cert/cc – PossibleThreat Articles

When Your Smart ID Card Reader Comes With Malware

May 17, 2022 0 Comments A Little Sunshine, cac reader, cert/cc, david dixon, michael danberry, militarycac.com, saicoo, The Coming Storm, u.s. general services administration, will dormann

Credit to Author: BrianKrebs| Date: Wed, 18 May 2022 01:07:59 +0000

Millions of U.S. government employees and contractors have been issued a secure smart ID card that enables physical access to buildings and controlled spaces, and provides access to government computer networks and systems at the cardholder’s appropriate security level. But many government employees aren’t issued an approved card reader device that lets them use these cards at home or remotely, and so turn to low-cost readers they find online. What could go wrong? Here’s one example.

Independent Krebs Security

Zyxel Fixes 0day in Network Storage Devices

February 24, 2020 0 Comments 0day, 500mhz, alex holden, cert coordination center, cert/cc, cve-2020-9054, dhs, emotet, Hold Security, Latest Warnings, Ransomware, The Coming Storm, Time to Patch, zero day, zyxel communications corp.

Credit to Author: BrianKrebs| Date: Mon, 24 Feb 2020 17:13:11 +0000

Networking hardware vendor Zyxel today released an update to fix a critical flaw in many of its network attached storage (NAS) devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the company that precise instructions for exploiting the vulnerability were being sold for $20,000 in the cybercrime underground. Based in Taiwan, Zyxel Communications Corp. (a.k.a “ZyXEL”) is a maker of networking devices, including Wi-Fi routers, NAS products and hardware firewalls. The company has roughly 1,500 employees and boasts some 100 million devices deployed worldwide. While in many respects the class of vulnerability addressed in this story is depressingly common among Internet of Things (IoT) devices, the flaw is notable because it has attracted the interest of groups specializing in deploying ransomware at scale.

Independent Krebs Security

Cryptic Rumblings Ahead of First 2020 Patch Tuesday

January 13, 2020 0 Comments anne neuberger, cert coordination center, cert/cc, crypt32.dll, Microsoft, microsoft cryptoapi, National Security Agency, NSA, patch tuesday january 2020, Time to Patch, will dormann, Windows

Credit to Author: BrianKrebs| Date: Mon, 13 Jan 2020 22:17:47 +0000

Sources tell KrebsOnSecurity that Microsoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows. Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S. military and to other high-value customers/targets that manage key Internet infrastructure, and that those organizations have been asked to sign agreements preventing them from disclosing details of the flaw prior to Jan. 14, the first Patch Tuesday of 2020.

Security Sophos

Office for Mac 2011 users warned about SYLK file format

November 5, 2019 0 Comments Apple, cert/cc, mac, Microsoft, Microsoft Office, Operating Systems, security threats, sylk, Technologies, vulnerability, Windows, xml macro

Credit to Author: John E Dunn| Date: Tue, 05 Nov 2019 17:14:21 +0000

Still running Office 2011 on a Mac? If so, there are at least two reasons why that might not be a good idea.<img src=”http://feeds.feedburner.com/~r/nakedsecurity/~4/HjBh551ovHI” height=”1″ width=”1″ alt=””/>