Security Leftovers

posted by Roy Schestowitz on Sep 30, 2023

• Snap Store Uploads Restricted Following Possible Security Issue

  Canonical is enacting manual reviews for all newly registered uploads to its Snap Store following what it describes as a ‘potential security incident’.

  It’s responding to reports that a number of recently published crypto-related snaps were acting in malicious manner (the apps in question have since been pulled and are no longer available to install).

  Now, this sounds dodgy – as any security incident might.

  But it’s important to note that while Canonical has announced this incident (and taken swift action to ameliorate the situation, to their credit) they describe it as a ‘potential security incident’ (emphasis mine). I.e. they’re still looking into things.

  If you take anything away from me reporting on this incident – there will be those out there suggesting that by reporting it I’m trying to milk it for clicks or some such, so I want to be clear – let it be that.

• Security updates for Friday

  Security updates have been issued by Debian (firefox-esr, jetty9, and vim), Gentoo (Fish, GMP, libarchive, libsndfile, Pacemaker, and sudo), Oracle (nodejs:16 and nodejs:18), Red Hat (virt:av and virt-devel:av), Slackware (mozilla), SUSE (chromium, firefox, Golang Prometheus, iperf, libqb, and xen), and Ubuntu (linux-raspi).

• Kia and Hyundai Blame TikTok and Instagram For Their Cars Getting Stolen

  In a court filing, the companies argue that social media companies “caused an unprecedented increase in thefts.” The cars being stolen didn’t have basic anti-theft technology.

• Researchers Extract Sounds From Still Images on Smartphone Cameras

  A group of academic researchers devised a technique to extract sounds from still images captured using smartphone cameras with rolling shutter and movable lens structures.

• Chromium 117.0.5938.132 fixes zero-day exploit

  Just yesterday I uploaded my  packages for chromium and chromium-ungoogled to 117.0.5938.92. Only to discover right before heading to bed that there's a new security update available; Chromium 117.0.5938.132 fixes a zero-day vulnerability in libvpx (CVE-2023-5217) which is already actively exploited to install spyware on computers.

• Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks

  Hackers have set their sights on CVE-2023-34468, an RCE vulnerability in Apache NiFi that impacts thousands of organizations. 

• North Korean hackers posed as Meta recruiter on LinkedIn [Ed: Microsoft gets you in trouble]

  Targets of the operation were given phony coding challenges that delivered a range of malware including a previously-unseen backdoor.

• In Other News: RSA Encryption Attack, Meta AI Privacy, ShinyHunters Hacker Guilty Plea

  Noteworthy stories that might have slipped under the radar: new RSA encryption attack, Meta’s AI privacy safeguards, and ShinyHunters hackers’ guilty plea. 

• Fastboot Fuzzing

  TL;DR The Fastboot protocol can often have hidden commands Those commands can do interesting things Conventionally they’re found by reverse engineering Can't find a copy of the firmware?

• Are You Still Storing Passwords In Plain Text Files, (Fri, Sep 29th)

  "Infostealer" malware [...] the goal is to steal "juicy" information like passwords, cookies, screenshots, keystrokes, and more. Yesterday, I spotted an interesting sample.

• Microsoft breach led to theft of 60,000 US State Dept emails

  Chinese hackers stole tens of thousands of emails from U.S. State Department accounts after breaching Microsoft's cloud-based Exchange email platform in May.

• Bankrupt IronNet Shuts Down Operations

  Bankrupt and out of financing options, IronNet has terminated all employees and plan to file for Chapter 7 protection.

• CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks

  CISA has added CVE-2018-14667, an old critical JBoss RichFaces flaw to its known exploited vulnerabilities catalog.

• Cloudflare Users Exposed to Attacks Launched From Within Cloudflare: Researchers

  Gaps in Cloudflare’s security controls allow users to bypass protections and target others from the platform itself.