Skip to main content

Security

Credit Card Breach at Mandarin Oriental

posted onMarch 5, 2015
by l33tdawg

In response to questions from KrebsOnSecurity, upscale hotel chain Mandarin Oriental Hotel Group today confirmed that its hotels have been affected by a credit card breach.’

Reached for comment about reports from financial industry sources about a pattern of fraudulent charges on customer cards that had all recently been used at Mandarin hotels, the company confirmed it is investigating a breach.

Apple plans fix next week for newly uncovered Freak security bug

posted onMarch 4, 2015
by l33tdawg

An Apple spokesman said on Tuesday that the company plans to release a fix next week to mitigate the newly uncovered 'Freak' security flaw affecting Safari browsers on its iOS and OS X operating systems.

A vulnerability in web encryption technology could enable attackers to spy on communications of users with vulnerable software, including Apple's Safari browser and Google Inc's Android browser, according to researchers who uncovered the flaw.

A representative for Google said he had no immediate comment.

China Says Push for Companies’ Encryption Keys Follows U.S. Lead

posted onMarch 4, 2015
by l33tdawg

China dismissed U.S. President Barack Obama’s concerns that new security laws would require foreign companies to open backdoors to their networks, saying the U.S. and the U.K. have long sought the same access.

“Many Western governments, including the governments of the U.S. and the U.K., have for many years asked technology companies to disclose their encryption keys,” Fu Ying, spokeswoman for China’s National People’s Congress, said Wednesday in Beijing. “This step is aimed at preventing and investigating terrorist activities.”

​No reboot patching comes to Linux 4.0

posted onMarch 4, 2015
by l33tdawg

With Linux 4.0, you may never need to reboot your operating system again.

One reason to love Linux on your servers or in your data-center is that you so seldom needed to reboot it. True, critical patches require a reboot, but you could go months without rebooting. Now, with the latest changes to the Linux kernel you may be able to go years between reboots.

What the FREAK? Huge SSL security flaw stems from US government backdoor

posted onMarch 4, 2015
by l33tdawg

Seven hours is all it takes to crack the encryption that is in place on some supposedly secure websites. Security experts blame the US government's ban on the use of strong encryption back in the 1990s for a vulnerability that has just come to light. Named FREAK (Factoring attack on RSA-EXPORT Keys), the flaw exists on high-profile websites including, ironically, NSA.gov.

Hackers can raid networks with burnt Blu-Rays

posted onMarch 2, 2015
by l33tdawg

British hacker Stephen Tomkinson has found two Blu-Ray-borne attacks.

His first exploit relies on a poor Java implementation in a product called PowerDVD from CyberLink. PowerDVD plays DVDs on PCs and creates menus using Java, but the way Oracle's code has been used allows naughty folk to circumvent Windows security controls.

ZTE Grand S3 can be unlocked with eye-based biometric solution

posted onMarch 2, 2015
by l33tdawg

Today at MWC 2015, we played with the ZTE Grand S3. ZTE's new flagship device lets users unlock their phones by looking at the front-facing camera. The cutting edge solution, called Eyeprint ID, works by scanning unique vein patterns in the human eye. See how it works in our brief hands-on video.

Swipe down from the top of the lock screen to bring up the eye scanner. You'll need to place the phone in front of your face so that both eyes appear in the box. It takes about 5 seconds from swiping down on the screen to unlock the Grand S3.

Zero-day in Seagate NAS allows attacker to remotely get unauthorized root access

posted onMarch 2, 2015
by l33tdawg

Thousands of Seagate Network Attached Storage (NAS) devices are defenseless against a zero-day remote code execution (RCE) vulnerability. Back in October, security researcher OJ Reeves attempted to responsibly disclose the hole in Seagate’s Business Storage 2-Bay NAS products, which ironically use a tagline of “deadlines happen. Be ready.” But Seagate still hasn’t issued a firmware fix, so Reeves has now publicly disclosed the bug.

Silent Circle targets enterprise users with 'world first' privacy ecosystem

posted onFebruary 27, 2015
by l33tdawg

Encrypted communications provider Silent Circle has raised approximately $50 million in a funding round aimed at pushing the company forward in the enterprise market.

Announced on Thursday, Silent Circle said "strong demand" from enterprise customers seeking to keep communication private through the Blackphone product range led the firm to launch a private, common equity round in order to grow and cater for new clients.