bug

Auto Added by WPeMatico

'Critical' T-Mobile Bug Allowed Hackers To Hijack Users' Accounts

'Critical' T-Mobile Bug Allowed Hackers To Hijack Users' Accounts

An anonymous reader quotes a report from Motherboard: The vulnerability was found and reported by a security researcher on December 19 of last year, but it hasn’t been revealed until now. Within a day, T-Mobile classified it as “critical,” patched the bug, and gave the researcher a $5,000 reward. That’s good news, but it’s unclear how long the site was vulnerable and whether any malicious hackers found and exploited the bug before it was fixed. The newly disclosed bug allowed hackers to log into T-Mobile’s account website as any customer. “It’s literally like logging into your account and then stepping away from the keyboard and letting the attacker sit down,” Scott Helme, a security researcher who reviewed the bug report, told Motherboard in an online chat. Shortly after we published this story, a T-Mobile spokesperson sent us a statement: “This bug was confidentially reported through our Bug Bounty program in December and fixed within a matter of hours,” the emailed statement read. “We found no evidence of customer information being compromised.”

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, bug
Botched npm Update Crashes Linux Systems, Forces Users to Reinstall

Botched npm Update Crashes Linux Systems, Forces Users to Reinstall

Catalin Cimpanu, reporting for BleepingComputer: A bug in npm (Node Package Manager), the most widely used JavaScript package manager, will change ownership of crucial Linux system folders, such as /etc, /usr, /boot. Changing ownership of these files either crashes the system, various local apps, or prevents the system from booting, according to reports from users who installed npm v5.7.0. — the buggy npm update. Users who installed this update — mostly developers and software engineers — will likely have to reinstall their system from scratch or restore from a previous system image.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, bug
Skype Can't Fix a Nasty Security Bug Without a Massive Code Rewrite

Skype Can't Fix a Nasty Security Bug Without a Massive Code Rewrite

ZDNet reports of a security flaw in Skype’s updater process that “can allow an attacker to gain system-level privileges to a vulnerable computer.” If the bug is exploited, it “can escalate a local unprivileged user to the full ‘system’ level rights — granting them access to every corner of the operating system.” What’s worse is that Microsoft, which owns Skype, won’t fix the flaw because it would require the updater to go through “a large code revision.” Instead, Microsoft is putting all its resources on building an altogether new client. From the report: Security researcher Stefan Kanthak found that the Skype update installer could be exploited with a DLL hijacking technique, which allows an attacker to trick an application into drawing malicious code instead of the correct library. An attacker can download a malicious DLL into a user-accessible temporary folder and rename it to an existing DLL that can be modified by an unprivileged user, like UXTheme.dll. The bug works because the malicious DLL is found first when the app searches for the DLL it needs. Once installed, Skype uses its own built-in updater to keep the software up to date. When that updater runs, it uses another executable file to run the update, which is vulnerable to the hijacking. The attack reads on the clunky side, but Kanthak told ZDNet in an email that the attack could be easily weaponized. He explained, providing two command line examples, how a script or malware could remotely transfer a malicious DLL into that temporary folder.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, bug
A Flaw In Hotspot Shield Can Expose VPN Users, Locations

A Flaw In Hotspot Shield Can Expose VPN Users, Locations

An anonymous reader quotes a report from ZDNet: A security researcher has found a way to identify users of Hotspot Shield, a popular free virtual private network service that promises its users anonymity and privacy. Hotspot Shield, developed by AnchorFree, has an estimated 500 million users around the world relying on its privacy service. By bouncing a user’s internet and browsing traffic through its own encrypted pipes, the service makes it harder for others to identify individual users and eavesdrop on their browsing habits. But an information disclosure bug in the privacy service results in a leak of user data, such as which country the user is located, and the user’s Wi-Fi network name, if connected. That information leak can be used to narrow down users and their location by correlating Wi-Fi network name with public and readily available data.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, bug
GE Fixing Bug in Software After Warning About Power Grid Hacks

GE Fixing Bug in Software After Warning About Power Grid Hacks

General Electric said on Wednesday it is fixing a bug in software used to control the flow of electricity in a utility’s power systems after researchers found that hackers could shut down parts of an electric grid. From a report: The vulnerability could enable attackers to gain remote control of GE protection relays, enabling them to “disconnect sectors of the power grid at will,” according to an abstract posted late last week on the Black Hat security conference website. Protection relays are circuit breakers that utilities program to open and halt power transmission when dangerous conditions surface.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, bug
Linux 4.11 Delayed For a Week

Linux 4.11 Delayed For a Week

Linux kernel creator Linus Torvalds said over the weekend that v4.11 version of Linux has hit a speed bump in the form of “NVMe power management that apparently causes problems on some machines.” The Register adds: “It’s not entirely clear what caused the [NVMe] issue (it wasn’t just limited to some NVMe hardware, but also particular platforms), but let’s test it.” Which sounds like a good idea, given that flash memory on the PCIe bus is increasingly mainstream. That problem and “a couple of really annoying” bugs mean that Torvalds has decided to do an eighth release candidate for Linux 4.11. “I did get fixes for the issues that popped up, so I could have released 4.11 as-is,” Torvalds wrote, “but it just doesn’t feel right.”

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, bug
IRS Warns Tax Info Leaked By US Financial Aid Site

IRS Warns Tax Info Leaked By US Financial Aid Site

“Hackers accessed the data of up to 100,000 people through a tool that helps students get financial aid,” writes CNN. An anonymous reader quotes their report:

IRS Commissioner John Koskinen testified before the Senate Finance Committee Thursday that a breach had been discovered in the fall. In September, he said, his agency discovered that fraudsters could use someone’s personal data to fill out a financial aid application, and the “Data Retrieval Tool” would populate the application with tax information. That information could be used to file false tax returns. The commissioner said fewer than 8,000 of these returns were processed, and refunds were issued totaling $30 million…
In October, the IRS told the Department of Education that the system could be abused by criminals, but because up to 15 million people use the system for convenience, they kept it available. However, in February, the agency witnessed a pattern of fraudulent activity, and it shut down the automated tool in March.

Now financial aid seekers will have to manually enter their parents’ reported income from previous tax years — at least until a new version of the tool comes online next October. In the meantime, the IRS is alerting 100,000 users who started an application but didn’t finish it, warning them that their tax information may have been compromised.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, bug