#cybersecurité

Red-teaming : vers des tests de robustesse de l’IA dans l’intérêt du public
▻https://danslesalgorithmes.net/stream/red-teaming-vers-des-tests-de-robustesse-de-lia-dans-linteret-du

— Permalink

#intelligenceartificielle #readteaming #cybersécurité #cybersecurity #pharmakon #clinicaltrials #stiegler

La loi Narcotrafic est une loi de #Surveillance : mobilisons nous !
▻https://www.laquadrature.net/2025/02/24/la-loi-narcotrafic-est-une-loi-de-surveillance-mobilisons-nous

La semaine prochaine, l’Assemblée nationale discutera d’une proposition de loi relative au « narcotrafic ». Contrairement à ce que le nom du texte indique, les mesures qui pourraient être adoptées vont bien au-delà du seul trafic de…

#Censure

Secteur du #cloud - État de la #menace informatique - CERT-FR
▻https://www.cert.ssi.gouv.fr/cti/CERTFR-2025-CTI-001

— Permalink

#cybersécurité

▻https://www.01net.com/actualites/fuite-donnees-cauchemardesque-localisation-millions-smartphones-ete-compromis

Un géant américain de la collecte et de la revente de données de localisation a été piraté. Des cybercriminels ont volé plus de 10 téraoctets de données confidentielles, montrant la localisation de millions de smartphones dans le monde. Pour les experts, c’est un scénario « cauchemardesque » susceptible de mettre en danger la sécurité nationale de plusieurs pays.

#cybersécurité #smartphones #cybercriminalité #protection_des_données #data_business

😵 Virus, chantage, piratage...

➡️ Ayez le nouveau réflexe cyber : rendez-vous sur le site ▻https://17cyber.gouv.fr de Cybermalveillance.gouv.fr

#Cybermalveillance #Sécurité #Piratage #Cybersécurité

Fuite de données de 78.000 clients de Norauto, dont des numéros de pièces d’identité afp - le figaro

Nouvelle cyberattaque d’une entreprise. L’enseigne Norauto, spécialisée dans la maintenance automobile, a été touchée par une fuite de données sur plusieurs milliers de ses clients, et de certains numéros de pièces d’identité, a confirmé mardi l’entreprise à une journaliste de l’AFP. « Norauto a fait l’objet d’un acte de cyber-malveillance. Les investigations menées par nos équipes mobilisées sur le sujet indiquent que des données à caractère personnel spécifiquement liées à notre service location ont été ciblées » , a indiqué l’entreprise, qui a précisé que 78.000 clients sont concernés. 

Les données personnelles touchées par la fuite portent, « selon les cas » , sur les noms et prénoms, les adresses mails et postales, les numéros de téléphone, les numéros de carte de fidélité ainsi que les numéros de pièce d’identité fournis à l’occasion de locations.

https://thumbs.dreamstime.com/b/pneu-crev%C3%A9-de-voiture-65744584.jpg

L’enseigne n’a pas précisé quelle part des clients étaient concernée par cette fuite liée aux pièces d’identité.

Norauto a précisé avoir « immédiatement mis en place des mesures pour stopper l’attaque et renforcer la sécurité de (ses) systèmes » , et avoir communiqué au sujet de cet acte de malveillance auprès de ses clients.

La Cnil, gendarme français des données personnelles, a confirmé avoir reçu une notification de violations de données, une démarche obligatoire.

#hacking #cyberattaque #sécurité #internet #sécurité_informatique #cyberattaques #cybersécurité #piratage #en_vedette

Source : ▻https://www.lefigaro.fr/secteur/high-tech/fuite-de-donnees-de-78-000-clients-de-norauto-dont-des-numeros-de-pieces-d-

Une publication de l’EFF (Electronic Frontier Foundation). Le site a une version en français et son organigramme (architecture) semble facile à s’approprier pour une navigation efficace :
►https://ssd.eff.org/fr

Surveillance
Self-Defense
Tips, Tools and How-tos for Safer Online Communications
A Project of the Electronic Frontier Foundation

Nous sommes la Fondation Frontière Électronique, un organisme indépendant sans but lucratif qui oeuvre depuis près de 30 ans pour protéger votre vie privée en ligne. Voici Autodéfense contre la surveillance : notre guide spécialisé sur la protection contre l’espionnage en ligne, pour vous et vos amis.

Lisez LES BASES pour découvrir le fonctionnement de la surveillance en ligne. Plongez-vous dans nos GUIDES SUR LES OUTILS pour obtenir des instructions sur l’installation de notre sélection des meilleures applications les plus sécurisées. De plus amples renseignements sont offerts dans les rubriques APPRENTISSAGE COMPLÉMENTAIRE. Si vous souhaitez une visite guidée, consultez notre liste de SCÉNARIOS DE SÉCURITÉ courants.

#cybersécurité #protection_des_données #activisme #militantisme

California governor vetoes expansive AI safety bill | Digital Trends
▻https://www.digitaltrends.com/computing/california-governor-vetoes-ai-safety-bill

https://www.digitaltrends.com/wp-content/uploads/2024/09/Gavin_Newsom_47998164696.jpg?resize=1200%2C630&p=1

Aller-retour des lois. Il n’y a pas qu’en France que les dirigeants politiques se contrefoutent de ce que votent les Parlements.

By Andrew Tarantola September 30, 2024 10:33AM
California Governor Gavin Newsom speaking at a lecturn.
Gage Skidmore / Flickr

California Gov. Gavin Newsom has vetoed SB 1047, the Safe and Secure Innovation for Frontier Artificial Models Act, arguing in a letter to lawmakers that it “establishes a regulatory framework that could give the public a false sense of security about controlling this fast-moving technology.”

“I do not believe this is the best approach to protecting the public from real threats posed by the technology,” he wrote. SB 1047 would have required “that a developer, before beginning to initially train a covered model … comply with various requirements, including implementing the capability to promptly enact a full shutdown … and implement a written and separate safety and security protocol.”

However, Newsom noted that 32 of the top 50 AI companies are based in California, and that the bill would focus on only the largest firms. “Smaller, specialized models may emerge as equally or even more dangerous than the models targeted by SB 1047,” he stated.

“While well-intentioned, SB 1047 does not take into account whether an Al system is deployed in high-risk environments, involves critical decision-making or the use of sensitive data,” Newsom wrote. “Instead, the bill applies stringent standards to even the most basic functions – so long as a large system deploys it.”

SB 1047 sparked heated debate within the AI industry as it made its way through the legislature. OpenAI stridently opposed the measure, resulting in researchers William Saunders and Daniel Kokotajlo publicly resigning in protest, while xAI CEO Elon Musk came out in favor of the bill. Many in Hollywood also expressed support for SB 1047, including J.J. Abrams, Jane Fonda, Pedro Pascal, Shonda Rhimes, and Mark Hamill.

“We cannot afford to wait for a major catastrophe to occur before taking action to protect the public. California will not abandon its responsibility. Safety protocols must be adopted. Proactive guardrails should be implemented, and severe consequences for bad actors must be clear and enforceable,” Newsom wrote. However, “ultimately, any framework for
effectively regulating Al needs to keep pace with the technology itself.”

Monday’s announcement comes less than a month after the governor signed AB 2602 and AB 1836, both backed by the SAG-AFTRA union. AB 2602 requires performers grant informed consent prior to using their “digital replicas,” while AB 1836 strengthened protections against ripping off the voice and likeness of deceased performers.

#Intelligence_artificielle #Californie #Nouvelles_méthodes_politiques #Cybersécurité

Big Tech Consolidation Amplified the CrowdStrike Outage
▻https://jacobin.com/2024/07/crowdstrike-microsoft-big-tech-consolidation

https://media.kasperskydaily.com/wp-content/uploads/sites/85/2016/04/05130925/windows-new-bsod-featured.jpg

21.7.2024 by Freddy Brewster, Lucy Dean Stockton , Katya Schwenk, Helen Santoro - On Friday, an update to a cybersecurity program took down Microsoft systems across the globe. Microsoft has resisted efforts to regulate a root cause of this chaos: the concentration of digital infrastructure in the hands of a few tech giants.

A little more than a year before Microsoft’s systems crashed on Friday, creating global chaos in the banking, airline, and emergency service industries, the company pushed back against regulators investigating the risks of a handful of cloud services companies controlling the world’s technological infrastructure, according to documents we reviewed.

“Regulators should carefully avoid any intervention that might disturb the competitive offerings that have promoted the explosive innovation and growth attributable to the cloud,” the company wrote in response to the Federal Trade Commission’s 2023 review of cloud computing companies’ security practices and interoperability protocols.

The agency questioned whether these companies “invest sufficient resources in research and development” of systems upon which the economy and government rely.

Microsoft is blaming this week’s global cloud outages on an update from CrowdStrike, a cybersecurity firm whose software protects against hacks. The debacle comes two days after federal agencies released new guidance sounding additional alarms that Big Tech’s consolidation of cloud services could put consumers at serious risk. It also comes one day after Microsoft’s cloud services experienced a separate outage in certain parts of the United States.

“This is a CrowdStrike-caused outage. It would be inaccurate to report this as a Microsoft outage,” the company said in a statement. “A CrowdStrike update was responsible for bringing down a number of IT systems globally. We are actively supporting customers to assist in their recovery.”

CrowdStrike did not respond to a request for comment.

“All too often these days, a single glitch results in a system-wide outage, affecting industries from healthcare and airlines to banks and auto-dealers,” posted Lina Khan, Federal Trade Commission chairwoman, whose agency spearheaded the probe of the cloud computing industry. “Millions of people and businesses pay the price. These incidents reveal how concentration can create fragile systems.”

At the root of the problem, regulators and researchers say, is Big Tech’s consolidation of cloud services, a technology that allows consumers to store computer information in massive data centers rather than storing it on-site. Just three companies — Amazon, Microsoft, and Google — control 65 percent of the cloud market, according to a report released on July 18 by CloudZero, a cost management platform.

Microsoft and CrowdStrike also dominate the end point security market, which ensures cybersecurity for devices like desktops, laptops, and mobile devices. As of 2022, the two companies controlled more than 30 percent of the market.

This consolidation helped allow a simple error to spiral on Friday.

“We had this cascading failure of all of these businesses, banks, the London Stock Exchange, all of these airlines had to be grounded, because of this one mistake,” said Zane Griffin Talley Cooper, a researcher at the University of Pennsylvania studying digital infrastructure. “And it’s because the internet has become so centralized in the hands of four or five big companies.”

“With that model, catastrophic failures like this are going to be increasingly common,” he added.
Regulatory Scrutiny Intensifies

In March 2023, the Federal Trade Commission announced a wide-ranging survey of the business practices of cloud providers. The agency looked at “market power, business practices affecting competition, and potential security risks,” soliciting comments from companies and the public.

In its response to the Federal Trade Commission’s probe, Microsoft claimed the marketplace for cloud services remains robust, and warned that regulations may affect “billions of dollars” in investments.

The company also suggested that the Federal Trade Commission’s intervention would “run the risk of impacting the quality of these solutions and the pace of innovation, and ultimately disadvantaging American companies on the global stage,” Microsoft wrote.

Public Citizen, a consumer advocacy nonprofit, warned the Federal Trade Commission in 2023 that the market dominance of Amazon, Microsoft, and Google over the cloud services sector is a threat to the economy.

“Single point dependency on a cloud provider is a structural weakness for the entire economy with the potential to cause more consumer harm in the future,” the group wrote in June 2023.

On Wednesday — just two days before the global outage — the Department of the Treasury, along with the Consumer Financial Protection Bureau and other federal agencies, cautioned that the industry’s deep reliance on a small handful of cloud service providers left it vulnerable to widespread outages and disruptions.

The Treasury also released a suite of guidance for banks and financial institutions, following its report from last February that raised an alarm about the potential risks of the highly consolidated market. The report advised that a failure like the one on Friday “could impact multiple financial institutions or U.S. consumers,” and recommended additional oversight, like inspecting third-party service providers.

The Consumer Financial Protection Bureau’s chief, Rohit Chopra, said on Friday that the failures are just a glimpse of the havoc that could be wreaked by this kind of outage in the financial sector. His agency has warned that in the future, such events could further “freeze parts of the payments infrastructure or grind other critical services to a halt.”

“There are just a handful of big cloud companies where so much of the economy is now resting on,” Chopra said on CNBC. “We’re getting a taste of some of the potential effects of a real reliance of sectors across the economy relying on a handful of cloud companies and other key systems.”

Friday’s outage was just a preview, he said, of what could go wrong in extreme cases of corporate consolidation and deregulation.

“Break Up This Cloud Consortium”

First reports of the outage surfaced early Friday morning, as computers running on Microsoft’s Windows operating system went down all at once. The issue traced back to a system update that was pushed by a company called CrowdStrike, a cybersecurity provider that is used to protect against hackers in a wide range of sectors, from airlines to banking — and was previously known for its involvement in the 2016 investigation into Russia’s hack of the Democratic National Committee.

CrowdStrike quickly said it had identified the problem with the update and began pushing a solution, but added that the fixes could take hours.

“We are aware of this issue and are working closely with CrowdStrike and across the industry to provide customers technical guidance and support to safely bring their systems back online,” Satya Nadella, Microsoft’s CEO, posted on X.

Microsoft, which was one of the early pioneers of cloud computing software, controls a staggering 85 percent of federal productivity software, and even more of its operating system.

Yet the Big Tech giant has a history of pushing back against cybersecurity measures. In 2016, the Federal Reserve, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation released a joint rulemaking notice regarding the need for increased regulations on “enhanced cyber risk management standards for large and interconnected entities.”

The proposed rule would have “significant consequences not only for the financial services industry but also for third-parties like Microsoft,” the company wrote in a comment letter. It also raised concerns about the new rules, and added that cloud service providers offer better service and cybersecurity than traditional on-site storage centers.

The rule was withdrawn in March 2019.

Agencies and Congress have repeatedly tried and failed to strengthen cybersecurity regulations. Within the past three years, lawmakers have introduced at least four legislative initiatives to address these concerns, though none have been adopted so far.

This February, the federal Cybersecurity and Infrastructure Security Agency also announced it was renewing a task force charged with managing risks to the global information and communications technology supply chain, crucial for protecting computer hardware, software, and applications.

The companies themselves were seemingly aware of the potential threat caused by an overreliance on cloud-based systems.

In a 2023 comment letter to the Consumer Financial Protection Bureau about a proposed rulemaking to tighten personal data restrictions, CrowdStrike — the cybersecurity company responsible for Friday’s data breach — argued that the biggest risk to cybersecurity was not software supply chain issues, but hackers.

“It is our view that perhaps the most significant threat to data comes from bad actors operating unlawfully, leading to data breaches, cyberattacks, exploits, ransomware attacks and other exposure of consumer data,” CrowdStrike wrote.

CrowdStrike echoed their concerns about the dangers of hackers and resulting system failures in their most recent annual 10-K report. The company told investors that the “consolidation of siloed products” was a concern because “integrating and maintaining numerous products, data and infrastructures across highly distributed enterprise environments” created “blind spots that hackers can exploit.”

Microsoft, in its 2023 annual report to shareholders, also expressed that “providing [their] customers with more services and solutions in the cloud puts a premium on the resilience of [their] systems.”

But the companies have worked hard to keep regulators from taking steps to address these risks.

Microsoft is one of the country’s top spenders on lobbying, ranking in the top one hundred of corporations. So far this year, the company spent more than $5 million on campaign donations and lobbying lawmakers and regulators. Microsoft lobbied Congress, the Federal Trade Commission, the Treasury Department, the Executive Office of the White House, and other regulators on “policy issues in cloud computing,” among other issues, disclosures show.

“What we really need,” said Cooper, the University of Pennsylvania researcher, “is regulators to break up this cloud consortium of four or five companies and help distribute management of the internet backbone through a host of different companies.”

Contributors

Freddy Brewster is a freelance reporter and has been published in the Los Angeles Times, NBC News, CalMatters, the Lost Coast Outpost, and other outlets across California.

Lucy Dean Stockton is the news editor at the Lever.

Katya Schwenk is a journalist based in Phoenix, Arizona.

Helen Santoro is a journalist based in Colorado.

#capitalisme #informatique #internet #nuage #sécutité #GAFAM #cloud_computimg #monopoles #Microsoft #Amazon #Google

🌐🔍 Découvrez comment rechercher des informations sociales associées à un nom de domaine.

➡️ Découvrez le nouvel article de @stephane sur ▻https://www.afnic.fr/observatoire-ressources/papier-expert/trouver-les-informations-sociales-associees-a-un-nom-de-domaine

#domaines #cybersécurité #whois #ndd

–----------------

🌐🔍 Discover how to look for social information associated with a domain name.

➡️ Discover @stephane ’s new article on ▻https://www.afnic.fr/en/observatory-and-resources/expert-papers/finding-social-information-associated-with-a-domain-name

#domains #security #cybersecurity #whois

Malicious VSCode extensions with millions of installs discovered
▻https://www.bleepingcomputer.com/news/security/malicious-vscode-extensions-with-millions-of-installs-discovered

https://www.bleepstatic.com/content/hl-images/2023/01/06/vscode-malware-header.jpg

Les marketplace de code, les extensions... sont avant tout des trous de sécurité dans l’espace de l’internet. On istalle, puis ça s’installe tout seul. Il faut faire confiance... alors que l’on sait que la cybersécurité est liée à l’absence de confiance. Je tremble toujours à chaque mise à jour.

VSCode

A group of Israeli researchers explored the security of the Visual Studio Code marketplace and managed to “infect” over 100 organizations by trojanizing a copy of the popular ’Dracula Official theme to include risky code. Further research into the VSCode Marketplace found thousands of extensions with millions of installs.

Visual Studio Code (VSCode) is a source code editor published by Microsoft and used by many professional software developers worldwide.

Microsoft also operates an extensions market for the IDE, called the Visual Studio Code Marketplace, which offers add-ons that extend the application’s functionality and provide more customization options.

Previous reports have highlighted gaps in VSCode’s security, allowing extension and publisher impersonation and extensions that steal developer authentication tokens. There have also been in-the-wild findings that were confirmed to be malicious.
Typosquatting the Dracula theme

For their recent experiment, researchers Amit Assaraf, Itay Kruk, and Idan Dardikman, created an extension that typosquats the ’Dracula Official’ theme, a popular color scheme for various applications that has over 7 million installs on the VSCode Marketplace.

Dracula is used by a large number of developers due to its visually appealing dark mode with a high-contrast color palette, which is easy on the eyes and helps reduce eye strain during long coding sessions.

The fake extension used in the research was named ’Darcula,’ and the researchers even registered a matching domain at ’darculatheme.com.’ This domain was used to become a verified publisher on the VSCode Marketplace, adding credibility to the fake extension.
The Darcula extension on VSC Marketplace
The Darcula extension on the VSCode Marketplace
Source: Amit Assaraf | Medium

Their extension uses the actual code from the legitimate Darcula theme but also includes an added script that collects system information, including the hostname, number of installed extensions, device’s domain name, and the operating system platform, and sends it to a remote server via an HTTPS POST request.
Risky code added to the extension
Risky code added to the Darcula extension
Source: Amit Assaraf | Medium

The researchers note that the malicious code does not get flagged by endpoint detection and response (EDR) tools, as VSCode is treated with leniency due to its nature as a development and testing system.
“Unfortunately, traditional endpoint security tools (EDRs) do not detect this activity (as we’ve demonstrated examples of RCE for select organizations during the responsible disclosure process), VSCode is built to read lots of files and execute many commands and create child processes, thus EDRs cannot understand if the activity from VSCode is legit developer activity or a malicious extension.” - Amit Assaraf

The extension quickly gained traction, getting mistakenly installed by multiple high-value targets, including a publicly listed company with a $483 billion market cap, major security companies, and a national justice court network.

The researchers have opted not to disclose the names of the impacted companies.

Since the experiment did not have malicious intent, the analysts only collected identifying information and included a disclosure in the extension’s Read Me, license, and the code.
Location of victims after 24 hours
Location of victims 24 hours after Darcula’s publication on VSC Marketplace
Source: Amit Assaraf | Medium
VSCode Marketplace status

After the successful experiment, the researchers decided to dive into the threat landscape of the VSCode Marketplace, using a custom tool they developed named ’ExtensionTotal’ to find high-risk extensions, unpack them, and scrutinize suspicious code snippets.

Through this process, they have found the following:

1,283 with known malicious code (229 million installs).
8,161 communicating with hardcoded IP addresses.
1,452 running unknown executables.
2,304 that are using another publisher’s Github repo, indicating they are a copycat.

Below is an example of code found in a malicious Visual Studio Code Marketplace extension that opens a reverse shell to the cybercriminal’s server.
Reverse shell found in a code beautifying extension (CWL Beautifer)
Reverse shell found in a code beautifying extension (CWL Beautifer)
Source: Amit Assaraf | Medium

Microsoft’s lack of stringent controls and code reviewing mechanisms on the VSCode Marketplace allows threat actors to perform rampant abuse of the platform, with it getting worse as the platform is increasingly used.

“As you can tell by the numbers, there are plethora of extensions that pose risks to organizations on the Visual Studio Code marketplace,” warned the researchers.

“VSCode extensions are an abused and exposed attack vertical, with zero visibility, high impact, and high risk. This issue poses a direct threat to organizations and deserves the security community’s attention.”

All malicious extensions detected by the researchers were responsibly reported to Microsoft for removal. However, as of writing this, the vast majority remains available for download via the VSCode Marketplace.

The researchers plan to publish their ’ExtensionTotal’ tool along with details about its operational capabilities next week, releasing it as a free tool to help the developers scan their environments for potential threats.

BleepingComputer has contacted Microsoft to ask if they plan to revisit the Visual Studio Marketplace’s security and introduce additional measures that would make typosquatting and impersonation harder, but we have not received a response by publication time.

#Cybersécurité #Code_Marketplace #Développement

Saint-Nazaire : un mois après une cyberattaque historique, des services municipaux encore mutilés et ça va durer - Simon Cherner

Après le cybertsunami, la reconstruction. Touchée de plein fouet par une attaque informatique historique dans la soirée du 9 avril, l’agglomération de Saint-Nazaire retrouve progressivement l’usage de ses services numériques. Mais le chemin sera long : considérée comme « très sérieuse », selon une source proche du dossier, l’agression aurait mis totalement hors service quelque 400 applications clés de la municipalité, fait disparaître quelques données et forcé de nombreuses équipes à revenir au papier et au crayon. Une régression technologique sans précédent pour la collectivité, et qui persiste encore en partie aujourd’hui.

https://i.f1g.fr/media/cms/616x347_cropupscale/2024/05/16/90cce76cb8ba3dabda3c078d147918b89a7e052e877b8fecbb90ac4f7bda1c1f.jpg

Une attaque particulièrement grave
Signe de cette discrète offensive numérique, l’agglomération connaîtrait environ 150 tentatives d’intrusion informatique par jour depuis les six derniers mois. L’une a fini par percer. Un mois plus tard, la faille qui a ouvert la voie aux pirates a pu être déterminée et circonscrite à l’adresse mail générique d’un service technique de l’agglomération. Le mot de passe associé à cette adresse aurait été forcé de manière assez rudimentaire, par force brute ou par l’intermédiaire d’une base de données précédemment piratée et partagée en ligne. Une fois en possession du mail, les attaquants ont pu s’en prendre aux serveurs de l’agglomération. Près d’un tiers du réseau interne a été infecté par un rançongiciel. Aucun groupe ne semble pour l’heure avoir revendiqué l’attaque.

« C’est un sujet très sensible. Ce genre d’attaque de grande envergure est particulièrement grave pour une agglomération comme Saint-Nazaire (127.000 habitants, NDLR) », commente un expert en cybersécurité basé en Loire-Atlantique qui préfère rester anonyme. « Les rançongiciels ont la cote auprès des pirates informatiques depuis l’attaque fondatrice du virus WannaCry , en 2017, poursuit-il. La période du Covid a accéléré la tendance et, désormais, nous voyons de plus en plus les tensions géopolitiques se répercuter dans le cyberespace, qui reste encore largement un Far West surveillé par un nombre insuffisant de shérifs. »

À la mi-mai, le secteur le plus mal en point correspondrait aux services de l’eau, dont les facturations et les prélèvements ont été complètement gelés. D’autres services, comme celui en charge des papiers d’identité, de l’urbanisme et des centres de loisirs fonctionnent au ralenti, et uniquement par papier. Une semaine après l’attaque, la mairie évoquait un délai de deux ans, avant le rétablissement complet de ses services. Un mois plus tard, aucune échéance n’est avancée par l’agglomération de Saint-Nazaire.

#hacking #cyberattaque #sécurité #internet #ransomware #sécurité_informatique #cyberattaques #cybersécurité #malware #piratage #algorithme #en_vedette #Saint-Nazaire #services_publics #services_public

Source : ▻https://www.lefigaro.fr/nantes/saint-nazaire-un-mois-apres-une-cyberattaque-historique-des-services-munici

Vous avez suivi l’histoire avec la librairie #XZ ?
C’est Mission Impossible IRL (ou le poisson d’avril le plus dingue de l’histoire des poissons d’avril)

Rémy sur Mastodon

Ça fait deux jours que je suis fasciné par ce qui se passe dans le monde de la sécurité informatique, autour de la backdoor XZ. Je vais essayer de vous l’expliquer, ça va être technique, mais c’est important.

Pour Internet, c’est l’équivalent d’un gros astéroïde qui serait passé à 5000km de la Terre. Pas d’impact, pas de dégâts directs, mais on aurait pu tous y passer et personne ne l’a vu venir.

Je vais chercher à vulgariser un maximum, tout en donnant des liens vers les sources directes, qui sont souvent très techniques et en anglais.

Le fil complet :
▻https://mamot.fr/@rusty@piaille.fr/112190942190403821

https://imgs.xkcd.com/comics/dependency.png

#cybersecurité #hacking #InfoSec #backdoor #OpenSSH

Unpatchable vulnerability in Apple chip leaks secret encryption keys | Ars Technica
▻https://arstechnica.com/security/2024/03/hackers-can-extract-secret-encryption-keys-from-apples-mac-chips

https://cdn.arstechnica.net/wp-content/uploads/2024/03/apple-mchip-encryption-vulnerability-760x380.jpg

Finalement, se promener sur les autoroutes numériques, c’est un peu comme se retrouver tout nu au milieu des Champs Elysées. Avant, ça n’arrivait que dans les cauchemards...

A newly discovered vulnerability baked into Apple’s M-series of chips allows attackers to extract secret keys from Macs when they perform widely used cryptographic operations, academic researchers have revealed in a paper published Thursday.

The flaw—a side channel allowing end-to-end key extractions when Apple chips run implementations of widely used cryptographic protocols—can’t be patched directly because it stems from the microarchitectural design of the silicon itself. Instead, it can only be mitigated by building defenses into third-party cryptographic software that could drastically degrade M-series performance when executing cryptographic operations, particularly on the earlier M1 and M2 generations. The vulnerability can be exploited when the targeted cryptographic operation and the malicious application with normal user system privileges run on the same CPU cluster.
Beware of hardware optimizations

The threat resides in the chips’ data memory-dependent prefetcher, a hardware optimization that predicts the memory addresses of data that running code is likely to access in the near future. By loading the contents into the CPU cache before it’s actually needed, the DMP, as the feature is abbreviated, reduces latency between the main memory and the CPU, a common bottleneck in modern computing. DMPs are a relatively new phenomenon found only in M-series chips and Intel’s 13th-generation Raptor Lake microarchitecture, although older forms of prefetchers have been common for years.

Security experts have long known that classical prefetchers open a side channel that malicious processes can probe to obtain secret key material from cryptographic operations. This vulnerability is the result of the prefetchers making predictions based on previous access patterns, which can create changes in state that attackers can exploit to leak information. In response, cryptographic engineers have devised constant-time programming, an approach that ensures that all operations take the same amount of time to complete, regardless of their operands. It does this by keeping code free of secret-dependent memory accesses or structures.

The breakthrough of the new research is that it exposes a previously overlooked behavior of DMPs in Apple silicon: Sometimes they confuse memory content, such as key material, with the pointer value that is used to load other data. As a result, the DMP often reads the data and attempts to treat it as an address to perform memory access. This “dereferencing” of “pointers”—meaning the reading of data and leaking it through a side channel—is a flagrant violation of the constant-time paradigm.

#Cybersécurité #Faille_M1 #Apple #Cryptographie

Médicaments non délivrés, devis et facturation en panne… Une cyberattaque perturbe sérieusement le système de santé aux États-Unis Ingrid Vergara

La cyberattaque d’une filiale de la plus importante compagnie d’assurance-santé américaine tourne à la crise d’ampleur aux États-Unis. Victime d’un rançongiciel qui affecte une de ses divisions depuis le 21 février, le groupe UnitedHealthcare n’est plus en mesure d’assurer de nombreuses tâches nécessaires au bon fonctionnement du système de santé. Des médecins qui ne peuvent plus savoir si un patient bénéficie ou non d’une assurance-santé, des pharmacies incapables de transmettre les demandes de remboursement de patients, des factures d’hôpitaux non réglées, des retards dans les délivrances d’ordonnances de médicaments…

https://i.f1g.fr/media/cms/704x396_cropupscale/2024/03/04/e007a7abdf349c5bbcc3f7f306dca3eb7819b5ef6382bd43cc21daaf3a0ce45c.jpg

Les réactions en chaîne s’étendent et s’aggravent au fur et à mesure que les jours passent. Car UnitedHealthcare est la plus grande plateforme d’échange de paiements entre médecins, pharmacies, prestataires de soins de santé et patients du système de santé américain. Sa filiale Change gère la facturation de quelque 67.000 pharmacies, . . . . .

#Santé #internet #sécurité_informatique #cyberattaques #cybersécurité #malware #usa #UnitedHealthcare #algorithme #juste_à_temps #dématérialisation #intelligence_artificielle #artificial-intelligence #blockchain #IA

Source et suite (payante) : ▻https://www.lefigaro.fr/secteur/high-tech/medicaments-non-delivres-devis-et-facturation-en-panne-une-cyberattaque-per

Google says spyware vendors behind most zero-days it discovers
▻https://www.bleepingcomputer.com/news/security/google-says-spyware-vendors-behind-most-zero-days-it-discovers

https://www.bleepstatic.com/content/hl-images/2023/12/29/Google_headpic.jpg

Intéressant sur le processus de fabrication du capitalisme de la menace (un pas de plus dans le capitalisme de surveillance).
Mais quand c’est google qui veut s’en prendre aux entreprises qui vendent des logiciels espions, on ne peut s’empêcher de penser qu’ainsi, ce serait Google qui serait le seul à savoir des choses sur ses utilisateurs. De là à en profiter ? Certainement pas, voyons, un monopole comme ça est plus grand qu’un service public, n’est-ce pas ?

Commercial spyware vendors (CSV) were behind 80% of the zero-day vulnerabilities Google’s Threat Analysis Group (TAG) discovered in 2023 and used to spy on devices worldwide.

Zero-day vulnerabilities are security flaws the vendors of impacted software do not know about or for which there are no available fixes.

Google’s TAG has been following the activities of 40 commercial spyware vendors to detect exploitation attempts, protect users of its products, and help safeguard the broader community by reporting key findings to the appropriate parties.

Based on this monitoring, Google has found that 35 of the 72 known in-the-wild zero-day exploits impacting its products over the last ten years can be attributed to spyware vendors.

“This is a lower-bounds estimate, as it reflects only known 0-day exploits. The actual number of 0-day exploits developed by CSVs targeting Google products is almost certainly higher after accounting for exploits used by CSVs that have not been detected by researchers, exploits where attribution is unknown, and cases where a vulnerability was patched before researchers discovered indications of exploitation in-the-wild.” - Google

Those spyware vendors use the zero-day flaws to target journalists, activists, and political figures as directed by their customers, including governments and private organizations.

Some notable CSVs highlighted in Google’s report are:

Cy4Gate and RCS Lab: Italian firms known for the “Epeius” and “Hermit” spyware for Android and iOS. The former acquired the latter in 2022, but operate independently.
Intellexa: Alliance of spyware firms led by Tal Dilian since 2019. It combines technologies like Cytrox’s “Predator” spyware and WiSpear’s WiFi interception tools, offering integrated espionage solutions.
Negg Group: Italian CSV with international reach established in 2013. It is known for “Skygofree” malware and “VBiss” spyware, targeting mobile devices through exploit chains.
NSO Group: Israeli firm famous for Pegasus spyware and other sophisticated espionage tools. It continues operations despite sanctions and legal issues.
Variston: Spanish CSV providing tailored security solutions. It collaborates with other vendors for zero-day exploits and is linked to the Heliconia framework, expanding in the UAE.

These vendors sell licenses to use their products for millions of dollars, allowing customers to infect Android or iOS devices using undocumented 1-click or zero-click exploits.

Some of the exploit chains utilize n-days, which are known flaws for which fixes are available, yet patching delays still make them exploitable for malicious purposes, often for extended periods.

Google says that CSVs have grown very aggressive in their hunt for zero-days, developing at least 33 exploits for unknown vulnerabilities between 2019 and 2023.

In the appendix of Google’s detailed report, one can find a list of 74 zero-days used by 11 CSVs. Of those, the majority are zero-days impacting Google Chrome (24) and Android (20), followed by Apple iOS (16) and Windows (6).

When white-hat researchers discover and fix the exploited flaws, CSVs often incur significant operational and financial damage as they struggle to reconstruct a working alternative infection pathway.

“Each time Google and fellow security researchers discover and disclose new bugs, it causes friction for CSVs and costs them development cycles,” says Google.

“When we discover and patch vulnerabilities used in exploit chains, it not only protects users, but prevents CSVs from meeting their agreements to customers, preventing them from being paid, and increasing their costs to continue operating.”

However, this is not enough to stop the proliferation of spyware, as the demand for these tools is strong, and the contracts are too lucrative for CSVs to give up.

Google calls for more action to be taken against the spyware industry, including higher levels of collaboration among governments, the introduction of strict guidelines that govern the use of surveillance technology, and diplomatic efforts with countries hosting non-compliant vendors.

Google is proactively countering spyware threats through solutions like Safe Browsing, Gmail security, the Advanced Protection Program (APP), and Google Play Protect, as well as by maintaining transparency and openly sharing threat information with the tech community.

#Google #Logiciels_espions #Cybersécurité #Zero_days

[Tuto 🎬] Sécurité e-mailing : découvrez avec Marc van der Wal, Ingénieur R&D à l’Afnic, comment SPF, DKIM et DMARC peuvent à la fois protéger le titulaire d’un nom de domaine en tant qu’émetteur mais également aider à la détection de tentatives d’usurpation par les destinataires

➡️ La vidéo sur ►https://www.afnic.fr/observatoire-ressources/actualites/revivez-en-video-la-12eme-edition-de-la-journee-du-conseil-scientifique-de-laf

#DNS #Sécurité #Email #JCSA23 #Cybersécurité #emailing #DKIM #SPF #DMARC

« Cybersécurité de vraies solutions existent » : retrouvez la campagne de Cybermalveillance.gouv.fr en partenariat avec France Télévisions ▻https://www.cybermalveillance.gouv.fr/tous-nos-contenus/actualites/cybersecurite-des-solutions-existent-campagne-france-televisi

#Cybersécurité

🎬 J-7 avant le replay #JCSA23 ! En attendant les présentations dans leur intégralité, retour en images sur les grands moments de la Journée du Conseil scientifique Afnic 2023 sur le thème « Spam et abus dans l’e-mailing / Mondes virtuels » ▻https://youtu.be/JWJp2kNkjno?si=VZY07q3FR_OFAVG1

#Afnic #Cybersécurité #Sécurité

Lancement aujourd’hui du premier ISAC dédié aux domaines de premier niveau ▻https://www.afnic.fr/observatoire-ressources/actualites/lancement-du-premier-isac-dedie-aux-domaines-de-premier-niveau

Launch today of the First Top-Level Domain ISAC on ▻https://www.tld-isac.eu

More info on ▻https://www.afnic.fr/en/observatory-and-resources/news/launch-of-the-first-top-level-domain-isac

#cybersécurité #cybersecurity #security #DNS #Europe #Internet

Un vol massif de données personnelles à Pôle emploi, six millions d’inscrits pourraient être concernés - Le Parisien
▻https://www.leparisien.fr/economie/six-millions-de-personnes-pourraient-etre-concernees-par-un-vol-de-donnee

Nom, prénom, numéro de Sécurité sociale… Un nouvel « acte de cybermalvaillance » a touché l’opérateur, via l’un de ses prestataires. Il pourrait concerner les données de six millions de demandeurs d’emploi. La direction de Pôle emploi va porter plainte.

La CNIL va-t-elle enquêter ? A qui va-t-on ponctionner 4% du chiffre d’affaires annuel ?

La Journée du Conseil scientifique de l’Afnic 2023 c’est ce mercredi 5 juillet au Campus Cyber pour parler spam et abus dans l’e-mailing avec Signal Spam, Mailjet France, Brevo France - ex Sendinblue et Annales des Mines .

Découvrez le programme complet et réservez les dernières places ►https://jcsa23.evenement.afnic.fr

#Afnic #cybersécurité #email #spam

🗓️ Spam et abus dans l’e-maling : comment les prévenir et les réduire ? C’est le thème de la Journée du Conseil scientifique de l’Afnic 2023 (JCSA23), mercredi 5 juillet au Campus Cyber !

✅ Réservez votre place sur ►https://jcsa23.evenement.afnic.fr

#Afnic #Sécurité #Cybersécurité #Spam #Emails #Abus #JCSA23

La cyberattaque de la ville de Lille estimée à plus d’un million d’euros Par A. D. D.

Plus de deux mois après l’attaque informatique qui a touché la mairie, plusieurs services demeurent impactés. La ville ne peut toujours pas facturer la cantine. Les salaires comme les factures sont réglées par les Finances publiques… Dans ce contexte et face à la charge de travail des agents, Martine Aubry a décidé de reporter le bilan politique de mi-mandat.

Survenue le 1er mars, la cyberattaque avait mis à l’arrêt tout le réseau informatique : 300 serveurs et quelque 3 500 ordinateurs. À ce jour, seuls 850 PC et messageries ont pu être rétablis.

https://globbsecurity.fr/wp-content/uploads/2016/10/cyberattaque-oct.jpg

L’attaque, revendiquée fin mars par le groupe Royal, « n’a pas eu, pour l’instant, d’effets pervers » selon Martine Aubry qui s’est exprimée sur le sujet au cours d’une conférence de presse mardi. En dehors de mails d’intimidation sur la messagerie de quatre agents, pas de demande de rançon à proprement parler.

Mais les événements ont entraîné de « grosses difficultés » comme l’a rappelé la maire de Lille. Tous les services ont dû se réorganiser en urgence pour assurer la continuité du service public en revenant au papier et au crayon.

Impossible de verser le salaire des agents
Privée d’accès aux logiciels, la ville n’est plus en mesure de payer le salaire des agents (et des élus) depuis mars. C’est la Direction régionale des Finances publiques qui a pris le relais. « Elle s’est montrée très compréhensive », a souligné Martine Aubry. La ville espère un retour à la normale en septembre pour le logiciel paye.

La DRFIP a également pris en charge le paiement des factures dues aux entreprises et aux associations. « On rouvre les logiciels progressivement, on teste, on doit prendre beaucoup de précautions (…) Rien n’a été dégradé, nous n’avons pas perdu de données », rassurait Martine Aubry. Le logiciel finances a été rouvert en priorité ainsi que celui de l’état civil. Le service, qui reçoit en moyenne 500 demandes d’actes par jour, peut désormais les sortir informatiquement (mais pas les envoyer par Internet pour le moment).

L’assurance va-t-elle prendre en charge ?
Côté familles, le paiement de la cantine est suspendu depuis mars mais la facturation devrait reprendre prochainement. Les inscriptions à l’école et à la crèche pour la rentrée prochaine se font normalement.

Le coût de la cyberattaque est pour le moment estimé à 1 million d’euros, « hors frais de personnel » précise la ville, dont les agents ont été fortement mobilisés ces dernières semaines. Un coût que la ville espère voir pris en charge par son assurance.

C’est dans ce contexte que la majorité municipale a décidé de reporter la présentation de son bilan de mi-mandat aux Lillois. Prévue fin mai, elle est reportée à fin septembre voire début octobre. « Nous sommes évidemment capables de dire ce que nous avons fait ou pas fait mais nous ne pouvons pas, aujourd’hui, avec le travail qu’ont les agents pour remettre en place les logiciels, leur demander en plus de nous accompagner sur tous les sujets qui seront présentés lors des réunions de quartier. »

#administration #sécurité #internet #cybersécurité #cyberattaque #sécurité_informatique #dématérialisation des #services_publics #mairie #Lille

Source : ▻https://www.lavoixdunord.fr/1328944/article/2023-05-17/la-cyberattaque-de-la-ville-delille-estimee-plus-d-un-million-d-euros

#Lille ville cyber maudite : le site de la ville inaccessible une partie de la journée suite à un incendie chez son hébergeur Par A. Mu. et A. D.

Le site de la ville de Lille a été inaccessible pendant une partie de la journée ce mercredi. Sur les réseaux sociaux, la mairie a indiqué que cela était dû à un incendie chez son hébergeur informatique, basé en région parisienne.

https://lvdneng.rosselcdn.net/sites/default/files/dpistyles_v2/vdn_864w/2023/04/26/node_1320652/56152598/public/2023/04/26/B9734122402Z.1_20230426110525_000%2BGRRMLJSTM.1-0.jpg

Basé à Clichy (Hauts-de-Seine), l’hébergeur #Ecritel a confirmé un sinistre qui n’a toutefois pas touché directement ses locaux et ses installations. Un feu a effectivement pris vers 5 heures au sous-sol d’un data center, le Global Switch Clichy, avant d’être maîtrisé deux heures plus tard. À la demande des secours, l’électricité a été coupée dans le bâtiment « par précaution », entraînant la mise à l’arrêt forcée des sites Internet hébergés.
. . . .
Les sites internet des préfectures maritimes de l’Atlantique, de la Manche, de la mer du Nord et de la Méditerranée étaient également indisponibles, tout comme celui de la préfecture du Pas-de-Calais, pour la même raison.

#administration #sécurité #internet #cybersécurité #sécurité_informatique #dématérialisation des #services_publics #mairie #Lille

Source : ▻https://www.lavoixdunord.fr/1320652/article/2023-04-26/lille-le-site-de-la-ville-inaccessible-suite-un-incendie-chez-son-heber