Hackin9
FreeBSD bsnmpd information disclosure
 
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
[SECURITY] [DSA 3431-2] ganeti regression update
 
Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778
 
[SECURITY] [DSA 3446-1] openssh security update
 
FreeBSD Security Advisory FreeBSD-SA-16:06.bsnmpd
 
Oracle Java SE CVE-2015-4760 Remote Security Vulnerability
 
JasPer 'jas_matrix_create()' Function Integer Overflow Vulnerability
 
Oracle Java SE CVE-2015-2632 Remote Security Vulnerability
 
Oracle Java SE CVE-2015-2638 Remote Security Vulnerability
 
 

(credit: japanexperterna.se)

A New York assemblyman has reintroduced a new bill that aims to essentially disable strong encryption on all smartphones sold in the Empire State.

Among other restrictions, the proposed law states that "any smartphone that is manufactured on or after January 1, 2016 and sold or least in New York, shall be capable of being decrypted and unlocked by its manufacturer or its operating system provider."

If it passes both houses of the state legislature and is signed by the governor, the bill would likely be the first state law that would impose new restrictions on mobile-based cryptography. Undoubtedly, if it makes it that far, the law would likely face legal challenges from Apple and Google, among others.

Read 9 remaining paragraphs | Comments

 

(credit: Guilherme Tavares)

A critical bug that can leak secret cryptographic keys has just just been fixed in OpenSSH, one of the more widely used implementations of the secure shell (SSH) protocol.

The vulnerability resides only in the version end users use to connect to servers and not in versions used by servers. A maliciously configured server could exploit it to obtain the contents of the connecting computer's memory, including the private encryption key used for SSH connections. The bug is the result of code that enables an experimental roaming feature in OpenSSH versions 5.4 to 7.1

"The matching server code has never been shipped, but the client code was enabled by default and could be tricked by a malicious server into leaking client memory to the server, including private client user keys," OpenSSH officials wrote in an advisory published Thursday. "The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers."

Read 5 remaining paragraphs | Comments

 
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 

2016-01-14:Updated to show">OpenSSHvulnerabilities likeHeartbleed.

OpenSSH 7.1p2 has been released with a security fix for a vulnerability recently assigned toCVE-2016-0777 [1]. CVE 2016-0777 is a client information leak that could leak private keys to a malicious server. A workaround is available for previous versions of OpenSSH [2].

Early reports from Redhat [3] and the OpenBSD Journal [4] provide">Since version 5.4, the OpenSSH client supports an undocumented feature called roaming. If a connection to an SSH server breaks unexpectedly, and if the server supports roaming as well, the client is able to reconnect to the server and resume the interrupted SSH session. ">An information leak flaw was found in the way OpenSSH client roaming feature was implemented. The information leak is exploitable in the default configuration of certain versions of the OpenSSH client and could (depending on the clients version, compiler, and operating system) allow a malicious SSH server to steal the clients private keys.

has similarities to the 2014 Heartbleed vulnerability that affected the OpenSSL crypto library. Heartbleed was much more serious, because the bug made it possible for anyone with moderate hacking skills to exploit any website using OpenSSL. By contrast, the OpenSSH bug can only be exploited after a vulnerable end user connects to a maliciously-configured server [5].

Thanks David, for the tipper!

References:

[1] http://www.openssh.com/txt/release-7.1p2
[2] http://marc.info/?l=openbsd-techm=145278077820529w=2
[3] https://access.redhat.com/articles/2123781
[4] http://undeadly.org/cgi?action=articlesid=20160114142733
[5]http://arstechnica.com/security/2016/01/bug-that-can-leak-crypto-keys-just-fixed-in-widely-used-openssh/

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 

BankInfoSecurity.com (blog)

Modest Growth in InfoSec Employment
BankInfoSecurity.com (blog)
Among BLS's 840 Standard Occupation Classifications, or SOCs, only one exists for IT security: information security analysts. And, according to an Information Security Media Group analysis of BLS data, the number of individuals designated as ...

 

Posted by InfoSec News on Jan 14

http://www.computerworld.com/article/3022060/security/6-critical-updates-for-january-patch-tuesday.html

By Greg Lambert
Computerworld
Jan 13, 2016

Microsoft has started the year with a truly unusual Patch Tuesday. There
are nine updates for January, with six rated as critical and the remaining
three rated as important (the reverse of the usual distribution in terms
of severity). January has a couple of additional surprises. First, it
looks...
 

Posted by InfoSec News on Jan 14

Forwarded from: THOTCON <info (at) thotcon.org>

*** BEGIN THOTCON TRANSMISSION

Greetings:

The Call for Papers (CFP) has closed and we are now in the process of
reading through a record number of entries. We are working very hard to
make this the best con we've ever put on for you. 

ICYMI: A few weeks ago we announced that the Chicago rock chip-tune band I
Fight Dragons will be performing live at the...
 

Posted by InfoSec News on Jan 14

http://www.theregister.co.uk/2016/01/14/cloud_security_alliance_says_infosec_wonks_would_pay_1m_ransoms/

By Team Register
14 Jan 2016

Some companies will pay hackers up to US$1 million in ransoms to claw back
stolen data according to a poll by the Cloud Security Alliance.

The survey garnered 209 respondents of which half were in IT security and
a third from tech with most hailing from companies with up to 1000 staff
and a quarter from large...
 

Posted by InfoSec News on Jan 14

http://www.healthcareitnews.com/news/8-out-10-mobile-health-apps-open-hipaa-violations-hacking-data-theft

By Bill Siwicki
Healthcare IT News
January 13, 2016

A new report shows 84 percent of U.S. FDA-approved health apps tested by
IT security vendor Arxan Technologies did not adequately address at least
two of the Open Web Application Security Project top 10 risks.

Most health apps are susceptible to code tampering and
reverse-engineering,...
 

Posted by InfoSec News on Jan 14

http://www.pcmag.com/article2/0,2817,2497873,00.asp

By Don Reisinger
pcmag.com
January 14, 2016

The so-called "teenage hackers" who last year found their way into the CIA
director's AOL email account are back at it, according to a report.

A member of hacking group "Crackas with Attitude (CWA)" contacted Vice's
Motherboard to inform the publication that it hacked several accounts
owned by James Clapper, U.S....
 

Posted by InfoSec News on Jan 14

http://thenextweb.com/gadgets/2016/01/12/now-someone-can-steal-your-wi-fi-password-from-your-doorbell/

[I called this back around September 2013 when Jamie Siminoff went on ABC's
"Shark Tank" pitching DoorBot, later rebranded to Ring.
https://twitter.com/c4i/status/401534203755765760 - WK]

By Owen Williams
thenextweb.com
01/14/16

Getting hacked sucks, but there’s something worse than that: getting
hacked because of your own...
 

Posted by InfoSec News on Jan 14

http://www.wired.com/2016/01/hacking-team-leak-helps-kaspersky-researchers-find-zero-day-exploit/

By Kim Zetter
Security
Wired.com
01/13/16

ZERO-DAY EXPLOITS ARE a hacker’s best friend. They attack vulnerabilities
in software that are unknown to the software maker and are therefore
unpatched. Criminal hackers and intelligence agencies use zero day
exploits to open a stealth door into your system, and because antivirus
companies also...
 

The Register

Cloud Security Alliance says infosec wonks would pay $1m ransoms
The Register
Some companies will pay hackers up to US$1 million in ransoms to claw back stolen data according to a poll by the Cloud Security Alliance. The survey garnered 209 respondents of which half were in IT security and a third from tech with most hailing ...

and more »
 
Internet Storm Center Infocon Status