Authors/Presenters:Yun Li, Tsinghua University, Ant Group; Yufei Duan, Tsinghua University; Zhicong Huang, Alibaba Group; Cheng Hong, Ant Group; Chao Zhang and Yifan Song, Tsinghua University

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access.
Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – Efficient 3PC for Binary Circuits with Application to Maliciously-Secure DNN Inference appeared first on Security Boulevard.

Qualys this week reported the discovery of a Remote Unauthenticated Code Execution (RCE) vulnerability in OpenSSH servers (sshd) that could potentially impact more than 14 million Linux systems.

The post Latest OpenSSH Vulnerability Might Impact 14M Linux Systems appeared first on Security Boulevard.

Tim looks grim: 10 year old vulnerabilities in widely used dev tool include a CVSS 10.0 remote code execution bug.

The post ‘Perfect 10’ Apple Supply Chain Bug — Millions of Apps at Risk of CocoaPods RCE appeared first on Security Boulevard.

In Lagos, where homosexuality is illegal, Chibuzo and Ekele reveal how risky it is for them to get together

We only touch behind closed doors

I miss the intimacy of sharing living space, and being together, day and night

To bolster digital security and resilience across the semiconductor supply chain, a critical first step is that organizations across the supply chain must re-orient their cybersecurity strategies.

The post Building Resilience in the Chip Supply Chain appeared first on Security Boulevard.

• Latest news from day three in the County Championship
• And you can email Tanya or comment below the line

And while Anderson performs ball-polishing duties for Tom Bailey at mid-on, poor Tom Bruce is turning out for Lancashire seconds at Barnsley. And the first drop of the day as Chris Green lets HH through his fingers at midwicket.

HH survives the over, Anderson’s first over of the summer is a maiden and off we go.

On Canvey Island in Essex, I found hard-up, demoralised voters taking refuge in rightwing half-truths

If politics is a soap opera, the people of Canvey Island switched off a few years ago. This is England at its most Conservative, literally: the island is in the constituency of Castle Point, which delivered the highest vote share (76.7%) in Britain for the party at the 2019 election.

The Tories’ looming appointment with electoral calamity is evident from the responses I receive when visiting this Essex coastal town, which range from indifference to contempt. There are plenty of older folk (a quarter of the residents in the constituency are aged over 65) but also a sprinkling of families, as well as shirtless young lads bombing down the high street on bikes, passing union flag bunting on the railings. Ask about the election, and some respond as if it’s the first they’ve heard of it, others like it’s a mild trauma they’d rather forget.

Companies that implement a holistic Cloud Native Application Protection Platform (CNAPP) position themselves for game-changing advantages.

The post Is Your Cloud Security a Mess? Five Problems CNAPP Can Cure appeared first on Security Boulevard.

Integrating mobile ID verification into digital payment systems marks a significant milestone in the evolution of digital commerce.

The post How Mobile ID Verification is Shaping the Future of Digital Payments appeared first on Security Boulevard.

Critical infrastructure and public sector organizations such as government and municipalities, manufacturing units, communication networks, transportation services, power and water treatment plants, et. al, have been battling a growing wave of breaches and cyberattacks.

The post 7 Steps To Secure Critical Infrastructure  appeared first on Security Boulevard.

As pornography use soars, some men feel their behaviour is moving from a compulsion to an addiction. They describe how this affects their health, happiness and relationships

Tony is in his 50s and recently did a rough calculation of how much of his life he has spent looking at pornography. “The result was horrifying,” he says. It was eight years. “I can barely think about it. The sense of failure is intense.”

Tony saw his first “hardcore” film on VHS in the 1980s when he was 12. In his 20s, he connected to the internet for the first time, which turned his habit into a “full-blown addiction”. Over the past 30 years, he has just about managed to maintain a double life: he works in a caring profession, is friends with men and women, has had relationships. But there is a part of him he keeps entirely hidden.

Authors/Presenters:Haibin Zhang, Sisi Duan, Boxin Zhao, Liehuang Zhu

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access.
Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – WaterBear: Practical Asynchronous BFT Matching Security Guarantees of Partially Synchronous BFT appeared first on Security Boulevard.

On the brink of insanity, my tattered mind unable to comprehend the twisted interplay of millennia of arcane programmer-time and the ragged screech of madness, I reached into the Mass and steeled myself to the ground lest I be pulled in, and found my magnum opus.

Booting Linux off of a Google Drive root.

↫ Ersei

That’s not… You shouldn’t… Why would…

SolarWinds hackers strike again: Remote access service hacked—by APT29, says TeamViewer.

The post ‘Russia’ Breaches TeamViewer — ‘No Evidence’ Billions of Devices at Risk appeared first on Security Boulevard.

Enlarge / The Tianlong-3 rocket as seen on its test stand before the anomaly. (credit: Space Pioneer)

One of the most promising Chinese space startups, Space Pioneer, experienced a serious anomaly this weekend while testing the first stage of its Tianlong-3 rocket near the city of Gongyi.

The rocket was undergoing a static fire test of the stage, in which a vehicle is clamped to a test stand while its engines are ignited, when the booster broke free. According to a statement from the company, the rocket was not sufficiently clamped down and blasted off from the test stand "due to a structural failure."

Video of the accidental ascent showed the rocket rising several hundred meters into the sky before it crashed explosively into a mountain 1.5 km away from the test site. (See various angles of the accident here, on the social media site X, or on Weibo.) The statement from Space Pioneer sought to downplay the incident, saying it had implemented safety measures before the test, and there were no casualties as a result of the accident. "The test site is far away from the urban area of ​​Gongyi," the company said.

Read 7 remaining paragraphs | Comments

While AI helps automatically detect and respond to rapidly evolving threats, XAI helps security professionals understand how these decisions are being made.

The post What is the Role of Explainable AI (XAI) In Security? appeared first on Security Boulevard.

The Cyber Trust Mark is a labeling initiative for consumer IoT devices in the United States that builds on work undertaken by the FCC and NIST, establishing data privacy and cybersecurity standards for connected devices.

The post Cyber Trust Mark: The Impacts and Incentives of Early Adoption appeared first on Security Boulevard.

As employers scramble to find or train security talent, organizations that ignore the inclusive approach may weaken their competitive posture in the battle for talent and overall security.

The post Cybersecurity Workforce Sustainability has a Problem. DEI Could be the Solution. appeared first on Security Boulevard.

Digital nomads go where the wind takes them around the globe, often working from coffee shops, co-working locations or public libraries. They rely on connecting to their work life via their mobile hotspot or public wi-fi connections.

The post Remote Rigor: Safeguarding Data in the Age of Digital Nomads appeared first on Security Boulevard.

Read more of this story at Slashdot.

Authors/Presenters:Athanasios Avgetidis, Omar Alrawi, Kevin Valakuzhy, Charles Lever, Paul Burbage, Angelos D. Keromytis, Fabian Monrose, Manos Antonakakis

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access.
Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – Beyond The Gates: An Empirical Analysis of HTTP-Managed Password Stealers and Operators appeared first on Security Boulevard.

Authors/Presenters:Boyang Zhang and Xinlei He, Yun Shen, Tianhao Wang, Yang Zhang

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access.
Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – A Plot is Worth a Thousand Words: Model Information Stealing Attacks via Scientific Plots appeared first on Security Boulevard.

Best Cybersecurity Shows on Netflix

 7. The Great Hack 

6. The Billion Dollar Code 

5. Connected 

4. Cyber Hell: Exposing an Internet Horror 

3. The Future Of 

2. Love, Death + Robots. 

1. Black Mirror 

AI promises considerable benefits however there’s still a lot of confusion surrounding the topic, particularly around the terms generative AI and predictive AI.

The post Generative AI vs. Predictive AI: A Cybersecurity Perspective appeared first on Security Boulevard.

Enlarge / A European ATV cargo freighter reenters the atmosphere over the Pacific Ocean in 2013.

Since the beginning of the year, landowners have discovered several pieces of space junk traced to missions supporting the International Space Station. On all of these occasions, engineers expected none of the disposable hardware would survive the scorching heat of reentry and make it to Earth's surface.

These incidents highlight an urgency for more research into what happens when a spacecraft makes an uncontrolled reentry into the atmosphere, according to engineers from the Aerospace Corporation, a federally funded research center based in El Segundo, California. More stuff is getting launched into space than ever before, and the trend will continue as companies deploy more satellite constellations and field heavier rockets.

"The biggest immediate need now is just to do some more work to really understand this whole process and to be in a position to be ready to accommodate new materials, new operational approaches as they happen more quickly," said Marlon Sorge, executive director of Aerospace's Center for Orbital and Reentry Debris Studies. "Clearly, that’s the direction that spaceflight is going.”

Read 15 remaining paragraphs | Comments

The openSUSE project recently announced the second release candidate (RC2) of its Aeon Desktop, formerly known as MicroOS Desktop GNOME. Aside from the new coat of naming paint, Aeon breaks ground in a few other ways by dabbling with technologies not found in other openSUSE releases. The goal for Aeon is to provide automated system updates using snapshots that can be applied atomically, removing the burden of system maintenance for “lazy developers” who want to focus on their work rather than desktop administration. System-tinkerers need not apply.

The idea behind Aeon, as with other immutable (or image-based) Linux distributions, is to provide the core of the distribution as a read-only image or filesystem that is updated atomically and can be rolled back if needed. Google’s ChromeOS was the first popular Linux-based desktop operating system to follow this model. Since the release of ChromeOS a number of interesting immutable implementations have cropped up, such as Fedora Silverblue, Project Bluefin (covered here in December 2023), openSUSE’s MicroOS (covered here in March 2023), and Ubuntu Core.

↫ Joe Brockmeier at LWN

With the amount of attention immutable Linux desktops are getting, and how much work and experimentation that’s going into them, I’m getting the feeling that sooner or later all of the major, popular desktop Linux distributions will be going this route. Depending on implementation details, I actually like the concept of a defined base system that’s just an image that can be replaced easily using btrfs snapshots or something like that, while all the user’s files and customisations are kept elsewhere. It makes intuitive sense.

Where the current crop of immutable Linux desktops fall flat for me is their reliance on (usually) Flatpak. You know how there’s people who hate systemd and/or Wayland just a little too much, to the point it gets a little weird and worrying? That’s me whenever I have to deal with Flatpaks. Every experience I have with Flatpaks is riddled with trouble for me.

Even though I’m a KDE user, I’m currently testing out the latest GNOME release on my workstation (the one that I used to conclude Windows is simply not ready for the desktop), using Fedora of course, and on GNOME I use the Mastodon application Tuba. While I mostly write in English, I do occasionally write in Dutch, too, and would love for the spell check feature to work in my native tongue, too, instead of just in English. However, despite having all possible Dutch dictionaries installed – hunspell, aspell – and despite those dictionaries being picked up everywhere else in GNOME, Tuba only showed me a long list of variants of English.

After digging around to find out why this was happening, it took me far longer than I care to publicly admit to realise that since the latest version of Tuba is only really available as a Flatpak on Fedora, my problem probably had something to do with that – and it turns out I was right: Flatpak applications do not use the system-wide installed spellcheck dictionaries like normal applications do.

This eventually led me to this article by Daniel Aleksandersen, where he details what you need to do in order to add spellcheck dictionaries to Flatpak applications. You need to run the following commands:

$ flatpak config languages --set "en;nl;"
$ sudo flatpak update

The list of languages uses two-letter codes only, and the first language listed will serve as the display language for Flatpak applications, while the rest will be fallback languages – which happens to include downloading and installing the Flatpak-specific copies of the spellcheck libraries. Sadly, this method is not particularly granular. Since it only accepts the two-letter codes, you can’t, say, only install “nl-nl”; you’ll be getting “nl-be” as well. In the case of a widely spoken language like English, this means a massive list of 18 different varieties of English. The resulting menus are… Not elegant.

This is just an example, but using Flatpak, you’ll run into all kinds of issues like this, that then have to be solved by hacks or obscure terminal commands – not exactly the user-friendly image Flatpak is trying to convey to the world. This particular issue might not matter to the probably overwhelming English-speaking majority of Flatpak developers, but for anyone who has to deal with multiple languages on a daily basis – which is a massive number of people, probably well over 50% of computer users¹ – having to mess around with obscure terminal commands hidden in blog posts just to be able to use the languages they use every day is terrible design on a multitude of levels, and will outright make Flatpak applications unusable for large numbers of people.

Whenever I run into these Flatpak problems, it makes it clear to me that Flatpak is designed not by users, for users – but by developers, for developers. I can totally understand and see why Flatpak is appealing to developers, but as a user, they bring me nothing but grief, issues, and weird bugs that all seem to stem from being made to make developers’ lives easier, instead of users’.

If immutable Linux distributions are really hellbent on using Flatpak as the the means of application installation – and it seams like they are – it will mean a massive regression in functionality, usability, and discoverability for users, and as long as Flatpak remains as broken and badly designed as it is, I really see no reason to recommend an immutable Linux desktop to anyone but the really curious among us.

1. Even in a country like the United States, which we think of as an English-speaking country, there are currently 42 million Spanish-speaking people, who most likely also have to use English on a daily basis. The way multilingual features are treated as afterthoughts by the tech industry – even the open source one – is baffling. ︎

A threat group dubbed Unfurling Hemlock infects targeted campaign with a single compressed file that, once executed, launches a 'cluster bomb' of as many as 10 pieces of malware that include loaders, stealers, and backdoors.

The post Unfurling Hemlock Tossing ‘Cluster Bombs’ of Malware appeared first on Security Boulevard.

Authors/Presenters:Xinben Gao, Lan Zhang

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access.
Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

The post USENIX Security ’23 – PCAT: Functionality and Data Stealing from Split Learning by Pseudo-Client Attack appeared first on Security Boulevard.

Authors/Presenters:Nicholas Carlini, Jamie Hayes, DeepMind; Milad Nasr Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, Eric Wallace

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access.
Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – Extracting Training Data from Diffusion Models appeared first on Security Boulevard.

Chinese fast-fashion-cum-junk retailer “is a data-theft business.”

The post Temu is Malware — It Sells Your Info, Accuses Ark. AG appeared first on Security Boulevard.

Microsoft details Skeleton Key, a new jailbreak technique in which a threat actor can convince an AI model to ignore its built-in safeguards and respond to requests for harmful, illegal, or offensive requests that might otherwise have been refused.

The post Skeleton Key the Latest Jailbreak Threat to AI Models: Microsoft appeared first on Security Boulevard.

Enlarge / SpaceX's 10th Falcon Heavy rocket climbs into orbit with a new US government weather satellite. (credit: SpaceX)

Welcome to Edition 6.50 of the Rocket Report! SpaceX launched its 10th Falcon Heavy rocket this week with the GOES-U weather satellite for NOAA, and this one was a beauty. The late afternoon timing of the launch and atmospheric conditions made for great photography. Falcon Heavy has become a trusted rocket for the US government, and its next flight in October will deploy NASA's Europa Clipper spacecraft on the way to explore one of Jupiter's enigmatic icy moons.

As always, we welcome reader submissions, and if you don't want to miss an issue, please subscribe using the box below (the form will not appear on AMP-enabled versions of the site). Each report will include information on small-, medium-, and heavy-lift rockets as well as a quick look ahead at the next three launches on the calendar.

Sir Peter Beck dishes on launch business. Ars spoke with the recently knighted Peter Beck, founder and CEO of Rocket Lab, on where his scrappy company fits in a global launch marketplace dominated by SpaceX. Rocket Lab racked up the third-most number of orbital launches by any US launch company (it's headquartered in California but primarily assembles and launches rockets in New Zealand). SpaceX's rideshare launch business with the Falcon 9 rocket is putting immense pressure on small launch companies like Rocket Lab. However, Beck argues his Electron rocket is a bespoke solution for customers desiring to put their satellite in a specific place at a specific time, a luxury they can't count on with a SpaceX rideshare.

Read 22 remaining paragraphs | Comments

Navigating the landscape of customer interactions is a delicate balancing act that requires constant calibration between security and operability (or usability, if speaking from a customer’s perspective).

The post How to Enhance Security Without Affecting the Customer Experience appeared first on Security Boulevard.

Let’s examine why so many applications remain vulnerable despite high-severity warnings and how to minimize the threat to your organization.

The post The Urgency to Uplevel AppSec: Securing Your Organization’s Vulnerable Building Blocks appeared first on Security Boulevard.

The rate of cyberattacks is rising as the threat level continues to evolve, according to BlackBerry Limited’s latest Global Threat Intelligence Report.

The post Cyberattack Rate Surges as Novel Malware Growth Accelerates appeared first on Security Boulevard.

Enlarge / Illustration of the SpaceX Dragon XL as it is deployed from the Falcon Heavy's second stage in high Earth orbit on its way to the Gateway in lunar orbit. (credit: SpaceX)

NASA has awarded an $843 million contract to SpaceX to develop a "US Deorbit Vehicle." This spacecraft will dock to the International Space Station in 2029 and then ensure the large facility makes a controlled reentry through Earth's atmosphere before splashing into the ocean in 2030.

"Selecting a US Deorbit Vehicle for the International Space Station will help NASA and its international partners ensure a safe and responsible transition in low Earth orbit at the end of station operations," said Ken Bowersox, NASA's associate administrator for Space Operations, in a statement. "This decision also supports NASA’s plans for future commercial destinations and allows for the continued use of space near Earth."

NASA has a couple of reasons for bringing the space station's life to a close in 2030. Foremost among these is that the station is aging. Parts of it are now a quarter of a century old. There are cracks on the Russian segment of the space station that are spreading. Although the station could likely be maintained beyond 2030, it would require increasing amounts of crew time to keep flying the station safely.

Read 11 remaining paragraphs | Comments

Authors/Presenters:Karola Marky, Shaun Macdonald, Yasmeen Abdrabou, Mohamed Khamis

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access.
Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – In the Quest to Protect Users from Side-Channel Attacks — A User-Centred Design Space to Mitigate Thermal Attacks on Public Payment Terminals appeared first on Security Boulevard.

A company that helps to authenticate users for big brands had a set of administration credentials exposed online for over a year, potentially allowing access to user identity documents such as driving licenses.

As more and more legislation emerges requiring websites and platforms—like gambling services, social networks, and porn sites—to verify their users’ age, the requirement for authentication companies offering that service rises.

You may never have heard of the Israeli based authentication company, AU10TIX, but you will certainly recognize some of its major customers, like Uber, TikTok, X, Fiverr, Coinbase, LinkedIn, and Saxo Bank.

AU10TIX checks users’ identities via the upload of a photo of an official document.

A researcher found that AU10TIX had left the credentials exposed, providing 404 Media with screenshots and data to demonstrate their findings. The credentials led to a logging platform containing data about people that had uploaded documents to prove their identity.

Whoever accessed the platform could peruse information about those people, including name, date of birth, nationality, identification number, and the type of uploaded document such as a drivers’ license, linking to an image of the identity document itself.

Research showed that the likely source of the credentials was an infostealer on a computer of a Network Operations Center Manager at AU10TIX.

Stolen credentials have shown to be a major source of breaches like those recently associated with Snowflake. Snowflake pointed to research which found that one cybercriminal obtained access to multiple organizations’ Snowflake customer instances using stolen customer credentials.

Another major problem is that these sets of credentials get traded and sold all the time. And it’s not as if when you sold them once, that’s it. Digital information can be copied and combined endlessly, leading to huge data sets that criminals can use as they see fit.

We’ve talked about the dangers of data brokers in the past. The California Privacy Protection Agency (CPPA) defines data brokers as businesses that consumers don’t directly interact with, but that buy and sell information about consumers from and to other businesses. There are around 480 data brokers registered with the CPPA. However, that might be just the tip of the iceberg, because there are a host of smaller players active that try to keep a low profile.

Either way, for any company and particularly an authentication company working with sensitive data, having such an account accessible with just login credentials should be grounds for serious penalties.

In a statement given to 404 Media, AU10TIX said it was no longer using the system and had no evidence the data had been used:

“While PII data was potentially accessible, based on our current findings, we see no evidence that such data has been exploited. Our customers’ security is of the utmost importance, and they have been notified.”

For now, there’s not much that individual users of the brands can do apart from keep an eye out for any official statements, and consider an ongoing identity monitoring solution. Below are some general tips on what to do if your data has been part of a data breach:

Protecting yourself after a data breach

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

• Check the vendor’s advice. Every breach is different, so check with the vendor to find out what’s happened, and follow any specific advice they offer.
• Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
• Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
• Watch out for fake vendors. The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
• Take your time. Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
• Consider not storing your card details. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
• Set up identity monitoring. Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

Check your personal data exposure

You can check what personal information of yours has been exposed on our Digital Footprint portal. Just enter your email address (it’s best to submit the one you most frequently use) to our free Digital Footprint scan and we’ll give you a report.

Researchers have identified three distinct nation-state campaigns leveraging advanced highly evasive and adaptive threat (HEAT) tactics.

The post Three Nation-State Campaigns Targeting Healthcare, Banking Discovered appeared first on Security Boulevard.

Cloud security has become a major focus for organizations worldwide as they battle with a growing number of data breaches and application sprawl that makes defense more complicated.

The post Cloud Security Tops Priority List for Organizations Globally appeared first on Security Boulevard.

Most organizations are uncertain about the effectiveness of their cybersecurity investments, despite increasing budgets and rampant cyber incidents, according to Optiv’s 2024 Threat and Risk Management Report.

The post Security Budgets Grow, but Inefficiencies Persist appeared first on Security Boulevard.

Authors/Presenters:Dominic Deuber, Michael Keuchen, Nicolas Christin

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access.
Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – Assessing Anonymity Techniques Employed in German Court Decisions: A De-Anonymization Experiment appeared first on Security Boulevard.