For 20 years a small two person firm in Ohio has licensed their TCP/IP software stack for use in embedded systems and IoT devices – from printers to medical devices. In June a collection of 19 vulnerabilities in this software was disclosed – affecting millions of devices from 50 different vendors. The collection of vulnerabilitiesRead more
Blog
A Zero-Day Remote Code Execution vulnerability affects 79 different Netgear routers With the significant increase in home-working due to the COVID pandemic, the security of home workers’ connectivity is under scrutiny. Security researchers have detailed a serious vulnerability in the firmware of many Netgear routers popular in small and home office set-ups. The vulnerability existsRead more
Verizon has published their 13th annual Data Breach Investigations Report – and it focuses on security incidents and breaches that occurred during 2019. The 2020 DBIR analysed 157,525 incidents, 32,002 in detail and confirmed 3950 breaches in 81 countries. Although the scope is global, half of the incidents in the data come from North AmericaRead more
VideoLAN has released a patch for their popular VLC Media player software to resolve a remote code execution vulnerability The VLC open source media player is widely used in domestic and enterprise environments for playback of all kinds of video files and digital signage applications. In a security bulletin, the developer state that: If successful, a maliciousRead more
In June 2020 Microsoft’s Patch Tuesday fixes a record 129 defects and vulnerabilities in its software – with a further 19 patches in the June Microsoft Office patch bundle. This continues a recent trend of ever-increasing numbers of patches included in the monthly updates from Microsoft (the two previous highest number of patches were inRead more
April’s patch Tuesday release from Microsoft includes fixes for three zero-day vulnerabilities in Windows that are under active attack. CVE-2020-1020 is a flaw in the Windows Adobe Type Manager Library. According to Microsoft: For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely. For systems running Windows 10,Read more
Microsoft warns that attackers are targeting two zero-day remote code execution vulnerabilities that exist in all versions of Windows – and a fix is not expected until the April patch Tuesday. The vulnerabilities exist in the Adobe Type Manager library which is a standard Windows component used primarily by Windows Explorer to display previews ofRead more
Most Android devices receive security updates for only 2 years from release – yet can remain on sale for much longer than that. Which means it is possible to by a brand new Android phone today that is already too old to receive security updates. When considering which smartphones and tablets to deploy to staff,Read more
A serious vulnerability, dubbed Ghostcat, has been discovered in Apache Tomcat and criminals are already trying to exploit it. Tomcat is one of the most popular Java application servers, with over 800k active installations visible on the web. According to the researchers who discovered the bug at Chaitin Tech: Due to a flaw in theRead more
Kr00k is a serious Wi-Fi vulnerability which can trick a device to retransmit the last 32k of encrypted traffic with an encryption key of all zeros. The flaw affects devices using Wi-Fi chips from Broadcom and Cypress including Apple devices, Amazon Echo and Google Nexus devices. The bug can be triggered when a device disconnectsRead more
