Design/Logic Flaw

An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access and consequently produce a...

CVE-2021-3011

An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access and consequently produce a...

CVE-2021-3011

The CVE-2021-3011 family describes an electromagnetic-wave side-channel vulnerability in NXP SmartMX/P5x security microcontrollers and A7x secure authentication microcontrollers, affecting CryptoLib up to v2.9. The issue enables extraction of the ECDSA private key with extensive physical access, ...

kernel security and bug fix update

2.6.32-754.33.1.OL6 - Update genkey bug 25599697 2.6.32-754.33.1 - message scsi: mptscsih: Fix read sense data size Tomas Henzl 1824907 2.6.32-754.32.1 - wireless libertas: make lbsibssjoinexisting return error code on rates overflow Jarod Wilson 1776569 - wireless libertas: don't exit from...

CVE-2020-12142

IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative...

OpenSSH now supports FIDO U2F security keys for 2-factor authentication

Here's excellent news for sysadmins. You can now use a physical security key as hardware-based two-factor authentication to securely log into a remote system via SSH protocol. OpenSSH, one of the most widely used open-source implementations of the Secure Shell SSH Protocol, yesterday announced th...

Google's Giving Out Security Keys to Help Protect Campaigns

Candidates can also get trained up on how to use Advanced Protection to keep their accounts safe...

Google Account Security Keys Launch for iPhone

Google has extended its Advanced Protection Program for account security to the iPhone platform, aimed at those that are the most-targeted by cybercriminals: Members of political campaign teams, journalists, activists, executives, employees in regulated industries such as finance or government, a...

The vulnerability of the buffer in the dev.c software for working with YubiKey security keys allows a perpetrator to execute arbitrary code.

The vulnerability of the buffer in the dev.c software for working with YubiKey security keys is related to the execution of operations beyond the boundaries of the memory buffer. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code...

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection system lies in the lack of protection for operational data, allowing attackers to obtain the SSL/TLS connection private keys.

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection Appliance lies in the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to obtain the SSL/TLS connection secrets...

Yubico Security Keys with a Crypto Flaw

Wow, is this an embarrassing bug: Yubico is recalling a line of security keys used by the U.S. government due to a firmware flaw. The company issued a security advisory today that warned of an issue in YubiKey FIPS Series devices with firmware versions 4.4.2 and 4.4.4 that reduced the randomness ...

Bluetooth Low Energy Advisory

Executive Summary Microsoft is aware of an issue that affects the Bluetooth Low Energy BLE version of FIDO Security Keys. Due to a misconfiguration in the Bluetooth pairing protocols, it is possible for an attacker who is physically close to a user at the moment he/she uses the security key to...

Bluetooth Flaw Found in Google Titan Security Keys; Get Free Replacement

A team of security researchers at Microsoft discovered a potentially serious vulnerability in the Bluetooth-supported version of Google's Titan Security Keys that could not be patched with a software update. However, users do not need to worry as Google has announced to offer a free replacement f...

About the security content of iOS 12.3

About the security content of iOS 12.3 This document describes the security content of iOS 12.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recen...

About the security content of tvOS 12.3

About the security content of tvOS 12.3 This document describes the security content of tvOS 12.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

On Security Tokens

Mark Risher of Google extols the virtues of security keys: I'll say it again for the people in the back: with Security Keys, instead of the user needing to verify the site, the site has to prove itself to the key. Good security these days is about human factors; we have to take the onus off of th...

Android 7.0+ Phones Can Now Double as Google Security Keys

Google this week made it easier for Android users to enable strong 2-factor authentication 2FA when logging into Google's various services. The company announced that all phones running Android 7.0 and higher can now be used as Security Keys, an additional authentication layer that helps thwart...

Android Gets FIDO2 Certification—Now Supports Secure Passwordless Logins

Great news. If you have already installed the latest update of Google Play Services released earlier today, and your Android device is running Android version 7.0 Nougat or above—Congratulations! Your device is now FIDO2 Certified. Are you thinking… what the heck that actually means? It means,...

Android Gets FIDO2 Certification—Now Supports Secure Passwordless Logins

Great news. If you have already installed the latest update of Google Play Services released earlier today, and your Android device is running Android version 7.0 Nougat or above—Congratulations! Your device is now FIDO2 Certified. Are you thinking… what the heck that actually means? It means,...

CVE-2017-18332

Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 71...