Category: vulnerabilities

Auto Added by WPeMatico

Security Vulnerabilities in Certificate Pinning

Posted on By infossl
academicpapers, certificates, maninthemiddleattacks, Security technology, vpn, vulnerabilities

New research found that many banks offer certificate pinning as a security feature, but fail to authenticate the hostname. This leaves the systems open to man-in-the-middle attacks. From the paper: Abstract: Certificate verification is a crucial stage in the establishment of a TLS connection. A common security flaw in TLS implementations is the lack of … Read More “Security Vulnerabilities in Certificate Pinning” »

Vulnerability in Amazon Key

Posted on By infossl
amazon, hacking, keys, locks, patching, Security technology, vulnerabilities

Amazon Key is an IoT door lock that can enable one-time access codes for delivery people. To further secure that system, Amazon sells Cloud Cam, a camera that watches the door to ensure that delivery people don’t abuse their one-time access privilege. Cloud Cam has been hacked: But now security researchers have demonstrated that with … Read More “Vulnerability in Amazon Key” »

New White House Announcement on the Vulnerability Equities Process

Posted on By infossl
nationalsecuritypolicy, nsa, Security technology, vulnerabilities

The White House has released a new version of the Vulnerabilities Equities Process (VEP). This is the inter-agency process by which the US government decides whether to inform the software vendor of a vulnerability it finds, or keep it secret and use it to eavesdrop on or attack other systems. You can read the new … Read More “New White House Announcement on the Vulnerability Equities Process” »

Security Flaw in Infineon Smart Cards and TPMs

Posted on By infossl
cryptanalysis, cryptography, estonia, idcards, Security technology, securityengineering, smartcards, vulnerabilities

A security flaw in Infineon smart cards and TPMs allows an attacker to recover private keys from the public keys. Basically, the key generation algorithm sometimes creates public keys that are vulnerable to Coppersmith’s attack: While all keys generated with the library are much weaker than they should be, it’s not currently practical to factorize … Read More “Security Flaw in Infineon Smart Cards and TPMs” »

Impersonating iOS Password Prompts

Posted on By infossl
apple, impersonation, ios, passwords, Security technology, socialengineering, spoofing, vulnerabilities

This is an interesting security vulnerability: because it is so easy to impersonate iOS password prompts, a malicious app can steal your password just by asking. Why does this work? iOS asks the user for their iTunes password for many reasons, the most common ones are recently installed iOS operating system updates, or iOS apps … Read More “Impersonating iOS Password Prompts” »

ISO Rejects NSA Encryption Algorithms

Posted on By infossl
backdoors, cryptography, edwardsnowden, encryption, nsa, Security technology, vulnerabilities

The ISO has decided not to approve two NSA-designed block encryption algorithms: Speck and Simon. It’s because the NSA is not trusted to put security ahead of surveillance: A number of them voiced their distrust in emails to one another, seen by Reuters, and in written comments that are part of the process. The suspicions … Read More “ISO Rejects NSA Encryption Algorithms” »

Bluetooth Vulnerabilities

Posted on By infossl
airgaps, bluetooth, malware, patching, Security technology, vulnerabilities

A bunch of Bluetooth vulnerabilities are being reported, some pretty nasty. BlueBorne concerns us because of the medium by which it operates. Unlike the majority of attacks today, which rely on the internet, a BlueBorne attack spreads through the air. This works similarly to the two less extensive vulnerabilities discovered recently in a Broadcom Wi-Fi … Read More “Bluetooth Vulnerabilities” »

Security Vulnerabilities in AT&T Routers

Posted on By infossl
att, encryption, Security technology, securityengineering, vulnerabilities

They’re actually Arris routers, sold or given away by AT&T. There are several security vulnerabilities, some of them very serious. They can be fixed, but because these are routers it takes some skill. We don’t know how many routers are affected, and estimates range from thousands to 138,000. Among the vulnerabilities are hardcoded credentials, which … Read More “Security Vulnerabilities in AT&T Routers” »

Unfixable Automobile Computer Security Vulnerability

Posted on By infossl
cars, computersecurity, mitigation, protocols, Security technology, vulnerabilities

There is an unpatchable vulnerability that affects most modern cars. It’s buried in the Controller Area Network (CAN): Researchers say this flaw is not a vulnerability in the classic meaning of the word. This is because the flaw is more of a CAN standard design choice that makes it unpatchable. Patching the issue means changing … Read More “Unfixable Automobile Computer Security Vulnerability” »