Privatnost i sigurnost podataka i korisnika

[tomek@vz]

Autor kopija

Secure Boot je najbolja stvar koja se pojavila na security sceni u zadnjem desetljeću.
Možda i jedina vrijedna pomena.

Implicirao sam da je u ono vrijeme implementacija ovakvih pi*darija od strane proizvođača bila , barem po mom sjećanju nemoguća. Ne kažem da je UEFI u kombinaciji sa Secure Boot-om loš već da je nov, moderniji sustav omogućio ovu negativnu stranu koja zapravo otvara nove i sofisticiranije vektore napada - kao što vidimo iz priloženog. Postavlja se pitanje - kako ovakvo sranje trajno eliminirati.

[The Exiled]

Nažalost i Secure Boot je veselje samo po sebi.

• New UEFI Secure Boot Vulnerability Could Allow Attackers to Load Malicious Bootkits
  
• New Secure Boot flaw lets attackers install bootkit malware, patch now
  
• PKfail Secure Boot bypass lets attackers install UEFI malware
  
• PKfail Secure Boot bypass remains a significant risk two months later

Security researchers have disclosed a new Secure Boot bypass tracked as CVE-2025-3052 that can be used to turn off security on PCs and servers and install bootkit malware.
The flaw affects nearly every system that trusts Microsoft's "UEFI CA 2011" certificate, which is pretty much all hardware that supports Secure Boot.

[mkey]

Autor Tajl3r

Ma to je mala beba za našeg teslu Ercegovca

Eee, neće da može. Musk je CEO 7 ogromnih i manjih kompanija, ima određenu političku karijeru a uz to je pro gamer koji igra preko deset sati na dan. Mate će ipak morati pojesti još dosta palente da dođe igdje blizu tog nivoa.

[The Exiled]

Musk se s tim pro-gamer pričama sjebal onog trena kad nije skužil s kim točno ima posla, pa nije dugo trebalo da mu cijeli Internet rastavi sve (1 - 2) na sastavne dijelove. Nakon toga su samo nastavili dalje s ostalim poslovnim poduhvatima koje Musk uvijek ponosno ističe i non-stop naglašava, pa je ko bi rekel ispalo da tip laže čim zine. PR bajke o uspješnom geniju i gameru su svih ovih godina bile OK štivo, dokle god se nije upustil u političke vode (1 - 2), samo da bi ga naposljetku potjerali podvijena repa. Obzirom na aktualnu Epstein situaciju dobro bude, ako se Musk jednog dana ne probudi mrtav ili slučajno padne kroz prozor prilikom logiranja na popularnu društvenu mrežu, jer zamjenu su mu već našli.

[mkey]

On bi možda mogao ispasti iz SpaceX rakete. Ili nastradati u brutalno gorećoj Tesli.

[The Exiled]

Ništa čudno ne bi bilo.

[tomek@vz]

"Anybody who's got a hosted SharePoint server has got a problem," the senior VP of cybersecurity firm CrowdStrike told the Washington Post. "It's a significant vulnerability."

And it's led to a new "global attack on government agencies and businesses" in the last few days, according to the article, "breaching U.S. federal and state agencies, universities, energy companies and an Asian telecommunications company, according to state officials and private researchers..."

"Tens of thousands of such servers are at risk, experts said, and Microsoft has issued no patch for the flaw, leaving victims around the world scrambling to respond." (Microsoft says they are "working on" security updates "for supported versions of SharePoint 2019 and SharePoint 2016," offering various mitigation suggestions, and CISA has released their own recommendations.)

From the Washington Post's article Sunday:
Microsoft has suggested that users make modifications to SharePoint server programs or simply unplug them from the internet to stanch the breach. Microsoft issued an alert to customers but declined to comment further... "We are seeing attempts to exploit thousands of SharePoint servers globally before a patch is available," said Pete Renals, a senior manager with Palo Alto Networks' Unit 42. "We have identified dozens of compromised organizations spanning both commercial and government sectors.''

With access to these servers, which often connect to Outlook email, Teams and other core services, a breach can lead to theft of sensitive data as well as password harvesting, Netherlands-based research company Eye Security noted. What's also alarming, researchers said, is that the hackers have gained access to keys that may allow them to regain entry even after a system is patched. "So pushing out a patch on Monday or Tuesday doesn't help anybody who's been compromised in the past 72 hours," said one researcher, who spoke on the condition of anonymity because a federal investigation is ongoing.

The breaches occurred after Microsoft fixed a security flaw this month. The attackers realized they could use a similar vulnerability, according to the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency. CISA spokeswoman Marci McCarthy said the agency was alerted to the issue Friday by a cyber research firm and immediately contacted Microsoft... The nonprofit Center for Internet Security, which staffs an information-sharing group for state and local governments, notified about 100 organizations that they were vulnerable and potentially compromised, said Randy Rose, the organization's vice president. Those warned included public schools and universities. Others that were breached included a government agency in Spain, a local agency in Albuquerque and a university in Brazil, security researchers said.

But there's many more breaches, according to the article:
"Eye Security said it has tracked more than 50 breaches, including at an energy company in a large state and several European government agencies."
"At least two U.S. federal agencies have seen their servers breached, according to researchers."
"One state official in the eastern U.S. said the attackers had 'hijacked' a repository of documents provided to the public to help residents understand how their government works. The agency involved can no longer access the material..."
"It was not immediately clear who is behind the hacking of global reach or what its ultimate goal is. One private research company found the hackers targeting servers in China..."

> Slashdot

[medo]

[QUOTE=The Exiled;3813501]Nažalost i Secure Boot je veselje samo po sebi.

Security researchers have disclosed a new Secure Boot bypass tracked as CVE-2025-3052 that can be used to turn off security on PCs and servers and install bootkit malware.
The flaw affects nearly every system that trusts Microsoft's "UEFI CA 2011" certificate, which is pretty much all hardware that supports Secure Boot.

To je upravo ono o čemu sam već pričao. Dokle god ne budemo mogli potpisivati certove sa našima CA-ovima to je banana.

[strikoo]

Autor tomek@vz

> Slashdot

nocas izdan patch

https://msrc.microsoft.com/blog/2025...ve-2025-53770/

[Night]

Autor Ivo_Strojnica

kažeš "hakiraju nas, ali nismo skroz sigurni, jer ne ostavljaju tragove"

No ono šta mi je super je kako oni ne hakiraju kineze.
Stvarno benigni narod.

Amerika : Kina nas hakira, kmeee.
Također Amerika : How the NSA Hacked Huawei: Operation Shotgiant - https://www.youtube.com/watch?v=aQNgelm7JeE