Apple has released an update for its Boot Camp utility to address vulnerabilities related to the wireless Key Reinstallation Attacks (KRACK) that were disclosed late last year.
http://feedproxy.google.com/~r/Securityweek/~3/GkQ_BEfzlWs/apple-patches-krack-flaws-boot-camp
Google this week released its July 2018 set of Android patches to address tens of vulnerabilities in the mobile operating system, including several rated as Critical.
http://feedproxy.google.com/~r/Securityweek/~3/E96A-2_3LFg/google-fixes-critical-android-vulnerabilities
Siemens informed customers on Tuesday that some of its SICLOCK central plant clocks are affected by several vulnerabilities, including ones that have been rated “critical.”
http://feedproxy.google.com/~r/Securityweek/~3/1UGQBLdsDXk/flaws-expose-siemens-central-plant-clocks-attacks
VMware informed customers last week that it patched several vulnerabilities that can lead to a denial-of-service (DoS) condition or information disclosure in its ESXi, Workstation, and Fusion products.
http://feedproxy.google.com/~r/Securityweek/~3/5Geaww7eW8E/vulnerabilities-patched-vmware-esxi-workstation-fusion
(credit: BAZ Antennen)
The Long Term Evolution mobile device standard used by billions of people was designed to fix many of the security shortcomings in the predecessor standard known as Global System for Mobile communications. Mutual authentication between end users and base stations and the use of proven encryption schemes were two of the major overhauls. Now, researchers are publicly identifying weaknesses in LTE that allow attackers to send nearby users to malicious websites and fingerprint the sites they visit.
The attacks work because of weaknesses built into the LTE standard itself. The most crucial weakness is a form of encryption that doesn’t protect the integrity of the data. The lack of data authentication makes it possible for an attacker to surreptitiously manipulate the IP addresses within an encrypted packet. Dubbed aLTEr, the researchers’ attack causes mobile devices to use a malicious domain name system server that, in turn, redirects the user to a malicious server masquerading as Hotmail. The other two weaknesses involve the way LTE maps users across a cellular network and leaks sensitive information about the data passing between base stations and end users.
The attacks, which are described in a paper published Thursday, require about $4,000 worth of equipment that must be within about one mile of the targeted user. Because the weaknesses are the result of design decisions made when the LTE specification was under development, there is no way to patch them now. End users, however, can protect themselves against aLTEr by only visiting websites that use HTTP Strict Transport Security and DNS Security Extensions.
Read 8 remaining paragraphs | Comments
https://arstechnica.com/?p=1338715
A recently addressed privacy bug on Nametests.com resulted in the data of over 120 million users who took personality quizzes on Facebook to be publicly exposed.
http://feedproxy.google.com/~r/Securityweek/~3/nmSvLuUUbRU/facebook-app-exposed-data-120-million-users
A team of researchers from universities worldwide have devised a new set of DMA-based Rowhammer attacks against the latest Android OS, along with a lightweight defense to prevent such attacks on ARM-based devices.
http://feedproxy.google.com/~r/Securityweek/~3/4dzotnXVqys/researchers-devise-rowhammer-attacks-against-latest-android-versions
With cyber-attacks on enterprise networks becoming more sophisticated, organizations have stepped up perimeter security by investing in the latest firewall, data and endpoint protection, as well as intrusion prevention technologies. In response, hackers are moving to the path of least resistance and looking for new avenues to exploit. Many security experts believe the next wave of enterprise hacking will be carried out by exploiting Application Programming Interfaces (APIs).
http://feedproxy.google.com/~r/Securityweek/~3/HWxJXRv_2c0/next-big-cyber-attack-vector-apis
A file deletion vulnerability that remains unpatched 7 months after being reported allows for the complete takeover of WordPress sites and for arbitrary code execution.
http://feedproxy.google.com/~r/Securityweek/~3/ODFW–9NTZk/unpatched-wordpress-flaw-leads-site-takeover-code-execution
Cisco has informed users that a recently patched vulnerability affecting its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software has been exploited in denial-of-service (DoS) attacks.
http://feedproxy.google.com/~r/Securityweek/~3/iRPtikz6oQU/cisco-asa-flaw-exploited-dos-attacks
