CVE-2021-0449

In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

Newest Intel Side-Channel Attack Sniffs Out Sensitive Data

Intel processors are vulnerable to a new side-channel attack, which researchers said can allow attackers to steal sensitive information such as encryption keys or passwords. Unlike previous side-channel attacks, this attack does not rely on sharing memory, cache sets and other former tactics...

MediaTek vow Competitive Conditions Issue Vulnerability

MediaTek vow is an application chip from MediaTek, China. It provides optimized platform size and power consumption. MediaTek vow suffers from a Competitive Condition Issue vulnerability that originates from a memory corruption due to a competitive condition, which can be exploited by an attacker...

Mysterious Macintosh Malware

This is weird: Once an hour, infected Macs check a control server to see if there are any new commands the malware should run or binaries to execute. So far, however, researchers have yet to observe delivery of any payload on any of the infected 30,000 machines, leaving the malwares ultimate goal...

The vulnerability of the System-on-a-Chip Driver for Intel Compute Stick STK1A32SC allows a hacker to gain increased privileges.

The vulnerability of the System-on-a-Chip Driver for Intel Compute Stick STK1A32SC is related to privilege management errors. Exploiting this vulnerability can allow an attacker to increase their privileges...

Hackers Targeting Apple’s M1 Chip with Mac Malware

By Waqas Ex-NSA researcher has discovered malware that is equipped with anti-analysis capabilities and designed to specifically target Apple's new chip. This is a post from HackRead.com Read the original post: Hackers Targeting Apples M1 Chip with Mac Malware...

Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part One)

In 2019, Mandiant’s Red Team discovered a series of vulnerabilities present within Digi International’s ConnectPort X2e device, which allows for remote code execution as a privileged user. Specifically, Mandiant’s research focused on SolarCity’s now owned by Tesla rebranded ConnectPort X2e device...

Bluetooth Overlay Skimmer That Blocks Chip

As a total sucker for anything skimming-related, I was interested to hear from a reader working security for a retail chain in the United States who recently found Bluetooth-enabled skimming devices placed over top of payment card terminals at several stores. Interestingly, these skimmers...

Denial Of Service (DoS)

Linux kernel vulnerable to heap-based buffer overflow. The vulnerability exists in the marvell wifi chip driver in Linux kernel which allows local users to cause a denial of servic or possibly execute arbitrary code...

PT-2021-2102 · Intel · Intel(R) Soc Driver Package

Name of the Vulnerable Software and Affected Versions: IntelR SOC driver package for STK1A32SC versions prior to 604 Description: The issue is related to insecure inherited permissions for the IntelR SOC driver package, which may allow an authenticated user to potentially enable escalation of...

Qualcomm Chip Security Breach

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc., and are often fabricated on the surface of semiconductor wafers. The Qualcomm chip suffers from a security vulnerability that stems from...

Cloning Google Titan 2FA keys

This is a clever side-channel attack: The cloning works by using a hot air gun and a scalpel to remove the plastic key casing and expose the NXP A700X chip, which acts as a secure element that stores the cryptographic secrets. Next, an attacker connects the chip to hardware and software that take...

Qualcomm Wlan Hal Input Validation Error Vulnerability

Qualcomm Wlan Hal is a Bluetooth support firmware from Qualcomm Incorporated. APQ8096AU, AQT1000, AR7420, AR8031, AR8035, AR8151, AR9380, CSR6030, CSR8811, CSRA6620, CSRA6640, CSRB31024, IPQ4018, IPQ4019, IPQ4028, IPQ4029. ipq5010, ipq5018, ipq6000, ipq6005, ipq6010, ipq6018, ipq6028, ipq8064,...

HaXmas Hardware Hacking

Usually, when you read an IoT hacking report or blog post, it ends with something along the lines of, "and that's how I got root," or "and there was a secret backdoor credential," or "and every device in the field uses the same S3 bucket with no authentication." You know, something bad, and the...

Binary Vulnerability in Rexchip Chip (CNVD-2020-75212)

With a R&D team specializing in system-on-chip design and algorithm research, Rexchip Microelectronics Corporation provides professional chip solutions for high-end intelligent hardware, cell phone peripherals, tablet PCs, TV set-top boxes, industrial control and other fields. A binary...

Binary Vulnerability in Rexchip Chip (CNVD-2020-75211)

With a R&D team specializing in system-on-chip design and algorithm research, Rexchip Microelectronics Corporation provides professional chip solutions for high-end intelligent hardware, cell phone peripherals, tablet PCs, TV set-top boxes, industrial control and other fields. A binary...

CVE-2020-0456

There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-170378843...

CVE-2020-0455

There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-170372514...

NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel Multiple Vulnerabilities (NS-SA-2020-0108)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has kernel packages installed that are affected by multiple vulnerabilities: - In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size...

CVE-2020-29438

Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification. This allows attackers to construct firmware that retrieves an unlock code from a secure enclave chip...