DecryptedTech

Friday19 August 2022

Displaying items by tag: 0Day

Google has announced the release of a new version of Chrome. The new version comes with fixes for eight vulnerabilities. Once of these vulnerabilities CVE-2022-0609, which is describes as a user-after-free vulnerability is already being exploited in the wild. This has led them to advise users to updated Chrome as soon as possible to avoid compromise. The flaws were found by Google’s own Threat Analysis Group.

Published in Security Talk

Containers are a popular item with cloud-based infrastructure. The idea of running low-cost (from a resource standpoint) systems to handle work loads while maintaining a higher level of security is a nice one. Making this type of decision does not mean that it puts them out of the reach of attackers though. We have seen several methods used by attackers to gain access to and control of the containers that that are in use. One of the latest is due to a 0-Day flaw in the Argo Continuous Deployment tool.

Published in Security Talk
Friday, 28 January 2022 07:22

Apple Patches Safari WebKit Bug and a 0-Day

Yesterday Apple released several patches for their different operating systems. One that we have talked about before is a core bug in Apple’s WebKit based Safari. This bug could potentially leak personal information regardless of the privacy settings you had enabled. In macOS you could always change to another browser that was not WebKit based. On iOS, iPadOS, watchOS and other app store locked devices there was no option as Apple requires every browser to use WebKit for its render engine.

Published in Security Talk

There are rumblings on the internet that all might not be well with EA after a round of password reset notices appear to have been sent out on Sunday (8-13-2015). EA does not give a specific reason behind the reset notifications other than suspicious activity. However, the timing seems to correlate with an authentication exploit that has been talked about on the darker side of the internet. These claims are that a group has been silently exploiting EA’s authentication servers for months. It is far from certain that EA has suffered a large-scale breach, but it does bring up the subject of authentication server security.

Published in News

GoogleGoogle’s previously unassailable Chrome web browser has now been hacked three times in only two days. The first two we have already told you about in a previous article. Vupen a French research company found a 0-day exploit that allowed them to jump out of Google’s Sand Box and then another that allowed them to execute arbitrary code on the OS that Chrome was installed on (in this case Windows). Vupen did this as part of the Pwn2Own competition held every year.

Published in News