Security

Eagle-eyed researchers from streaming titan Netflix have uncovered several troubling security vulnerabilities within the TCP implementations on Linux and FreeBSD kernels. The most severe specimen, called SACK Panic, could permit an attacker to remotely induce a kernel panic within recent Linux operating systems. A kernel panic is a kind of vulnerability where an operating system cannot easily recover – or, indeed, cannot recover at all. This could force a restart of a targeted host, causing a temporary shutdown in services. Hard Fork! Hard Fork? Hard Fork Given Linux powers a variety of systems, from web servers to high-performance computing clusters, this is obviously really concerning. In total, Netflix has found four separate vulnerabilities, each with their own distinct behaviors. They all pertain to the same part of the Linux and FreeBSD TCP implementation — the minimum segment size (MSS) and TCP Selective Acknowledgement (SACK). One issue highlighted by Netflix … [Read more...] about Netflix fixes potentially devastating Linux SACK vulnerability

At this point, you're probably keeping an eye out for possible phishing messages in your email. You know the drill: If you have any doubts, don't click links or download attachments. That's difficult enough to adhere to in practice. Now, thanks to new findings from the threat intelligence firm Kaspersky, along with phishing texts, phishing tweets, and phishing pop-ups, you need to worry about one more thing: phishing in your calendar. Phishers have realized that they can take advantage of seemingly innocuous calendar settings to plant their own events laced with phishing links on victims' schedules. In many cases, this also triggers notifications automatically, further legitimizing the malicious events. The scam is particularly effective because the calendar entries and notifications stem from trusted apps like Google Calendar. The attack comes simply from scammers sending a wave of calendar event invites to Google Calendar users. The goal is to take advantage of a default setting that … [Read more...] about Tricky Scam Plants Phishing Links in Your Google Calendar

A new research study has found that Venmo continues to make it easy for third-parties to scrape users’ public transaction history without their permission. Dan Salmon, a computer science student at Minnesota State University, has published a new data set of over seven million Venmo transactions on GitHub collected over a six month period. Hard Fork! Hard Fork? Hard Fork “I am releasing this dataset in order to bring attention to Venmo users that all of this data is publicly available for anyone to grab without even an API key,” Salmon wrote on the GitHub page, while warning users to change their privacy settings. The development comes more than a year after a similar finding by Hang Do Thi Duc, a former Mozilla fellow, unearthed more than 200 million Venmo public transactions. The peer-to-peer mobile payments service, which has 40 million monthly active users, makes transaction details public by default. This includes usernames, full names, profile pictures, … [Read more...] about PSA: Set your Venmo transactions to private right now

There's a new battleground in the browser wars: user privacy. Firefox just made its Enhanced Tracking Protection a default feature, Apple continues to pile privacy-focused features into its Safari browser, and people are more aware than ever before of the sort of information they can reveal every time they set a digital footprint on the web. If you want to push back against online tracking, you've got several options to pick from when choosing a default browser. These are the browsers that put user privacy high on the list of their priorities. DuckDuckGo (Android, iOS, browser extension) You might know DuckDuckGo as the anti-Google search engine, but it's also branched out to make its own mobile browsers for Android and iOS. Not only do they keep you better protected online, they give you plenty of information about what they're blocking. DuckDuckGo starts by enforcing encrypted HTTPS connections, when websites offer them, and then gives each page you visit a grade based on how … [Read more...] about It’s Time to Switch to a Privacy Browser

Not so long ago, companies that cracked personal devices on behalf of governments did so in secret, closely guarding even the descriptions of their capabilities. Now, it seems, they proudly tweet about their updated abilities to hack into new iPhones, like a video game firm offering an expansion pack. On Friday afternoon, the Israeli forensics firm and law enforcement contractor Cellebrite publicly announced a new version of its product known as a Universal Forensic Extraction Device or UFED, one that it calls UFED Premium. In the marketing around that update, it says that its cracking tool can now unlock any iOS device cops can lay their hands on, including those running iOS 12.3, released just a month ago. Cellebrite claims UFED Premium can extract files from many recent Android phones as well, including the Samsung Galaxy S9. No other law enforcement contractor has made such broad claims about a single product, at least not publicly. The move signals not only another step in the … [Read more...] about Cellebrite Now Says It Can Unlock Any iPhone for Cops