Zoom Will Be End-to-End Encrypted for All Users

Zoom is doing the right thing: it's making end-to-end encryption available to all users, paid and unpaid. This is a change; I wrote about the initial decision here. ...we have identified a path forward that balances the legitimate right of all users to privacy and the safety of users on our...

CVE-2020-13637

An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the clientkey, the deviceid, and the public key for end-to-end encryption in cleartext, enabling an attacker by copying or having access to the local storage databas...

Code injection

An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the clientkey, the deviceid, and the public key for end-to-end encryption in cleartext, enabling an attacker by copying or having access to the local storage databas...

CVE-2020-13637

The CVE-2020-13637 entry applies to the stashcat app up to version 3.9.2 across macOS, Windows, Android, iOS, and possibly other platforms. The root issue is the storage of sensitive credentials (client_key, device_id, and the public key for end-to-end encryption) in cleartext in the local storag...

June 16, 2020—KB4567513 (OS Build 17763.1294)

None None...

Zero Trust—Part 1: Networking

Enterprises used to be able to secure their corporate perimeters with traditional network controls and feel confident that they were keeping hackers out. However, in a mobile- and cloud-first world, in which the rate and the sophistication level of security attacks are increasing, they can no...

WFH Alert: Critical Bug Found in Old D-Link Router Models

D-Link is urging customers to replace its now obsolete line of DIR-865L Wireless Routers in reaction to a recently discovered critical command-injection bug that leaves users open to a denial-of-service attack. The routers, first introduced in 2013, reached end-of-life support in Feb. 2016. In Au...

WFH Alert: Critical Bug Found in Old D-Link Router Models

D-Link is urging customers to replace its now obsolete line of DIR-865L Wireless Routers in reaction to a recently discovered critical command-injection bug that leaves users open to a denial-of-service attack. The routers, first introduced in 2013, reached end-of-life support in Feb. 2016. In Au...

PT-2020-13827 · Citrix · Citrix Xenapp

Name of the Vulnerable Software and Affected Versions: Citrix XenApp version 6.5 Description: The issue allows a remote unauthenticated attacker to determine whether a user exists on the server when two-factor authentication 2FA is enabled. This is because the 2FA error page is only displayed aft...

Default credentials

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

June 9, 2020—KB4561616 (OS Build 14393.3750)

None None...

June 9, 2020—KB4561602 (OS Build 16299.1932)

None None...

Security Update for Adobe Flash Player: June 9, 2020

None None...

June 9, 2020—KB4561605 (OS Build 15063.2409)

None None...

SQL Injection Vulnerability in BEESCMS Backend ad***_bo***.php Page

BEESCMS is a scalable content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in the adbo.php page in the BEESCMS backend. An attacker can exploit the vulnerability to obtain sensitive database information...

News Wrap: Fake Minneapolis Police Breach, Zoom End-To-End Encryption Debate

Threatpost editors Lindsey O’Donnell-Welch and Tara Seals discuss the top security news stories of the week, including: Reports emerged earlier this week that the Minneapolis police department had been breached by hacktivist group Anonymous. Security expert Troy Hunt debunked the reports, however...

Zoom's Commitment to User Security Depends on Whether you Pay It or Not

Zoom was doing so well.... And now we have this: Corporate clients will get access to Zoom's end-to-end encryption service now being developed, but Yuan said free users won't enjoy that level of privacy, which makes it impossible for third parties to decipher communications. "Free users for sure ...

Zoom's End-to-End Encryption Will Be for Paying Customers Only

The videoconferencing company says it wants to be able to work with law enforcement to catch bad actors on its platform...

NOTICE-OF-CHANGE ANNOUNCEMENT FOR CITRIX SD-WAN 5100 Standard Edition and 800 WANOP Edition

Citrix Systems, Inc. announces a Notice of Status Change for the Citrix SD-WAN 5100 Standard Edition and 800 WANOP Edition platforms. The tables below explain the Citrix SD-WAN life cycle management milestones as well as important information regarding dates and options during this period. The...

Facebook Announces Messenger Security Features that Don't Compromise Privacy

Note that this is "announced," so we don't know when it's actually going to be implemented. Facebook today announced new features for Messenger that will alert you when messages appear to come from financial scammers or potential child abusers, displaying warnings in the Messenger app that provid...