Apple Fixes Exploited Zero-Day With iOS 16.1 Patch
The Cupertino device maker confirmed the active exploitation of CVE-2022-42827, warning in a barebones advisory that the flaw exposes iPhones and iPads to arbitrary code execution attacks. “An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited,” Apple said…
15-Year-Old Python Vulnerability Present in 350,000 Projects Resurrected
The vulnerability in question is CVE-2007-4559, initially described as a directory traversal vulnerability in Python’s ‘tarfile’ module that could allow an attacker to remotely overwrite arbitrary files by convincing users to process specially crafted tar archives. The flaw was never properly patched and instead users were warned not to open archive files from untrusted sources….
Industry Reactions to Govt Requiring Security Guarantees From Software Vendors
Building on the cybersecurity executive order signed by President Joe Biden in May 2021, a memorandum from the OMB requires federal agencies to comply with NIST guidance — for secure software development and supply chain security — when using third-party software. In order to ensure compliance, agencies will have to at least obtain a self-attestation…
Microsoft: Multiple Iranian Groups Conducted Cyberattack on Albanian Government
On July 15, 2022, threat actors working on behalf of the government of Iran launched a destructive attack targeting the Albanian government’s websites and public services, taking them offline. The attack had less than 10% total impact on the customer environment. The campaign consisted of four different stages, with different actors responsible for every one…
Mudge Blows Whistle on Alleged Twitter Security Nightmare
Twitter’s former head of security has blown the whistle on what he characterizes as sprawling cybersecurity weaknesses, including vulnerabilities that could lay the social media platform open to cyberattacks that could have major national-security implications. That’s the allegation from Peiter “Mudge” Zatko, who sent a 200+-page disclosure to Congress detailing issues that he claims could…
Microsoft Publishes Office Symbols to Improve Bug Hunting
Symbols are pieces of information used during debugging, and are contained within Symbol files, which are created by the compiler during application build. Some of these symbols are called ‘public symbols’. They contain basic information, such as function names and global variables, and are used in all forms of debugging. Symbol files that contain only…
Go-Based Apps Vulnerable to Attacks Due to URL Parsing Issue
Go, or Golang, is an open source programming language designed for building reliable and efficient software at scale. Supported by Google, Go is leveraged by some of the world’s largest companies and it’s often used to develop cloud-native apps, including for Kubernetes. Oxeye researchers have conducted an analysis of Go-based cloud-native applications and discovered an…
Tidelift Raises $27 Million to Tackle Open Source Supply Chain Security
High profile supply chain attacks like SolarWinds, Kaseya, Codecov, ua-parser-js and Log4j have put pressure on companies and governments to address the risks associated with open source and other software supply chain risks. President Biden’s May 2021 Executive Order includes supply chain attacks as an area of concern. More recently, on January 13, 2022, a…
Ransomware, Malware-as-a-Service Dominate Threat Landscape
Red Canary’s 2022 Threat Detection Report (PDF) analyzed more than 30,000 confirmed threats across the firm’s customer base. The report notes that ransomware criminals have responded to improving target company backups by introducing sensitive data exfiltration and the threat of exposure (double extortion). “Backups will allow an organization to get back up and running more…
Application Security Firm ForAllSecure Raises $21 Million
The funding round was co-led by Koch Disruptive Technologies (KDT) and New Enterprise Associates (NEA). Founded a decade ago, ForAllSecure is focused on automating software testing to improve security, and already serves Fortune 1000 companies in sectors such as aerospace, automotive, and high-tech, as well as the US military. Named Mayhem, the company’s autonomous security…
