RUSTSEC-2016-0005 rust-crypto is unmaintained; switch to a modern alternative

The rust-crypto crate has not seen a release or GitHub commit since 2016, and its author is unresponsive. NOTE: The old rust-crypto crate with hyphen should not be confused with similarly named new RustCrypto GitHub Org without hyphen. The GitHub Org is actively maintained. We recommend you switc...

rust-crypto is unmaintained; switch to a modern alternative

The rust-crypto crate has not seen a release or GitHub commit since 2016, and its author is unresponsive. NOTE: The old rust-crypto crate with hyphen should not be confused with similarly named new RustCrypto GitHub Org without hyphen. The GitHub Org is actively maintained. We recommend you switc...

[SECURITY] Fedora 25 Update: libgcrypt-1.6.6-1.fc25

Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...

[SECURITY] Fedora 24 Update: libgcrypt-1.6.6-1.fc24

Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...

Multiple Vulnerabilities Identified in 'Utterly Broken' BHU Routers

Researchers have identified a router so fraught with vulnerabilities and so “utterly broken” that it can be exploited to do pretty much anything. An attacker could bypass its authentication, peruse sensitive information stored in the router’s system logs and even use the device to execute OS...

GPG Patches 18-Year-Old Libgcrypt RNG Bug

New versions of Libgcrypt and Gnu Privacy Guard GnuPG or GPG released on Wednesday include security fixes for vulnerabilities discovered in the mixing functions of the Libgcrypt random number generator. The flaws were privately disclosed by Felix Dörre and Vladimir Klebanov of Karlsruhe Institute...

DDoSCoin — New Crypto-Currency Pays Users for Participating in DDoS Attacks

It’s 2016, and now, you can earn some dollars by contributing into well-organized DDoS attack scheme. Do you know while mining Bitcoins you are actually contributing a significant computational power to keep the Bitcoin network running? In Bitcoins, the miners actually build and maintain massive...

Simple Car Hack Open Millions Wireless Key Systems

Academic researchers added another hack to a growing list of compromises involving vehicles, and this one should give drivers pause the next time they leave valuables locked in their trunk. This hack involves millions of Volkswagen, Ford and Chevrolet vehicles that rely on an outdated key fob...

UBUNTU-CVE-2016-5142

The Web Cryptography API aka WebCrypto implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via crafted JavaScript code,...

[SECURITY] Fedora 23 Update: libgcrypt-1.6.5-1.fc23

Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...

RHEL 6 : ntp (RHSA-2016:1552)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1552 advisory. - ntp: off-path denial of service on authenticated broadcast mode CVE-2015-7979 - ntp: crypto-NAK preemptable association denial of service...

Export-Grade Crypto Patching Improves

LAS VEGAS – The FREAK, LOGJAM and DROWN attacks of the last 17 months weren’t just the work of academics and security researchers who found a cool way to unmask encrypted traffic. They were ugly reminders of the Crypto Wars of the 1990s and why export-grade cryptography and intentional encryption...

Debian DLA-559-1 : ntp security update

Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs : CVE-2015-7974 Matt Street discovered that insufficient key validation allows impersonation attacks between authenticated peers. CVE-2015-7977 / CVE-2015-7978 Stephen Gray discovered that a NULL...

Fast Browser Vulnerability

KChrome, derived from Google's open source project Chromium and compatible with IE, is a browser with dual kernels of Webkit and IE. Thanks to the high performance of Webkit, you will be faster when browsing the web in normal times. A design vulnerability exists in Crypto Browser that allows...

[SECURITY] Fedora 24 Update: libgcrypt-1.6.5-1.fc24

Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...

Cerber: Analyzing a Ransomware Attack Methodology To Enable Protection

Ransomware is a common method of cyber extortion for financial gain that typically involves users being unable to interact with their files, applications or systems until a ransom is paid. Accessibility of cryptocurrency such as Bitcoin has directly contributed to this ransomware model. Based on...

IDPS SandBox AntiVirus Stealth Killer: MorphAES

IDPS SandBox AntiVirus Stealth Killer MorphAES is the world’s first polymorphic shellcode/malware engine, with metamorphic properties and capability to bypass sandboxes, which makes it undetectable for an IDPS, it’s cross-platform as well and library-independent. Properties: Polymorphism AES...

Juniper Crypto Bug Let Attackers Eavesdrop on Router, Switch Traffic

Juniper Networks patched a crypto bug tied to its public key infrastructure that could have allowed hackers to access the company’s routers, switches and security devices and eavesdrop on sensitive communications. The flaw was tied to Juniper products and platforms running Junos, the Juniper...

On the Android Crypto Weakness, FDE Bypass, Hummingbad, and More

Mike Mimoso, Tom Spring and Chris Brook discuss the news of the week, including all things Android: the crypto weakness, the full disk encryption bypass, and new malware, Hummingbad, which impacts the mobile operating system. The three also discuss the TP-Link router fiasco. Download:...

The vulnerability of the OpenSSL software allows a malicious attacker to compromise the accessibility of protected information.

The vulnerability in the sslsetclientdisabled function in t1lib.c of OpenSSL allows remote SSL servers to trigger a service failure by replacing the null pointer and terminating the client application abnormally, using the ServerHello message. This message includes the SRP crypto packet without...