Security News > 2022 > January
The British government's PR campaign to destroy popular support for end-to-end encryption on messaging platforms has kicked off, under the handle "No Place To Hide", and it's as broad as any previous attack on the safety-guaranteeing technology. Judging by videos earnestly distributed by organisations supporting it, the No Place To Hide campaign is much wider than merely targeting Facebook Messenger as was previously thought.
The CVE-2022-0185 vulnerability in Ubuntu is severe enough that Red Hat is also advising immediate patching. It affects RHEL as well as Ubuntu 20.04, 21.04 and 21.10 - and presumably other distros, too.
Fortune 500 integrated services firm R.R.Donnelley & Sons is the latest victim of the hacking collective known as the Conti Group. RRD didn't name the perpetrator of the attack in the filing.
President Joe Biden signed a national security memorandum on Wednesday to increase the security of national security systems part of critical US government networks used in military and intelligence activities when storing or transferring classified info. "Modernizing our cybersecurity defenses and protecting all federal networks is a priority for the Biden Administration, and this National Security Memorandum raises the bar for the cybersecurity of our most sensitive systems," the White House said.
Cisco has fixed a critical security flaw discovered in the Cisco Redundancy Configuration Manager for Cisco StarOS Software during internal security testing. "A vulnerability in Cisco RCM for Cisco StarOS Software could allow an unauthenticated, remote attacker to perform remote code execution on the application with root-level privileges in the context of the configured container," Cisco said.
The sixth annual report from Aryaka found that IT teams are planning to invest more in 2022 but expect more transparency and control. IT leaders are managing distributed teams and juggling more complex networks than ever, according to Aryaka's Global State of the WAN 2022 report.
Security analysts have discovered and linked MoonBounce, "The most advanced" UEFI firmware implant found in the wild so far, to the Chinese-speaking APT41 hacker group. Kaspersky couldn't retrieve that payload for analysis or figure out how exactly the actors infected the UEFI firmware in the first place.
Last summer, the San Francisco police illegally used surveillance cameras at the George Floyd protests. It prohibits city agencies like the SFPD from acquiring, borrowing, or using surveillance technology, without prior approval from the city's Board of Supervisors, following an open process that includes public participation.
The UK's Competition and Markets Authority has invited comments from industry and interested parties about NortonLifeLock's proposed $8bn purchase of fellow infosec outfit Avast. "The CMA is considering whether it is or may be the case that this transaction, if carried into effect, will result in the creation of a relevant merger situation under the merger provisions of the Enterprise Act 2002," it said.
Attackers looking to exploit recently discovered Log4j vulnerabilities are also trying to take advantage of a previously undisclosed vulnerability in the SolarWinds Serv-U software. It affects version 15.2.5 and previous versions of Serv-U, and has been patched by SolarWinds in version 15.3.