Browser makers build bulwarks to stump Spectre attacks

Credit to Author: Gregg Keizer| Date: Sat, 06 Jan 2018 12:58:00 -0800

Amid the panicked response this week to the news of significant, though not-yet-exploited, vulnerabilities in the vast bulk of the world’s microprocessors, it went almost unnoticed that most browser makers responded by updating their wares in the hope of fending off possible web-based attacks.

The Google-driven revelations – it was members of the search firm’s Project Zero security team who identified the multiple flaws in processors designed by Intel, AMD and ARM – were to go public next week, on Jan. 9, this month’s Patch Tuesday. At that time, a coordinated effort by multiple vendors, from OS developers to silicon makers, was to debut with patches to protect, as best could be done without replacing the CPU itself, systems against flaws grouped under the umbrella terms of Meltdown and Spectre. That plan went out the window when leaks started to circulate earlier this week.

To read this article in full, please click here

Read more

Interesting disguise employed by new Mac malware HiddenLotus

Credit to Author: Thomas Reed| Date: Fri, 08 Dec 2017 16:00:22 +0000

A new piece of Mac malware called HiddenLotus is using a clever new trick to fool users into opening it.

Categories:

Tags:

(Read more…)

The post Interesting disguise employed by new Mac malware HiddenLotus appeared first on Malwarebytes Labs.

Read more

Yet another flaw in Apple’s “iamroot” bug fix

Credit to Author: Thomas Reed| Date: Mon, 04 Dec 2017 17:05:12 +0000

Flaws in Apple’s response to the “iamroot” vulnerability show that some systems can remain vulnerable even after applying the patch.

Categories:

Tags:

(Read more…)

The post Yet another flaw in Apple’s “iamroot” bug fix appeared first on Malwarebytes Labs.

Read more

Serious macOS vulnerability exposes the root user

Credit to Author: Thomas Reed| Date: Wed, 29 Nov 2017 16:00:02 +0000

A major macOS vulnerability in High Sierra was reported. Anyone can log in as “root” with an empty password. Learn more.

Categories:

Tags:

(Read more…)

The post Serious macOS vulnerability exposes the root user appeared first on Malwarebytes Labs.

Read more

Apple putties Krack in macOS, iOS

Credit to Author: Gregg Keizer| Date: Tue, 31 Oct 2017 17:06:00 -0700

Apple on Tuesday patched both macOS and iOS against serious vulnerabilities in the Wi-Fi Protected Access II (WPA2) protocol used to secure wireless networks.

Information about the flaws, dubbed “Krack” by their Belgian discoverer, made news earlier in the month when security researcher Mathy Vanhoef announced weaknesses in WPA2 that could allow criminals to read information transmitted over a Wi-Fi network thought to be encrypted.

Krack, said Vanhoef, stood for “Key Reinstallation Attacks.”

The macOS 10.13.1 and iOS 11.1 updates addressed the Krack vulnerabilities, as well as a slew of others. The Mac update fixed a whopping 148 flaws, while the iPhone and iPad update quashed 20 bugs. The bulk of the macOS patches – 90 of the total – plugged holes in “tcpdump,” an open-source network packet analyzer that’s baked into the operating system.

To read this article in full or to leave a comment, please click here

Read more

Keychain vulnerability in macOS

Credit to Author: Thomas Reed| Date: Tue, 26 Sep 2017 18:11:06 +0000

On Monday, Patrick Wardle, a respected security researcher at Synack and owner of Objective-See, sent a tweet about a keychain vulnerability he had found in macOS High Sierra. As his tweet showed, it is possible for a malicious app to extract, and then exfiltrate, keychain data from High Sierra, with passwords clearly exposed in plain text.

Categories:

Tags:

(Read more…)

The post Keychain vulnerability in macOS appeared first on Malwarebytes Labs.

Read more