Security Leftovers

• Apple patches zero-day kernel hole and much more – update now! [Ed: Apple did not patch this until it was publicly known that it had been exploited]

  The bug fixes for iPhones and iPads include remote code execution flaws (RCEs) in components from the kernel itself to Apple’s image rendering library, graphics drivers, video processing modules and more. Several of these bugs warn that “a malicious application may be able to execute arbitrary code with kernel privileges”. That’s the sort of security hole that could lead to a complete device takeover – what’s known in the jargon as a “jailbreak“, because it escapes from Apple’s strict lockdown and app restrictions.

• Creating our own password manager

  We can manage a range of passwords by creating our own password manager using the bash commandline available in popular GNU/Linux operating systems. The GNU/Bash Shell is readily available in Ubuntu/Debian based Linux systems. They can be launched using the terminal application (with the shortcut Ctrl+Alt+T).

• Conti presses Costa Rica. Bluetooth LE proof-of-concept. Making initial access more difficult. Cyber phases of hybrid wars. [Ed: Costa Rica pays a huge price for being penetrated by Microsoft]

  Reuters reports that the number of Costa Rican organizations affected by Conti's ransomware attack has now grown to twenty-seven. Recently elected President Rodrigo Chaves has said that nine institutions, most of them governmental, were heavily affected, and that the attacks were having an "enormous" impact on foreign trade and tax collection. The governments of Israel, the United States and Spain are all providing Costa Rica with assistance in recovery and remediation, but a lot of work remains to be done.

• Fantastic Open Source Cybersecurity Tools and Where to Find Them [Ed: Ironically, one must run unsafe proprietary software just to open this article]

• Venezuelan cardiologist charged with 'designing and selling ransomware' [Ed: Microsoft Windows]

  The US Attorney’s Office has charged a 55-year-old cardiologist with creating and selling ransomware and profiting from revenue-share agreements with criminals who deployed his product. A complaint [PDF] filed on May 16th in the US District Court, Eastern District of New York, alleges Moises Luis Zagala Gonzalez – aka “Nosophoros,” “Aesculapius” and “Nebuchadnezzar” – created a ransomware builder known as “Thanos”, and ransomware named “Jigsaw v. 2”. The self-taught coder and qualified cardiologist advertised the ransomware in dark corners of the web, then licensed it ransomware to crooks for either $500 or $800 a month, it is claimed. He also ran an affiliate network that offered the chance to run Thanos to build custom ransomware, in return for a share of profits, it is alleged.

• Firefox out-of-band update to 100.0.1 – just in time for Pwn2Own? [Ed: Bloated browsers beget impossible security?]

• How crooks backdoor sites and scrape credit card info • The Register

  In a paper scheduled to appear at the Usenix '22 security conference later this year, authors Asuman Senol (imec-COSIC, KU Leuven), Gunes Acar (Radboud University), Mathias Humbert (University of Lausanne) and Frederik Zuiderveen Borgesius, (Radboud University) described how they measured data handling in web forms on the top 100,000 websites, as ranked by research site Tranco. ®

• Meet Wizard Spider, the multimillion-dollar gang behind Conti, Ryuk malware [Ed: Microsoft Windows]

  There also is a custom hash-cracking system that "stores cracked hashes, updates threat actors on the cracking status and shows the results of cracking attempts on other servers," the threat hunters wrote. The software claims it can crack a broad array of common hash types, including LM:NTLM hashes, cached domain credentials, Kerberos 5 TGS-REP/AS-REP tickets, KeePass files, and those used for MS Office 2013 documents.

• Pentester pops open Tesla Model 3 using low-cost Bluetooth module

  Tesla Model 3 and Y owners, beware: the passive entry feature on your vehicle could potentially be hoodwinked by a relay attack, leading to the theft of the flash motor. Discovered and demonstrated by researchers at NCC Group, the technique involves relaying the Bluetooth Low Energy (BLE) signals from a smartphone that has been paired with a Tesla back to the vehicle. Far from simply unlocking the door, this hack lets a miscreant start the car and drive away, too.

• Technical Advisory – Tesla BLE Phone-as-a-Key Passive Entry Vulnerable to Relay Attacks

• India slightly softens infosec incident reporting rules • The Register

  India has slightly softened its controversial new reporting requirements for information security incidents and made it plain they apply to multinational companies. The rules were announced with little advance warning in late April and quickly attracted criticism from industry on grounds including the requirement to report 22 different types of incident within six hours, a requirement to register personal details of individual VPN users, and retention of many log files for 180 days.

• How to choose a certificate management tool

  Managing certificates that hold all your encryption secrets is impossible without the right tool. Here's how to narrow the field.

• OpenSSF Helping to Secure Open Source Software [Ed: No, it is mostly a marketing (openwashing) facade for proprietary software companies that actively insert back doors into things and strive to centralise everything around themselves under the guise of "security"]

• Sigstore Sets Out to Secure Cloud-Native Supply Chain [Ed: No, this is about outsourcing trust and centralising it around Pentagon-connected companies in the name of so-called 'security' (it's censorship of software)]

• SBOM Everywhere: The OpenSSF Plan for SBOMs [Ed: Missing disclosure here about LF paying for puff pieces about its programs and schemes]

• Patch your VMware gear now – or yank it out, Uncle Sam tells federal agencies [Ed: When VMWare points the finger at Linux it's a deflection tactic]

• Malicious PyPI package opens backdoors on Windows, Linux, and Macs [Ed: It's not an OS issue but an issue of people installing malware on their OS]

Switching to Linux OS isn't as scary as you think " here's why

For long-time Windows and macOS users, the thought of switching to Linux instills fear. But when Linux is just as good (and honestly, a lot safer), why not make the switch? Linux operating systems are often the go-to option for the tech savvy or computer enthusiasts, consequently, it’s almost seen as exclusive to that niche. People might think, “If tech-savvy nerds gravitate toward Linux, it’s probably not for me.” However, that’s just not true. If you switch smartphone brands, there’s always a learning curve, but ultimately, you end up knowing that new phone like the back of your hand. It’s the same concept with an operating system on a laptop. There’s an adjustment period, but Linux operating systems are actually pretty intuitive.

Microsoft Antitrust Abuses, Sabotage, and Ad-Stuffing

• Microsoft revises software licensing, cloud policies amid EU regulator scrutiny

  OVHcloud and Nextcloud lawsuits hit the spot as Windows giant admits to potential competition issues

• Microsoft patches the patch that broke Windows authentication [Ed: Microsoft Windows keeps breaking itself; a sadist's platform]

  Microsoft has released an out-of-band patch to deal with an authentication issue that was introduced in the May 10 Windows update. Elizabeth Tyler, cyber security consultant on Microsoft's Detection and Response Team, confirmed the fix to worried administrators early this morning.

• Bing! Microsoft tests search box in the middle of Windows 11 desktop [Ed: No wonder Windows users are fleeing]

  Microsoft has rolled out an Insider Build threatening "interactive content on the Windows desktop."

GCC 12.1 supports China's LoongArch CPU family

Version 12.1 of the GNU Compiler Collection (GCC) was released this month, and among its many changes is support for China's LoongArch processor architecture. The announcement of the release is here; the LoongArch port was accepted as recently as March. China's Academy of Sciences developed a family of MIPS-compatible microprocessors in the early 2000s. In 2010 the tech was spun out into a company called Loongson Technology which today markets silicon under the brand "Godson". The company bills itself as working to develop technology that secures China and underpins its ability to innovate, a reflection of Beijing's belief that home-grown CPU architectures are critical to the nation's future. LoongArch emerged from Loongson around about last year, and was described as a new RISC ISA that comes in 32-bit and 64-bit flavours. Also: Paper Published: Deep space reception of Tianwen-1 by AMSAT-DL using GNU radio