Tux Machines

Security: Microsoft Breaches and More

Posted by Roy Schestowitz on Sep 29, 2023

Progress Software Patches Critical Pre-Auth Flaws in WS_FTP Server Product

Progress Software ships patches for critical-severity flaws in its WS_FTP file transfer software and warns that a pre-authenticated attacker could wreak havoc on the underlying operating system.

US State Department Says 60,000 Emails Taken in Alleged Chinese Hack [Ed: Microsoft ruins nations]

The US State Department said that hackers took around 60,000 emails in an attack which Microsoft has [falsely] blamed on China.

[...]

“It was approximately 60,000 unclassified emails that were exfiltrated as a part of that breach,” State Department spokesman Matthew Miller told reporters.

“Classified systems were not [breached]. These only related to the unclassified system,” he said.

Government Shutdown Could Bench 80% of CISA Staff [Ed: Not much of value would be lost]

Roughly 80% of CISA staff will be sent home at the end of the week in case of a government shutdown.

Cyberattacks hit military, Parliament websites as India-based group targets Canada [Ed: Windows TCO]

The attacks seem to have hit institutions controlled by the government, but not the core infrastructure from which federal departments and agencies operate.

Millions of files with potentially sensitive information exposed online, researchers say

Researchers with Censys, a service that indexes devices connected to the [Internet] and the services they’re running, recently indexed nearly 314,000 distinct [Internet]-connected devices and web servers with open directory listings and at least one file. The scanner then took note of file names, paths, file sizes and last-modification timestamps, creating what the company calls “one of the most comprehensive databases of all open directories on the internet.”

Passkeys, Crypto, and Signing AI Content

Under the hood, it’s just crypto (as in cryptography). There’s a public and private key pair that’s generated. The private keys are used to sign log-in challenges sent by the authenticating service. We’ve had hardware security keys and WebAuthn for a while but mostly used them as a second-factor authentication. They required you to buy an additional device (usually USB). They weren’t used as primary authentication because if you lost the device, you couldn’t recover your account.