Kategorie

Enlarge (credit: Aurich Lawson / Getty Images)

Back at the start of the year, a set of attacks that leveraged the speculative execution capabilities of modern high-performance processors was revealed. The attacks were named Meltdown and Spectre. Since then, numerous variants of these attacks have been devised. In tandem, a range of mitigation techniques has been created to enable at-risk software, operating systems, and hypervisor platforms to protect against these attacks.

A research team—including many of the original researchers behind Meltdown, Spectre, and the related Foreshadow and BranchScope attacks—has published a new paper disclosing yet more attacks in the Spectre and Meltdown families. The result? Seven new possible attacks. Some are mitigated by known mitigation techniques, but others are not. That means further work is required to safeguard vulnerable systems.

The previous investigations into these attacks has been a little ad hoc in nature; examining particular features of interest to provide, for example, a Spectre attack that can be performed remotely over a network, or Meltdown-esque attack to break into SGX enclaves. The new research is more systematic, looking at the underlying mechanisms behind both Meltdown and Spectre and running through all the different ways the speculative execution can be misdirected.

Read 14 remaining paragraphs | Comments

Microsoft’s November Patch Tuesday fixes include mitigation against a zero-day vulnerability leaving Windows 7, Server 2008 and Server 2008 R2 open to attack.

Another security vulnerability has been reported in Facebook that could have allowed attackers to obtain certain personal information about users and their friends, potentially putting the privacy of users of the world's most popular social network at risk. Discovered by cybersecurity researchers from Imperva, the vulnerability resides in the way Facebook search feature displays results for

Enlarge / This message, shown during Windows upgrades, is going to be salt in the wound.

Just over a month since its initial release, Microsoft is making the Windows 10 October 2018 Update widely available today. The update was withdrawn shortly after its initial release due to the discovery of a bug causing data loss.

New Windows 10 feature updates use a staggered, ramping rollout, and this (re)release is no different. Initially, it'll be offered only to two groups of people: those who manually tell their system to check for updates (and that have no known blocking issues due to, for example, incompatible anti-virus software), and those who use the media-creation tool to download the installer. If all goes well, Microsoft will offer the update to an ever-wider range of Windows 10 users over the coming weeks.

For the sake of support windows, Microsoft is treating last month's release as if it never happened; this release will receive 30 months of support and updates, with the clock starting today. The same is true for related products; Windows Server 2019 and Windows Server, version 1809, are both effectively released today.

Read 8 remaining paragraphs | Comments

Google cloud business customers were impacted by a Border Gateway Protocol hijacking.

The vulnerability is one of many with the same root cause: Cross-process information leakage.

Overall, the company released only three patches as part of its regularly-scheduled November update.

A brief outage on Monday diverted traffic to providers such as Google and Cloudflare via China - was it a blunder or a hack?

An attorney in the infamous 2015 Jeep hack predicts that more lawsuits related to IoT security are looming in the future.

There's no obvious executable payload in the attack but the attackers may be building a collection of websites and biding their time.

In 1999, Bruce Schneier wrote, "Complexity is the worst enemy of security." That was 19 years ago (!) and since then, cyber security has only become more complex. Today, controls dramatically outnumber staff available to support them. The Bank of America has a $400-million cyber budget to hire security staff and implement a broad array of products. But what if your budget and

Drug and immigration cops in the US are buying surveillance cameras to hide in streetlights and traffic barrels.

Police say it's a felony, but a woman arrested in connection with a drive-by shooting says she doesn't even know how to remotely wipe.

Cloudflare na jaře spustil svůj vlastní veřejný a šifrovaný DNS server, který podobně jako Google hostuje na atraktivní a snadno zapamatovatelné IP adrese 1.1.1.1 a 1.0.0.1. Jen připomenu, že Google používá 8.8.8.8 a 8.8.4.4. Nyní jedna z klíčových firem budující internetovou infrastrukturu ...

LinuxSecurity.com: The EU General Protection Data Regulation (GDPR) is supposed to make companies take extra care with their customers' personal data. That includes gathering explicit consent to use information and keeping it safe from identity thieves.

LinuxSecurity.com: The rise of usable, frictionless encryption has brought us to a point where users can be fairly certain that their Signal or WhatsApp messages are not being collected, subpoenaed, or wiretapped by cops armed with a warrant or message interception technology.

The new variant can exfiltrate emails for a period going back 180 days, en masse.

Internetem prolétla zpráva, že na nové MacBooky nebo nový Mac mini nelze nainstalovat Linux, což by byl zásadní problém, protože mnoho vývojářů používá tato zařízení jako hardware právě pro otevřený operační systém. Problém je ale komplexnější a situace stále trochu nevyřešená. Důvodem celého ...

A full 60 million U.S. cards were compromised in the past 12 months. While 93 percent of those were EMV chip-enabled, merchants continued to use mag stripes.