Mozilla un-pwned, Chrome hardened, BPFDoor goes deep, and more.

Infosec Overnights - Daily Security News

内容由Paul Torgersen提供。所有播客内容（包括剧集、图形和播客描述）均由 Paul Torgersen 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品，您可以按照此处概述的流程进行操作https://zh.player.fm/legal。

2y ago 2:50

MP3•单集首页

已归档的系列专辑 ("不活跃的收取点" status)

When? This feed was archived on May 25, 2023 16:09 (12M ago). Last successful fetch was on July 29, 2022 18:35 (2y ago)

Why? 不活跃的收取点 status. 我们的伺服器已尝试了一段时间，但仍然无法截取有效的播客收取点

What now? You might be able to find a more up-to-date version using the search function. This series will no longer be checked for updates. If you believe this to be in error, please check if the publisher's feed link below is valid and contact support to request the feed be restored or if you have any other concerns about this.

A daily look at the relevant information security news from overnight.
Episode 232 - 25 May 2022
Mozilla un-pwned- https://www.bleepingcomputer.com/news/security/mozilla-fixes-firefox-thunderbird-zero-days-exploited-at-pwn2own/
Chrome hardened -
https://www.securityweek.com/chrome-102-patches-32-vulnerabilities
Moshen Dragon Trend-ing - https://www.bleepingcomputer.com/news/security/trend-micro-fixes-bug-chinese-hackers-exploited-for-espionage/
No TOR for Tails -
https://portswigger.net/daily-swig/tails-users-warned-not-to-launch-bundled-tor-browser-until-security-fix-is-released
BPFDoor goes deep- https://www.bleepingcomputer.com/news/security/bpfdoor-malware-uses-solaris-vulnerability-to-get-root-privileges/
Hi, I’m Paul Torgersen. It’s Wednesday May 25th, 2022, and again from Las Vegas, this is a look at the information security news from overnight.
From BleepingComputer.com:
Mozilla has released security updates to address zero-day vulnerabilities exploited during the Pwn2Own Vancouver 2022 hacking contest. The two critical flaws can let attackers gain JavaScript code execution on mobile and desktop devices running Firefox, Firefox ESR, Firefox for Android, and Thunderbird. On a side note: the total amount of bug bounties earned at Pwn2Own this year? $1.2 million. Well done.
From SecurityWeek.com:
Google announced the release of Chrome 102, which patches 32 vulnerabilities, including one critical and eight high-severity flaws. The critical security hole has been described as a use-after-free bug affecting Indexed DB. Somebody has a bug bounty coming to them for that one too.
From BleepingComputer.com:
Trend Micro has patched a flaw in Trend Micro Security that has been used by Chinese threat group Moshen Dragon to side-load malicious DLLs. The fix was deployed via ActiveUpdate, so if you have an active internet connection, you should have already received it. More details in the article.
From PortSwigger.net:
Tails is warning users to stop using Tor Browser that comes bundled with the privacy-focused operating system. They found a bug that could enable an attacker to corrupt the methods of an Array object in JavaScript via prototype pollution. This could end in the execution of attacker-controlled JavaScript code in a privileged context.
And last this today, from BleepingComputer.com
During a recent incident response, PwC has been able to dig into the inner workings of the BPFdoor malware for Linux and Solaris. BPFDoor is a custom backdoor that can't be stopped by firewalls, it can function without opening any ports and does not need a command and control server because it can receive commands from any IP address on the web. This nasty has been attributed to a China-based threat actor PwC tracks as Red Menshen. All the details in the article.
That’s all for me today. Have a great rest of your day. And as always, until tomorrow, be safe out there.

221集单集