PT-2019-13634 · Shapeshift · Keepkey

Name of the Vulnerable Software and Affected Versions: ShapeShift KeepKey devices affected versions not specified Description: A side channel vulnerability was discovered related to the row-based OLED display on ShapeShift KeepKey devices. The power consumption of each display cycle varies based ...

DEF CON 2019: Researchers Demo Hacking Google Home for RCE

LAS VEGAS – The Tencent Blade Team of researchers demonstrated several ways they have developed to hack and run remote code on Google Home smart speakers. The hacks center around what is known as a Magellan vulnerability, which can be used to exploit the massively popular SQLite database engine...

Industrial Security Featuring Delta's enteliBUS Manager

ARCHIVED STORY From Building Control to Damage Control: A Case Study in Industrial Security Featuring Delta's enteliBUS Manager By Mark Bereza · August 09, 2019 Management. Control. It seems that you can’t stick five people in a room together without one of them trying to order the others around...

OPENSUSE-SU-2019:1840-1 Security update for vlc

This update for vlc to version 3.0.7.1 fixes the following issues: Security issues fixed: - CVE-2019-5439: Fixed a buffer overflow bsc1138354. - CVE-2019-5459: Fixed an integer underflow bsc1143549. - CVE-2019-5460: Fixed a double free bsc1143547. - CVE-2019-12874: Fixed a double free in...

Important: qemu-kvm

Issue Overview: Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA STore Address and STD STore Data sub-operations. These sub-operations allow the processor to hand-off...

PTP at DEF CON 27

Here's the lowdown on our 14 DEF CON 27 talks, workshops, and panel sessions: Main Stage Track 3 Paris: Saturday 13:00 Chris Wade presents Tag-side attacks against NFC Track 2 Paris: Saturday 15:00 G Richter presents Reverse-Engineering 4g Hotspots for Fun, Bugs and Net Financial Loss Villages...

Unpatched Flaws in IoT Smart Deadbolt Open Homes to Danger

UPDATE Researchers have uncovered vulnerabilities in a popular smart deadbolt could allow attackers to remotely unlock doors and break into homes. The manufacturer behind the smart lock, Hickory Hardware, has deployed patches to the affected apps on the Google Play Store and Apple App Store. The...

How Windows Defender Antivirus integrates hardware-based system integrity for informed, extensive endpoint protection

Detecting and stopping attacks that tamper with kernel-mode agents at the hypervisor level is a critical component of the unified endpoint protection platform in Microsoft Defender Advanced Threat Protection Microsoft Defender ATP. It’s not without challenges, but the deep integration of Windows...

Backup to Tape Job to the HPE LTO tape drives fails with "Tape error: '1117'" after upgrade to Veeam Backup & Replication 9.5 Update 4b

Challenge Backup and other operations to HPE LTO tape drives may constantly fail after installation of Veeam Backup & Replication 9.5 Update 4b 9.5.4.2866. Veeam fails to connect to the tape drive and returns the following errors: 18.07.2019 15:49:24 Warning TapeDrive alert: The tape drive has a...

openSUSE Security Update : kernel-firmware (openSUSE-2019-1770)

This update for kernel-firmware fixes the following issues : kernel-firmware was updated to version 20190618 : - cavium: Add firmware for CNN55XX crypto driver. - linux-firmware: Update firmware file for Intel Bluetooth 22161 - linux-firmware: Update firmware file for Intel Bluetooth 9560 -...

EulerOS 2.0 SP2 : libgcrypt (EulerOS-SA-2019-1750)

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization,...

CVE-2019-13648

In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service TM Bad Thing exception and system crash via a sigreturn system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal32.c...

Fails and Fixes with IoT

After nearly 6 years of tearing apart 'internet of things' devices, here's a look at the high level fails that we keep seeing. We're not going to go in to point issues such as Wi-Fi credential leakage and Bluetooth compromise: our blog is littered with those! What are the root issues and what can...

UBUNTU-CVE-2019-13648

In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service TM Bad Thing exception and system crash via a sigreturn system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal32.c...

Mirai Botnet Sees Big 2019 Growth, Shifts Focus to Enterprises

The infamous Mirai internet of things botnet is spiking in growth while changing up its tactics, techniques and procedures so far in 2019, to target more and more enterprise-level hardware, It’s a state of affairs that presents a greater concern than ever before given the ongong migration to the...

Hardware encryption doesn't work on tape operations after update to 9.5 Patch 4b

Challenge After you update to patch 4b 9.5.4.2866, you may face the following encryption-related issues during the backup and restore procedures. Restore from tape backups made in the previous product versions with enabled hardware encryption may fail with the following error message: 11.07.2019...

honggfuzz vulnerability mining technology principle analysis-vulnerability warning-the black bar safety net

Google AFLWinAFL, the libfuzzer and honggfuzz is the most famous of the three based on code coverage fuzzer is. Online on the AFLWinAFLanalysis of the articles more, and on the latter two Analysis Articles less. Before the spring brother has written about honggfuzz article: honggfuzz vulnerabilit...

The vulnerability of the software-hardware protection system VipNet Coordinator HW allows a perpetrator to trigger an emergency shutdown of the system or execute arbitrary code.

The vulnerability of the MFTPD software-based information protection system, implemented by the VipNet Coordinator HW, exists due to incorrect processing of the F field in the OFS command. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a crash, thereby...

NETGEAR WiFi Router JWNR2010v5 R6080 - Authentication Bypass

NETGEAR WiFi Router JWNR2010v5 R6080 - Authentication Bypass Exploit Title: NETGEAR WiFi Router R6080 - Security Questions Answers Disclosure Date: 13/07/2019 Exploit Author: Wadeek Hardware Version: R6080-100PES Firmware Version: 1.0.0.34 / 1.0.0.40 Vendor Homepage:...

CISCO Small Business 200 / 300 / 500 Switches - Multiple Vulnerabilities

Exploit Title: CISCO Small Business 200, 300, 500 Switches Multiple Vulnerabilities. Shodan query: /config/logoffpage.html Discovered Date: 07/03/2014 Reported Date: 08/04/2019 Exploit Author: Ramikan Website: http://fact-in-hack.blogspot.com Vendor...