Mowing down demons: DOOM comes to Husqvarna smart lawnmowers
▻https://www.bleepingcomputer.com/news/technology/mowing-down-demons-doom-comes-to-husqvarna-smart-lawnmowers
“The legendary 1993 video game DOOM® will be playable on Husqvarna Automower® NERA robotic lawnmower models from April this year,” reads a news release on Husqvarna’s site.
hein ? mais #wtf ??? Sur le coup je me suis dit j’avais mal lu.
Google says spyware vendors behind most zero-days it discovers
▻https://www.bleepingcomputer.com/news/security/google-says-spyware-vendors-behind-most-zero-days-it-discovers
Intéressant sur le processus de fabrication du capitalisme de la menace (un pas de plus dans le capitalisme de surveillance).
Mais quand c’est google qui veut s’en prendre aux entreprises qui vendent des logiciels espions, on ne peut s’empêcher de penser qu’ainsi, ce serait Google qui serait le seul à savoir des choses sur ses utilisateurs. De là à en profiter ? Certainement pas, voyons, un monopole comme ça est plus grand qu’un service public, n’est-ce pas ?
Commercial spyware vendors (CSV) were behind 80% of the zero-day vulnerabilities Google’s Threat Analysis Group (TAG) discovered in 2023 and used to spy on devices worldwide.
Zero-day vulnerabilities are security flaws the vendors of impacted software do not know about or for which there are no available fixes.
Google’s TAG has been following the activities of 40 commercial spyware vendors to detect exploitation attempts, protect users of its products, and help safeguard the broader community by reporting key findings to the appropriate parties.
Based on this monitoring, Google has found that 35 of the 72 known in-the-wild zero-day exploits impacting its products over the last ten years can be attributed to spyware vendors.
“This is a lower-bounds estimate, as it reflects only known 0-day exploits. The actual number of 0-day exploits developed by CSVs targeting Google products is almost certainly higher after accounting for exploits used by CSVs that have not been detected by researchers, exploits where attribution is unknown, and cases where a vulnerability was patched before researchers discovered indications of exploitation in-the-wild.” - Google
Those spyware vendors use the zero-day flaws to target journalists, activists, and political figures as directed by their customers, including governments and private organizations.
Some notable CSVs highlighted in Google’s report are:
Cy4Gate and RCS Lab: Italian firms known for the “Epeius” and “Hermit” spyware for Android and iOS. The former acquired the latter in 2022, but operate independently.
Intellexa: Alliance of spyware firms led by Tal Dilian since 2019. It combines technologies like Cytrox’s “Predator” spyware and WiSpear’s WiFi interception tools, offering integrated espionage solutions.
Negg Group: Italian CSV with international reach established in 2013. It is known for “Skygofree” malware and “VBiss” spyware, targeting mobile devices through exploit chains.
NSO Group: Israeli firm famous for Pegasus spyware and other sophisticated espionage tools. It continues operations despite sanctions and legal issues.
Variston: Spanish CSV providing tailored security solutions. It collaborates with other vendors for zero-day exploits and is linked to the Heliconia framework, expanding in the UAE.
These vendors sell licenses to use their products for millions of dollars, allowing customers to infect Android or iOS devices using undocumented 1-click or zero-click exploits.
Some of the exploit chains utilize n-days, which are known flaws for which fixes are available, yet patching delays still make them exploitable for malicious purposes, often for extended periods.
Google says that CSVs have grown very aggressive in their hunt for zero-days, developing at least 33 exploits for unknown vulnerabilities between 2019 and 2023.
In the appendix of Google’s detailed report, one can find a list of 74 zero-days used by 11 CSVs. Of those, the majority are zero-days impacting Google Chrome (24) and Android (20), followed by Apple iOS (16) and Windows (6).
When white-hat researchers discover and fix the exploited flaws, CSVs often incur significant operational and financial damage as they struggle to reconstruct a working alternative infection pathway.
“Each time Google and fellow security researchers discover and disclose new bugs, it causes friction for CSVs and costs them development cycles,” says Google.
“When we discover and patch vulnerabilities used in exploit chains, it not only protects users, but prevents CSVs from meeting their agreements to customers, preventing them from being paid, and increasing their costs to continue operating.”
However, this is not enough to stop the proliferation of spyware, as the demand for these tools is strong, and the contracts are too lucrative for CSVs to give up.
Google calls for more action to be taken against the spyware industry, including higher levels of collaboration among governments, the introduction of strict guidelines that govern the use of surveillance technology, and diplomatic efforts with countries hosting non-compliant vendors.
Google is proactively countering spyware threats through solutions like Safe Browsing, Gmail security, the Advanced Protection Program (APP), and Google Play Protect, as well as by maintaining transparency and openly sharing threat information with the tech community.
Black Cat 😺 attaque ses victimes à la SEC
►https://www.bleepingcomputer.com/news/security/ransomware-gang-files-sec-complaint-over-victims-undisclosed-breac
via @dowser101
Des hackers saisissent la SEC pour dénoncer la société qu’ils ont rançonnée et qui n’a pas donné suite : légalement les sociétés victimes doivent signaler qu’une quantité de leur données n’étaient pas cryptées et ont été piratées.
déjà ici : ▻https://seenthis.net/messages/1027123
Ransomware gang files SEC complaint over victim’s undisclosed breach
►https://www.bleepingcomputer.com/news/security/ransomware-gang-files-sec-complaint-over-victims-undisclosed-breac
Non, mais là, c’est vraiment un gag.
La sécurité informatique face à la mafia du monde entier...
The ALPHV/BlackCat ransomware operation has taken extortion to a new level by filing a U.S. Securities and Exchange Commission complaint against one of their alleged victims for not complying with the four-day rule to disclose a cyberattack.
Earlier today, the threat actor listed the software company MeridianLink on their data leak with a threat that they would leak allegedly stolen data unless a ransom is paid in 24 hours.
MeridianLink is a publicly traded company that provides digital solutions for financial organizations such as banks, credit unions, and mortgage lenders.
Hackers snitch to the SEC
According to DataBreaches.net, the ALPHV ransomware gang said they breached MeridianLink’s network on November 7 and stole company data without encrypting systems.
The ransomware actor said that “it appears MeridianLink reached out, but we are yet to receive a message on their end” to negotiate a payment in exchange for not leaking the supposedly stolen data.
The alleged lack of response from the company likely prompted the hackers to exert more pressure by sending a complaint to the U.S. Securities and Exchange Commission (SEC) about MeridianLink not disclosing a cybersecurity incident that impacted “customer data and operational information.”
Critical RCE found in popular Ghostscript open-source PDF library
▻https://www.bleepingcomputer.com/news/security/critical-rce-found-in-popular-ghostscript-open-source-pdf-library
Ghostscript, an open-source interpreter for PostScript language and PDF files widely used in Linux, has been found vulnerable to a critical-severity remote code execution flaw.
The flaw is tracked as CVE-2023-36664, having a CVSS v3 rating of 9.8, and impacts all versions of Ghostscript before 10.01.2, which is the latest available version released three weeks ago.
According to Kroll’s analysts, G. Glass and D. Truman, who developed a proof of concept (PoC) exploit for the vulnerability, code execution can be triggered upon opening a malicious, specially-crafted file.
Considering that Ghostscript is installed by default in numerous Linux distributions and used by software such as LibreOffice, GIMP, Inkscape, Scribus, ImageMagick, and the CUPS printing system, opportunities to trigger CVE-2023-36664 are abundant in most cases.
Kroll also comments that the problem affects open-source apps on Windows, too, if those use a port of Ghostscript.
Linux version of Royal Ransomware targets VMware ESXi servers
▻https://www.bleepingcomputer.com/news/security/linux-version-of-royal-ransomware-targets-vmware-esxi-servers
Royal Ransomware is the latest ransomware operation to add support for encrypting Linux devices to its most recent malware variants, specifically targeting VMware ESXi virtual machines.
Ça m’a pourri ma matinée de dimanche. Les mesures de prévention mises en œuvre par les hébergeurs ont coupé certains de nos serveurs ESX (deux tiers). Le temps de comprendre comment contourner proprement ces mesures, la matinée était passée.
Z-Library eBook site domains seized by U.S. Dept of Justice
▻https://www.bleepingcomputer.com/news/technology/z-library-ebook-site-domains-seized-by-us-dept-of-justice
nternet domains for the popular Z-Library online eBook repository were seized early this morning by the U.S. Department of Justice, preventing easy access to the service.
Z-Library is ranked in the top 10k most visited websites on the Internet, offering over 11 million books and 84 million articles for free via its website.
Yesterday, the websites hosted at z-lib.org, b-ok.org, and 3lib.net began displaying a message stating that the service was seized by the US DOJ and the Postal Inspection Service, as shown below.
BleepingComputer reached out to the U.S. Department of Justice to learn about the seizures but has yet to hear back. However, the U.S. Postal Inspector’s office told BleepingComputer they were credited in the seizure notice by mistake.
Friday afternoon, the seizure notice on 3lib.net was updated to indicate the domains were seized by the FBI and the United States Attorney’s Office for the Eastern District of New York.
Google, Microsoft can get your passwords via web browser’s spellcheck
▻https://www.bleepingcomputer.com/news/security/google-microsoft-can-get-your-passwords-via-web-browsers-spellchec
Encore une question inquiétante... même si pour cela, il faut avoir choisit la correction syntaxique améliorée et demander à voir son propre mot de passe... mais ce sont néanmoins des situations que l’on doit utiliser régulièrement... sachant que demain, ce qui est « enhanced » sera la norme standard, pour le service de l’usager, évidemment.
A tous les programmeurs : mettre l’attribut spellcheck=false dans tous les champs comportant des données sensibles (mot de passe, numéro de sécu, adresses,...). Ça évitera aussi aux usagers d’avoir des suggestions absurdes...
Extended spellcheck features in Google Chrome and Microsoft Edge web browsers transmit form data, including personally identifiable information (PII) and in some cases, passwords, to Google and Microsoft respectively.
While this may be a known and intended feature of these web browsers, it does raise concerns about what happens to the data after transmission and how safe the practice might be, particularly when it comes to password fields.
Both Chrome and Edge ship with basic spellcheckers enabled. But, features like Chrome’s Enhanced Spellcheck or Microsoft Editor when manually enabled by the user, exhibit this potential privacy risk.
"Russia has created its own trusted TLS certificate authority (CA) ...
▻https://diasp.eu/p/14259335
“Russia has created its own trusted TLS certificate authority (CA) to solve website access problems that have been piling up after sanctions prevent certificate renewals.”
“The sanctions imposed by western companies and governments are preventing Russian sites from renewing existing TLS certificates, causing browsers to block access to sites with expired certificates.”
Apparently this affects not just .ru, .by, .su, and .рф domains, but any domain where the certificate is would be paid for by a Russian bank account.
“Currently, the only web browsers that recognize Russia’s new CA as trustworthy are the Russia-based Yandex browser and Atom products, so Russian users are told to use these instead of Chrome, Firefox, Edge, etc.”
Russia creates its own TLS certificate authority to bypass (...)
Gros succès pour le #fédivers, il est maintenant utilisé par le logiciel malveillant (en l’occurrence pour trouver le C&C ou C2, le centre de commandement du botnet où le zombie va prendre ses ordres).
▻https://www.bleepingcomputer.com/news/security/vidar-stealer-abuses-mastodon-to-silently-get-c2-configuration
▻https://heimdalsecurity.com/blog/vidar-stealer-returns-and-has-a-new-target-mastodon
Notez la remarque vicieuse, classique chez les sécuritaires, comme quoi le fédivers n’est pas assez censuré.
(Ne regardez pas le compte cité dans l’article, il a déjà été fermé.)
Les logiciels malveillants ont déjà utilisé le DNS, IRC, XMPP, le Web, Ethereum, Twitter, des pads, pour communiquer avec leur C&C, tôt ou tard, ils devaient utiliser le fédivers. Tout outil de communication peut être utilisé ainsi. C’est pour ça que des remarques comme « Mastodon a relatively under-moderated space » sont très connes : est-ce qu’il propose qu’un censeur (« modérateur », en politiquement correct) lise tous les profils et comprenne que scan:192.0.2.1 est une instruction ?
Un bon exemple d’une utilisation d’un outil existant pour la communication du logiciel malveillant : ▻https://www.bleepingcomputer.com/news/security/russian-state-hackers-use-britney-spears-instagram-posts-to-contro
Panne du service #DNS (faisant autorité, pas résolveur) d’#Akamai (Akamai Edge) hier. Ça n’a pas duré longtemps (une heure ?) mais comme Akamai est utilisé par plusieurs gros trucs (comme France Info), ça a été très visible. Comme toujours avec les serveurs Web modernes, cela a entrainé des pannes en cascade, chez des gens qui n’utilisaient pas ce service d’Akamai mais utilisaient (« serverless ») un service qui utilisait le service d’Akamai. Les serveurs d’Akamai répondaient SERVFAIL (Server Failure).
« a software configuration update triggered a bug in the DNS system, the system that directs browsers to websites. This caused a disruption impacting availability of some customer websites. »
▻https://twitter.com/Akamai/status/1418271515192270850
▻https://edgedns.status.akamai.com disait « Resolved - This incident has been mitigated.
Jul 22, 17:09 UTC
Investigating - We are aware of an emerging issue with the Edge DNS service.
We are actively investigating the issue. If you have questions or are experiencing impact due to this issue, please contact Akamai Technical Support. In the interest of time, we are providing you the most current information available, which is subject to changes, corrections, and updates.
Jul 22, 16:09 UTC »
▻https://twitter.com/PowerDNS_Bert/status/1418240932198162438 pour quelques détails techniques ▻https://pbs.twimg.com/media/E66ejnmXsAYDSEZ?format=png&name=small
Voir aussi ▻https://www.crn.com/news/cloud/another-akamai-outage-took-down-major-sites-and-services ▻https://www.bleepingcomputer.com/news/security/akamai-dns-global-outage-takes-down-major-websites-online-services ▻https://www.cnbc.com/2021/07/22/several-major-websites-go-down-in-widespread-internet-outage.html pour une synthèse
SeenThis n’a pas été affecté :-)
Microsoft announces Azure cloud for top secret government data
▻https://www.bleepingcomputer.com/news/security/microsoft-announces-azure-cloud-for-top-secret-government-data
Microsoft today announced the launch of a new offering for its mission-critical Azure Government cloud targeted at government customers and partners that regularly work with top-secret classified data.
“Today, we are announcing the expansion of our mission-critical cloud for US Government with new capabilities in Azure Government, the expansion of Azure Government Secret, and the announcement of a new cloud to serve customers with Top Secret classified data—Azure Government Top Secret,” Tom Keane, corporate vice president of Microsoft’s Azure Global, said.
Microsoft is still working with the US Government on accreditation for the newly launched Azure Government Top Secret regions according to Keane.
Keane also shared the list of all available options for US Government customers based on compliance requirements, a list which also includes the commercial public version of the Azure cloud, next to the Azure Government and Azure Government Secret offerings.
Microsoft provides access to Azure Government offerings only to US federal, state, local, tribal governments, and their partners, with operations in these cloud regions available only to screened US citizens.
Azure Government also offers a comprehensive level of certifications designed to simplify even the most critical government compliance requirements.
#Données_gouvernementales #Microsoft #Sécurité_données #Cloud
Cerberus Android malware source code offered for sale for $100,000
▻https://www.bleepingcomputer.com/news/security/cerberus-android-malware-source-code-offered-for-sale-for-100-000
The maintainer of Cerberus banking trojan for Android is auctioning the entire project for a price starting at $50,000 or close the deal for double the money. The price includes everything from source code to customer list along with installation guide and the scripts to make components work together. Profit potential For at least one year, the group behind Cerberus advertised their business and rented the malicious bot for up to $12,000 per year. They also offered a license for shorter (...)
#algorithme #Cerberus #smartphone #spyware #données #écoutes #hacking #banque
Google Now Bans Some Linux Web Browsers From Their Services
▻https://www.bleepingcomputer.com/news/google/google-now-bans-some-linux-web-browsers-from-their-services
(...) some users have reported that they could still login with Falkon [1, 2].
This has led people to offer a variety of theories for why this is happening including it being an A/B test being done by Google, related to the version of QtWebEngine installed, or maybe even an account setting such as 2FA being enabled.
Je crois qu’il est important de se passer des services, apps, OS et infras de Gogol autant que possible et dès que possible. Ils sont incontestablement en passe de devenir le Migro$oft des années à venir : devenus hégémoniques ils se permettent n’importe quoi.
Google Docs Says Chromium-Based Microsoft Edge Is Not Supported
▻https://www.bleepingcomputer.com/news/microsoft/google-docs-says-chromium-based-microsoft-edge-is-not-supported
Trop fun la gueguerre....
When users of the Chromium-based Microsoft Edge use Google Docs, the service is stating that the browser is not supported. As the new Microsoft Edge uses the same HTML engine as Chrome and is clearly supported, some users feel that Google is playing unfairly.
Google Docs indicates that Edge is unsupported by displaying a notification at the top of the page that states “The version of the browser you are using is no longer support. Please upgrade to a supported browser.”. The message links to this Google support article.
This message is being shown because Google whitelists browsers based on their useragent strings, and for any that are not whitelisted, will display the above unsupported message.
A browser useragent is a unique string associated with a browser and used to identify it. When the browser connects to a website, the browser’s useragent string is also sent to the web site so that the site can offer customizations based on the browser.
For example, the useragent string for the new Microsoft Edge is:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3763.0 Safari/537.36 Edg/75.0.131.0
Even though the new Microsoft Edge is compatible with Google docs because it shares the same HTML engine as Google Chrome, since its useragent is not whitelisted, Google Docs will state it is unsupported.
To prove this, I installed the User-Agent Switcher for Chrome extension in Microsoft Edge and configured the browser to use the useragent of Chrome 74, which is shown below.
“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36”
Once I switched the useragent and refreshed Google Docs, the unsupported message was no longer shown.
Google can fix, but Microsoft can fix it faster
As there should not be any reason for Google to not whitelist the new Edge’s useragent string, how fast Google fixes this issue on their side will indicate whether they plan on playing fairly.
The good news is that Microsoft has a function built into the new Microsoft Edge that allows it switch its useragent as needed based on the domain being visited.
As we reported earlier this month, this is being done so that sites who whitelist or offer different features based on a browser’s useragent string will work properly in the new Microsoft Edge.
If Google decides to take their time resolving this problem, Microsoft can bypass them altogether and create a new rule for the docs.google.com URL and use Chrome’s useragent string so that this “unsupported” message goes away.
YouTube to Stop Recommending Conspiracy Theory Videos
▻https://www.bleepingcomputer.com/news/google/youtube-to-stop-recommending-conspiracy-theory-videos
This does not mean that this content will be removed from YouTube or banned from being uploaded in the future, but it does mean they will no long recommend them as videos that you may find interesting. YouTube feels that this create a balance between providing free speech on their platform, while not contributing to the spread of misinformation.
“To be clear, this will only affect recommendations of what videos to watch, not whether a video is available on YouTube,” the blog post continues. “As always, people can still access all videos that comply with our Community Guidelines and, when relevant, these videos may appear in recommendations for channel subscribers and in search results. We think this change strikes a balance between maintaining a platform for free speech and living up to our responsibility to users.”
▻https://youtube.googleblog.com/2019/01/continuing-our-work-to-improve.html
Continuing our work to improve recommendations on YouTube
Friday, January 25, 2019
When recommendations are at their best, they help users find a new song to fall in love with, discover their next favorite creator, or learn that great paella recipe. That’s why we update our recommendations system all the time—we want to make sure we’re suggesting videos that people actually want to watch. You might remember that a few years ago, viewers were getting frustrated with clickbaity videos with misleading titles and descriptions (“You won’t believe what happens next!”). We responded by updating our system to focus on viewer satisfaction instead of views, including measuring likes, dislikes, surveys, and time well spent, all while recommending clickbait videos less often
Data of 130 Million Chinese Hotel Chain Guests Sold on Dark Web Forum
▻https://www.bleepingcomputer.com/news/security/data-of-130-million-chinese-hotel-chain-guests-sold-on-dark-web-fo
A hacker is selling the personal details of over 130 million hotel guests for 8 Bitcoin ($56,000) on a Chinese Dark Web forum. The breach was reported today by Chinese media after several cyber-security firms spotted the forum ad [1, 2, 3, 4]. The seller said he obtained the data from Huazhu Hotels Group Ltd (Huazhu from hereafter), one of China’s largest hotel chains, which operates 13 hotel brands across 5,162 hotels in 1,119 Chinese cities.
Forum ad claims to sell According to a (...)
Firefox Add-On With 220,000+ Installs Caught Collecting Users’ Browsing History
▻https://www.bleepingcomputer.com/news/security/firefox-add-on-with-220-000-installs-caught-collecting-users-brows
But this boost of attention from the Mozilla team didn’t go down as intended. Hours after Mozilla’s blog post, Raymond Hill, the author of the uBlock Origin ad blocker pointed out on Reddit that the add-on exhibited a weird behavior.
“With this extension, I see that for every page you load in your browser, there is a POST to http://136.243.163.73/,” Hill said. “The posted data is garbled, maybe someone will have the time to investigate further.”
US Border Agents Didn’t Verify Any e-Passports Since 2007 Because They Didn’t Have the Software
►https://www.bleepingcomputer.com/news/government/us-border-agents-didnt-verify-any-e-passports-since-2007-because-t
The United States of America, the country with one of the most draconian border crossing procedures in the world, hadn’t verified the validity of chip-implanted e-passports since 2007, the time when foreigners were first required to have one. Shockingly, the reason is that US border agents lacked the software to do so, according to revelations made this week by Senators Ron Wyden (D-Oregon) and Claire McCaskill (D-Missouri) in a letter sent to US Customs and Border Protection (CBP) (...)
Mais il existe ailleurs... (je copie-colle le texte, au cas où...)
US Border Agents Didn’t Verify Any e-Passports Since 2007 Because They Didn’t Have the Software
The United States of America, the country with one of the most draconian border crossing procedures in the world, hadn’t verified the validity of chip-implanted e-passports since 2007, the time when foreigners were first required to have one.
Shockingly, the reason is that US border agents lacked the software to do so, according to revelations made this week by Senators Ron Wyden (D-Oregon) and Claire McCaskill (D-Missouri) in a letter sent to US Customs and Border Protection (CBP) management.
The two senators are now urging the CBP to correct this glaring security hole and purchase the equipment necessary to verify if e-Passports are authentic and haven’t been tampered with.
You could have entered the US using a forged e-Passport
e-Passports are mandatory for all foreigners entering the US from a country on the visa waiver program. These are countries whose citizens aren’t required to obtain a visa before entering the US.
Instead, as one of the security measures imposed on citizens from the 38 countries on the US’ visa waiver program, travelers must possess an e-Passport that comes with an electronic chip.
This chip contains data on the passport holder, but also a digital signature that border agents can verify using special software.
The data and accompanying signature are meant to be an anti-forgery system as only state authorities can change data on the chip and resign the chip with a valid signature.
CBP was warned in 2010
Since 2007, when the US has started asking foreigners to present an e-passport when entering the US, border agents have been able to read the data on the chip, but not verify its digital signature for authenticity.
This means that for almost eleven years, foreigners could have entered the US using forged e-Passports, albeit they still had to craft a convincing passport in the first place.
“CBP has been aware of this security lapse since at least 2010, when the Government Accountability Office (GAO) released a report highlighting the gap in technology,” Wyden and McCaskill wrote in their letter. “Eight years after that publication, CBP still does not possess the technological capability to authenticate the machine-readable data in e-Passports.”
The two senators are now urging the CBP to implement a plan to properly authenticate e-Passport holders and their data by January 1, 2019.
►https://www.bleepingcomputer.com/news/government/us-border-agents-didnt-verify-any-e-passports-since-2007-because-t
JavaScript Cryptomining Scripts Discovered in 19 Google Play Apps
▻https://www.bleepingcomputer.com/news/security/javascript-cryptomining-scripts-discovered-in-19-google-play-apps
There doesn’t appear to be an end in sight for the cryptojacking scourge affecting all facets of the web right now.
If you’re not bored already of reading yet another incident where miscreants deployed the Coinhive in-browser script to mine Monero behind users’ backs, then this article might interest you.
Coinhive found inside Play Store apps
Our article is based on a 13-page report published last week by UK cyber-security firm Sophos. According to the company, its engineers discovered 19 Android applications that were uploaded and made available through the official Google Play Store.