Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror

Submission + - 10-Year-Old Open Source Flaw Could Affect 'Almost Every Apple Device' (thecyberexpress.com)

storagedude writes: Some of the most widely used web and social media applications could be vulnerable to three newly discovered CocoaPods vulnerabilities — including potentially millions of Apple devices, according to a report by The Cyber Express, the news service of threat intelligence vendor Cyble Inc.

E.V.A Information Security researchers reported three vulnerabilities in the open source CocoaPods dependency manager that could allow malicious actors to take over thousands of unclaimed pods and insert malicious code into many of the most popular iOS and MacOS applications, potentially affecting "almost every Apple device."

The researchers found vulnerable code in applications provided by Meta (Facebook, Whatsapp), Apple (Safari, AppleTV, Xcode), and Microsoft (Teams); as well as in TikTok, Snapchat, Amazon, LinkedIn, Netflix, Okta, Yahoo, Zynga, and many more.

The vulnerabilities have been patched, yet the researchers still found 685 Pods “that had an explicit dependency using an orphaned Pod; doubtless there are hundreds or thousands more in proprietary codebases.”

The newly discovered vulnerabilities – one of which (CVE-2024-38366) received a 10 out of 10 criticality score – actually date from a May 2014 CocoaPods migration to a new 'Trunk’ server, which left 1,866 orphaned pods that owners never reclaimed.

While the vulnerabilities have been patched, the work for developers and DevOps teams that used CocoaPods before October 2023 is just getting started.

“Developers and DevOps teams that have used CocoaPods in recent years should verify the integrity of open source dependencies used in their application code,” the E.V.A researchers said.

Submission + - Microsoft says your content is "freeware" to steal (windowscentral.com)

joshuark writes: Microsoft's CEO of AI Mustafa Suleymansaid that content on the open web can be copied and used to create new content. The CEO spoke with CNBC's Andrew Ross Sorkin at the Aspen Ideas Festival earlier this week.

"With respect to content that is already on the open web, the social contract of that content since the 90s has been that it is fair use. Anyone can copy it, recreate with it, reproduce with it. That has been freeware, if you like. That's been the understanding," said Suleyman.

Microsoft and OpenAI have been on the receiving end of several copyright infringement lawsuits. Eight US-based publishers filed suits against OpenAI and Microsoft, joining The New York Times, which already had an ongoing suit.

Submission + - regreSSHion: Unauthenticated Remote Root Vulnerability in OpenSSH Server (qualys.com)

Artem S. Tashkinov writes: The Qualys Threat Research Unit (TRU) has discovered a Remote Unauthenticated Code Execution (RCE) vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems. CVE assigned to this vulnerability is CVE-2024-6387. The vulnerability, which is a signal handler race condition in OpenSSH’s server (sshd), allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems; that presents a significant security risk. This race condition affects sshd in its default configuration.

Based on searches using Censys and Shodan, we have identified over 14 million potentially vulnerable OpenSSH server instances exposed to the Internet. Anonymized data from Qualys CSAM 3.0 with External Attack Surface Management data reveals that approximately 700,000 external internet-facing instances are vulnerable. This accounts for 31% of all internet-facing instances with OpenSSH in our global customer base.

In our security analysis, we identified that this vulnerability is a regression of the previously patched vulnerability CVE-2006-5051, which was reported in 2006. A regression in this context means that a flaw, once fixed, has reappeared in a subsequent software release, typically due to changes or updates that inadvertently reintroduce the issue. This incident highlights the crucial role of thorough regression testing to prevent the reintroduction of known vulnerabilities into the environment. This regression was introduced in October 2020 (OpenSSH 8.5p1).

Submission + - Technical Analysis of Pegasus Spyware

Mirnotoriety writes: An Investigation Into Highly Sophisticated Espionage Software

Executive Summary: “This report is an in-depth technical look at a targeted espionage attack being actively leveraged against an undetermined number of mobile users around the world. Lookout researchers have done deep analysis on a live iOS sample of the malware, detailed in this report. Citizen Lab’s investigation links the software and infrastructure to that of NSO Group which offers a product called Pegasus solution.”

Comment No alternative mean a lot didn't really speak (Score 1) 397

If you could show numbers for phone with replaceable parts and show that it didn't sell, sure I would agree with you but since there's none on the market you just have no idea what the market is for those that want it, only the market for those that don't care. Sure it's popular but it do not mean that you're not missing out on even more. So no, not anything reliable. Personally, the only smartphone I bought had a replaceable battery, an SD card slot and a physical (landscape, sorry Blackberry) keyboard and of course it's old and I would like to change it but until someone offer an interesting product they just won't get my money. You're probably right that I'm alone in this but until you have real numbers to compare to you just don't know.

Comment Re:CHEAP (Score 1) 183

Sorry for the late reply, I thought slashdot would send me an email on reply (yes, the setting is still enabled, not sure what happened).

But no, the "walking space" argument do not work because there exists cubicle with wall on just the desk area - it do not takes any walkway space, and otherwise you could still have 3 walls but have it stop at the back of your butt when you're sat at your desk, and the space saved would be pretty small. Even in a high rent city, how much would you be saving, really?

Yes, you save on the furniture cost by having a huge table vs individual desk, but that is a fixed cost and not a recurring one. Same with the "reconfiguration" cost, it should really not happen frequently, so is not an argument either.

The gain of having the wall is of course to stop noise and visual distraction and I'm pretty sure it's well worth the minimal saving you're getting with open space office.

Comment Re:Speed Dial (Score 1) 85

I think you missed the part where some number of the old opera guys started a new browser called Vivaldi. Opera wasn't really the same opera since a little while. It's not that surprising they're selling it I guess.

Vivaldi was still pretty "beta" until recently but now it's getting pretty stable and include a lot of must have feature from old opera. Vivaldi is pretty much the replacement for old opera, not the browser being sold. It already has a lot, if not most, features from old opera (including speed dial) so you should probably check it out. The thing I miss the most right now is having access to my bookmark from the menu (there is no bookmark entry in the menu) but it's not the end of the world (it will probably be there eventually). Really, most of it is already there.

Comment Re:Dear Browser Manufaturers. (Score 1) 95

Obvious troll but I'll bite.

Opera (old one I assume since you used "was") compared to Apple??? What might make you say that? Did you ever use it for more than 5 minutes?

To the contrary, (old) Opera was more like the old (XP-days) Microsoft with relatively lots of options and easy to use.

The *new* opera is a lot more like Apple (or modern Microsoft, or Google): Here is the new "correct", and *only*, way to use our product. Don't like it? Too bad, get another browser (they're all copying each others and won't have what you're looking for anyway). What do you mean different people might have different preferences/optimal usage? Insanity!

Slashdot Top Deals

How much net work could a network work, if a network could net work?

Working...