams

Hackers were found sneaking into the devices of Solana crypto HODLers by hiding behind a new Phantom security update. They are airdropping infected NFTs to Solana owners that may deploy password-stealing malware leading to the theft of cryptocurrency wallets. The attack began roughly two weeks back with NFTs titled 'PHANTOMUPDATE.COM' or 'UPDATEPHANTOM.COM.'

 Companies to Watch

Through its Open Threat Modeling platform, IriusRisk helps developers, architects, and security engineers to design secure software throughout the Software Development Lifecycle (SDLC).

 Breaches and Incidents

In a filing with the Singapore Exchange, Singtel included a statement from Dialog, an Australia-based IT services consulting company it acquired in April, confirming that "an unauthorized third party may have accessed company data".

 Malware and Vulnerabilities

Multiple campaigns by LofyGang distributed nearly 200 trojanized and typosquatted packages on the NPM and GitHub open-source repositories. The fraudulent packages are laden with password stealers and Discord-specific malware. Developers are suggested to carefully choose packages on platforms like GitHub and nmp.

 Geopolitical, Terrorism

Britain's GCHQ spy agency chief will warn Western countries Tuesday of the "huge threat" from China seeking to exploit its tech dominance to control its own citizens and gain influence abroad.

 Companies to Watch

Endor Labs announced the closing of a $25 million seed round to build a dependency lifecycle management platform. Investors betting on Endor Labs include Lightspeed Venture Partners and Dell Technologies Capital.

 Govt., Critical Infrastructure

Representatives from Ukraine’s State Service of Special Communications and Information Protection (SSSCIP) and the European Union Agency for Cybersecurity (ENISA) recently met to discuss strengthening cooperation and networking.

 Threat Intel & Info Sharing

Cobalt Strike, whose legitimate user base consists of white hat hackers, is being abused "with increasing frequency" against many industries, including the healthcare and public health sector, by ransomware gangs and various APT groups, HC3 writes.

 Feed

Red Hat Security Advisory 2022-6875-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include privilege escalation and use-after-free vulnerabilities.

 Feed

Red Hat Security Advisory 2022-6872-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include privilege escalation and use-after-free vulnerabilities.

 Feed

Red Hat Security Advisory 2022-6855-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include buffer overflow, denial of service, double free, and spoofing vulnerabilities.

 Feed

Red Hat Security Advisory 2022-6856-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include buffer overflow, denial of service, and spoofing vulnerabilities.

 Feed

Red Hat Security Advisory 2022-6854-01 - The gnutls packages provide the GNU Transport Layer Security library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits for   show more ...  

object-oriented languages, such as C++, Python, or Pike, in applications like LSH or GNUPG, or even in kernel space. Issues addressed include a double free vulnerability.

 Feed

Ubuntu Security Notice 5669-1 - It was discovered that the SUNRPC RDMA protocol implementation in the Linux kernel did not properly calculate the header size of a RPC message payload. A local attacker could use this to expose sensitive information. Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP   show more ...  

implementation in the Linux kernel did not provide sufficient randomization when calculating port offsets. An attacker could possibly use this to expose sensitive information.

 Feed

Ubuntu Security Notice 5667-1 - Selim Enes Karaduman discovered that a race condition existed in the General notification queue implementation of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Pawan Kumar   show more ...  

Gupta, Alyssa Milburn, Amit Peled, Shani Rehana, Nir Shildan and Ariel Sabba discovered that some Intel processors with Enhanced Indirect Branch Restricted Speculation did not properly handle RET instructions after a VM exits. A local attacker could potentially use this to expose sensitive information.

 Feed

Ubuntu Security Notice 5668-1 - It was discovered that the BPF verifier in the Linux kernel did not properly handle internal data structures. A local attacker could use this to expose sensitive information. It was discovered that an out-of-bounds write vulnerability existed in the Video for Linux 2 implementation in   show more ...  

the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 5669-2 - It was discovered that the SUNRPC RDMA protocol implementation in the Linux kernel did not properly calculate the header size of a RPC message payload. A local attacker could use this to expose sensitive information. Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP   show more ...  

implementation in the Linux kernel did not provide sufficient randomization when calculating port offsets. An attacker could possibly use this to expose sensitive information.

 Feed

Ubuntu Security Notice 5657-1 - It was discovered that Graphite2 mishandled specially crafted files. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.

 Feed

Ubuntu Security Notice 5665-1 - It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use this issue to cause applications using PCRE to crash, resulting in a denial of service. It was discovered that PCRE incorrectly handled certain Unicode encoding. A remote attacker could use this issue to cause applications using PCRE to crash, resulting in a denial of service.

 Feed

Google's American Fuzzy Lop is a brute-force fuzzer coupled with an exceedingly simple but rock-solid instrumentation-guided genetic algorithm. afl++ is a superior fork to Google's afl. It has more speed, more and better mutations, more and better instrumentation, custom module support, etc.

 Feed

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide. The 3.x series is the current major version of OpenSSL.

 Feed

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

 Feed

Fortinet on Monday revealed that the newly patched critical security vulnerability impacting its firewall and proxy products is being actively exploited in the wild. Tracked as CVE-2022-40684 (CVSS score: 9.6), the flaw relates to an authentication bypass in FortiOS, FortiProxy, and FortiSwitchManager that could allow a remote attacker to perform unauthorized operations on the administrative

 Feed

The operators behind the BazaCall call back phishing method have continued to evolve with updated social engineering tactics to deploy malware on targeted networks. The scheme eventually acts as an entry point to conduct financial fraud or the delivery of next-stage payloads such as ransomware, cybersecurity company Trellix said in a report published last week. Primary targets of the latest

 Feed

A now-patched security flaw in the vm2 JavaScript sandbox module could be abused by a remote adversary to break out of security barriers and perform arbitrary operations on the underlying machine. "A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox," GitHub said in an advisory published on September 28, 2022. The

 Feed

The White House has recently announced a $1 billion cyber security grant program that is designed to help state and local governments improve their cyber defenses, especially about protecting critical infrastructure. The recent executive order stems from the $1.2 trillion infrastructure bill that was signed almost a year ago. That bill allocated $1 billion for protecting critical infrastructure

 Feed

Cyber criminals are using a previously undocumented phishing-as-a-service (PhaaS) toolkit called Caffeine to effectively scale up their attacks and distribute nefarious payloads. "This platform has an intuitive interface and comes at a relatively low cost while providing a multitude of features and tools to its criminal clients to orchestrate and automate core elements of their phishing

 Feed only

Graham Cluley Security News is sponsored this week by the folks at Kolide. Thanks to the great team there for their support! Device security is a lot like Mount Everest: it’s tough to scale. When you’re a small company dominated by engineers, you can keep up with fleet management with nothing more than trust and   show more ...  

… Continue reading "Kolide gives you real-time fleet visibility across Mac, Windows, and Linux, answering questions MDMs can’t"

2022-10
Aggregator history
Tuesday, October 11
SAT
SUN
MON
TUE
WED
THU
FRI
OctoberNovemberDecember