This posting is here to collect cyber security news in May 2019.
I post links to security vulnerability news to comments of this article.
If you are interested in cyber security trends, read my Cyber security trends 2019 posting.
You are also free to post related links.
355 Comments
Tomi Engdahl says:
Stack Overflow says hackers breached website and gained accessed to production servers. https://stackoverflow.blog/2019/05/16/security-update/
I guess nothing is secure and you need to assume that you hacked all the time.
Tomi Engdahl says:
Ukraine under CyberAttack
https://pentestmag.com/ukraine-under-cyberattack/
New cyber attack on the business of Ukraine. Full analysis of the latest version of SmokeBot Loader.
Tomi Engdahl says:
WhatsApp Vulnerability Fixed
https://www.schneier.com/blog/archives/2019/05/whatsapp_vulner_1.html
Tomi Engdahl says:
Russians hacked 2 Florida voting systems; FBI and DeSantis refuse to release details
https://www.politico.com/states/florida/story/2019/05/14/russians-hacked-2-florida-voting-systems-fbi-and-desantis-refuse-to-release-details-1015772
Russian hackers successfully tapped into the voter registration files of two Florida counties in 2016, a startling detail revealed Tuesday by Gov. Ron DeSantis after a meeting with the FBI and the Department of Homeland Security last week.
Tomi Engdahl says:
San Francisco passes city government ban on facial recognition tech
https://techcrunch.com/2019/05/14/san-francisco-facial-recognition-ban/
Tomi Engdahl says:
CITIES
San Francisco Could Become the First U.S. City to Ban the Use of Facial Recognition Technology
http://time.com/5588098/san-francisco-facial-recognition-technology-ban/
Tomi Engdahl says:
Hackers breached 3 US antivirus companies, researchers reveal
Source code, network access being sold online by “Fxmsp” collective.
https://arstechnica.com/information-technology/2019/05/hackers-breached-3-us-antivirus-companies-researchers-reveal/
Tomi Engdahl says:
WannaCry, a million computers remain at risk
The threat posed by the leaked NSA tools remains a concern
https://techcrunch.com/2019/05/12/wannacry-two-years-on/
Tomi Engdahl says:
Botched update crashes hundreds of Netherlands police ankle monitors
They couldn’t track suspects for a worryingly long period.
https://www.engadget.com/2019/05/12/update-crashes-dutch-police-ankle-monitors/
Tomi Engdahl says:
Devin Coldewey / TechCrunch:
AT&T, Sprint, T-Mobile, and Verizon say they’ve stopped selling customer geo-location data to third parties, according to letters they all sent the FCC — Reports emerged a year ago that all the major cellular carriers in
A year after outcry, carriers are finally stopping sale of location data, letters to FCC show
https://techcrunch.com/2019/05/16/a-year-after-outcry-carriers-are-finally-stopping-sale-of-location-data-letters-to-fcc-show/
Tomi Engdahl says:
Robin Emmott / Reuters:
EU agrees on a new sanctions mechanism for hackers, with ability to target them anywhere in the world, freeze their assets in the bloc, and ban them from entry
Days before elections, EU approves new cyber sanctions regime
https://www.reuters.com/article/us-eu-cyber-idUSKCN1SN1FQ
The European Union will directly penalize computer hackers after governments agreed on Friday a new mechanism to target individuals anywhere in the world, freezing their assets in the bloc and banning them from entry.
The new powers follow a diplomatic push by Britain and the Netherlands — overcoming initial reluctance from Italy — to allow the 28-country bloc to move more quickly against malign cyber attacks that can bring down crucial infrastructure.
While no names were added immediately, the EU says the sanctions mechanism will allow the bloc to move quickly to punish future attacks, rather than rely on the current system of special country lists that are complex to negotiate.
Russia has made cyber and electronic warfare a key part of its military operations, Western officials say, and Britain, the Netherlands and the United States have accused Moscow of conducting a campaign of hacks against the West.
Tomi Engdahl says:
Russell Brandom / The Verge:
Researchers: NYPD used edited suspects’ photos and photos of celebs, when witnesses said the suspects looked like them, to generate facial recognition matches
The NYPD uses altered images in its facial recognition system, new documents show
https://www.theverge.com/2019/5/16/18627548/nypd-facial-recognition-altered-faces-privacy?mid=1
In one case, a photo of the actor Woody Harrelson was used to locate a suspect
Tomi Engdahl says:
Catalin Cimpanu / ZDNet:
IBM report attributes a 95% decline in attacks caused by hacktivist groups since 2015 to the disintegration of Anonymous and sustained law enforcement crackdown
Hacktivist attacks dropped by 95% since 2015
https://www.zdnet.com/article/hacktivist-attacks-dropped-by-95-since-2015/
Hacktivist scene collapses as Anonymous hacker collective dies a slow death.
Tomi Engdahl says:
Shirin Ghaffary / Vox:
A look at various tools such as drones, sensors, and AI being deployed at the US-Mexico border, as a proposed “smart wall” garners bipartisan political support — Here’s what a so-called “smart wall” of technology at the US-Mexico border looks like. — Graphics by Javier Zarracina/Vox
The “smarter” wall: how drones, sensors, and AI are patrolling the border
https://www.vox.com/recode/2019/5/16/18511583/smart-border-wall-drones-sensors-ai
Here’s what a so-called “smart wall” of technology at the US-Mexico border looks like.
Tomi Engdahl says:
>20,000 Linksys routers leak historic record of every device ever connected
https://arstechnica.com/information-technology/2019/05/33-linksys-router-models-leak-full-historic-record-of-every-device-ever-connected/
More than 20,000 Linksys wireless routers are regularly leaking full historic records of every device that has ever connected to them, including devices’ unique identifiers, names, and the operating systems they use. The data can be used by snoops or hackers in either targeted or opportunistic attacks.
Independent researcher Troy Mursch said the leak is the result of a flaw in almost three dozen models of Linksys routers. It took about 25 minutes for the Binary Edge search engine of Internet-connected devices to find 21,401 vulnerable devices on Friday.
Over 25,000 Linksys Smart Wi-Fi routers vulnerable to sensitive information disclosure flaw
https://badpackets.net/over-25000-linksys-smart-wi-fi-routers-vulnerable-to-sensitive-information-disclosure-flaw/
This sensitive information disclosure vulnerability requires no authentication and can be exploited by a remote attacker with little technical knowledge.
Tomi Engdahl says:
Security Research Labs:
Many Ethereum nodes running popular clients like Parity and Geth take months to apply security patches, which may leave the network vulnerable to 51% attacks
The blockchain ecosystem has a patch problem
https://srlabs.de/bites/blockchain_patch_gap/
SRLabs research suggests that security vulnerabilities remain unpatched for many Ethereum blockchain participants for extended periods of time, putting the blockchain ecosystem at risk.
Crypto currencies provide a popular alternative to centralized payment systems, and promise transactions between mutually anonymous parties, often called “trustless” transactions.
However, the required rational actions seem to extend beyond what many blockchain users are willing to do. In particular, we found early evidence that blockchain participants do not sufficiently patch and hence carry known vulnerabilities.
Ethereum relies on high availability to prevent double spending. A hacker who controls more than 51% of the computational power in the network can double spend coins, enriching the hacker and undermining the trust in the ecosystem. If a hacker can crash a large number of nodes, controlling 51% of the network becomes easier. Hence, software crashes are a serious security concern for blockchain nodes (unlike in other pieces of software where the hacker does not usually benefit from a crash).
For that reason, denial of service vulnerabilities have a particularly high severity in cryptocurrency networks; they can be used to massively reduce the amount of computational power needed to perform a 51% attack and double-spend.
Unpatched Parity Ethereum nodes can be remotely crashed. In February 2019, we reported a vulnerability in the Parity Ethereum client that could be used to remotely crash any Parity Ethereum node prior to version 2.2.10.
According to our collected data, only two thirds of nodes have been patched so far. Shortly after we reported this vulnerability, Parity released a security alert, urging participants to update their nodes.
Breaking the backbone of the Ethereum network requires crashing only a handful of nodes. Unfortunately, the data from ethernodes.org does not include whether a node is a miner. However, we know that currently the vast amount of hashing power is concentrated in a few mining pools. Mining pools often share one node to communicate with the Ethereum network, and we can safely assume that those mining pools are very security aware and keep their nodes up-to-date.
To resolve this situation, more reliable update mechanisms are needed. It is therefore desirable (and in line with Ethereum core beliefs) to decentralize the hashing power – this decentralization however would only increase security if the new mining nodes would still be security aware.
Even if the miner nodes are secure for now, failure to close known vulnerabilities may lead to a collapse of the blockchain ecosystem if and when the hashing power becomes more decentralized. This failure to update could leave the blockchain ecosystem in a more vulnerable state by lowering the barrier for performing a 51% attack.
Tomi Engdahl says:
Angela Moon / Reuters:
Source: Google will stop collaborating and providing Huawei with technical support for Android and Google services, including Google Play — NEW YORK (Reuters) – Alphabet Inc’s Google has suspended business with Huawei that requires the transfer of hardware, software and technical services except …
Exclusive: Google suspends some business with Huawei after Trump blacklist – source
https://www.reuters.com/article/us-huawei-tech-alphabet-exclusive/exclusive-google-suspends-some-business-with-huawei-after-trump-blacklist-source-idUSKCN1SP0NB
Tomi Engdahl says:
Security
Good heavens, is it time to patch Cisco kit again? Prime Infrastructure root privileges hole plugged
Do the thing ASAP, you know how it works by now
https://www.theregister.co.uk/2019/05/17/cisco_prime_infrastructure_critical_vuln/
CVE-2019-1821 “can be exploited by an unauthenticated attacker that has network access to the affected [web] administrative interface,” Cisco said in an advisory.
Tomi Engdahl says:
A large chunk of Ethereum clients remain unpatched
https://www.zdnet.com/article/a-large-chunk-of-ethereum-clients-remain-unpatched/
Unpatched clients leave Ethereum network vulnerable to 51% attacks.
Tomi Engdahl says:
Security researchers discover Linux version of Winnti malware
https://www.zdnet.com/article/security-researchers-discover-linux-version-of-winnti-malware/
Winnti Linux variant used in 2015 in the hack of a Vietnamese gaming company.
Tomi Engdahl says:
Stack Overflow says hackers breached production systems
https://www.zdnet.com/article/stack-overflow-says-hackers-breached-production-systems/
Stack Overflow said it detected a security breach over the weekend.
Tomi Engdahl says:
Stack Overflow hacker went undetected for a week
https://www.zdnet.com/article/stack-overflow-hacker-went-undetected-for-a-week/
Stack Overflow now says hacker might have also accessed user data.
Tomi Engdahl says:
At least 186 EU ISPs use deep-packet inspection to shape traffic, break net neutrality
https://www.zdnet.com/article/186-eu-isps-use-deep-packet-inspection-to-shape-traffic-break-net-neutrality/
NGOs, academics warn about DPI’s impact on user privacy, that net neutrality might be watered down in the EU.
Tomi Engdahl says:
EternalBlue reaching new heights since WannaCryptor outbreak
Attack attempts involving the exploit are in hundreds of thousands daily
https://www.welivesecurity.com/2019/05/17/eternalblue-new-heights-wannacryptor/
It has been two years since EternalBlue opened the door to one of the nastiest ransomware outbreaks in history, known as WannaCryptor (or WannaCry). Since the now-infamous malware incident, attempts to use the exploit have only been growing in prevalence. Currently it is at the peak of its popularity, with users bombarded with hundreds of thousands of attacks every day.
The EternalBlue exploit was allegedly stolen from the National Security Agency (NSA) in 2016 and leaked online on April 14, 2017 by a group known as Shadow Brokers. The exploit targets a vulnerability in Microsoft’s implementation of the Server Message Block (SMB) protocol, via port 445.
Tomi Engdahl says:
Feds Target $100M ‘GozNym’ Cybercrime Network
https://krebsonsecurity.com/2019/05/feds-target-100m-goznym-cybercrime-network/
Law enforcement agencies in the United States and Europe today unsealed charges against 11 alleged members of the GozNym malware network, an international cybercriminal syndicate suspected of stealing $100 million from more than 41,000 victims with the help of a stealthy banking trojan by the same name.
Tomi Engdahl says:
Slack Flaw Allows Hackers to Steal, Manipulate Downloads
https://www.securityweek.com/slack-flaw-allows-hackers-steal-manipulate-downloads
A recently patched vulnerability in the Slack desktop application for Windows can be exploited by malicious actors to steal and manipulate a targeted user’s downloaded files.
David Wells, a researcher at Tenable, discovered that version 3.3.7 of the Slack desktop app is affected by a download hijacking vulnerability that can be exploited by getting the targeted user to click on a specially crafted link pasted into a Slack channel. The security hole was patched by Slack with the release of version 3.4.0.
Tomi Engdahl says:
Days before elections, EU approves new cyber sanctions regime
https://www.reuters.com/article/us-eu-cyber/days-before-elections-eu-approves-new-cyber-sanctions-regime-idUSKCN1SN1FQ
The European Union will directly penalize computer hackers after governments agreed on Friday a new mechanism to target individuals anywhere in the world, freezing their assets in the bloc and banning them from entry.
The new powers follow a diplomatic push by Britain and the Netherlands — overcoming initial reluctance from Italy — to allow the 28-country bloc to move more quickly against malign cyber attacks that can bring down crucial infrastructure.
“This is decisive action to deter future cyber attacks,” British Foreign Secretary Jeremy Hunt said in a statement.
Tomi Engdahl says:
Google uses Gmail to track a history of things you buy — and it’s hard to delete
https://www.cnbc.com/2019/05/17/google-gmail-tracks-purchase-history-how-to-delete-it.html
Google saves years of information on purchases you’ve made, even outside Google, and pulls this information from Gmail.
It’s complicated to delete this private information, and options to turn it off are hidden in privacy settings.
Google says it doesn’t use this information to sell you ads.
Tomi Engdahl says:
Security
It’s not chicken feed: Million-dollar meal deal for livestock sabotaged by hackers… and, er, exchange rates
Six-week investigation delay shrank payment by 13%
https://www.theregister.co.uk/2019/05/17/forex_rates_cost_livestock_feed_buyers_161k_after_hacker_tamper_with_invoices/
A $1.2m shipment of livestock feed went awry when “hackers” intercepted and tweaked emails with payment details, eventually costing the cheeky buyers an extra $161,000 after exchange rates moved during the legal fallout.
The sunflower meal traders ended up in dispute when the buyers refused to pay a shortfall caused by forex rates moving after unnamed hackers allegedly forged vital payment emails.
A strange tale, this shows the effects of a business email compromise attack.
Exchange rate malarkey
The London account was held in the name of Ecobank, which the judge emphasised had not committed any “fraud or wrongdoing” itself. Being received into a London bank account, albeit the wrong one, the USD sum had been converted into sterling on arrival. This turned the $1,167,900 into £768,372.45.
The judge added, however: “It is commercially impossible to transfer funds to a bank which are intended for the benefit of a customer without identifying the beneficiary and the destination account by branch and account name and number.”
Tomi Engdahl says:
Giga-hurts radio: Terrorists build Wi-Fi bombs to dodge cops’ cellphone jammers
Explosives activated by wireless networking signals discovered amid election
https://www.theregister.co.uk/2019/05/17/wifi_bomb_trigger/
Terrorists have been caught strapping Wi-Fi-activated backup triggers to bombs in Indonesia, police claimed this week.
The explosives were discovered in a raid earlier this month, and included a switching mechanism that enabled them to be detonated using a signal sent via Wi-Fi if the main trigger, which uses a SIM card and waits for a mobile phone message to detonate, was blocked by radio-frequency jammers.
Tomi Engdahl says:
WordPress WP Live Chat Support Plugin Fixes XSS Flaw
https://threatpost.com/wordpress-wp-live-chat-support-plugin-fixes-xss-flaw/144856/
Tomi Engdahl says:
Ransomware ‘Remediation’ Firm Exposed: Researchers Weigh in on Paying
https://threatpost.com/ransomware-pay-or-not/144833/
The decision to pay a ransom in the case of a ransomware attack can be a complex one for businesses.
A company that claimed to use technology tools to help victims with ransomware cleanup was found to secretly be paying the ransom, while collecting a premium from their clients, according to an expose out this week. The situation brings the core dilemma of business-focused ransomware directly into the spotlight: To pay, or not to pay?
Tomi Engdahl says:
Dutch Probe China’s Huawei for Possible Spying: Report
https://www.securityweek.com/dutch-probe-chinas-huawei-possible-spying-report
Dutch intelligence services are investigating Huawei for possibly spying for the Chinese government by leaving a “back door” to data of customers of major telecoms firms, a report said Thursday.
Tomi Engdahl says:
Microsoft Tech Support Scams Invade Azure Cloud Services
https://www.bleepingcomputer.com/news/security/microsoft-tech-support-scams-invade-azure-cloud-services/
Tomi Engdahl says:
Hacking forums survive cybercrime dragnet as feds prioritize drug-market busts
https://www.cyberscoop.com/cybercrime-hacking-forums-exploit-digital-shadows/
t might be more difficult these days to conduct an anonymous drug deal on the dark web, but not every online criminal enterprise is feeling the pinch of international law enforcement.
New research shows that as the FBI and other crime-fighting agencies have gone after dark web markets, cybercrime communities have avoided the heat. Stolen financial information, access to hacked social media accounts and malicious software tools are still widely available on forums accessible on the open web, without using the Tor anonymity software.
Tomi Engdahl says:
GozNym cyber-crime gang which stole millions busted
https://www.bbc.com/news/technology-48294788
Tomi Engdahl says:
Threat spotlight: CrySIS, aka Dharma ransomware, causing a crisis for businesses
https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/
Tomi Engdahl says:
Slack Bug Allows Remote File Hijacking, Malware Injection
https://threatpost.com/slack-remote-file-hijacking-malware/144871/
An attacker can supply a malicious hyperlink in order to secretly alter the download path for files shared in a Slack channel.
Tomi Engdahl says:
A Closer Look at Satan Ransomware’s Propagation Techniques
https://www.fortinet.com/blog/threat-research/closer-look-satan-ransomwares-propagation-technics.html
Tomi Engdahl says:
Recent MuddyWater-associated BlackWater campaign shows signs of new anti-detection techniques
https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html
Tomi Engdahl says:
LeakedSource Operator Pleads Guilty in Canada
https://www.securityweek.com/leakedsource-operator-pleads-guilty-canada
Canadian authorities announced last week that Defiant Tech Inc., the company that ran LeakedSource, pleaded guilty to trafficking identity information and possession of property obtained through crime.
Tomi Engdahl says:
Linux Kernel Privilege Escalation Vulnerability Found in RDS Over TCP
https://www.securityweek.com/linux-kernel-privilege-escalation-vulnerability-found-rds-over-tcp
A memory corruption vulnerability recently found in Linux Kernel’s implementation of RDS over TCP could lead to privilege escalation.
Tracked as CVE-2019-11815 and featuring a CVSS base score of 8.1, the flaw impacts Linux kernels prior to 5.0.8, but only systems that use the Reliable Datagram Sockets (RDS) for the TCP module.
Tomi Engdahl says:
DHS Highlights Common Security Oversights by Office 365 Customers
https://www.securityweek.com/dhs-highlights-common-security-oversights-office-365-customers
As organizations migrate to Microsoft Office 365 and other cloud services, many fail to use proper configurations that ensure good security practices, the U.S. Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) warns.
Tomi Engdahl says:
Face It, You’re Being Watched
https://www.youtube.com/watch?v=IbTBh7Uc450
San Francisco is the first American city to ban facial recognition software used by police and other agencies. Bloomberg QuickTake explains why the technology’s advance is so alarming to regulators, the public, and even the people developing it.
Tomi Engdahl says:
US Warns Chinese Drones May Steal Data: Report
https://www.securityweek.com/us-warns-chinese-drones-may-steal-data-report
Washington has warned that Chinese-made drones could be giving spy agencies in Beijing “unfettered access” to stolen data, according to a report in American media.
The Department of Homeland Security sent out an alert on Monday flagging drones built in China as a “potential risk to an organization’s information”, CNN reported.
The US government has “strong concerns about any technology product that takes American data into the territory of an authoritarian state that permits its intelligence services to have unfettered access to that data or otherwise abuses that access,” wrote CNN, quoting the DHS alert.
Tomi Engdahl says:
Sean Gallagher / Ars Technica:
Two weeks after the city of Baltimore’s networks suffered a ransomware attack, many of its systems remain offline, including utilities billing, phone, and email — Houses can’t be sold, bills can’t be paid while city networks are shuttered. — It’s been nearly two weeks since the City …
Baltimore ransomware nightmare could last weeks more, with big consequences
https://arstechnica.com/information-technology/2019/05/baltimore-ransomware-nightmare-could-last-weeks-more-with-big-consequences/
Houses can’t be sold, bills can’t be paid while city networks are shuttered.
It’s been nearly two weeks since the City of Baltimore’s networks were shut down in response to a ransomware attack, and there’s still no end in sight to the attack’s impact. It may be weeks more before the city’s services return to something resembling normal—manual workarounds are being put in place to handle some services now, but the city’s water billing and other payment systems remain offline, as well as most of the city’s email and much of the government’s phone systems.
To top it off, unlike the City of Atlanta—which suffered from a Samsam ransomware attack in March of 2018—Baltimore has no insurance to cover the cost of a cyber attack. So the cost of cleaning up the RobbinHood ransomware, which will far exceed the approximately $70,000 the ransomware operators demanded, will be borne entirely by Baltimore’s citizens.
It’s not like the city wasn’t warned. Baltimore’s information security manager warned of the need for such a policy during budget hearings last year. But the final budget did not include funds for that policy, nor did it include funding for expanded security training for city employees, or other strategic investments
City officials have provided few details about the extent of the attack, as the city is cooperating with an FBI investigation. But it appears that the ransomware was triggered on some systems in the early hours of May 7, when email service was suddenly interrupted. The city’s response to the attack has thrown many city services into disorder or shut them down entirely.
City officials have stressed that emergency systems, such as police and fire department networks and the city’s 911 system, were not affected. The 911 system suffered from a ransomware attack last year when some firewall settings were disabled during maintenance.
Real estate purchases cannot be closed, though Mayor Young said that a paper-based workaround for handling closings would be put in place by today. Water bills and other city charges (including parking tickets and citations from the city’s speed camera and red light camera network) cannot be paid. And many city workers have had to resort to using their own laptops without a connection to city networks
The mayor’s Office of Information Technology has been struggling to regain its footing over the past two years after a string of fired chief information officers—four consecutive CIOs were fired or forced to resign over a period of five years.
According to a 2018 strategy document, Baltimore spends about half of what other cities budget for IT, and the Office of Information Technology only controls about one percent of the total budget; most of the IT spending is part of other department’s operational budgets.
Until the ransomware attack, the city’s email was almost entirely internally hosted, running on Windows Server 2012 in the city’s data center. Only the city’s Law Department had moved over to a cloud-based mail platform.
Some of Baltimore’s systems are hosted elsewhere, including the city’s primary website
Tracking down how and when the malware got into the city’s network is a significant task. The city has a huge attack surface
Tomi Engdahl says:
Persistence of Chaos: Laptop infected with world’s most dangerous malware up for sale
https://news.sky.com/story/persistence-of-chaos-laptop-infected-with-worlds-most-dangerous-malware-up-for-sale-11725622
The terms of sale state the buyer must recognise the computer as art and have “no intention of disseminating any malware”.
A laptop infected with six of the most dangerous viruses and malware that have caused around $95bn (£74bn) of damage has been put up for auction.
Tomi Engdahl says:
BlueKeep Remote Desktop Exploits Are Coming, Patch Now!
https://www.bleepingcomputer.com/news/security/bluekeep-remote-desktop-exploits-are-coming-patch-now/
Security researchers have created exploits for the remote code execution vulnerability in Microsoft’s Remote Desktop Services, tracked as CVE-2019-0708 and dubbed BlueKeep, and hackers may not be far behind.
While the vulnerability inspired some playful users to create fake proof-of-concept code intended for rickrolling, it is no joke. As Remote Desktop Services is commonly exposed to the public so that users can gain remote access to their internal computers, successful exploitation could allow access to an entire network.
Using information from their research and from public scripts, security professionals at NCC Group have created a network detection rule for CVE-2019-0708. After testing with Suricata IDS/IPS, NCC Group made it publicly available.
https://github.com/nccgroup/Cyber-Defence/blob/master/Signatures/suricata/2019_05_rdp_cve_2019_0708.txt
Tomi Engdahl says:
Google myönsi pahan tietoturvamokan, jota ei huomattu 14 vuoteen
https://www.tivi.fi/uutiset/google-myonsi-pahan-tietoturvamokan-jota-ei-huomattu-14-vuoteen/17c61a06-72b3-409b-92a0-cf5456c8ecca
Google on kertonut löytäneensä bugin, jonka vuoksi joidenkin G Suite -yrityskäyttäjien salasanoja on säilytetty selkokielisinä tiivisteiden käyttämisen sijaan.
Tomi Engdahl says:
Cisco Starts Patching Firmware Bug; Millions of Devices Still Vulnerable
https://threatpost.com/cisco-patch-firmware/144936/
A flaw in the Secure Boot trusted hardware root-of-trust affects enterprise, military and government network gear, including routers, switches and firewalls.
Cisco has issued a handful of firmware releases for a high-severity vulnerability in Cisco’s proprietary Secure Boot implementation that impacts millions of its hardware devices, across the scope of its portfolio.