Aggregator

10月17日-18日，上海·五角场凯悦酒店，不见不散！

A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /adms/classes/Users.php. The manipulation leads to improper access controls. This vulnerability is known as CVE-2023-0916. The attack can be launched remotely. Furthermore, there is an exploit available.

Roughly 70% of malware incidents are a result of social engineering, with spearphishing being a common method. Let’s learn more about this phenomenon and discover: What is spearphishing?  It is a targeted form of phishing attack where the adversary focuses on a specific individual or organization. Unlike generic phishing, spearphishing is often more sophisticated and […]

The post What is Spearphishing: Definition, Techniques, Real-world Example  appeared first on ANY.RUN's Cybersecurity Blog.

仅通过一个恶意Python代码包即可执行蔓延的供应链攻击。

监管要求甲方严格落实审查责任

近日安全研究人员发现从游戏机到总统大选投标机的海量设备仍然使用不安全的测试密钥，容易受到UEFI bootkit恶意软件的攻击。 安全启动不安全 在近期的安全研究中，一项涉及设备制造行业安全启动（Secure Boot）保护机制的供应链失败问题引发了广泛关注。此次事件波及的设备型号范围远比之前已知的要广泛得多，受影响的设备涵盖了ATM机、POS机、甚至投票机等多个领域。 这一问题源自于过去十年间，数百种设备型号中使用了非生产环境的测试平台密钥，这些密钥在其根证书中标注了“DO NOT TRUST”（请勿信任）等警示语，此类密钥原本应仅用于测试环境，但设备制造商却将其应用于生产系统。 平台密钥作为加密的“信任根”锚定了硬件设备与其运行的固件之间的信任关系，确保安全启动机制正常运行。然而，由于大量用于测试安全启动主密钥的私钥被泄漏，极大地削弱了这一安全机制的有效性。研究发现，2022年甚至有人将一部分私钥在GitHub上公开发布。这些信息为攻击者提供了必要条件，能够通过植入“根工具包”（Rootkits）等恶意软件，破坏设备的UEFI（统一可扩展固件接口）安全启动保护。 500多种设备存在隐患 此次供应链安全事件被Binarly命名为“PKfail”（CVE-2024-8105），意指平台密钥（Platform Key）失效。此次失败展示了供应链复杂性已超出用户当前的风险管理能力，特别是在涉及第三方供应商时。不过，研究人员指出，这一风险完全可以通过“安全设计理念”进行规避和缓解。 根据Binarly的最新报告，受此问题影响的设备型号远超此前的认知。Binarly的研究工具在过去几个月中收集到了10095个固件样本，其中791个（约占8%）包含了非生产密钥。 受PKfail影响的固件数量 最初，Binarly识别出了大约513种设备型号使用了测试密钥，目前一数字已增长至972种。此外，最早报告的215个受影响型号中，有490个型号使用了在GitHub上公开的密钥。研究人员还发现了四个新的测试密钥，使得总数达到了约20个。 此前发现的密钥均来自AMI，这是一家为设备制造商提供UEFI固件开发工具包的主要供应商之一。自7月以来，Binarly还发现了AMI的其他两大竞争对手Insyde和Phoenix的密钥同样存在问题。 更多的受影响设备还包括： Hardkernel的odroid-h2、odroid-h3和odroid-h4 Beelink Mini 12 Pro Minisforum HX99G Binarly进一步指出，受影响的设备不仅限于桌面电脑和笔记本电脑，还包括大量医疗设备、游戏机、企业级服务器、ATM机、销售终端设备，甚至包括投票机！由于目前尚无修复方案，研究人员基于保密协议未披露具体的设备型号。Binarly发布了“PKfail扫描仪”，供应商可以自行上传固件映像查看是否使用了测试密钥。 此次事件表明，安全启动作为一种设备预启动阶段的加密保护机制，尽管被广泛应用于政府承包商和企业环境中，但其安全性依然存在隐患，其供应链管理中存在重大漏洞。   转自安全内参，原文链接：https://www.secrss.com/articles/70379 封面来源于网络，如有侵权请联系删除

Изощрённый способ маскировки делает новый вредонос практически невидимым.

CERN 准备于 11 月 30 日驱逐隶属于俄罗斯研究机构的科学家，但它没有完全切断与俄罗斯机构的联系，它通过与位于俄罗斯 Dubna 的 Joint Institute for Nuclear Research (JINR)达成的协议继续与俄罗斯科学家合作。不切断与 JINR 的合作在研究人员中间引发了分歧。此前有数百名俄罗斯科学家参与了 CERN 的 LHC 大强子对撞机实验。乌克兰科学家反对继续与俄罗斯合作，而 Science4Peace 组织则反对限制任何国家的科学家展开科学合作。其他人表示，CERN 留出了两年的准备时间，这有助于减轻俄罗斯科学家退出的影响。工作人员已经帮助想留下的俄罗斯科学家在俄罗斯之外的研究机构寻找工作机会。已有大约 90 名科学家从俄罗斯机构转移到非俄罗斯机构。

青藤，让云更安全

US Schools and libraries have until November 1, 2024 to enrol for a three-year program during which participants will receive discounts on eligible cybersecurity services and equipment

9月21号将举办边缘智能 x 扣子技术沙龙，活动上有行业大咖分享 AI 及物联网领域前沿洞察、快速构建端侧智能体应用、揭秘地瓜机器人最新开发套件等等干货知识，还有精美茶歇、互动抽奖等你来！

A vulnerability was found in D-Link DAP-2622 and classified as critical. Affected by this issue is some unknown functionality of the component IPv4 Address Handler. The manipulation leads to stack-based buffer overflow. This vulnerability is handled as CVE-2023-44417. Access to the local network is required for this attack. There is no exploit available.

A vulnerability was found in D-Link DAP-2622. It has been classified as critical. This affects an unknown part of the component Telnet CLI Command Handler. The manipulation leads to command injection. This vulnerability is uniquely identified as CVE-2023-44416. Access to the local network is required for this attack to succeed. There is no exploit available.

A vulnerability has been found in Ashlar-Vellum Cobalt and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to uncontrolled search path. This vulnerability is known as CVE-2023-44437. It is possible to launch the attack on the local host. There is no exploit available.

A vulnerability was found in Ashlar-Vellum Argon and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to uncontrolled search path. This vulnerability is handled as CVE-2023-44438. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Ashlar-Vellum Xenon. It has been classified as critical. This affects an unknown part. The manipulation leads to uncontrolled search path. This vulnerability is uniquely identified as CVE-2023-44439. An attack has to be approached locally. There is no exploit available.

A vulnerability was found in Ashlar-Vellum Lithium. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to uncontrolled search path. This vulnerability was named CVE-2023-44440. Local access is required to approach this attack. There is no exploit available.

A vulnerability was found in Parallels Desktop. It has been classified as critical. This affects an unknown part. The manipulation leads to link following. This vulnerability is uniquely identified as CVE-2023-50226. It is possible to launch the attack on the local host. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in TP-Link TL-WR902AC and classified as critical. Affected by this issue is the function dm_fillObjByStr. The manipulation leads to stack-based buffer overflow. This vulnerability is handled as CVE-2023-50225. The attack may be launched remotely. There is no exploit available.