Aggregator

Memory-Safe Coding Cuts Android System Flaws by 75%

DataBreachToday.com
1 year 6 months ago
Google Says Rust Language Initiative Eliminates Cross-Site Scripting, Other Flaws
Google says switching to a memory-safe language such as Rust under its Safe Coding program has helped significantly reduce the number of vulnerabilities in Android systems. The number of vulnerabilities uncovered in Android devices has fallen from over 200 in 2019 to fewer than 50 by 2024.

Breach Roundup: How to Spot North Korean IT Workers

DataBreachToday.com
1 year 6 months ago
Also: Ransomware Surged in 2023, MoneyGram Back in Service After Cyberattack
This week, advice on spotting North Korean staff; ransomware attacks rose; MoneyGram back online; FCC fined political operative; CISA warned of water system attacks; Ukraine restricted Telegram use; North Korean hackers used new malware; U.K. arrested alleged hacker; PSNI is in data leak talks.

NIST Calls for Major Overhaul in Typical Password Practices

DataBreachToday.com
1 year 6 months ago
Draft Guidelines Call for Longer, Randomized Passwords Instead of Memorized Phrases
The National Institute of Standards and Technology is calling for longer, randomized passwords instead of memorized phrases containing combinations of upper and lowercase letters in new guidance that aims to modernize current password practices across the public and private sectors.

Visa Acquires AI Leader Featurespace for Payments Protection

DataBreachToday.com
1 year 6 months ago
Featurespace's AI Expertise Will Enhance Visa's Fraud, Risk and Payments Technology
Visa has signed a definitive agreement to acquire AI-driven fraud prevention leader Featurespace. This acquisition will reinforce Visa's fraud detection capabilities, integrating advanced machine learning technology to strengthen financial crime prevention and protect global transactions.

GitLab 公布存在严重的管道执行漏洞

嘶吼
1 year 6 months ago

GitLab 发布了关键更新以解决多个漏洞，其中最严重的漏洞 (CVE-2024-6678) 允许攻击者在特定条件下以任意用户身份触发管道。

此版本适用于 GitLab 社区版 (CE) 和企业版 (EE) 的 17.3.2、17.2.5 和 17.1.7 版本，并作为每两个月 (计划) 安全更新的一部分修补了总共 18 个安全问题。

CVE-2024-6678 漏洞的严重程度评分为 9.9，该漏洞可能使攻击者能够以停止操作作业的所有者的身份执行环境停止操作。

该漏洞的严重性在于其可能被远程利用、缺乏用户交互以及利用该漏洞所需的权限较低。GitLab 称，该问题影响 CE/EE 版本 8.14 至 17.1.7、17.2 至 17.2.5 之前的版本以及 17.3 至 17.3.2 之前的版本。他们强烈建议所有运行受下述问题影响的版本的安装尽快升级到最新版本。

GitLab 管道是用于构建、测试和部署代码的自动化工作流程，是 GitLab CI/CD（持续集成/持续交付）系统的一部分。它们旨在通过自动执行重复任务并确保对代码库的更改进行一致测试和部署来简化软件开发流程。

GitLab 近几个月多次解决任意管道执行漏洞，包括 2024 年 7 月修复 CVE-2024-6385、2024 年 6 月修复 CVE-2024-5655 以及 2023 年 9 月修补 CVE-2023-5009，均被评为严重。

该公告还列出了四个严重性较高的问题，评分在 6.7 到 8.5 之间，这些问题可能会让攻击者破坏服务、执行未经授权的命令或破坏敏感资源。这些问题总结如下：

·CVE-2024-8640：由于输入过滤不当，攻击者可以通过 YAML 配置将命令注入连接的 Cube 服务器，从而可能损害数据完整性。从 16.11 开始影响 GitLab EE。

·CVE-2024-8635：攻击者可以通过制作自定义 Maven 依赖代理 URL 来向内部资源发出请求，从而利用服务器端请求伪造 (SSRF) 漏洞，从而危害内部基础设施。从 16.8 开始影响 GitLab EE。

·CVE-2024-8124：攻击者可以通过发送较大的“glm_source”参数触发 DoS 攻击，从而使系统不堪重负并不可用。从 16.4 开始影响 GitLab CE/EE。

·CVE-2024-8641：攻击者可以利用 CI_JOB_TOKEN 获取受害者 GitLab 会话令牌的访问权限，从而劫持会话。从 13.7 开始影响 GitLab CE/EE。

胡金鱼

苹果从俄罗斯应用商店下架 60 款 VPN 应用

Solidot
1 year 6 months ago
苹果从俄罗斯应用商店下架了 60 款 VPN 应用。俄罗斯正在严打 VPN，苹果的行动是在这一背景下进行的。 Mozilla 在今年六月也收到了俄罗斯电信互联网监管机构 Roskomnadzor 从 Mozilla 扩展商店移除规避审查扩展的要求，Mozilla 一开始遵守了，之后拒绝了这一要求。苹果在 7 月从俄罗斯应用商店下架了至少一款 VPN 应用，在 7 月初到 9 月 18 日间至少下架了 60 款 VPN 应用。

New infosec products of the week: September 27, 2024

Help Net Security
1 year 6 months ago

Here’s a look at the most interesting products from the past week, featuring releases from Absolute, ArmorCode, Bitdefender, Guardsquare, Malwarebytes, NETGEAR, and Nudge Security. Bitdefender debuts GravityZone PHASR, enhancing security through user behavior analysis GravityZone PHASR enables security teams to anticipate and quickly mitigate emerging risks before they escalate and seamlessly adapts as threats and user roles evolve to ensure security measures always remain aligned with business objectives. For example, if a user’s responsibilities change … More →

The post New infosec products of the week: September 27, 2024 appeared first on Help Net Security.

Help Net Security

How to lock and hide iPhone apps in iOS 18

Help Net Security
1 year 6 months ago

iOS 18 allows you to lock and hide apps to protect the information within them by requiring Face ID, Touch ID, or your passcode for access, while also concealing the content from searches, notifications, and various areas throughout the system. If someone is using your iPhone, they won’t be able to open locked apps and will be notified that they can only access them by using Face ID. Not all apps can be locked, as … More →

The post How to lock and hide iPhone apps in iOS 18 appeared first on Help Net Security.

Anamarija Pogorelec

Managed ad