Mozilla Firefox Security Advisory (MFSA2015-71) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Security Tool Guts: How Much Should Customers See?

Many cybersecurity tools use engines that calculate risk for events in customer environments. The accuracy of these risk engines is a major concern for customers, since it determines whether an attack is detected or not. Therefore, organizations often request visibility into how a risk engine...

Automatic Cipher Suite Ordering in crypto/tls

This is the first article I wrote for the Go blog !! about how TLS cipher suites configuration got so complicated, and how weve made it way easier in Go 1.17. The Go standard library provides crypto/tls, a robust implementation of Transport Layer Security TLS, the most important security protocol...

A week in security (June 28 – July 4)

Last week on Malwarebytes Labs: Is it Game Over for VR Advergaming? Lil’ skimmer, the Magecart impersonator What is the WireGuard VPN protocol? Binance receives the ban hammer from UK’s FCA Fired by algorithm: The future’s here and it’s a robot wearing a white collar Second colossal Linkedin...

Microsoft exec reveals “routine” secrecy orders from government investigators

Microsoft executive Tom Burt told Congressional lawmakers Wednesday that Federal law enforcement agencies send “routine” secret orders for customer information from the Seattle-based company, numbering anywhere from 2,400 to 3,500 such requests a year. “While the recent news about secret...

Security Bulletin: Resilient supports TLS1.2 ciphers that are not enabled for Perfect Forward Secrecy (PFS) (CVE-2021-20566)

Summary Resilient supports TLS1.2 ciphers that are not enabled for Perfect Forward Secrecy PFS. Such ciphers could allow an attacker who has recorded encrypted traffic and later obtains the server's key to decrypt highly sensitive information. Vulnerability Details CVEID: CVE-2021-20566...

US Postal Service Files Blockchain Voting Patent

The US Postal Service has filed a patent on a blockchain voting method: Abstract: A voting system can use the security of blockchain and the mail to provide a reliable voting system. A registered voter receives a computer readable code in the mail and confirms identity and confirms correct ballot...

US Postal Service Files Blockchain Voting Patent

The US Postal Service has filed a patent on a blockchain voting method: Abstract: A voting system can use the security of blockchain and the mail to provide a reliable voting system. A registered voter receives a computer readable code in the mail and confirms identity and confirms correct ballot...

Taking Transport Layer Security (TLS) to the next level with TLS 1.3

Transport Layer Security TLS 1.3 is now enabled by default on Windows 10 Insider Preview builds, starting with Build 20170, the first step in a broader rollout to Windows 10 systems. TLS 1.3 is the latest version of the internet’s most deployed security protocol, which encrypts data to provide a...

Return Of Bleichenbacher's Oracle Threat

ROBOT is the return of a 19-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server. Recent assessments: busterb at May 09, 2019 5:57pm UTC reported: The details are pretty heavily documented on robotattack.org, so no need to...

More on Law Enforcement Backdoor Demands

The Carnegie Endowment for International Peace and Princeton University's Center for Information Technology Policy convened an Encryption Working Group to attempt progress on the "going dark" debate. They have released their report: "Moving the Encryption Policy Conversation Forward. The main...

Cryptographic Update in Citrix Workspace App for Android

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Objective This feature is an important change to the secure communication protocol. Cipher suites wi...

SSL/TLS Forward Secrecy Cipher Suites Not Supported

The remote host use at least one SSL/TLS ciphers that does not offer forward secrecy FS also known as perfect forward secrecy PFS. It's a feature that provides assurances the session keys will not be compromised even if the server's private key is compromised. No source data...

Vulnerabilities in the WPA3 Wi-Fi Security Protocol

Researchers have found several vulnerabilities in the WPA3 Wi-Fi security protocol: The design flaws we discovered can be divided in two categories. The first category consists of downgrade attacks against WPA3-capable devices, and the second category consists of weaknesses in the Dragonfly...

CVE-2019-9191

The ETSI Enterprise Transport Security ETS, formerly known as eTLS protocol does not provide per-session forward secrecy...

Design/Logic Flaw

The ETSI Enterprise Transport Security ETS, formerly known as eTLS protocol does not provide per-session forward secrecy...

CVE-2019-9191

Technical details about CVE-2019-9191 are not publicly disclosed in the provided documents. No affected products, versions, or fixes are specified here. Monitor for updates to obtain concrete information.

CVE-2019-9191

The ETSI Enterprise Transport Security ETS, formerly known as eTLS protocol does not provide per-session forward secrecy...

Phishers Target Anti-Money Laundering Officers at U.S. Credit Unions

A highly targeted, malware-laced phishing campaign landed in the inboxes of multiple credit unions last week. The missives are raising eyebrows because they were sent only to specific anti-money laundering contacts at credit unions, and many credit union sources say they suspect the non-public da...

Critical Zcash Bug Could Have Allowed 'Infinite Counterfeit' Cryptocurrency

The developers behind the privacy-minded Zcash cryptocurrency have recently discovered and patched a highly dangerous vulnerability in the most secretive way that could have allowed an attacker to coin an infinite number of Zcash ZEC. Yes, infinite… like a never-ending source of money. Launched i...