Suche
Beiträge, die mit engineer getaggt sind
That could allow a local attacker to gain root privileges without requiring user interaction. Needrestart is a utility that scans a system to determine the services that need to be restarted after applying shared library updates.
https://blog.qualys.com/vulnerabilities-threat-research/2024/11/19/qualys-tru-uncovers-five-local-privilege-escalation-vulnerabilities-in-needrestart
#linux #ubuntu #it #security #privacy #engineer #tech #media #news
![Multiple decade-old security vulnerabilities have been disclosed in the needrestart package.
The vulnerabilities are believed to have existed since the introduction of interpreter support in needrestart 0.8, which was released on April 27, 2014.
"These needrestart exploits allow Local Privilege Escalation (LPE) which means that a local attacker is able to gain root privileges," Ubuntu said in an advisory, noting they have been addressed in version 3.8.
<https://ubuntu.com/blog/needrestart-local-privilege-escalation>
The 5 flaws are listed below:
• CVE-2024-48990 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
• CVE-2024-48991 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by winning a race condition & tricking needrestart into running their own, fake Python interpreter.
• CVE-2024-48992 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.
• CVE-2024-11003 [CVSS score: 7.8] and CVE-2024-10224 [CVSS score: 5.3] - Two vulnerabilities that allows a local attacker to execute arbitrary shell commands as root by taking advantage of an issue in the libmodule-scandeps-perl package. (before version 1.36)](https://nerdculture.de/system/media_attachments/files/113/521/649/340/089/036/original/9c79a893744b5d47.jpeg "Multiple decade-old security vulnerabilities have been disclosed in the needrestart package.
The vulnerabilities are believed to have existed since the introduction of interpreter support in needrestart 0.8, which was released on April 27, 2014.
\"These needrestart exploits allow Local Privilege Escalation (LPE) which means that a local attacker is able to gain root privileges,\" Ubuntu said in an advisory, noting they have been addressed in version 3.8.
<https://ubuntu.com/blog/needrestart-local-privilege-escalation>
The 5 flaws are listed below:
• CVE-2024-48990 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
• CVE-2024-48991 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by winning a race condition & tricking needrestart into running their own, fake Python interpreter.
• CVE-2024-48992 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.
• CVE-2024-11003 [CVSS score: 7.8] and CVE-2024-10224 [CVSS score: 5.3] - Two vulnerabilities that allows a local attacker to execute arbitrary shell commands as root by taking advantage of an issue in the libmodule-scandeps-perl package. (before version 1.36)")
Qualys TRU Uncovers Five Local Privilege Escalation Vulnerabilities in needrestart | Qualys Security Blog
The Qualys Threat Research Unit (TRU) has identified five Local Privilege Escalation (LPE) vulnerabilities within the needrestart component…Saeed Abbasi (Qualys, Inc.)
T-Mobile has joined a list of major organizations like AT&T, Verizon & Lumen Technologies that have been singled out as part of what appears to be a full-blown Chinese threat actors cyber espionage campaign.
https://www.wsj.com/politics/national-security/t-mobile-hacked-in-massive-chinese-breach-of-telecom-networks-4b2d7f92
#us #telecom #companies #breach #it #security #privacy #engineer #media #tech #news
It’s with sadness that we note the passing of Thomas Eugene Kurtz, on November 12th. He was co-inventor of the BASIC programming language back in the 1960s. The legacy of his work lives on in the generation of technologists.
>10 PRINT "Rest in Peace"
>20 GOTO 10
https://computerhistory.org/blog/in-memoriam-thomas-e-kurtz-1928-2024/
#memoriam #ThomasKurtz #rip #basic #programming #language #tech #science #history #it #engineer #media #news
![[ImageSource: Computerhistory.org]
“Thomas Eugene Kurtz (Feb. 22 1928–Nov. 12, 2024) was an American mathematician, computer scientist and co-inventor, with John Kemeny, of the BASIC programming language and Dartmouth Timesharing System.”](https://nerdculture.de/system/media_attachments/files/113/504/030/617/705/770/original/1d3b30002c734a48.jpeg "[ImageSource: Computerhistory.org]
“Thomas Eugene Kurtz (Feb. 22 1928–Nov. 12, 2024) was an American mathematician, computer scientist and co-inventor, with John Kemeny, of the BASIC programming language and Dartmouth Timesharing System.”")
In Memoriam: Thomas E. Kurtz, 1928–2024 - CHM
CHM remembers the remarkable career and contributions of 2023 Fellow Thomas E. Kurtz, who passed away on November 12, 2024.hhackford (Computer History Museum)
A hardware hacker [GaryOberNichts] has successfully modified Nintendo's $100 Alarmo device to run the classic video game Doom. This marking another milestone in the gaming community's tradition of porting the 1993 shooter to unconventional devices.
https://github.com/GaryOderNichts/alarmo_doom
#doom #nintendo #alarmo #port #hack #it #engineer #programming #retro #gaming #art #media #tech #artist #news
GitHub - GaryOderNichts/alarmo_doom: Doom for the Nintendo Alarmo
Doom for the Nintendo Alarmo. Contribute to GaryOderNichts/alarmo_doom development by creating an account on GitHub.GitHub
Microsoft’s November Patch Update fixes 91 Windows security vulnerabilities, including 4 zero-days. The critical fixes address actively exploited flaws in Windows. It is strongly recommended that users apply these updates as soon as possible to mitigate possible security risks. Updates can be installed via Windows Update.
https://msrc.microsoft.com/update-guide/
#microsoft #windows #update #it #security #privacy #engineer #media #tech #news
Exactly 20 years ago, Mozilla started shipping version 1.0 of its Firefox browser. Mozilla celebrated its 20th anniversary of Firefox with new and upcoming features like tab previews, marking up PDFs, tab grouping and Mozilla's exploration of AI, via mozilla.ai, gets more cautious support.
https://www.mozilla.org/en-US/firefox/132.0/whatsnew/
#mozilla #firefox #20th #anniversary #web #it #engineer #media #tech #news
What’s new with Firefox
Take your stand against an industry that’s selling your data to third parties. Stay smart and safe online with technology that fights for you.Mozilla
Google fixed two actively exploited Android zero-day flaws as part of its November security updates, addressing a total of 51 vulnerabilities. Tracked as CVE-2024-43047 & CVE-2024-43093, the two issues are marked as exploited in limited, targeted attacks.
https://source.android.com/docs/security/bulletin/2024-11-01
#google #android #update #zerodays #it #security #privacy #engineer #media #tech #news
A working Turing Machine was submitted to Lego Ideas, consisting of approximately 2,900 parts and a bucketload of extreme cleverness. The original machine was devised by mathematician Alan Turing in 1936. Turing's idea was a hypothetical system that could simulate any computer algorithm.
https://youtu.be/8AA3E05axHw?si=MWCSLoUNAxo2TiWD
#turing #machine #history #retro #computing #lego #artist #it #engineer #media #tech #art #news
![[ImageSource: Bananaman 2018]
The design consisted of an infinitely long tape with symbols that could be moved left and right, a 'head' that could read the symbols and overwrite them with new ones, a finite control that described the machine's state, and a table to link each combination of state and symbol to an instruction for what to do next.
In addition to the constraints of making the device out of Lego, there was also the challenge of fitting into the limits imposed by Lego Ideas. At the time of submission, this was 3,000 parts and The Bananaman's contraption finally managed to come in at around 2,900. The limit has since been raised to 5,000 parts.
Fans of 3D printing will no doubt be pleased to note that some of the parts (notably one of the large gears) came from a printer, but only because buying missing bits online tends to take longer and cost more. A real-world version of the model was designed and built first to make sure it worked.](https://nerdculture.de/system/media_attachments/files/113/458/800/213/747/743/original/4e54ce5092333434.jpeg "[ImageSource: Bananaman 2018]
The design consisted of an infinitely long tape with symbols that could be moved left and right, a 'head' that could read the symbols and overwrite them with new ones, a finite control that described the machine's state, and a table to link each combination of state and symbol to an instruction for what to do next.
In addition to the constraints of making the device out of Lego, there was also the challenge of fitting into the limits imposed by Lego Ideas. At the time of submission, this was 3,000 parts and The Bananaman's contraption finally managed to come in at around 2,900. The limit has since been raised to 5,000 parts.
Fans of 3D printing will no doubt be pleased to note that some of the parts (notably one of the large gears) came from a printer, but only because buying missing bits online tends to take longer and cost more. A real-world version of the model was designed and built first to make sure it worked.")
![[ImageSource: 6zacl8.blogspot]
The original Alan Turing machine.
First demonstrated in 1950, this is one of Britain's earliest stored program computers and the oldest complete general purpose electronic computer in Britain. Designed and built at the National Physical Laboratory, Middlesex in 1949-1950, it was based on plans for a larger computer (the ACE) designed by the mathematician Alan Turing (1912-1954) at NPL between 1945 and 1947. Previously Turing worked on the Colossus computer used in codebreaking at Bletchley Park during World War II. Pilot ACE was estimated to have cost £50,000 to design and build, but by 1954 had earned over £240,000 from advanced scientific and engineering work in various fields including crystallography, aeronautics and computing bomb trajectories.](https://nerdculture.de/system/media_attachments/files/113/458/800/252/914/368/original/cfe6001fae509327.jpeg "[ImageSource: 6zacl8.blogspot]
The original Alan Turing machine.
First demonstrated in 1950, this is one of Britain's earliest stored program computers and the oldest complete general purpose electronic computer in Britain. Designed and built at the National Physical Laboratory, Middlesex in 1949-1950, it was based on plans for a larger computer (the ACE) designed by the mathematician Alan Turing (1912-1954) at NPL between 1945 and 1947. Previously Turing worked on the Colossus computer used in codebreaking at Bletchley Park during World War II. Pilot ACE was estimated to have cost £50,000 to design and build, but by 1954 had earned over £240,000 from advanced scientific and engineering work in various fields including crystallography, aeronautics and computing bomb trajectories.")
Apple silicon Macs will get their ultimate gaming test. One of the most graphically demanding and visually impressive games in recent years, will soon get a Mac release, according to CD Projekt Red.
https://www.cyberpunk.net/en/news/50947/just-announced-cyberpunk-2077-ultimate-edition-coming-to-mac
#apple #silicon #mac #cyberpunk2077 #gaming #engineer #media #it #tech #news
Just Announced — Cyberpunk 2077: Ultimate Edition Coming to Mac!
Available early next year on Macs with Apple silicon, the Ultimate Edition will launch on the Mac App Store and Steam.Home of the Cyberpunk 2077 universe — games, anime & more
Yes, we're talking about the good old floppy disk, which is somehow still being utilized for something as important as a critical function of a public transport network within a major city’s.
https://www.govtech.com/transportation/s-f-muni-will-spend-212m-to-move-train-control-off-disk
#us #rail #train #control #metro #floppydisk #publictransport #travel #hitachirail #retrocomputing #engineer #media #tech #news
S.F. Muni Will Spend $212M to Move Train Control Off Disk
San Francisco’s Municipal Transportation Agency has approved a contract with Hitachi Rail for a new train control system. The replacement will move the Muni Metro off 1998 technology that runs on floppy disks.GovTech
The free version of the popular WordPress plugin LiteSpeed Cache has fixed a dangerous privilege elevation flaw on its latest release that could allow unauthenticated actors to gain admin rights.
[CVE-2024-50550 CVSS score: 8.1]
https://patchstack.com/articles/rare-case-of-privilege-escalation-patched-in-litespeed-cache-plugin/
#wordpress #litespeed #flaw #it #security #privacy #engineer #media #tech #news
Rare Case of Privilege Escalation Patched in LiteSpeed Cache Plugin - Patchstack
A vulnerability in LiteSpeed Cache allowed unauthorized admin access; fixed in version 6.5.2, with Patchstack users automatically protected.Rafie Muhammad (Patchstack)
Researchers have found new versions of a sophisticated Android financial-fraud Trojan that’s notable for its ability to intercept calls a victim tries to place to customer-support personnel of their banks.
https://www.zimperium.com/blog/mishing-in-motion-uncovering-the-evolving-functionality-of-fakecall-malware/
#android #fakecall #vishing #malware #it #security #privacy #engineer #media #tech #news
![[ImageSource: Zimperium]
Overview of latest FakeCall attacks.
The FakeCall malware typically infiltrates a device through a malicious app downloaded from a compromised website or a phishing email. The app requests permission to become the default call handler. If granted, the malware gains extensive privileges.
A fake call interface mimics the actual Android dialer, displaying trusted contact information and names, elevating the level of deception to a point that's hard for victims to realize.
What makes this malware so dangerous is that when a user attempts to call their financial institution, the malware secretly hijacks the call and redirects it to an attacker's phone number instead.](https://nerdculture.de/system/media_attachments/files/113/413/326/251/269/062/original/531c03137c2b88d1.png "[ImageSource: Zimperium]
Overview of latest FakeCall attacks.
The FakeCall malware typically infiltrates a device through a malicious app downloaded from a compromised website or a phishing email. The app requests permission to become the default call handler. If granted, the malware gains extensive privileges.
A fake call interface mimics the actual Android dialer, displaying trusted contact information and names, elevating the level of deception to a point that's hard for victims to realize.
What makes this malware so dangerous is that when a user attempts to call their financial institution, the malware secretly hijacks the call and redirects it to an attacker's phone number instead.")
Mishing in Motion: Uncovering the Evolving Functionality of FakeCall Malware - Zimperium
In this blog post we share Zimperium’s Zero-Day Protection against the Water Makara Spear-Phishing campaign.Zimperium
The company also seeks to improve the system's security and has expanded its security bounty program to include rewards of up to [$1 Million] for vulnerabilities that could compromise “the fundamental security and privacy guarantees of PCC”.
https://security.apple.com/blog/pcc-security-research
#apple #pcc #vm #securityresearch #bug #bounty #programming #ai #it #security #privacy #engineer #media #tech #news
![[ImageSource: Apple]
Interacting with the Private Cloud Compute client from the Virtual Research Environment.
Apple provides a Virtual Research Environment (VRE), which replicates locally the cloud intelligence system and allows inspecting it as well as testing its security and hunting for issues.
“The VRE runs the PCC node software in a virtual machine with only minor modifications. Userspace software runs identically to the PCC node, with the boot process and kernel adapted for virtualization,” Apple explains, sharing documentation on how to set up the Virtual Research Environment on your device.
VRE is present on macOS Sequia 15.1 Developer Preview and it needs a device with Apple silicaon and at least 16GB of unified memory.
<https://security.apple.com/documentation/private-cloud-compute/vresetup>](https://nerdculture.de/system/media_attachments/files/113/407/824/963/613/937/original/a72a81f16cf58a68.png "[ImageSource: Apple]
Interacting with the Private Cloud Compute client from the Virtual Research Environment.
Apple provides a Virtual Research Environment (VRE), which replicates locally the cloud intelligence system and allows inspecting it as well as testing its security and hunting for issues.
“The VRE runs the PCC node software in a virtual machine with only minor modifications. Userspace software runs identically to the PCC node, with the boot process and kernel adapted for virtualization,” Apple explains, sharing documentation on how to set up the Virtual Research Environment on your device.
VRE is present on macOS Sequia 15.1 Developer Preview and it needs a device with Apple silicaon and at least 16GB of unified memory.
<https://security.apple.com/documentation/private-cloud-compute/vresetup>")
