Quantum Computers and the Change in Cybersecurity

The next revolution in computer science already has a name: quantum computing. Computers capable of working with the superposition of ones and zeros (using qubits, which can take both values, unlike bits, which take one or the other) are still a laboratory animal, but research is increasingly approaching the dream of developing a machine with these characteristics capable of revolutionizing everything from medicine to computer security.

The quantum era will usher in a new phase in the eternal race between defenders and attackers of our privacy. Cryptography will be the battlefield in which this war of the future will be fought, the contenders of which are already preparing for a confrontation that could take place in the coming years.

Theoretically, a quantum computer would be able to break most of the current encryption algorithms, especially those based on public keys. A quantum computer can factor at a much higher speed than a conventional one. A brute-force attack (testing all possible passwords at high speed until you get the right one) would be a piece of cake with a machine that boasts these characteristics.

On the other hand, with this paradigm shift in computing will also come the great hope for privacy. Quantum cryptography will make things very difficult for spies and cybercriminals. While current encryption systems are secure because intruders who attempt to access information can only do so by solving complex problems, with quantum cryptography they would have to violate the laws of quantum mechanics, which, as of today, is impossible.

A quantum computer would be able to break most of the current encryption algorithms.

In any case, it is still early to fear or await with enthusiasm the arrival of these algorithms. Quantum computers are neither going to start decoding passwords tomorrow, nor will they be so dangerous when, within a few years, they are finally able to do so. Predictably, the security systems that would be most vulnerable to these machines will no longer be in use when, five years from now at least, they’ve become a more everyday reality.

Until then, and as a special precaution to protect the documents and some of the more confidential conversations of a company, it wouldn’t hurt to follow some tips. The most important thing is to avoid asymmetric key encryptions such as RSA, EIGamal, or one that’s based on the Diffy-Hellman protocol. Quantum computers would be able to solve relatively easily the mathematical problems at the core of their security.

The post Quantum Computers and the Change in Cybersecurity appeared first on Panda Security Mediacenter.

Re: Executable installers are vulnerable^WEVIL (case 46): Pelles C allows arbitrary code execution

Posted by Stefan Kanthak on Jan 24

“Ding Dong” <dingdongloop () gmail com> wrote:

Please stop top posting and full quotes!

Run “NTSD.exe setup.exe” and see which DLLs Windows loads, and how
they are loaded.
Rename setup.exe to something.exe, run “NTSD.exe something.exe” and
compare the results.

JFTR: NTSD.exe was shipped with Windows NT5.x; in newer versions you
have to install the debugging tools.

If you want to run without debugger:…

WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass

Posted by Kacper Szurek on Jan 24

# Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass
# Date: 24.01.2017
# Software Link: https://www.wdc.com
# Exploit Author: Kacper Szurek
# Contact: https://twitter.com/KacperSzurek
# Website: https://security.szurek.pl/
# Category: local

1. Description

It’s possible to execute arbitrary commands using login form because
`exec()` function is used without `escapeshellarg()`.

It’s possible to bypass login form…

APPLE-SA-2017-01-23-7 iTunes for Windows 12.5.5

Posted by Apple Product Security on Jan 24

APPLE-SA-2017-01-23-7 iTunes for Windows 12.5.5

iTunes for Windows 12.5.5 is now available and addresses the
following:

WebKit
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed through
improved memory handling.
CVE-2017-2354: Neymar of Tencent’s Xuanwu Lab (tencent.com) working
with Trend Micro’s Zero Day Initiative

WebKit
Impact:…

China makes VPNs illegal to tighten its Great Firewall

China is long known for its strict Internet censorship laws through the Great Firewall of China – China’s Golden Shield project that employs a variety of tricks to censor Internet and block access to various foreign websites in the country by its government.

The Great Firewall has blocked some 171 out of the world’s 1,000 top websites, including Google, Facebook, Twitter, Tumblr, Dropbox, and

CVE-2017-2929

Adobe Acrobat Chrome extension version 15.1.0.3 and earlier have a DOM-based cross-site scripting vulnerability. Successful exploitation could lead to JavaScript code execution.

CVE-2017-2970

Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the XSLT engine related to template manipulation. Successful exploitation could lead to arbitrary code execution.

CVE-2017-2971

Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the JPEG decoder routine. Successful exploitation could lead to arbitrary code execution.