Security should be a priority in any company, but it should be even more paramount in places where lives are at risk. So we have to wonder how someone ever allowed a security flaw in aircraft inflight systems that would allow for someone to compromise the aircraft. This is the claim of security researcher Ruben Santamarta has made and he plans to prove it at Black Hat 2014.
A couple of days ago we posted a story about a group of developers that complained to Valve about their lack of a Bug Bounty. In their complaint was an inference that having a form of reward would make people want to identify and report bugs and exploits in a timely manner. On the surface that would seem to make sense, but there is a flip side to this line of thinking. There will also be times when people will wait to report something to ensure they get the most money out of their efforts.
Yesterday we wrote about a disturbing flaw in some D-Link routers that allow for a malicious individual to access it without a username or password. Shortly after we published the article we were reminded that this flaw does not just exist in D-Link hardware, but is also present in devices from many other companies that have SOHO and Residential products. The string for each might be different and in some cases harder to gain access to, but it is there.
After the general announcement that Google’s Chrome exposes user information to capture, Google has come back with a reply. It seems that Google does not want anyone to know that there is a security hole in their flagship browser. They are continuing to claim that it is “the most secure” browser and that Chrome maintains user data in an encrypted format. They feel that there is nothing wrong and that the information being presented by Information Finders is no big deal. If Chrome is storing data then it will be encrypted… if your OS supports it and that it only collects this information if the user asks it to. It is a very interesting statement to be made given the information presented.
It seems that Apple’s latest and greatest mobile operating system was shipped with a major flaw disguised as a feature. Shortly after the launch of iOS 7 there were the usual reports of bricked phones, problems reactivating the phone once it was installed etc. Most of these are common and more often than not can be traced to user software that is installed including many of the newer mobile device management applications that are in use. However when reports (and videos) started popping up showing how to bypass the lock screen without a password things were not so normal.
In Mid-2011 it was revealed that many Supervisory Control and Data Acquisition (SCADA) devices were visible on the internet with a simple Google search. What was even more terrifying was that many of these devices still had the default username and password set and were visible in the search results. In 2009 someone with the same idea developed a search engine that was able to find connected devices as a service making it easier to find them and… exploit them. In January of 2012 a security flaw was found in the way that many (if not all) connected IP cameras operated. The flaw was originally found in a TRENDNet’s IP camera (a discontinued one) and it was a serious one.
Indian enthusiast Arul Kumar who deals with computer security issues, reported a flaw in the social network Facebook, which allows you to delete any photo on Facebook within one minute. Failure is spotted within Support Dashboard portal that allows users to send complaints regarding violation or offensive content, and monitor whether the individual complaint is processed. Facebook employees handle complaints 24 hours a day, seven days a week.
Palestinian security researcher Khalil Shreateh attempted to inform Facebook of a security flaw. Shreateh contacted Facebook with a message stating, “My name is Khalil Shreateh. I finished school with a BA Degreen in Information Systems. I would like to report a bug in your main site (www.facebook.com) which I discovered it… The bug allow Facebook users to share links to others facebook users, I tested it on Sarah Goodin wall and I got success post (sic).” Their lack of interest in asking more questions and denying it was a bug, led to him posting a message directly to Mark Zuckerberg’s wall.
A rather major, but basic flaw in the way that MySQL and MariaDB handle passwords has opened up both of these to brute force attacks and can allow the attacker to gain access in seconds. This flaw which exploits an issue in the way the passwords are checked using the memcmp function can be used as long as the attacker knows at least one user name. Considering that “root” is almost always in existence the password security on many MySQL and MariaDB databases is practically nonexistent.