Experimental News Clipping Site

Tag: exploits

  • Hacker News: Don’t use Session – Round 2

    —

    by

    Kurt Seifried
    in

    Source URL: https://soatok.blog/2025/01/20/session-round-2/ Source: Hacker News Title: Don’t use Session – Round 2 Feedly Summary: Comments AI Summary and Description: Yes **Short Summary with Insight**: The text is a critical analysis of the security and cryptography protocol design of the Session messaging application compared to its peers. It discusses weaknesses in Session’s cryptographic practices, such…

  • Simon Willison’s Weblog: Lessons From Red Teaming 100 Generative AI Products

    —

    by

    Kurt Seifried
    in

    Source URL: https://simonwillison.net/2025/Jan/18/lessons-from-red-teaming/ Source: Simon Willison’s Weblog Title: Lessons From Red Teaming 100 Generative AI Products Feedly Summary: Lessons From Red Teaming 100 Generative AI Products New paper from Microsoft describing their top eight lessons learned red teaming (deliberately seeking security vulnerabilities in) 100 different generative AI models and products over the past few years.…

  • Hacker News: Thoughts on having SSH allow password authentication from the Internet

    —

    by

    Kurt Seifried
    in

    Source URL: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHOnExposingPasswordAuth Source: Hacker News Title: Thoughts on having SSH allow password authentication from the Internet Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text discusses the security implications of using SSH (Secure Shell) for remote server access, particularly the advantages and disadvantages of disabling password-based authentication in favor of public key…

  • Hacker News: A New type of web hacking technique: DoubleClickjacking

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html Source: Hacker News Title: A New type of web hacking technique: DoubleClickjacking Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text introduces the concept of “DoubleClickjacking,” a sophisticated web vulnerability that builds upon traditional clickjacking techniques by exploiting event timing between double clicks. This novel approach allows attackers to bypass…

  • Alerts: CISA Releases Twelve Industrial Control Systems Advisories

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/01/16/cisa-releases-twelve-industrial-control-systems-advisories Source: Alerts Title: CISA Releases Twelve Industrial Control Systems Advisories Feedly Summary: CISA released twelve Industrial Control Systems (ICS) advisories on January 16, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-016-01 Siemens Mendix LDAP ICSA-25-016-02 Siemens Industrial Edge Management ICSA-25-016-03 Siemens Siveillance Video Camera…

  • The Register: Raspberry Pi hands out prizes to all in the RP2350 Hacking Challenge

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/01/16/raspberry_pi_awards_prizes_for/ Source: The Register Title: Raspberry Pi hands out prizes to all in the RP2350 Hacking Challenge Feedly Summary: Power-induced glitches, lasers, and electromagnetic fields are all tools of the trade Raspberry Pi has given out prizes for extracting a secret value from the one-time-programmable (OTP) memory of the Raspberry Pi RP2350 microcontroller…

  • The Register: China’s Salt Typhoon spies spotted on US govt networks before telcos, CISA boss says

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/01/15/salt_typhoon_us_govt_networks/ Source: The Register Title: China’s Salt Typhoon spies spotted on US govt networks before telcos, CISA boss says Feedly Summary: We are only seeing ‘the tip of the iceberg,’ Easterly warns Beijing’s Salt Typhoon cyberspies had been seen in US government networks before telcos discovered the same foreign intruders in their own…

  • Alerts: Ivanti Releases Security Updates for Multiple Products

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/01/14/ivanti-releases-security-updates-multiple-products Source: Alerts Title: Ivanti Releases Security Updates for Multiple Products Feedly Summary: Ivanti released security updates to address vulnerabilities in Ivanti Avalanche, Ivanti Application Control Engine, and Ivanti EPM.  CISA encourages users and administrators to review the following Ivanti security advisories and apply the necessary guidance and updates: Ivanti Avalanche Ivanti Application…

  • Alerts: Microsoft Releases January 2025 Security Updates

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/01/14/microsoft-releases-january-2025-security-updates Source: Alerts Title: Microsoft Releases January 2025 Security Updates Feedly Summary: Microsoft released security updates to address vulnerabilities in multiple Microsoft products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.  CISA encourages users and administrators to review the following and apply necessary updates:…

  • The Register: Microsoft fixes under-attack privilege-escalation holes in Hyper-V

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/01/15/patch_tuesday_january_2025/ Source: The Register Title: Microsoft fixes under-attack privilege-escalation holes in Hyper-V Feedly Summary: Plus: Excel hell, angst for Adobe fans, and life’s too Snort for Cisco Patch Tuesday The first Patch Tuesday of 2025 has seen Microsoft address three under-attack privilege-escalation flaws in its Hyper-V hypervisor, plus plenty more problems that deserve…