eSecurity Planet

JANUARY 22, 2024

January 16, 2024 Open-Source UEFI Implementation Sees 9 Vulnerabilities Type of vulnerability: Weaknesses in the network boot process of UEFI’s network implementation. The problem: The Unified Extensible Firmware Interface (UEFI) specification has an open-source network implementation, EDK II, with nine discovered vulnerabilities.

Authentication 113

Authentication Malware VPN Mobile 113

Pen Test Partners

MAY 16, 2024

On 18th April 2024 NCSC announced the latest iteration of the CAF with version 3.2. Those three material changes Two of these changes relate to the Identity and Access Control Principle and in particular the Identity Verification, Authentication and Authorisation CO. What has changed in the CAF?

Authentication 52

Authentication Software Firmware Accountability 52

Security Affairs

FEBRUARY 28, 2024

” In February 2024, a court order allowed US authorities to neutralize the Moobot botnet, a network of hundreds of small office/home office (SOHO) routers under the control of the Russia-linked group APT28. Upgrade to the latest firmware version. Additionally, the actors have strategically targeted many individuals in Ukraine.”

Energy and Utilities 99

Energy and Utilities Government Firewall Malware 99

SecureList

FEBRUARY 27, 2024

However, we decided not to update the toy immediately in order to explore what could be extracted from the older firmware version. ADB Activation We analyzed the configuration files contained in the firmware memory chip and found a setting called “ENABLE_ADB=N.” This was the first security-related issue we discovered.

Education 97

Education Manufacturing Firmware Internet 97

Centraleyes

JUNE 11, 2024

12 Risk Mitigation Measures for 2024 In the next section, we draw upon insights from the National Security Agency (NSA) to explore top-tier risk reduction strategies. Additionally, ensure that updates are authentic and delivered over secure channels to maintain the integrity of software installations.

Risk 52

Risk Cyber Insurance Insurance Authentication 52

eSecurity Planet

NOVEMBER 1, 2021

Once in place, manufacturers will have 30 months to begin meeting the new legal requirements, giving them until mid-2024 to bring the devices into compliance. New vulnerabilities are created every day by cybercriminals, leading to many IoT devices being installed with out-of-date firmware and other exploitable vulnerabilities.”.

Wireless 109

Wireless IoT Manufacturing Mobile 109

eSecurity Planet

MAY 27, 2024

GitHub Enterprise Server and GitLab patched their authentication bypass and XSS issues. May 20, 2024 Critical QNAP NAS Vulnerability Exposes Devices to RCE Type of vulnerability: Stack buffer overflow. The fix: QNAP has released an emergency upgrade ( QTS 5.1.7.2770 version 20240520 ) that addresses CVE-2024-27130 and other issues.

Backups 67

Backups Authentication DDOS Engineering 67

The Last Watchdog

JANUARY 22, 2024

23, 2024 — Sternum, the pioneer in embedded IoT security and observability, today announced enhanced security for the ChargePoint Home Flex. ChargePoint, with its last firmware update, has disabled the HTTP server and updated the NTP client to address the issues. Tel Aviv, Israel – Jan.

IoT 100

IoT InfoSec Firmware Manufacturing 100

Pen Test Partners

OCTOBER 9, 2023

There is no concrete method to follow as it will rely on contents of the decomposed design from Step 2, but typical examples might include the following: Intellectual property in the device firmware. Deploy malicious firmware. link] [link] Have a software/firmware update mechanism. Cryptographic keys on the device or pod.

IoT 52

IoT Firmware Mobile Manufacturing 52

eSecurity Planet

MAY 2, 2024

Most organizations express confidence in their current status and budgets, but also expect to experience at least one data breach in 2024. Multi-factor authentication : Protects stolen credentials against use by requiring more than a simple username and password combination for access to resources. globally, +19.8%

Cybersecurity 121

Cybersecurity DDOS Penetration Testing Passwords 121

eSecurity Planet

MARCH 4, 2024

February 26, 2024 FCKeditor Used for SEO Poisoning on Government, University Sites Type of vulnerability: Malicious URL redirect. February 27, 2024 Ransomware Gangs Target Unpatched ScreenConnect Servers Type of vulnerability: Authentication bypass and path traversal. The fix: Apply Windows patches ASAP.

IoT 117

IoT Internet Internet Ransomware 117