Week in review: Vulnerability tracking, GDPR quick guide, tackling the insider threat

Here’s an overview of some of last week’s most interesting news and articles: Intel offers to pay for Spectre-like side channel vulnerabilities Intel is expanding the bug bounty program it started last March, and is raising considerably the awards it plans to give out for helpful vulnerability information. The company is, simultaneously, starting a new bug bounty program focused specifically on side channel vulnerabilities, i.e., vulnerabilities that are rooted in Intel hardware but can be … More

Still relying solely on CVE and NVD for vulnerability tracking? Bad idea

2017 broke the previous all-time record for the highest number of reported vulnerabilities. The 20,832 vulnerabilities cataloged during 2017 by Risk Based Security (VulnDB) eclipsed the total covered by MITRE’s Common Vulnerability Enumeration (CVE) and the National Vulnerability Database (NVD) by more than 7,900. “Incredibly, we see too many companies still relying on CVE and NVD for vulnerability tracking, despite the US government funded organization falling short year after year. While some argue that the … More

Vulnerability in ISC BIND leads to DoS, patch today!

The Internet Systems Consortium has released security updates for BIND, the most widely used Domain Name System (DNS) software on the Internet, and a patch for ISC DHCP, its open source software that implements the Dynamic Host Configuration Protocol for connection to an IP network. BIND update The BIND update should be implemented as soon as possible: the vulnerability (CVE-2017-3145) can lead to denial-of-service and crash, and instances of that happening have been reported by … More

Week in review: WPA3, Intel AMT vulnerability, Meltdown and Spectre attack detection

Here’s an overview of some of last week’s most interesting news and articles: CBP releases new guidelines on phone, laptop searches at US borders The US Customs and Border Protection agency released an update to its Directive governing Border Searches of Electronic Devices. What the rise of cyber indictments means for 2018 The growing implementation of indictments throughout 2017 was arguably the most impactful government action to counter cyber attacks, and yet received little attention. … More

Android vulnerability allows attackers to modify apps without affecting their signatures

Among the many Android vulnerabilities patched by Google this December is one that allows attackers to modify apps without affecting their signatures. The danger “Although Android applications are self-signed, signature verification is important when updating Android applications. When the user downloads an update of an application, the Android runtime compares its signature with the signature of the original version. If the signatures match, the Android runtime proceeds to install the update,” Guard Square researchers explained. … More

Eavesdropper vulnerability exposes sensitive corporate communications data

Appthority published research on its discovery of the Eavesdropper vulnerability, caused by developers carelessly hard coding their credentials in mobile applications that use the Twilio Rest API or SDK, despite best practices the company clearly outlines in its documentation. What applications are affected by the Eavesdropper vulnerability? Security researchers have identified this as a real and ongoing threat affecting nearly 700 apps in enterprise mobile environments, over 170 of which are live in the official … More

Infosec expert viewpoint: Vulnerability patching

Vulnerability patching is one of the most useful and cost-effective methods to mitigate a plethora of security threats. Here’s what infosec experts think about the challenges related to patching systems, and how they see vulnerability patching evolve in the near future. They also give advice to enterprises looking to deploy a solution that makes vulnerability patching easier. Morey Haber, VP of Technology, Office of the CTO, BeyondTrust Unpatched machines have various degrees of risk. The … More

Vulnerability in code library allows attackers to work out private RSA keys

Researchers have discovered a security vulnerability in the Infineon-developed RSA library, which could be exploited by attackers to discover the RSA private key corresponding to an RSA public key generated by this library. This private key could be then misused to impersonate its legitimate owner, decrypt sensitive messages, forge signatures (e.g. for software releases) and more. The vulnerable version of the library is v1.02.013, and it’s unfortunately been in use since 2012 in a wide … More

Unpatched SQLi vulnerability in SmartVista e-commerce suite

Companies using SmartVista, the popular e-commerce/payment management product suite developed by Swiss company BPC Banking Technologies, are urged to put limit access to its management interface. That’s because Rapid7 researcher Aaron Herndon found a SQL injection vulnerability in it, and BPC has shown no indication that it’s going to fix it. About the vulnerability According to Rapid7’s findings, the issues affect the “Transactions” interface of SmartVista Front-End (SVFE), version 2.2.10, revision 287921. “Users with access … More

Easily exploitable Apache Struts vulnerability opens businesses to attack

A critical vulnerability in Apache Struts, a popular open source framework for developing web applications, opens any server running an app built using it to remote attackers. It can be exploited easily, by sending a specially crafted web request to the application and, according to SANS ISC handler Adrien de Beaupre, a working exploit has already been spotted. About the vulnerability The flaw (CVE-2017-9805) was spotted during a static code analysis by researchers with software … More