MalwareBytesSecurity

A week in security (December 11 – December 17)

Credit to Author: Malwarebytes Labs| Date: Mon, 18 Dec 2017 18:45:39 +0000

A compilation of notable security news and blog posts from December 11 to December 17, including the net neutrality ruling, adult site advertising, and Bitcoin-related scams.

Categories:

Tags:

(Read more…)

The post A week in security (December 11 – December 17) appeared first on Malwarebytes Labs.

Read More
QuickHealSecurity

Virus Infectors: a perpetual attack vector – A report by Quick Heal Security Labs

Credit to Author: Amar Patil| Date: Fri, 12 Jan 2018 09:51:57 +0000

2017 was the year of ransomware and cryptocurrency miners but we are still seeing infectors posing as a prominent attack vector. However, old infectors still remain a significant threat to users. In 2017, we observed a few old infector families making new versions of their old code, though no new…

Read More
FortinetSecurity

Dr. StrangePatch or: How I Learned to Stop Worrying (about Meltdown and Spectre) and Love Security Advisory ADV180002

Credit to Author: Minh Tran| Date: Fri, 12 Jan 2018 11:39:59 +0000

  Introduction 2018 truly is starting off with a bang: fundamental CPU flaws dubbed Meltdown and Spectre were found affecting pretty much all modern processors developed since the Pentium Pro (1995). These flaws root in two critical CPU features: Out of Order Execution and Speculative Execution, which are crucial for performance. Since this is an important feature and not a bug, it is inherently hard to fix. Furthermore, for performance reasons, speculative execution is almost always implemented in hardware, so “fixes”…

Read More
FortinetSecurity

An Analysis of the OpenSSL SSL Handshake Error State Security Bypass (CVE-2017-3737)

Credit to Author: Dehui Yin| Date: Fri, 12 Jan 2018 11:39:59 +0000

OpenSSL is a widely used library for SSL and TLS protocol implementation that secures data using encryption and decryption based on cryptographic functions. However, a Security Bypass vulnerability – recently addressed in a patch by the OpenSSL Project –can be exploited to make vulnerable SSL clients or remote SSL servers send clean application data without encryption. This Security Bypass vulnerability (CVE-2017-3737) is caused by an error when the SSL_read or SSL_write function handles an "error state" during an SSL handshake….

Read More