Security

Focused on delivering an easy initial setup and post-install configuration, IPFire is a Linux distro designed for firewalls. Version 2.29 Core 187 comes with an additional layer of protection against denial-of-service (DoS) attacks. This capability is useful in high-bandwidth and cloud deployment scenarios.

A critical vulnerability, Sinkclose, has been discovered in AMD processors. The flaw allows attackers to gain near-total control of affected systems. While AMD is working on patches, users are urged to update their systems immediately to mitigate risks of data theft, system takeover, espionage, and possible infrastructure disruption.

The "0.0.0.0 Day" vulnerability, discovered 18 years ago, allows malicious websites to bypass security protocols in Google Chrome, Mozilla Firefox, and Apple Safari, primarily affecting Linux and macOS devices. This flaw lets attackers remotely alter settings, access protected information, and potentially execute code on affected systems. Despite its initial disclosure in 2008, the vulnerability remains unresolved, though browser developers are now taking steps to address it. Additional security measures are recommended for developers to protect their applications.

Cameras support the robot vacuum cleaner at work or detect falls in the home. Unfortunately, there is always a risk of misuse, which a new type of camera system can prevent.

At Black Hat USA 2024, a researcher showcased a method for taking over the Windows Update Process to craft a custom system downgrade. With the system downgraded, threat actors can elevate privileges, bypass security features, and exploit previously patched vulnerabilities.

Researchers have developed an AI-powered method to reconstruct images displayed on a computer screen by intercepting electromagnetic radiation emitted from the HDMI cable. Hackers could remotely capture sensitive information, such as passwords or financial data. While the average user is unlikely to be targeted, organizations handling sensitive information should be aware of this and take necessary measures if needed.

WazirX has outlined a strategy to address a recent cyberattack that resulted in the loss of over $230 million in crypto assets. The crypto exchange has implemented a two-tiered recovery plan, allowing users to choose between prioritized asset recovery with limited access or immediate access with delayed recovery. To mitigate losses, WazirX will distribute recovered funds among affected users through a “balanced crypto basket” approach.

CheckMag We're sorry, but unfortunately NBC Notebookprotect Safe Browsing filter doesn't recognise this blurb. This article might try to do unpredictable things to your computer.

After years of working on a plan to eliminate third-party cookies, which enable tracking user activity across websites, from the Chrome browser, Google has decided not to go ahead with it, citing adverse effects on its advertising business. Instead, it now plans to give users the choice to opt out of third-party cookies in favour of its new Privacy Sandbox tech.

After a faulty update of the security solution CrowdStrike caused history-making IT failures last week, entrepreneur Elon Musk took the logical step and banned the software from his companies.

Magazine CrowdStrike’s recent failure has been reported as the “Largest IT outage in history,” which leaves many to wonder why so many critical points of the global infrastructure rely on their platform. CrowdStrike’s cyber security services are responsible for 298 of the Fortune 500 companies, 538 of the Fortune 1000 companies, and 8 out of 10 of the top financial firms. 

Samsung Galaxy devices are now confirmed to receive a crucial security update in August 2024. This update addresses a major vulnerability (CVE-2024-32896) that affects all Android phones and tablets, not just Pixels. While some new camera improvements could be bundled for the Galaxy S24, Samsung might prioritize integrating new Galaxy AI features or focus solely on security updates.

A major tech outage is causing havoc globally as of July 19th. Airlines have grounded flights due to communication problems, while hospitals, banks, and media outlets are also experiencing disruptions. Early reports suggested a potential link to a software issue with CrowdStrike Falcon Sensor, a cybersecurity program that is causing Windows systems to display the "blue screen of death". The company CEO has since posted a tweet about identifying, isolating and working on the issue as they urge organizations to communicate with CrowdStrike via official channels.

Major Indian crypto exchange WazirX suffered a security breach, losing over $230 million in digital assets. The company posted a tweet on 18th July (3:48 AM EDT) announcing suspension of withdrawals as they investigate the incident - which reportedly involved a compromised multisig wallet. North Korean hackers are responsible for this incident, as per Elliptic.

Brazil's data protection agency, ANPD, has ordered Meta to halt its training of generative AI systems within the country. The ANPD cited concerns about user privacy and the potential for harm, and as per Meta's latest statement to TechCrunch, the company is hitting the brakes in Brazil for now, while it sorts everything out. Long-term plans remain unclear at this point.

While Google Chrome is currently displaying security warnings when trying to download certain files and forbid the operation, the upcoming full-page security warning screen will also allow the user to choose one of three reasons for downloading, and regardless of the answer, the user will be able to complete the operation.

MarineMax, a Florida-based yacht and boat retail company, suffered a data breach in March 2024, impacting over 123,000 customers and possibly employees. After initially downplaying the incident, MarineMax confirmed that attackers breached their systems and stole personal information, including names and potentially more. The breach took place between March 1 and 10, and Rhysida claimed responsibility for the same.

AT&T got hacked recently, following an event of a similar nature earlier in 2024. The latter was massive, with personal information of over 73 million customers getting leaked, and this latest data breach is even bigger with approximately 110 million clients affected.

CheckMag So many people rely on mobile devices of all stripes to keep their data secure. Let’s look at why this is not such a good idea - and the options available to fight back.

Capable of providing a fully-loaded Linux firewall solution that only requires a few clicks to secure a network, NethSecurity got an update with two major highlights. Version 8.1 comes with a user account manager in the web GUI, as well as a visual connection tracker.

Many feel misuse of generative AI poses an enormous security risk, according to an international survey carried out by Censuswide, with phishing attacks named as the other key concern. 74% of respondents express confidence in their IT departments' abilities yet over a half report having experienced a data breach lately. 55% of the security experts admit they do not conduct security audits as often as they should.

In what some security experts are calling the largest password compilation in history, over 9.9 billion passwords were posted on a dark web forum. These passwords were compiled from multiple hacks and leaks, including some that occurred decades ago.

If you are using the ChatGPT app on a Mac, you are advised to make sure it is up to date without delay. Evidence that previous versions have been saving your chats in a potentially vulnerable form on your device and, thereby, do not adhere to Apple's typical privacy standards, has come to light.

Authy, a 2FA app owned by Twilio, was affected by a data breach earlier this week. A total of 33 million phone numbers were exposed. Twilio confirmed that no other user data was compromised, with the Authy app since receiving a new security-centric update.

Los Angeles Unified School District Ed AI chatbot service provider AllHere has gone belly up after taking over $2 million for three months of poor service while violating student data privacy. The Harvard-educated CEO and most employees have been fired, and the company has been put up for sale.

HiDock touts its new product as the ultimate, most futuristic laptop dock of the future. Not only can it automatically record the voice calls taken over its inbuilt speaker, it can use AI to record and produce written transcriptions and summaries of them. It can also act as a hub for dual 4K monitors, SD cards, thumb drives and USB accessories.

While Microsoft plans to end support for Windows 10 in late 2025, 0patch comes with the promise of supporting Windows 10 v22H2 with critical security patches until 2030 and even further if there is enough demand. Fortunately, the $25-per-year or $35-per-year Pro and Enterprise subscriptions are also accompanied by a free plan.

70mai asserts that its latest dash cam can act as an advanced driver assistance system (ADAS) as well as a vehicle surveillance system. Based on the on-trend Sony STARVIS 2 sensor, the A510 is also packed with features such as night vision, HDR and fast wireless connections that be delivered via inbuilt 4G/LTE as well as Wi-Fi.

Identity verification company AU10TIX has exposed identity information for users of Coinbase, Fiverr, LinkedIn, PayPal, Upwork, and more to hackers by failing to secure admin login for 18 months. The admin account had access to the name, birthdate, nationality, ID type and number, and ID image of people using services AU10TIX contracted with. Typically, a person’s name and birthday are enough for hackers to steal identities.

A Nintendo leaker accidentally outed their source to Bloomberg, while other leaks allegedly originated from a Google employee with access to Nintendo's YouTube channel. Nintendo retaliated by tightening up its IT security and pushing at least one leaker into hiding.

The US Department of Commerce will ban Kaspersky in America beginning July 20, 2024. The ban under Information and Communications Technology and Services regulations will effectively prevent Kaspersky from selling and updating products such as its popular antivirus software to Americans.

A massive cyberattack has crippled over 15,000 North American auto dealerships that use the CDK dealership management system. The software-as-a-service can manage all aspects of a dealership from quotes to service to sales. Affected dealerships are forced to use pen and paper.

Taking its level of security one step further, Tails 6.4 comes with a random seed on the USB stick that strengthens all its cryptographic functions. Thanks to it, the Persistent Storage, Tor, or HTTPS are now more secure. Additionally, this new release comes with multiple minor tweaks and fixes.

Adobe recently stirred up controversy with an update to its terms of use, seemingly demanding unfettered access to user-generated content. The concerns were amplified by fears of Adobe using user content to train its Firefly generative AI. Adobe has now responded, but users remain sceptical, with some already jumping ship.

Security and forensics-focused Kali Linux is back with bug updates and tweaks, as well as new tools and desktop updates. Released yesterday, Kali 2024.2 includes Gnome 46 and Xfce updates for Kali-Undercover and HiDPI, as well as no less than 18 new tools, including coercer, horst, netexec, and snort.

The worst results that a privacy check by Mozilla has ever produced. And it's not at all surprising that all the car manufacturers tested were criticized - some, fortunately, less so.

DARPA has released its deepfake detection tools developed in its Semantic Forensics program to counter AI threats. Nearly two dozen tools help detect deepfake photos and videos as well as AI-generated text and voice. Collaborative AI FORCE challenges released every four weeks encourage public researchers to help develop innovative solutions to the generative AI threat.

Households with August retrofit smart locks now have the convenient option of biometric access via the Yale Keypad Touch. The wireless keypad + fingerprint scanner helps the premium smart lock compete favourably with the latest offerings in the market.

At $149.99, the Aqara U50 is officially the least expensive Apple Home Key smart lock around, taking over the entry-level place of the U100. Not only can the U50 be operated via voice commands, passwords, key cards and the mere tap of an iPhone or smartwatch, it can also be re-keyed to work with your existing keys, unlike the U100. However the conspicuous lack of a fingerprint reader might create a dilemma for homeowners considering the U50.

Thieves in Los Angeles and Orange County, California are using hidden cameras to target unoccupied homes for theft. Wireless home security cameras can be knocked out with Wi-Fi jammers, but as homeowners smarten up and switch to wired security systems, thieves are now using hidden surveillance cameras to hit homes when the occupants are out.

In the aftermath of a patent dispute, Motorola and Lenovo are no longer allowed to sell smartphones and laptops with WWAN modules. Although some targeted Lenovo laptops can still be acquired as long as existing stocks last, the brand might appeal the court's decision and revert the ruling.

EZVIZ asserts that its latest pan/tilt (PT) outdoor Wi-Fi camera comes with double the security as it has double the lenses. Both of the H9c's cameras are rated for a resolution of 2K, although they have discrete zoom and wide-angle functions. Combined, the OEM backs them to achieve up to 2x the detail and an extended color night vision range compared to its predecessors.

Microsoft has rolled out passkeys support to consumer accounts, joining an effort by major companies including Apple and Google to eliminate password use. The login method utilizes face, fingerprint, or pin authentication, typically on a smartphone, to authenticate logins. This also introduces potential problems and annoyances.

The CEO of Pro Network Entities trafficking counterfeit Cisco networking equipment into America has been sentenced to merely 78 months in prison. Despite supplying hundreds of millions of dollars of fake, potentially compromised Cisco equipment that were installed at US military bases, government sites, hospitals, and schools across America, the CEO was sentenced to merely 78 months in prison.

Microsoft has officially acknowledged that the Windows security update for April could prevent the use of VPNs, affecting all versions of Windows 11, Windows 10 and Windows Server. While a fix is on the way, the only solution until it arrives is to roll back the update to the previous version.

EZVIZ' latest video doorbell is its first to come with its own solar power for potentially always-on operation. The EP3x Pro is also rated to 'expand' its field of vision with dual cameras, and to keep the user alerted as to the arrival of people or other things such as packages subscription-free.

With a share of over 85% in the productivity software segment and more than 90% in the operating system market share currently in use with the federal agencies, Microsoft reigns supreme in the US. However, this makes it quite sluggish when it comes to dealing with threats and worthy of being considered a national security concern.

Of course, there are many automated processes on the Internet. Search engines like Google browse for new content. AI makes use of freely available knowledge. What is worrying, however, is the development of so-called bad bots.

A simple spelling error in the source code of the Telegram Messenger Windows application let attackers bypass a security warning. This enabled the automatic execution of Python scripts after clicking on a link disguised as a video.

The U.S. Department of Defense has proactively begun eliminating all Chinese battery energy storage system from use across all branches of the military, including the Navy, due foreign threat risks. China, Russia, and other countries have stepped up cyberattacks in recent years to disrupt the American and other power grids.