Microsoft has issued a critical security advisory concerning a backdoor vulnerability (CVE-2024-3094) found within the widely used XZ Utils file compressor. This major flaw, with a maximum severity score of 10.0 on the CVSS scale, affects several popular Linux distributions including Fedora, Kali Linux, OpenSUSE, and Alpine Linux. Potentially, this vulnerability could have had a widespread global impact.

Andres Freund was investigating a 500-millisecond delay in SSH connections

Thankfully, a Microsoft Linux developer, Andres Freund, stumbled upon the issue while investigating a suspicious 500-millisecond delay in SSH connections. He uncovered a malicious backdoor embedded within the XZ software itself.

At the time of writing, only four out of 63 security vendors on VirtusTotal are correctly flagging this exploit as harmful. This incident highlights the importance of vigilance, as many users might have overlooked the seemingly minor delay. It also brings to attention the potential vulnerability of open-source software to malicious actors.

If you’re concerned about your system’s safety, versions 5.6.0 and 5.6.1 of XZ Utils are confirmed to be compromised. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends using older, verified versions of the software as a precaution.

Several third-party tools can also help identify the vulnerability. Security firms Qualys and Binarly offer free scanners:

• Qualys: Look for VULNSIGS version 2.6.15-6, with the vulnerability ID (QID) “379548.”
• Binary: This free XZ backdoor scanner will display a message like “XZ malicious implant detected” if your system is affected.

RELATED:

• Tongue Gestures? Microsoft’s Future Products may Redefine Gesture Control (Or Not)
• Microsoft & OpenAI planning $100 billion supercomputer Stargate AI
• Lenovo Legion Y700 2023: Save $100 on this 8-inch gaming Android tablet
• Xiaomi Band 8 Genshin Impact custom edion get a huge discount.
• Best of MWC 2024: AI Phone, Transparent Laptop, 3D Tablet & More

(Via)

The post Microsoft Employee Discovers Critical Flaw in Linux Utility, Prevents Widespread Global Impact appeared first on Gizmochina.

Millions of developers and users are on alert as the popular code-sharing platform GitHub faces a large-scale attack. Security researchers at Apiiro have identified a concerning trend where malicious actors are targeting GitHub repositories, potentially compromising over 100,000 projects.

Massive Malware Campaign Targets Over 100,000 GitHub Repositories

The attack involves a technique called “malicious repository obfuscation” where attackers clone legitimate repositories, inject harmful code, and re-upload them to the platform. These tampered repositories can then be downloaded by unsuspecting users, potentially compromising their systems or infecting them with malware.

The report by Apiiro highlights several factors making GitHub vulnerable to such attacks. The platform’s ease of use, readily available APIs, and the presence of numerous hidden repositories create an ideal environment for attackers to launch “watering hole attacks.”

In these attacks, attackers target popular and frequently downloaded repositories. They inject malicious code into these repositories and then re-upload them. To further amplify their reach, attackers create numerous fake forks of the compromised repositories using automated methods. These fake forks can then be spread through social media, online forums, and other channels, tricking users into downloading the malicious versions.

The report acknowledges that GitHub has been notified and has taken down most of the identified malicious repositories. However, the activity is ongoing, with attackers constantly attempting to inject harmful code. This ongoing struggle resembles a game of whack-a-mole, where GitHub plays catch-up, removing malicious code after it has already been uploaded, potentially putting users at risk.

The report further reveals that this attack campaign began in May 2023 and has been steadily growing. This continuous activity raises concerns that even more repositories and users could be compromised in the future. Developers and users are advised to exercise caution when downloading code from GitHub, especially from unfamiliar repositories. It’s crucial to verify the source and legitimacy of the code before integrating it into projects.

RELATED:

• Microsoft teams with Intel on 18A process chip development
• Older CPUs or PCs may lose out on future Windows 11 updates
• Best of MWC 2024: AI Phone, Transparent Laptop, 3D Tablet & More
• Big Discount: AOOSTAR R1 N100 NAS Mini PC Only For $159
• Get latest Oneplus 12 Phone for $699 on Geekwills

(Source)

The post Microsoft’s popular code-sharing platform GitHub under attack, potentially affecting millions appeared first on Gizmochina.

In a security setback Comcast, the parent company of Xfinity experienced a concerning incident where they fell victim to a vulnerability known as Citrix Bleed. This unfortunate event resulted in information belonging to 36 million Xfinity customers being exposed to hackers. The vulnerability, which was identified in Citrix networking devices commonly used by corporations had been exploited by cybercriminals since August.

It has been confirmed that the hackers took advantage of the Citrix Bleed flaw and managed to access systems between October 16 and October 19. However, it was not, until October 25 that the breach was discovered. The compromised customer data includes usernames hashed passwords, names, contact information, the four digits of social security numbers dates of birth well as secret questions and answers.

Despite Citrix releasing patches in October to address the vulnerability issue it is reported that Comcast took nine days to secure their network against this threat. In response to this incident, Xfinity is strongly urging customers to change their passwords especially if they have been using the same password across multiple platforms. Additionally, Xfinity advises customers to remain vigilant against phishing attempts and is implementing prompts for password changes upon customer login. They are also encouraging customers to utilize two-factor authentication for added security.

Xfinity has promptly reported this incident to law enforcement agencies. Is currently undergoing data analysis, for further investigation. Customers can find information in an official notice sent out by Xfinity which stresses the importance of taking proactive measures in order to mitigate potential risks.

RELATED:

• Samsung’s latest data breach exposes customer information for over a year
• Intel Secures $3.2 Billion Grant from Israel for $25 Billion Chip Plant Expansion
• HUAWEI FreeClip Open-Ear Earbuds Review: Clip-on Comfort with C-bridge Design
• Giztop’s Christmas Holiday Savings: Unwrap Joy with Exclusive Discount
• Epic Games Store Gifts 17 Free Games – Grab Human Resource Machine for Free on Epic Store Now
• Aula S98 mechanical keyboard with Gasket, triple-mode connectivity launched in China for 139 Yuan ($19)
• Rockstar Games’ Bold Leap into Medieval Realms with Project Ethos

(via)

The post Comcast’s Xfinity Faces Data Breach: Citrix Bleed Vulnerability Exposes 36 Million Customers’ Information appeared first on Gizmochina.

Nintendo has announced that it has taken Mario Kart 8 and Splatoon offline due to security issues. The company posted a message on its website stating that urgent maintenance was required to fix a vulnerability related to online play. Nintendo has not yet provided an estimated time for when the network services will be restored. The company apologizes for any inconvenience caused by this situation.

According to Dataminer OatmealDome, the issue is “almost certainly” due to ENLBufferPwn. This exploit could allow an attacker to take control of a victim’s system by simply being matched with them in an online multiplayer game. It was previously found to be a problem in Mario Kart 7 on the 3DS and several other Switch games, including Mario Kart 8 Deluxe, Animal Crossing: New Horizons, Nintendo Switch Sports, Splatoon 2 and 3. However, Nintendo has already patched those titles to protect them against the exploit.

A video posted by YouTuber PabloMK7 showed ENLBufferPwn in action on Mario Kart 7. It allowed custom firmware to be inserted onto the targeted console, and it could have potentially been used to steal account or credit card information, as well as to record a victim using the 3DS’ mic and cameras.

Although it may disappoint those still playing the games on the discontinued Wii U system, it seems that Nintendo had little choice but to take the online features offline until the security issue is resolved. Nintendo takes its privacy issues quite seriously, and it doesn’t help that Mario Kart 8 was the biggest-selling game on the Wii U, with nearly 8.5 million copies sold. On the other hand, the original Splatoon sold almost 5 million copies.

The issue surfaced just a few weeks before March 27, as Nintendo is shutting down the Wii U and 3DS eShops. After that, owners of the systems will not be able to make purchases on the digital storefronts, but they will still be able to download titles they previously bought.

RELATED:

• Nintendo’s Latest Leak Hints at Cloud Gaming via Switch Online Service
• Nintendo Switch Overtakes Sony’s PS4 to Become the Third Best-Selling Console of All Time
• MWC 2023: Best Products & Announcements From Day 1

(Via)

The post Nintendo Takes Mario Kart 8 & Splatoon Offline Because of Security Exploit appeared first on Gizmochina.

The servers of Acer have just been hit with a major breach recently. This breach has lead to loss of important internal business information related to several millions of users in India.

According to a NotebookCheck report, the Taiwanese PC maker suffered from a major breach that has affected its after sales services systems. This marks the second major cyberattack that the company has faced this year. As of right now, Hacker group Desorden have claimed responsibility for the attack. The hacker group claimed that they have stolen 60GB worth of data, which includes customer information, corporate data, sensitive accounts, financial data, and audit data.

Furthermore, the breach also includes login details of Acer retailers and distributors in India as well. The hacker group has also stated that it will also offer the company the rights to verify the authenticity of the breach and the stolen data. Reportedly, the publicly available data of 10,000 individuals has been already available. This breach first took place on 5th October 2021, with the hackers claiming to also have acquired sensitive data of millions of Acer customers that it will release for a fee.

According to an official spokesperson from the company, We have recently detected an isolated attack on our local after-sales service system in India. Upon detection, we immediately initiated our security protocols and conducted a full scan of our systems. We are notifying all potentially affected customers in India. The incident has been reported to local law enforcement and the Indian Computer Emergency Response Team, and has no material impact to our operations and business continuity.”

RELATED:

• Acer Predator Gaming Projectors feature support for variable refresh rate
• Acer’s ConceptD 7 SpatialLabs Edition laptop allows one to see 3D content without glasses
• Acer Hummingbird Future Environmental Edition goes on sale in China; price starts at 4,899 yuan ($761)

The post Acer suffers from major security breach, affects millions of Indian users appeared first on Gizmochina.

A small group of hackers has managed to cause a security breach, which has affected hundreds of businesses. This includes the popular electric vehicle maker Tesla after hackers gained access to surveillance cameras from Verkada.

According to a Reuters report, the hacker group gained access to the live feed of the security cameras and even archived surveillance footage from hundreds of businesses. The group even managed to breach Tesla by gaining administrative access to the camera maker Verkada over the past two days, as per sources involved in the security breach incident. Tillie Kottmann, a Swedish software developer, shared screenshots on Twitter from inside a Tesla warehouse in California and an Alabama jail.

Kottman gained attention for finding security flaws in mobile applications and other systems. As per the software developer, the breach was to draw attention to the pervasive monitoring of people after having found login information for Verkada’s administrative tools publicly online earlier this week. Verkada has since acknowledged an intrusion and said that it has disabled all internal administrator accounts to prevent any unauthorized access.

As per an official statement “Our internal security team and external security firm are investigating the scale and scope of this issue, and we have notified law enforcement.” Notably, the hacker group could have used its access to control the camera gear to access other parts of the company’s networks with Tesla and even software makers Cloudflare and Okta, as per Kottman.

RELATED:

• Dashcam captures woman chasing after a summoned Tesla Model 3 thinking it was rolling away
• India pursues Tesla with incentives like cheaper production costs than China
• Tesla rival NIO offers EV with a record 700km range, raises competition in China

The post Tesla and hundreds more face security breach, hackers gain access of Verkada security cameras appeared first on Gizmochina.

OnePlus, the smartphone manufacturer, had publicly announced the second data breach in two years back in November 2019. Since then, the company has promised to launch a new bug bounty program by the end of the year 2019. The move was made to bump up security measures and prevent future breaches. Now, the company has finally announced that its bug bounty program is live.

For users that find any bug or vulnerabilities in the systems, they can submit it on OnePlus’s official website that features a new bug report section. Users must login first and apparently, the company will be creating and updating a leaderboard of top contributors. The company will even feature the top three contributors on the bug bounty’s main page as well.

In the about section of the bug bounty program, OnePlus promises to reward users that submit reports according to certain tiers.

• • Special cases: up to $7,000 (roughly 49,000 CNY)
  • Critical: $750–$1,500 (5,258-10,517 CNY)
  • High: $250–$750 (1,752-5,258 CNY)
  • Medium: $100–$250 (701-1752 CNY)
  • Low: $50–$100 (350-701 CNY)

Editor’s Pick: OnePlus 7 and OnePlus 7 Pro’ latest update brings back “Hide Notch” feature

The exact definition of the tiers are still uncertain, however, OnePlus states that the reward you may receive is, “determined based on vulnerabilities severity and actual business impact.” The company had previously announced that it would partner up with a world renowned security platform in December 2019. That is now confirmed to be the startup HackerOne.

The collaboration with HackerOne is starting as a pilot program which would see numerous select security researchers being invited to test against OnePlus’ systems. The company also mentioned that a public version of the same will be launched in 2020.

UP NEXT: Richard Yu: Huawei shipments to reach 230 million by the end of 2019

(Source,Via)

The post OnePlus to launch a Bug Bounty program, users can earn up to $7000 (49,000 CNY) appeared first on Gizmochina.

OnePlus’ customer data has been breached, yet again. The smartphone maker made an announcement a few hours back stating that some of its customer’s information like “name, contact number, email, and shipping address within certain orders” may have been exposed by the most recent data breach. However, information like payment information, passwords and accounts are safe.

OnePlus hasn’t given out an exact number of affected users, however, the company said that it has already sent out emails to the users whose data has been breached. If you were one of the affected customers, you should have received a mail similar to this sometime in the past couple of days. If you haven’t got an email from the company, then your data wasn’t breached.

Editor’s Pick: OnePlus 3 & 3T receive their Final Security update, ends official support

The official OnePlus website seems to be the point of the breach but the company assured that they have thoroughly inspected the website to ensure there are no similar security flaws. The company also adds that affected users ‘may receive spam and phishing emails as a result of this incident’.

This isn’t the first time OnePlus had a security breach. Last year, in January, credit card information of nearly 40,000 OnePlus customers was breached through the company’s OnePlus.net website. Unfortunately, the company has not revealed the scale of this particular breach.

Security breaches are never good for a company. However, the company assures that it will partner “with a world-renowned security platform next month, and will launch an official bug bounty program by the end of December”. This is definitely the right way moving forward, however, OnePlus should have probably done this immediately after the first breach to avoid a second incident.

UP NEXT: OnePlus 7 Pro’s audio is almost as good as the Note 10+ reveals DxOMark Audio Test

(Source)

The post OnePlus Customer Data Breached yet again, Names and Addresses likely exposed appeared first on Gizmochina.

The security and privacy of the users’ data is a major concern among poplar apps and websites. Many times, these companies have failed to provide a secure environment for the users’ data. A similar incident has been witnessed by a security researcher Victor Gevers of non-profit organization GDI. As per a report from the Financial Times, the identities and other personal data of 300 million Chinese users were searchable on the internet if anyone knows the IP on Saturday, last week.

The data of Chinese popular social messaging networks such as QQ and WeChat were exposed including Chinese citizen ID, photos, addresses, GPS location data along with the personal messages. It seems a major breach on the ChinaNet online, internet service provider servers. As per Gevers, later the data was distributed to over 17 different remote servers. It is not confirmed whether and why it is sent to over different servers and what’s the actual usage. But as per assumption, Gevers claims that the data is sent to police stations in different regions of China.

In actual he quoted that, “There is no evidence that law enforcement is doing something active with this spoonfed data. But the infrastructure and well-planned data distribution are there.”  He further investigated the issue and shared some parts of Direct Messages that were supposed to be private. He even shared some snippets of the chats as proof on his Twitter handle.

Upon digging deep, the data patterns hinted that these users might be frequent gamers who used different cafes. There’s another possibility that its the Chinese government’s way of keeping a tap on users who don’t follow censorship in China. Even though, some local officers have also asked internet cafes to track the users’ browsing history time-to-time with software.

Gevers accumulated the information while he was crawling Shodan search engine. As per him, the data was exposed in attempts by someone to frisk through the servers.

Later, Gevers resolved the issue by taking the matter to the Chinese internet service provider. In response, ChinaNet Online secured the data within a few hours.

• Read More: China Consumer Association knocks Apple, asks to compensate Apple ID theft victims

In China, the Government scans the users’ activity routinely to ensure safety and security. Even though, most of the Chinese internet companies are quite straightforward in complying with the state policies. Most of the companies have added in their privacy policies that they “comply with applicable laws and regulations.”

We hope in the future, the telecom operators and internet service providers should be more stringent while handling users’ data.

(Via)

The post WeChat and QQ’s 364 million Chinese users data exposed online appeared first on Gizmochina.

Facebook has said that an attack on its network has affected almost 50 million user accounts, exposing their personal information. The breach could allow attackers to take over the accounts of affected users. The full extent of the attack remains unknown at this time.

The social media giant said that the security breach was discovered earlier this week on Tuesday. The company found that the attackers had exploited a feature in Facebook’s code that impacted ‘View As’, which lets people see what their own profile looks like to others. The attackers exploited the vulnerability, which leaked Facebook access token, giving attackers access to users’ accounts.

In a conference call with reports, Mark Zukerberg, CEO of Facebook, said, “We’re taking it really seriously. We have a major security effort at the company that hardens all of our surfaces. I’m glad we found this. But it definitely is an issue that this happened in the first place.”

Currently the company’s internal investigation “is still in its early stages” and it has provided no details regarding who might be behind the attack or what user data (if any) was exfiltrated. Facebook has not revealed where in the world the affected 50 million users are, but says that it has informed Irish data regulators, where Facebook’s European subsidiary is based.

Over 90 million users were forced to log out of their accounts on Friday, which is a common security measure when accounts have been compromised. However, the users were not required to change their passwords.

The company said that it has fixed the vulnerability and has also notified law enforcement officials. It has temporarily disabled the View As feature while the company conducts a thorough security review. Facebook says that peoples’ privacy and security are very important and apologises for the incident.

Read More: WhatsApp co-founder Brian Acton feels he sold users’ privacy with Facebook acquisition

The news about security breach comes at a time when Facebook is going through a rough time. It is currently facing federal investigation over its role in the Cambridge Analytica scandal in which the firm misused data from about 87 million Facebook users.

(Source, Image Source)

The post Facebook security breach puts 50 million user accounts at risk appeared first on Gizmochina.