Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Vulnerability. Show all posts
Vulnerability
CrwodStrike CyberCrime Cyberhacker Cybersecurity CyberThreat Network PowerSchool Social Security SSN Vulnerability

Hackers Infiltrated PowerSchool Network Well Before December Attack

 


It has been announced that the CrowdStrike investigation into PowerSchool's large-scale data breach that took place in December 2024 has been published. It was determined during the investigation that unauthorized access to the company's systems occurred four months prior, beginning in August and continuing in September, with the initial breach taking place in August and September. With more than 60 million students and 18,000 customers worldwide, PowerSchool is the world's leading cloud-based software provider for K-12 education. 

Among the many services PowerSchool offers are enrollment management, communication tools, attendance tracking, staff administration, learning solutions, analytics, and financial management, among others. PowerSchool disclosed in December of an unauthorized access to its customer support portal, PowerSource, which had been compromised by threat actors. It was discovered in this portal that there was a remote maintenance tool that was used by attackers to connect with customer databases. As a result of this vulnerability, sensitive information such as full name, physical address, contact information, Social Security number (SSN), medical records, and academic grades could have been accessed. 

According to CrowdStrike's investigation findings, there was an extensive amount of information about the security incident that gave further insight into the timeline and scope, emphasizing the need for enhanced cybersecurity measures to protect sensitive educational data. CrowdStrike conducted an investigation recently and it revealed that a hacker had stolen the company's support credentials several months ago to access the company's network. 

CrowdStrike's report indicates that PowerSchool's network has been accessed between August 16, 2024, and September 17, 2024 with the same compromised credentials as those used in December. By using these credentials, unauthorized access was granted to PowerSchool's PowerSource, the customer support portal which was later exploited in December to gain access to PowerSchool's network. 

According to CrowdStrike's report, PowerSource is intended to provide support technicians with the necessary privileges to access customer SIS database instances to perform maintenance purposes. CrowdStrike noted that limited data available in PowerSchool's log data prevented further analysis, but the investigation did not find sufficient evidence to conclusively link the August and September activity to the threat actor responsible for the December breach. According to the report, the December security breach could have been avoided had the compromised credentials been updated on time. 

However, it does suggest that if the credentials were updated on time, the December breach could have been avoided. Several cybersecurity measures, including frequent credential updates and enhanced monitoring, can prevent unauthorized access to sensitive data and safeguard sensitive information. PowerSchool released a report recently containing findings from CrowdStrike's investigation on February 28, 2025. This update highlights the importance of proactive cybersecurity measures. 

Using compromised credentials, the cyberattack has been carried out on the PowerSource customer support portal, according to the report. This unauthorized access has been in place since December 19, 2024, when it was notified at 19:43:14 UTC, until December 28, 2024, at 06:31:18 UTC, when it was discovered and mitigated. A cybersecurity firm called CrowdStrike has found that the attackers successfully removed sensitive data belonging to teachers and students from the compromised systems, but has not found any evidence that suggests that other databases were accessed or stolen by these attackers. 

As a result of the investigation, it was found that PowerSchool did not have malware deployed within its infrastructure, nor did the investigation indicate that privileges were escalating, lateral movement occurred, or downstream customer or school systems had been compromised. Based on CrowdStrike's dark web intelligence as of January 2, 2025, it appears that the attackers kept their promise not to publish the stolen data after receiving an extortion payment in return for not publishing it. 

The firm has not identified any instances of the information being sold or leaked online, and further analysis has shown that a breach of the PowerSource portal occurred in August and September of 2024, using the same compromised credentials, suggesting that it could have occurred even earlier than August and September of 2024. However, due to limitations in log data retention, there are insufficient evidence to confirm whether the same threat actor is behind both the earlier breaches as well as the December attack, due to limitations in log data retention. 

Specifically, the report stated that PowerSource logs for August 16, 2024, at 01:27:29 UTC, indicated that an unauthorized attack was performed by an unidentified actor using compromised support credentials on this date. In addition, CrowdStrike pointed out that the available SIS log data did not extend far enough to be able to determine whether the access resulted in the exfiltration of data from PowerSchool's SIS. 

PowerSchool has not publicly disclosed the number of schools, students, and teachers affected by the breach despite its severity, raising questions about transparency. According to the report, the breach affects 6,505 school districts across the United States, Canada, and other countries. The stolen data set contains approximately 62,488,628 student records and 9,506,624 teacher records. 

In light of these findings, stringent cybersecurity measures must be put in place, including timely credential management and enhanced monitoring, to protect sensitive educational data and prevent unauthorized access to it. PowerSchool has assured stakeholders that all necessary precautions have been taken to ensure that no further unauthorized access to the compromised data will take place. The company notified parents and guardians in a communication that the stolen information was not expected to be released to the public and that they could permanently delete it without duplicating or spreading it further. 

According to an in-depth analysis of PowerSchool system logs that began on December 22, 2024, unusual activity was identified by both on-premises and cloud-hosted PowerSchool customers. According to our investigations, two key data tables - Students_export.csv and Teachers_export.csv - were transferred to an IP address which was traced back to Ukraine and then were deleted. There are two IP addresses on the domain, 91.218.50.11, which belong to Virtual Systems, a legitimate hosting provider. This indicates that the attacker is likely to have either rented a service directly or exploited an existing account. 

As soon as PowerSchool discovered the breach on December 28, 2024, it promptly contacted CyberSteward, a cybersecurity incident response company, to negotiate with the attacker and resolve the problem. As the cybersecurity journalist Brian Krebs reported in an internal FAQ, PowerSchool requested assurances concerning the fate of the stolen data based on the internal FAQ. The threat actor subsequently confirmed with PowerSchool that all the data that had been exfiltrated had been erased and that no additional copies were kept of any of the data. 

Additionally, the attacker is alleged to have provided a video that shows how the process of file deletion is conducted. According to the findings, the cyber threat landscape has evolved dramatically over the past decade and there is an increasing trend for organizations to implement robust security measures to limit unauthorized access and exploitation of sensitive information. As a result of CrowdStrike's investigation, it was clear that cyber threats to schools and education institutions have become increasingly sophisticated and that action must be taken to prepare for them. 

It is important to note that the PowerSchool breach, which went undetected for months, illustrates the dangers posed by compromised credentials, as well as the potential risks posed by unauthorized access to students' and faculty's sensitive data. PowerSchool has assured that necessary precautions have been taken to prevent further misuse of the stolen data, yet this incident is considered to be a critical reminder of the vulnerabilities that exist in the digital infrastructure that handles vast amounts of information related to individual students and teachers. 

Given the tardy detection of the breach, as well as the extent of data exfiltration, it is imperative that continuous monitoring is maintained, credential updates are made promptly, and robust access control measures are implemented. To ensure that education institutions and technology providers remain secure moving forward, they must adopt advanced threat detection mechanisms, enforcing multi-factor authentication, and following rigorous incident response protocols. 

As a result of maintaining public trust and making sure that affected stakeholders are informed about data breaches, transparency remains crucial when revealing them. Despite the ever-changing tactics of cybercriminals, organizations remain vigilant and must enhance their security frameworks to mitigate the risk of a future breach and prevent it from happening again in the future. As a result of this event, all institutions that handle sensitive data should take note. It should serve as a strong reminder that cybersecurity is more than just a precaution, but one of the essential responsibilities of modern educational institutions.
Read more »
Windows
BYOVD Attack CyberCrime Cybersecurity CyberThreat Vulnerabilities and Exploits Vulnerability Windows

Cybercriminals Target Paragon Partition Manager Vulnerability in BYOVD Attacks

 


It has been reported that threat actors have been actively exploiting a security vulnerability within the BioNTdrv.sys driver of Paragon Partition Manager in ransomware attacks by elevating privileges and executing arbitrary code under the guise of attacks. The CERT Coordination Center (CERT/CC) has identified this zero-day vulnerability as CVE-2025-0289, one of five security flaws discovered by Microsoft during the past year. 

Other flaws have been identified, including arbitrary memory mapping, arbitrary memory write, null pointer dereferences, insecure kernel resource access, and arbitrary memory move vulnerabilities. It is especially concerning that an adversary may be able to exploit this vulnerability. It involves a Microsoft-signed driver, which allows adversaries to take advantage of the Bring Your Own Vulnerable Driver (BYOVD) technique. 

Using this method, attackers can compromise systems regardless of whether Paragon Partition Manager is installed, broadening the attack surface significantly. As BioNTdrv.sys operates at the kernel level, threat actors can exploit these vulnerabilities to execute commands with elevated privileges. This allows them to bypass security measures and defensive software, as attackers can access the system and deploy additional malicious payloads. 

Even though Microsoft researchers have identified all five security flaws, the company can not divulge what ransomware groups have been leveraging CVE-2025-0289 to execute their attacks. They are only aware that it has been weaponized in ransomware operations. A bulletin issued by Microsoft's CERT Coordination Center (CERT/CC) indicated that threat actors have been exploiting this vulnerability to conduct BYOVD-based ransomware attacks. 

According to the CVE-2025-0289 vulnerability, further malicious code within compromised environments can be executed by exploiting this vulnerability to escalate privileges to the SYSTEM level. This vulnerability can be exploited to facilitate the exploitation of BYOVD attacks, even on systems where the affected driver is not installed, and this can result in threat actors gaining elevated privileges and executing malicious code without the protection of security systems in place. 

As part of the identified security flaws affecting BioNTdrv.sys versions 1.3.0 and 1.5.1, CVE-2025-0285 is a flaw in version 7.9.1 which permits the mapping of kernel memory to arbitrary user inputs by not properly validating the length of the input. By exploiting this vulnerability, the user can escalate their privileges even further. 

There is a CVE-2025-0286 vulnerability that exists in version 7.9.1, resulting from improper validation of input controlled by users, which allows attackers to exploit this flaw to execute malicious code on the target machine. An unprivileged code execution vulnerability has been found in version 7.9.1, caused by an insufficient MasterLrp structure in the input buffer, which can result in a null pointer dereference vulnerability. 

Successful exploit allows arbitrary kernel-level code to be executed, facilitating privilege escalation and further misuse. Version 7.9.1 contains a vulnerability in the memmove function. This function fails to properly sanitize user-supplied data, allowing attackers to manipulate kernel memory and escalate privileges. 

Inversion of the CVE-2025-0289 vulnerability, an insecure kernel resource access vulnerability, has been found in version 17 of the Linux kernel due to a failure to validate the MappedSystemVa pointer before passing it to HalReturnToFirmware during the detection process. By exploiting this vulnerability, attackers can compromise the system. 

This security vulnerability has been addressed by Paragon Software by releasing the updated driver BioNTdrv.sys version 2.0.0 across all products within Paragon Software's Hard Disk Manager suite, including Partition Manager versions 17.45.0 and later versions. This update has been developed to reduce the risks associated with the previously identified security vulnerabilities. 

There is also a dedicated security patch available for 64-bit versions of Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025 that will provide users with an additional layer of protection against any exploits that might occur in the future, thereby enhancing the level of security. As part of Microsoft's efforts to protect its ecosystem, it has updated its Vulnerable Driver Blocklist, which effectively disables the execution of BioNTdrv.sys versions that are compromised within Windows environments, thereby preventing exploitation. 

Users and enterprises are strongly encouraged to ensure that this protection mechanism is kept in place to prevent exploitation. In light of the ongoing threat posed by these vulnerabilities, especially as a result of ransomware attacks, all users of Paragon Partition Manager and its associated products must update their software as soon as possible to the newest version available. 

As a further precaution, all Windows users should make sure that they enable the Microsoft Vulnerable Driver Blocklist feature as soon as possible. This is because it serves as a critical defense against BYOVD (Bring Your Vulnerable Driver) attacks, where outdated or insecure drivers are leveraged to elicit privileges and compromise a computer system.
Read more »
Vulnerability
CyberCrime Cyberhackers Cybersecurity CyberThreat Internet of Things Password Privacy Security Security Risk Vulnerability

Default Password Creates Major Security Risk for Apartment Complexes

 


Under research conducted by security researchers, it was discovered that a widely used door access control system includes an inherently insecure default password. Thousands of buildings across the country have insecure default passwords that can be accessed easily and remotely by anyone. It was discovered by Eric Daigle that there is still a lot of residential and commercial properties in North America that have not yet modified the default passwords for their access control systems, many of them are not even aware that this is a good idea.   

When security researcher Eric Daigle examined an apartment building’s access control panel, he inadvertently discovered one of the most concerning security issues in recent years while inspecting the access control panel. Initially, a routine observation while waiting for a ferry led to the discovery of a critical security flaw affecting hundreds of residential buildings across the country, which caused a widespread financial loss for thousands of people.

In late last year, Eric Daigle became interested in the system when he noticed an unusual access control panel on his normal daily activities. He conducted a short online search for “MESH by Viscount” and found a sales page for its remote access capability, followed by the discovery of a PDF installation guide available for download. It is typical for access control systems to be configured with a default password, which administrators are supposed to change to match their credentials. 

However, Daigle observed that the installation manual did not provide clear instructions regarding how these credentials were to be modified. It was later revealed, after further investigation into the user interface's login page title, that multiple publicly accessible login portals are available for this product. Alarmingly, as a result of this research, he was able to access the first one with default credentials, which highlights a critical security vulnerability. 

The Enterphone MESH door access system is currently owned by Hirsch, and Hirsch has announced that to address this security vulnerability, a software patch will be released shortly that will require users to change their default password, as soon as possible. An internet-connected device will often have a default password, which is often included in the product manual to facilitate the initial setup process. 

There is, however, a significant security risk in requiring end users to manually update these credentials, since if they fail to do so, their systems can be vulnerable to unauthorized access. Hirsch’s door access solutions are not prompted to customers when they are installed, nor are they required to modify the default passwords, leaving many systems at risk of unauthorized access. This vulnerability had been discovered by security researcher Eric Daigle, based on the findings he made, according to his findings. 

The vulnerability has been designated as CVE-2025-26793 as a result of his findings. Modern building security systems have become increasingly integrated with the Internet of Things (IoT) technology, especially in apartment complexes seeking a more advanced alternative to traditional phone-line-based access control systems. Among these key fob systems, Hirsch Mesh features a web-based portal that enables the use of key fobs throughout a large building to be tracked and logged, as well as allowing remote access to various entry points also within the building to be controlled remotely. 

The accessibility of the system's default login credentials, however, raises a crucial security concern because they are openly published in the installation manual, which is easily accessible via an online search, as the installer provides a list of the default login credentials. While waiting at a bus stop for his bus, Eric Daigle made a quick internet search based on the name of the product displayed on the security terminal of the apartment complex across the street. He located the manual in just a few minutes, which identified a way to circumvent the building's security measures. This highlighted a significant flaw in the system's design, leading to a serious risk of abuse. 

The default password that is set on internet-connected devices has historically posed a significant security threat because unauthorized individuals can gain access under the guise of legitimate users, leading to data breaches or the possibility of malicious actors hijacking these devices to carry out large-scale cyberattacks. In recent years, there have been several governments, including the UK, Germany, the US, and other countries, which have been encouraging technology manufacturers to adopt more robust security measures to avoid the security risks associated with using default credentials that were considered insecure in the first place. 

Having been rated as highly vulnerable by the FBI as a result of its ease of exploit, Hirsch's door entry system has been rated as a high threat as well with a severity rating of 10. Exploiting the flaw involves a minimal amount of effort. There is a public documentation available on Hirsch's website, which contains the installation manual for the system, which can be used to obtain the default password. An affected building is vulnerable to unauthorized access if individuals with these credentials log in to the login window of the building's system through the login portal; this highlights a critical security flaw in the system.
Read more »
Vulnerability
CISA Critical Exploits cyberattacks trending news News Vulnerabilities Vulnerability

CISA Warns of Critical Exploits in ProjectSend, Zyxel, and Proself Systems


Recently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has discovered and added three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities, impacting North Grid Proself, ProjectSend, and Zyxel firewalls, are being actively exploited, posing serious risks of data breaches and operational disruptions to unpatched systems. At the time of publishing, Zyxel acknowledged the issue and advised users to update their firmware promptly and strengthen admin credentials.

Vulnerabilities Identified in North Grid Proself, ProjectSend, and Zyxel Firewalls

North Grid Proself Vulnerability (CVE-2023-45727): A severe XML processing vulnerability in North Grid Proself has been identified, allowing attackers to bypass restrictions and access sensitive server data. Systems running versions older than 5.62, 1.65, and 1.08 are vulnerable to exploitation through maliciously crafted XML requests, which can extract sensitive account information.

ProjectSend Vulnerability (CVE-2024-11680): A critical authentication flaw in ProjectSend, an open-source file-sharing platform, has been flagged with a CVSS severity score of 9.8. Versions prior to r1720 are susceptible to attacks where malicious actors manipulate the options.php file using crafted HTTP requests. This enables them to create unauthorized accounts, upload webshells, and inject harmful JavaScript code. Security researchers from VulnCheck report that attackers are leveraging automated tools such as Nuclei and Metasploit to exploit this vulnerability.

Notably, exploitation attempts are marked by altered server configurations, including random strings in landing page titles—a trend observed since September 2024. Despite a patch being released in May 2023, over 4,000 exposed instances remain vulnerable.

Zyxel Firewall Vulnerability (CVE-2024-11667): Zyxel firewalls running firmware versions between V5.00 and V5.38 are vulnerable to a directory traversal attack. This flaw allows attackers to upload or download files via manipulated URLs within the web management interface, potentially compromising system integrity.

Exploitation Attempts and Mitigation Strategies

ProjectSend instances have been the primary focus of attackers. Public-facing systems have seen unauthorized user registrations—a setting not enabled by default—facilitating access for malicious actors. Webshells uploaded during these attacks are often stored in predictable directories, with filenames tied to timestamps and user data. Organizations are urged to review server logs to identify and address suspicious activities.

Under Binding Operational Directive (BOD) 22-01, federal agencies must prioritize these vulnerabilities, while CISA has recommended that private organizations take immediate action to mitigate the risks. Updating software, reviewing server configurations, and enhancing log analysis are critical steps to safeguard systems from exploitation.

Read more »
Vulnerability
AI developers CISA Cyber Security data security Encryption Executive Order 14117 government data National Security U.S. personal data Vulnerability

CISA Proposes New Security Measures to Protect U.S. Personal and Government Data

 

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has proposed a series of stringent security requirements to safeguard American personal data and sensitive government information from potential adversarial states. The initiative aims to prevent foreign entities from exploiting data vulnerabilities and potentially compromising national security.

These new security protocols target organizations involved in restricted transactions that handle large volumes of U.S. sensitive personal data or government-related data, especially when such information could be exposed to "countries of concern" or "covered persons." This proposal is part of the broader implementation of Executive Order 14117, signed by President Biden earlier this year, which seeks to address critical data security risks that could pose threats to national security.

The scope of affected organizations is wide, including technology companies such as AI developers, cloud service providers, telecommunications firms, health and biotech organizations, financial institutions, and defense contractors. These businesses are expected to comply with the new security measures to prevent unauthorized access to sensitive information.

"CISA’s security requirements are split into two main categories: organizational/system-level requirements and data-level requirements," stated the agency. Below is a breakdown of some of the proposed measures:

  • Monthly Asset Inventory: Organizations must maintain and update a comprehensive asset inventory that includes IP addresses and hardware MAC addresses.
  • Vulnerability Remediation: Known exploited vulnerabilities should be addressed within 14 days, while critical vulnerabilities, regardless of known exploitation, must be remediated within 15 days. High-severity vulnerabilities should be resolved within 30 days.
  • Accurate Network Topology: Companies must maintain a precise network topology, which is crucial for identifying and responding to security incidents swiftly.
  • Multi-Factor Authentication (MFA): All critical systems must enforce MFA, and passwords must be at least 16 characters long. Immediate access revocation is required upon employee termination or a change in roles.
  • Unauthorized Hardware Control: Organizations must ensure that unauthorized hardware, such as USB devices, cannot be connected to systems handling sensitive data.
  • Log Collection: Logs of access and security-related events, including intrusion detection/prevention, firewall activity, data loss prevention, VPN usage, and login events, must be systematically collected.
  • Data Reduction and Masking: To prevent unauthorized access, organizations should reduce the volume of data collected or mask it, and encrypt data during restricted transactions.
  • Encryption Key Security: Encryption keys must not be stored alongside the encrypted data, nor in any country of concern.
  • Advanced Privacy Techniques: The use of techniques like homomorphic encryption or differential privacy is encouraged to ensure sensitive data cannot be reconstructed from processed data.
CISA has called for public feedback on the proposed security measures before they are finalized. Interested parties can submit their comments by visiting regulations.gov, entering CISA-2024-0029 in the search bar, and submitting feedback through the available form.
Read more »
Windows
Authentication CVE-2024-8260 Cyber Security NTLM OPA Patch relay Tenable Vulnerability Windows

Critical Flaw in Open Policy Agent Exposed NTLM Credentials, Patch Released

 

A now-resolved security vulnerability in Styra's Open Policy Agent (OPA) could have exposed New Technology LAN Manager (NTLM) hashes, potentially leading to credential leakage. If exploited, the flaw allowed attackers to capture the NTLM credentials of the OPA server’s local user account and send them to a remote server. From there, they could either crack the password or relay the authentication, according to a report by cybersecurity firm Tenable, shared with The Hacker News.

The vulnerability, identified as CVE-2024-8260 and classified as a Server Message Block (SMB) force-authentication flaw, affected both the Command Line Interface (CLI) and the Go software development kit (SDK) on Windows. The issue arose from improper input validation, enabling unauthorized access by leaking the Net-NTLMv2 hash of the logged-in user on the Windows device running OPA.

Exploiting this vulnerability required specific conditions: the victim had to initiate outbound SMB traffic over port 445, gain an initial foothold through social engineering, or run the OPA CLI using a Universal Naming Convention (UNC) path rather than a Rego rule file.

Tenable security researcher Shelly Raban explained that when a Windows machine accesses a remote share, it sends the NTLM hash of the local user to authenticate to the remote server. Attackers can capture these credentials to perform relay attacks or crack the password offline. Following the responsible disclosure in June 2024, the issue was patched in version 0.68.0, released on August 29, 2024.

Tenable emphasized the importance of securing open-source projects to avoid exposing vendors and users to potential threats. The disclosure of this vulnerability coincides with Akamai's revelation of a privilege escalation flaw (CVE-2024-43532) in Microsoft's Remote Registry Service, which also involved NTLM relay attacks.

Microsoft, in response to NTLM vulnerabilities, reiterated its commitment to replace NTLM with Kerberos in Windows 11 to enhance authentication security.
Read more »
Vulnerability
Awareness Cyber Criminals Cyber Fraud Cybersecurity elderly Financial Loss fraud prevention Online Scams Scams vigilance Vulnerability

India's Digital Rise Sees Alarming Surge in Online Scams Targeting the Elderly

 

With India advancing in the digital landscape, the country is also witnessing a concerning rise in online scams. In recent months, thousands of individuals have lost substantial sums to these cyber criminals, either hoping to earn more money or after being threatened. Scammers employ new tricks, targeting people across all age groups, with a notable increase in elderly victims. Cyber criminals use increasingly sophisticated techniques to exploit the vulnerability and trust of senior citizens, causing significant financial and emotional distress.

In one case from Bengaluru, a 77-year-old woman named Lakshmi Shivakumar lost Rs 1.2 crore to a scam. It began with a call from someone posing as a Telecom Department representative, falsely claiming a SIM card in her name was involved in illegal activities in Mumbai. The caller mentioned a complaint with the Mumbai Crime Branch to add credibility.

Within hours, she received another call from individuals impersonating Mumbai Crime Branch officers, accusing her of laundering Rs 60 crore and demanding her bank account details for verification. Using threats of arrest and showing a fabricated FIR and arrest warrant, the scammers coerced her into sharing her bank details, ultimately transferring Rs 1.28 crore from her account, promising the money's return after the investigation.

In another case from Chandigarh, an elderly woman was deceived out of Rs 72 lakh under the pretense of a digital arrest scam. She received a call from someone claiming to be from the Central Bureau of Investigation (CBI) office in Andheri, Mumbai, falsely implicating her in a drug case connected to a man named Naresh Goyal and threatening to freeze her bank accounts.

The scammer linked her ATM card to the suspect and claimed obscene messages from her phone were circulating. Under immense pressure, she complied with the demands, participating in a video call where a fake police ID was shown. Over a week, the scammers defrauded her of Rs 72 lakh, promising to return the money after proving her innocence.

Older people are particularly vulnerable to such scams due to several reasons. They often struggle to keep up with the latest technology and digital security measures, making them easy targets for tech-savvy criminals. Additionally, older adults are more likely to trust authoritative figures and may not recognize the signs of deceit in official-looking communications. Their financial stability and natural inclination to trust and cooperate with law enforcement further increase their susceptibility.

How to stay safe and protect the elderly from scams

To protect the elderly from falling prey to such scams, awareness and vigilance are crucial. Here are some essential tips:

  • Inform elderly family members about common types of scams and the tactics used by fraudsters. Regular discussions can help them recognize and avoid potential threats.
  • Encourage seniors to verify any unsolicited calls or messages by contacting the official organization directly using known contact details, not the ones provided by the caller.
  • Ensure that devices used by the elderly have updated security software to protect against malware.
Read more »
Vulnerability
Cyber Attacks Cyber space Cyberattack Intel CPU Vulnerability

New Intel CPU Vulnerability 'Indirector' Found

Researchers from the University of California, San Diego, have discovered a new vulnerability in modern Intel processors, specifically the Raptor Lake and Alder Lake generations. This vulnerability, named 'Indirector,' can be used to steal sensitive information from the CPU. 

The problem lies in two components of the CPU: the Indirect Branch Predictor (IBP) and the Branch Target Buffer (BTB). These components help the CPU make quick decisions, but they have flaws that attackers can exploit. The researchers identified three main techniques used in Indirector attacks: 

1. iBranch Locator: A tool that helps attackers find specific parts of the CPU's decision-making process by identifying the indices and tags of victim branches. 

2. IBP/BTB Injections: Tricks to manipulate the CPU's predictions, causing it to run unauthorized code through targeted injections. 

3. ASLR Bypass: A method to break security measures that protect the memory layout, making it easier to predict and control the CPU. 

By using these techniques, attackers can trick the CPU into running their own code and accessing sensitive data like passwords or encryption keys. This is accomplished by combining the speculative execution achieved through targeted injections with cache side-channel techniques, such as measuring access times, to infer the accessed data. 

To protect against Indirector attacks, the researchers suggest two main defenses: 

1. Use IBPB More: The Indirect Branch Predictor Barrier (IBPB) can prevent certain types of speculative execution, but it can slow down the CPU by up to 50%. 

2. Improve CPU Design: Making the CPU's prediction systems more complex and secure by adding encryption and randomization, which could involve incorporating more complex tags. 

Intel was informed about the Indirector vulnerability in February 2024 and has shared the information with other affected companies. Intel reviewed the findings and believes that existing protections, such as IBRS, eIBRS, and BHI, are effective against this new attack, so no new mitigations or guidance are required. 

The researchers will present their full findings at the USENIX Security Symposium in August 2024. They have also published more detailed information, proof-of-concept code, and tools related to Indirector on GitHub for further study and understanding. 

These publications provide a deeper dive into the attack methodologies, potential data leak mechanisms, and suggested mitigations. Modern CPUs from Intel are vital for many applications, and discovering such vulnerabilities highlights the importance of continually improving hardware security. 

By addressing these flaws and implementing the recommended defenses, the problem security of these processors can be significantly enhanced, protecting users from potential data leaks and other malicious activities.
Read more »
Subscribe to: Posts (Atom)