(safe) Unsecure security

Redis recently released a security advisory regarding CVE-2025-49844. This critical (CVSS 10.0) use-after-free (UAF) vulnerability in Lua scripting could allow authenticated attackers to execute remote code on older versions of Redis and Valkey with Lua scripting enabled. Developers are urged to upgrade to patched releases as soon as possible.

The vulnerability exploits a 13-year-old UAF memory corruption bug in Redis, allowing a post-auth attacker to send a crafted Lua script to escape the default Lua sandbox and execute arbitrary native code. This grants full host access, enabling data theft, wiping, encryption, resource hijacking, and lateral movement within cloud environments.

13 years. That's how long it took to find a critical safety vulnerability in one of the most popular C open source codebases, Redis.

The Europol SIMCARTEL operation shows that fighting crime is essential, but it also raises a warning: in the EU, SIM cards and communications are already under strict surveillance and control. While dismantling criminal networks is a good cause, we must not let it justify the erosion of fundamental privacy and personal freedoms for everyone. We should invest in smarter, less intrusive ways to combat crime rather than resort to blanket surveillance so that both security and the right to live untracked can be preserved.

Apie ChatControl lietuviškai

• The UK government ordered Apple to create a “back door” into its most secure cloud storage, citing national security and crime prevention.
• The US, especially Vice President JD Vance and President Trump, strongly opposes this, seeing it as a threat to free speech and privacy, and a risk to tech partnerships.
• Apple withdrew its secure service from the UK and is legally challenging the order, with WhatsApp joining the fight.
• The UK’s stance is jeopardizing tech and data agreements with the US and complicating future AI regulation.
• UK officials admit the Home Office mishandled the issue and will likely have to retreat to avoid damaging relations with Washington.

Supply chains are the new (old) battleground.

• Chinese-linked hackers are targeting the Taiwanese semiconductor industry and investment analysts as part of a string of cyberespionage campaigns.
• These groups often target "peripheral suppliers or related industries”
• In June where a China-linked hacking group identified by TeamT5 as "Amoeba" launched a phishing campaign against an unnamed chemical company that plays a critical role in the semiconductor supply chain

Unreleased Beyoncé music and luxury Apple gear were stolen during the 'Cowboy Carter' tour. Classic blunder: thieves grab MacBooks loaded with Find My trackers, making escapes a digital nightmare.

It’s poetic: artists now rely on surveillance capitalism to protect art.

You think you are paranoid? Think again.

AI driven exploits? What is next - ICE on eBay?

Scary (or Awesome) depending on your view.

cross-posted from: https://lemmy.world/post/26598539

cross-posted from: https://programming.dev/post/26664400

Tarlogic developed a new C-based USB Bluetooth driver that is hardware-independent and cross-platform, allowing direct access to the hardware without relying on OS-specific APIs.

Armed with this new tool, which enables raw access to Bluetooth traffic, Tarlogic discovered hidden vendor-specific commands (Opcode 0x3F) in the ESP32 Bluetooth firmware that allow low-level control over Bluetooth functions.

In total, they found 29 undocumented commands, collectively characterized as a "backdoor," that could be used for memory manipulation (read/write RAM and Flash), MAC address spoofing (device impersonation), and LMP/LLCP packet injection.

Espressif has not publicly documented these commands, so either they weren't meant to be accessible, or they were left in by mistake. The issue is now tracked under CVE-2025-27840.

"it's just for testing"

Nobody seems to notice... nobody seems to care..

If you left alone in the office and have nothing better to do..

The CALEA system, designed in the U.S. for mass surveillance, has become a global threat. Telecom equipment with "back doors" isn't just an American issue—it's a worldwide risk. Trusting the "good guys" is naive; any end with "back doors" can be a target. Encryption is our defense, and we must be careful about what we buy. #security #technology

Good slides on how to reduce risks

Laughed my ass off:

"Since QEMU is a legitimate tool that is also digitally signed, Windows does not raise any alarms about it running, and security tools cannot scrutinize what malicious programs are running inside the virtual machine."

Highlights

In analyzing 138 actively exploited vulnerabilities in 2023, Google Mandiant reported Oct. 15 that 70% of them were zero-days, indicating that threat actors are getting much better at identifying vulnerabilities in software.

It’s a worrying trend in and of itself, but what caused even more concern among security analysts was that Google Mandiant also found that the time-to-exploit (TTE) — the time it takes threat actors to exploit a flaw — was down to a mere five days in 2023 compared with 63 days in 2018-19 and 32 days in 2021-22.

Highlights

Iran’s multifaceted approach in the cyber domain allows Iran to project power and influence in the Middle East while avoiding direct conventional military confrontations with stronger adversaries. Iran uses cyber operations to complement its broader geopolitical strategies, often employing cyber espionage and sabotage to gain strategic advantages or to retaliate against sanctions and military threats. As Iran increasingly incorporates AI technologies into its cyber operations, the likelihood of more disruptive and damaging activities escalates, presenting a substantial challenge not only to regional stability but also to global security.

Maj. Gen. Qassem Soleimani’s death marked a significant turning point in Iran’s cyber strategy, pushing Tehran to assert its power and influence through increased cyber activities aimed at the U.S. and its allies

Cyber proxy groups use various tactics to create negative psychological effects among adversaries. APTs such as Mint Sandstorm use precise targeting to create unease among a specific group of people. Iran also uses “faketivists,” which are groups that commit cyberattacks for a specific cause, like hacktivists, but are borne from a specific geopolitical event and are created by a nation-state to perpetuate narratives that support their cause. Faketivists can be nation-state actors and/or proxy groups associated with the IRGC and the Ministry of Intelligence and Security (MOIS). The cyberattacks in Israel that have deployed faketivists have had mixed success, but they have garnered both local and global support. The purpose of these groups is to spread their “success” and to create disruption and attention, regardless of actual operational success.

Looking ahead, we can expect Iran to further integrate AI into its cyber strategy, escalating the frequency and sophistication of attacks, particularly on critical infrastructure and democratic processes. Additionally, the growing alignment between Iran and other global cyber powers, such as Russia and China, further increases the sophistication and reach of its cyber capabilities, presenting significant challenges for those attempting to counter these evolving threats.

A vulnerability was discovered in Infineon’s cryptographic library, which is utilized in YubiKey 5 Series, and Security Key Series with firmware prior to 5.7.0 and YubiHSM 2 with firmware prior to 2.4.0. The severity of the issue in Yubico devices is moderate.

An attacker could exploit this issue as part of a sophisticated and targeted attack to recover affected private keys. The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM, knowledge of the accounts they want to target, and specialized equipment to perform the necessary attack. Depending on the use case, the attacker may also require additional knowledge including username, PIN, account password, or authentication key.

https://ghostarchive.org/archive/JS9X1 Chinese government hackers penetrate U.S. internet providers to spy Beijing’s hacking effort has “dramatically stepped up from where it used to be,” says former top U.S cybersecurity official.

A reminder

Highlights

Many systems use encryption of one sort or another. However, when we talk about encryption in the context of modern private messaging services, it typically has a very specific meaning: the use of default end-to-end encryption to protect message content. When used in an industry-standard way, this feature ensures that all conversations are encrypted by default — under encryption keys that are only known to the communication participants, and not to the service provider.

Telegram clearly fails to meet this stronger definition, because it does not encrypt conversations by default. If you want to use end-to-end encryption in Telegram, you must manually activate an optional end-to-end encryption feature called “Secret Chats” for each private conversation you want to have. To reiterate, this feature is explicitly not turned on for the vast majority of conversations, and is only available for one-on-one conversations, and never for group chats with more than two people in them.

Even though end-to-end encryption is one of the best tools we’ve developed to prevent data compromise, it is hardly the end of the story. One of the biggest privacy problems in messaging is the availability of loads of meta-data — essentially data about who uses the service, who they talk to, and when they do that talking.

;)