A major internet subsea fiber cable in the South of France was severed yesterday at 20:30 UTC, causing connectivity problems in Europe, Asia, and the United States, including data packet losses and increased website response latency.
Cloud security company Zscaler reports that they made routing adjustments to mitigate the impact. However, users still face problems due to app and content providers routing traffic through the impacted paths.
“Zscaler is working with the content providers to have them influence their portion of the path,” reads a notice from Zscaler.
With Executive Order 14028, a large regulatory push toward mandating the production of a software bill of materials (SBOM) began. As this new buzzword spreads, you’d think it was a miracle cure for securing the software supply chain. Conceptually, it makes sense — knowing what is in a product is a reasonable expectation. However, it is important to understand what exactly an SBOM is and whether or not it can objectively be useful as a security tool.
SBOMs are meant to be something like a nutrition label on the back of a grocery store item listing all of the ingredients that went into making the product. While there currently is no official SBOM standard, a few guideline formats have emerged as top candidates. By far, the most popular is the Software Data Package Exchange (SPDX), sponsored by the Linux Foundation.
SPDX, as with most other formats, attempts to provide a common way to represent basic information about the ingredients that go into the production of software: names, versions, hashes, ecosystems, ancillary data like known flaws and license information, and relevant external assets. However, software is not as simple as a box of cereal, and there is no equivalent to the Food and Drug Administration enforcing compliance to any recommended guidelines.
Sensitive information for some Microsoft customers were exposed by a misconfigured server, Microsoft Security Response Center said on Wednesday. The misconfigured endpoint was accessible on the Internet and did not require authentication.
The exposed information included names, email addresses, email content, company name, phone numbers, and files “relating to business between a customer and Microsoft or an authorized Microsoft partner,” the company said. The endpoint has already been secured to require authentication, and affected customers have been notified.
“This misconfiguration resulted in the potential for unauthenticated access to some business transaction data corresponding to interactions between Microsoft and prospective customers, such as the planning or potential implementation and provisioning of Microsoft services,” Microsoft said, noting that there is no indication that customer accounts or systems had been compromised.
Of their yearly balance of about €3 million, nearly the entirely is spent on the main congress and other events and conferences. Over the last few years, addressing geography, generation, and gender equities (3G), the International Astronautical Federation established itself as the youngest and most diverse space organization in the world. Over the same period, the IAF President Pascale Ehrenfreund, has pushed her excellent Global Innovation Agenda which “has brought emerging countries to our space family through conferences, expanded work with partner organizations, and created innovative systems for sharing information among members” [1].In his first newsletter [2] the incumbent President, Clay Mowry, communicated the IAF agenda for next 3 years: “Sustainability, Investment and Security”. According to Mowry, “the IAF should seek to influence conversations around the sustainability of the space environment. Securing orbits, spacecraft, frequencies, and physical resources is critical to the future viability of space exploration.” And: “The coming three years will see a shift towards the commercial development of low Earth orbit and major push to field systems in lunar orbits and on the surface of the Moon. We must be prepared to tackle the challenges of growing investment in the space sector head-on. Security refers to the freedom to operate safely in the space domain. Without it, investors and nation states can hardly be expected to pour the continued resources and attention required to secure humanity’s future beyond Earth.”
An agenda oriented to civilian space development? We may say yes, moderately. We want to encourage and further develop this orientation, and we’ll do our best to move IAF more on the side of human expansion into the Geo-Lunar space and the Solar System.
Security researchers have discovered an npm timing attack that reveals the names of private packages so threat actors can release malicious clones publicly to trick developers into using them instead.
The attack relies on a small time difference in the return of a “404 Not Found” error when searching for a private compared to a non-existent package in the repository.
While the response time difference is only a few hundred milliseconds, it is enough to determine whether a private package exists to perform package impersonation attacks.
Signal says it will start to phase out SMS and MMS message support from its Android app to streamline the user experience and prioritize security and privacy.
While this announcement may surprise those who don’t know Signal can also be used to manage this type of text message, the Signal for Android app could be configured as the default SMS/MMS app since its beginning as TextSecure, an app that used the Axolotl Ratchet protocol.
“We have now reached the point where SMS support no longer makes sense. In order to enable a more streamlined Signal experience, we are starting to phase out SMS support from the Android app,” the company said in a blog post published today.
Providing “impeccable” security at the intersection of innovation, technology, and adventure sports.
Adrenaline junkies, thrill seekers, and newbies, you might want to add experiencing a first-of-its-kind giant swing backed by Artificial Intelligence (AI) to your bucket list.
Learn how your company can create applications to automate tasks and generate further efficiencies through low-code/no-code tools on November 9 at the virtual Low-Code/No-Code Summit. Register here.
With the increasing digitization of services across multiple industries, large corporations are pushing for new security measures to keep their customers’ documents and sensitive information secure. Among these measures are passwordless logins, with new authentication methods adding an extra layer of data protection.
The transition to passwordless logins is undeniable, with approximately 60% of large and global enterprises and 90% of midsize enterprises predicted to adopt passwordless methods in at least 50% of use cases, according to a recent Gartner study. This comes as no surprise, as security problems associated with password-only authentication are among the digital world’s biggest vulnerabilities. Consumers are often tempted to reuse passwords across different services due to the difficulty of managing so many passwords.
Twelve new security flaws impacting various chipsets were disclosed in this month’s security advisory for Qualcomm’s devices, two of which have been given a critical severity rating. Two significant flaws in Qualcomm chipsets have been identified that might allow malicious payloads to installed remotely on the Android devices.
The first vulnerability, identified as CVE-2022–25748 (CVSS score 9.8), affects Qualcomm’s WLAN component and is described as a “Integer Overflow to Buffer Overflow during parsing GTK frames”. If exploited, this issue might result in memory corruption and remote code execution. This vulnerability impact all smart devices that use the Qualcomm Snapdragon APQ, CSRA, IPQ, MDM, MSM, QCA, WSA, WCN, WCD, SW, SM, SDX, SD, SA, QRB, QCS, QCN, and more series.
