PT-2022-4117 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in security settings of the Windows Hello biometric authentication feature in the Windows operating system. This could allow an attacker to bypass existing...

Got the security controls wrong in OT and maritime? Watch as engineers work around them

Industrial control systems security is slowly improving, partly a result of attention from regulators and lawmakers. However, we often see security controls implemented that don’t take account of the unique challenges that engineers looking after OT environments face. We see controls brought in...

Samsung Confirms Data Breach After Hackers Leak Galaxy Source Code

Samsung on Monday confirmed a security breach that resulted in the exposure of internal company data, including the source code related to its Galaxy smartphones. "According to our initial analysis, the breach involves some source code relating to the operation of Galaxy devices, but does not...

3 key resources to accelerate your passwordless journey

Every organization today faces password-related challenges—phishing campaigns, productivity loss, and password management costs to name just a few. The risks now outweigh the benefits when it comes to passwords. Even the strongest passwords are easily phish-able and vulnerable to attacks, such as...

3 key resources to accelerate your passwordless journey

Every organization today faces password-related challenges—phishing campaigns, productivity loss, and password management costs to name just a few. The risks now outweigh the benefits when it comes to passwords. Even the strongest passwords are easily phish-able and vulnerable to attacks, such as...

CVE-2021-3145

In Ionic Identity Vault before 5, a local root attacker on an Android device can bypass biometric authentication...

CVE-2021-3145

Ionic Identity Vault before version 5 on Android is vulnerable to a biometric authentication bypass that can be exploited by a local root attacker. Affected are Identity Vault versions 4.7 and earlier on Android, with the vulnerability allowing bypass of biometric protection and granting access t...

CVE-2021-3145

In Ionic Identity Vault before 5, a local root attacker on an Android device can bypass biometric authentication...

Ionic Identity Vault 4.7 Android Biometric Authentication Bypass

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Identity Vault Vendor: Ionic CSNC ID: CSNC-2021-001 CVE ID: CVE-2021-3145 Subject: Biometric Authentication Bypass on Android Severity: Medium Effect: Authentication Bypass Author: Emanuel Duss Date: 2021-09-...

Ionic Identity Vault 4.7 Android Biometric Authentication Bypass Vulnerability

Ionic Identity Vault versions 4.7 and below suffer from a biometric authentication bypass vulnerability on Android. Product: Identity Vault Vendor: Ionic CVE ID: CVE-2021-3145 Subject: Biometric Authentication Bypass on Android Severity: Medium Effect: Authentication Bypass Introduction...

Windows Hello Bypass Bug Patch is Faulty, Researchers Say

LAS VEGAS – Microsoft Windows 10 biometric user authentication systems Windows Hello can be bypassed, using a single infrared image of a user’s face planted on a tampered clone of an external USB-based webcam. The vulnerability, tracked as CVE-2021-34466, CVSS score: 5.7, was patched by Microsoft...

Windows Hello Bypass Fools Biometrics Safeguards

A vulnerability in Microsoft’s Windows 10 password-free authentication system has been uncovered that could allow an attacker to spoof an image of a person’s face to trick the facial-recognition system and take control of a device. Windows Hello is a feature in Windows 10 that allows users to...

Deploying EFBs securely

It may come as a surprise to some to discover that electronic flight bag security at airlines is often quite variable. Whilst some use an MDM, a lot don’t. Of those who do, PINs are often weak. Some airlines actively encourage pilots to use their devices for personal use. We’ve heard stories of a...

How to Log In to Your Devices Without Passwords

You can use your face, fingerprint, or a wearable to get access to your gadgets. It saves you some typing—and makes you feel like a spy...

CVE-2021-28653

The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferred storage mechanism if the device has Secure Enclave support but lacks biometric authentication hardware...

Authentication flaw

The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferred storage mechanism if the device has Secure Enclave support but lacks biometric authentication hardware...

CVE-2021-28653

CVE-2021-28653 affects iOS and macOS apps prior to 1.4.1 for Western Digital G‑Technology ArmorLock NVMe SSD. The vulnerability arises from insecure key storage: the app stores keys using a non‑preferred mechanism when Secure Enclave is available but biometric hardware is absent. This can lead to...

CVE-2021-28653

The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferred storage mechanism if the device has Secure Enclave support but lacks biometric authentication hardware...

DigitalPersona 4.5.0.2213 - 'DpHostW' Unquoted Service Path

Exploit Title: DigitalPersona 4.5.0.2213 - 'DpHostW' Unquoted Service Path Exploit Author : SamAlucard Exploit Date: 2020-11-08 Vendor : DigitalPersona U. are U. One Touch Version : DigitalPersona Pro 4.5.0.2213 Vendor Homepage : https://www.hidglobal.com/crossmatch Tested on OS: Windows 10 Home...

Apple Touch ID Flaw Could Have Let Attackers Hijack iCloud Accounts

Apple earlier this year fixed a security vulnerability in iOS and macOS that could have potentially allowed an attacker to gain unauthorized access to a user's iCloud account. Uncovered in February by Thijs Alkemade, a security specialist at IT security firm Computest, the flaw resided in Apple's...