The Linux kernel suffers from multiple privilege escalation vulnerabilities.
Monthly Archives: February 2016
What happens to your Facebook account when you pass away?
We leave a huge digital footprint on Facebook. Did you ever think about what will happen with your data when you pass away?
The social giant Facebook has existed long enough to realize that it is part of a human’s life events. We announce the most important milestones on our timelines by sharing with our Facebook friends the joy of getting married, having babies, or moving abroad. But what will happen with all that data when we pass away? Discussing your digital legacy isn’t pleasant, but it’s important is our reality. Don’t leave it up to your family member, friends, or even worse: Facebook itself. In this article I will guide you through all the options you have, so you can make a conscious decision about your data, using the tools that Facebook offers to its users.
The Fight for Privacy– Apple vs. the Federal Government
AVG’s Chief Legal Officer, Harvey Anderson recently sat down with Marty Gonzalez from San Francisco’s Kron 4 Morning News Weekend to discuss why Apple is fighting back against privacy disclosure.
Over the last few weeks the entire country has been discussing the court order enforcing Apple to unlock data security from the iOS device used by one of the alleged terrorists in the San Bernardino shooting. Whether talks of support were in favor of the Federal government or for the tech giant, the larger issue that continues to rise to the surface is how this could jeopardize the privacy of millions of iOS users.
Recently, AVG’s Chief Legal Officer, Harvey Anderson sat down with San Francisco’s own Marty Gonzalez from Kron 4 Morning News Weekend, to discuss the severity of Apple complying with the ruling and unlocking the door to privacy.
VIDEO: Chief Legal Officer discusses Apple vs Federal Government
Gonzalez: ….So far it’s been a stalemate between the FBI and Apple. What would be the long term range impact of Apple refusing this court order to crack the code?
Anderson: I think it’s dangerous what’s happening right now…You’re essentially asking a company to introduce a vulnerability, a bug, a security flaw into its system. Once that happens, there’s not a lot of confidence that this bug will only be used for this case. Suppose an authoritarian government gets it, suppose a malicious hacker gets it. Will it also be used the next time you want to get data….?
Gonzalez: Let’s say people are, people are thinking, wait a minute, why doesn’t Apple just give the FBI the phone, Apple cracks the code and gives it back to the FBI and it’s just a one-time deal. Is that not plausible?
Anderson: Not really. Actually, what happened in this case is that Apple was working very closely with the FBI and right after the phone was taken into custody it appears that we just learned is that the Apple ID password was reset. So Apple has a very easy way to do an iCloud backup of this phone. The phone could have been brought to a trusted network, the network would have recognized the data, and then the government could have gotten the data from Apple’s Cloud which it has access to. But someone within the San Bernardino county officials recently tweeted that the FBI asked them to reset the passwords, which prevented this easy method to get the data.
Gonzalez: Apple and the Federal government have been arguing the whole topic about encryption for years. This is just the latest step. Where do you think this issue goes from here?
Anderson: It’s so unknown. It’s such a dangerous precedent. If this order is upheld. As you know this order was actually an ex parte order. Apple has not had a chance to oppose it legally but I think it’s such a dangerous to force a company to introduce a security flaw. The problem is that there is no privacy without security. That’s the underlining paradigm that exists here. Once you start to take away security, it starts to compromise people’s privacy. It’s not privacy against the proper judicial use of disclosure and discover it’s against others.
Gonzalez: Apple is arguing that once it’s gone, it’s gone.
Anderson: Exactly.
Apple Releases Security Update for Apple TV
Original release date: February 25, 2016
Apple has released a security update for Apple TV to address multiple vulnerabilities. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected device.
US-CERT encourages users and administrators to review the Apple security update for Apple TV 7.2.1 (3rd generation) and apply the necessary update.
This product is provided subject to this Notification and this Privacy & Use policy.
Drupal Update Fixes 10 Vulnerabilities, One Critical
Drupal addressed 10 vulnerabilities in the CMS this week, including a critical access bypass issue and another issue that could lead to remote code execution.
Identity theft accounts for ‘majority of data breaches’
Theft of identities along with personal information still accounts for the majority of data breaches, a new global survey by Gemalto has found.
The post Identity theft accounts for ‘majority of data breaches’ appeared first on We Live Security.
Executable installers are vulnerable^WEVIL (case 26): the installer of GIMP for Windows allows arbitrary (remote) and escalation of privilege
Posted by Stefan Kanthak on Feb 25
Hi @ll,
the executable installer gimp-2.8.16-setup-1.exe (and of course
older versions too) available from <http://www.gimp.org/downloads/>
loads and executes UXTheme.dll from its “application directory”.
For software downloaded with a web browser the application
directory is typically the user’s “Downloads” directory: see
<https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html…
Re: Executable installers are vulnerable^WEVIL (case 26): the installer of GIMP for Windows allows arbitrary (remote) and escalation of privilege
Posted by Stefan Kanthak on Feb 25
“Jernej Simončič” <jernej|s-os () eternallybored org> wrote:
UXTheme.dll is loaded when “visual styles” and/or “themes” are
DISABLED (which is the case in my test systems), either via GUI, via
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionThemeManager]
“ThemeActive”=”0”
or via stopping/disabling the “themes” service:
NET.EXE Stop Themes
SC.EXE Config Themes…
Executable installers are vulnerable^WEVIL (case 4): InstallShield's wrapper and setup.exe
Posted by Stefan Kanthak on Feb 25
Hi @ll,
executable installers [°] created with InstallShield (see
<http://www.flexerasoftware.com/producer/products/software-installation/installshield-software-installer/>
alias <http://installshield.com/>) are vulnerable:
1. Their wrappers/self-extractors load and execute a rogue/bogus/
malicious RichEd32.dll [‘] (and other DLLs too, dependent on
the version of Windows) eventually found in the directory they
are…
Various Linux Kernel USERNS Issues
Posted by halfdog on Feb 25
Hello List,
Here are some issues recently discovered:
* Overlayfs over Fuse Privilege Escalation: On some systems, e.g.
Ubuntu Wily, it is possible to place an USERNS overlayfs mount over a
fuse (file system in userspace) mount. Inactive SUID binaries in the
user-controllable fuse filesystem may then be copied to other
filesystems in copy_up, thus allowing unprivileged users to create
arbitrary SUID binaries on the disk. Read more…
(CRD…