Hallowed Bugtraq infosec list killed then resurrected over the weekend: We heard your feedback, says Accenture

Plus: Watch out for NTFS-corrupting folder, Mimecast hack, and more

In brief Last week ended with news that the venerable infosec mailing list Bugtraq was being shutdown at the end of the month.

From its first posts in November 1993, Bugtraq aimed to get details of vulnerabilities, as well as defence and exploitation techniques, onto netizens' radar, and discussed among admins and security researchers. Posts to this once high-volume Symantec-owned list stopped on February 22 last year, and now we know why – a lack of funding and resources.

"Assets of Symantec were acquired by Broadcom in late 2019, and some of those assets were then acquired by Accenture in 2020," an email from the list administrators read.

"At this time, resources for the Bugtraq mailing list have not been prioritized, and this will be the last message to the list. The archive will be shut down January 31st, 2021."

Then on Sunday, Accenture had a change of heart. It's now looking like Bugtraq could last a while longer.

"Bugtraq has been a valuable institution within the Cyber Security community for almost 30 years. Many of our own people entered the industry by subscribing to it and learning from it," the Accenture team said. "So, based on the feedback we've received both from the community-at-large and internally, we've decided to keep the Bugtraq list running. We'll be working in the coming weeks to ensure that it can remain a valuable asset to the community for years to come."

If you're using non-Chromium Edge on Windows, don't. A bug-hunter known as Jonas L found that accessing a specially named folder path on NTFS will corrupt the file-system on Windows 10 1803 and later, requring a reboot and repair operation. Non-Chromium Edge browsers will try to open the path if it's in a URL in a malicious webpage, triggering the flaw. There are other ways to get people to open the path, such as by hiding the folder in a zip file. It's hoped Microsoft will fix this soon. We're not going to share the folder name until then.

Mimecast cert hack: Enterprise security shop Mimecast revealed last week that one of its security certificates, used to link its products to Microsoft 365 deployments, was compromised, potentially allowing miscreants to, for instance, snoop on oragnizations' data in transit between the affected Mimecast and Microsoft services. Mimecast wouldn't comment further mid-investigation, though said in a statement:

Microsoft recently informed us that a Mimecast-issued certificate provided to certain customers to authenticate Mimecast Sync and Recover, Continuity Monitor, and IEP products to Microsoft 365 Exchange Web Services has been compromised by a sophisticated threat actor.

Approximately 10 percent of our customers use this connection. Of those that do, there are indications that a low single digit number of our customers’ M365 tenants were targeted. We have already contacted these customers to remediate the issue.

As a precaution, we are asking the subset of Mimecast customers using this certificate-based connection to immediately delete the existing connection within their M365 tenant and re-establish a new certificate-based connection using the new certificate we’ve made available. Taking this action does not impact inbound or outbound mail flow or associated security scanning.

COVID-19 data leaked: The EU Medicines Agency said some of the coronavirus vaccine approval documents stolen during a network intrusion it disclosed last month has been shared online.

"Some of the unlawfully accessed documents related to COVID-19 medicines and vaccines belonging to third parties have been leaked on the internet," it said in a statement.

"Necessary action is being taken by the law enforcement authorities. The Agency continues to fully support the criminal investigation into the data breach and to notify any additional entities and individuals whose documents and personal data may have been subject to unauthorised access."

The thieves abused a single vulnerable application to extract the info, EMA said in an earlier update.

How zero-days are exploited in the real world: Patch Tuesday is always a busy time as vendors emit scores of product fixes, which made it surprising that Google's Project Zero hotshots used the day to publish a six-part detailed report into a fairly unusual incident involving four zero-day holes being abused in the wild to hijack people's computers and devices.

The exploitation of the programming blunders was picked up early last year, and carried out by "a highly sophisticated" outfit, we're told. The intruders were observed using two different servers, one going after Windows machines and the other Android, in so-called watering-hole attacks – which is where the snoops figure out the websites or services routinely used by their targets, and compromise said platforms to then infect the visitors.

One of the exploited Chrome zero-day holes was a faulty JIT compiler issue, and the intruder chained this with three zero-days flaws in Windows' font handling and CSRSS to gain control of PCs. While the Android attack used exploits for known bugs in older builds of the OS, the Googlers said they think the attacker has zero-day exploits for the mobile operating system, too.

"These exploit chains are designed for efficiencya and flexibility through their modularity," Project Zero said.

"They are well-engineered, complex code with a variety of novel exploitation methods, mature logging, sophisticated and calculated post-exploitation techniques, and high volumes of anti-analysis and targeting checks. We believe that teams of experts have designed and developed these exploit chains."

Install an ad-blocker, says CISA: There were two alerts last week from the US government's Cybersecurity and Infrastructure Security Agency (CISA), one warning of hackers succeeding in busting open several enterprise clouds and another [PDF] suggesting federal agencies use ad blockers.

"CISA is aware of several recent successful cyberattacks against various organizations’ cloud services," agency said. "The cyber threat actors involved in these attacks used a variety of tactics and techniques - including phishing, brute force login attempts, and possibly a 'pass-the-cookie' attack - to attempt to exploit weaknesses in the victim organizations’ cloud security practices."

The pass-the-cookie attack is noteworthy as it may have allowed one miscreant to bypass multifactor authentication and get into protected areas of a network. Curiously, financial information was targeted in many of the intrusions.

Elsewhere, in a newly released Capacity Enhancement Guide, the CISA recommends US federal agencies install ad blockers to avoid malicious ad injections; standardize on a single, secure browser deployment; use DNS to block access to malicious sites and services; and isolate the browser from other software where possible

NSA issues do's and DoHn'ts: While we're on the topic of American advice, the National Security Agency has issued guidance on the correct way to run DNS-over-HTTPS (DoH) and claimed it isn't all plain sailing.

"DoH is not a panacea," the super-snoops' report states [PDF]. "DoH is specifically designed to encrypt only the DNS transaction between the client and resolver, not any other traffic that happens after the query is satisfied."

In addition, DoH's encrypted traffic makes life harder for systems that examine traffic for suspicious activity, and can be a pain to configure correctly, the agency said. It recommends DoH is suitable for home and mobile workers, and care should be taken when deploying it on core enterprise systems. ®

Speaking of the NSA... Long-time government advisor Rob Joyce has been appointed director of the NSA's Cybersecurity Directorate.

Send us news

Signal banned for booking obviously targeted ads? That story's too good to be true, Facebook says

Antisocial giant surprisingly vocal in dismissing chat app rival's 'stunt'

Encrypted messaging service Signal on Tuesday made a show of trolling Instagram and its parent company Facebook by creating ads that incorporated audience targeting categories into its ad copy.

The ads address viewers by identifying targeting criteria like lifestyle categories, occupation, geographic location, and personal interests presumably gleaned through online data collection.

Apart from the marketing value of tweaking a dominant messaging rival, Signal did so, it claims, to expose the inner workings of ad tech data collection.

Continue reading

Basecamp CEO issues apology after 'no political discussions at work' edict blows up in his face

30% of employees reportedly walked out following sudden rule change

Jason Fried, CEO of project management tool Basecamp, has issued a public apology following a major bust-up over new policies that discouraged employees from discussing "societal politics" at work.

Writing on the company's blog, Fried said: "Last week was terrible. We started with policy changes that felt simple, reasonable, and principled, and it blew things up culturally in ways we never anticipated. David [Heinemeier Hansson, CTO] and I completely own the consequences, and we're sorry. We have a lot to learn and reflect on, and we will."

The furore began on 26 April, when Fried published a list of changes to working conditions at Basecamp.

Continue reading

AWS to cut Python 2.7 off at the knees in July with 'minor version update' for Chalice

Seriously, it's time to move on

Amazon is the latest to drive a knife into the twitching corpse of Python 2 with an announcement that AWS Chalice will follow Lambda in nudging customers to later versions.

15 July is the cut-off date, which is generous considering the Python Software Foundation pulled the plug on fixes and support for Python 2 on 1 January 2020. AWS Lambda was supposed to follow suit on 1 June 2020 but, well, stuff happened in 2020 (in October support was stretched a little further until "at least 1 June 2021"). It took until 24 March 2021 for Amazon to settle on a death date for the tech.

Chalice is a framework for Lambda, and so will follow suit with what the cloud behemoth described as a "minor version update" that will require Python 3.6 or above (the Lambda crew recommends 3.8).

Continue reading

Aerospike adds set indexing and SQL expressions to make the distributed NoSQL database more ML-friendly

New Spark 3.0 connector will appeal to users too, analyst says

Distributed NoSQL database Aerospike is introducing set indexes and SQL operations within expressions in the pursuit of greater machine learning efficiency via its Apache Spark 3.0 connector.

Speaking to The Register, chief product officer Srini Srinivasan claimed the combined tweaks could help reduce the feedback cycle to improve ML models from days to hours.

A key-value and multi-modal database, Aerospike can run on the edge to support so-called real-time decisions based on pre-existing ML models in applications such as fraud detection. It is also used to feed data back into the ML model management commonly used by data pipeline platform Apache Spark to ensure models reflect changes to data patterns in the real world.

Continue reading

21 nails in Exim mail server: Vulnerabilities enable 'full remote unauthenticated code execution', millions of boxes at risk

Nearly 4 million to be exact, say researchers

Researchers at security biz Qualys discovered 21 vulnerabilities in Exim, a popular mail server, which can be chained to obtain "a full remote unauthenticated code execution and gain root privileges on the Exim Server."

Exim is a mail transfer agent (MTA), responsible for receiving and forwarding email messages. It runs primarily on Unix or Linux and is the default MTA on Debian - though Ubuntu and Red Hat Enterprise Linux use Postfix by default.

Some hosting companies use Exim to provide email services to their customers, and it was also popular in universities and other educational institutions (it was initially developed at the University of Cambridge in 1995) though many of these have transitioned to Office 365 or Google email, not least Cambridge itself.

Continue reading

Microsoft's Edge browser for Linux hits the Beta Channel... if you're into that kind of thing

Add yet another Chromium browser to your collection

Microsoft's Edge browser has taken another step to stability on Linux with the addition of the operating system to its Beta Channel.

Quite why anyone would actually want Microsoft's latest attempt at a browser on Linux is open to question. From the perspective of the Windows giant, getting developers to test their code on the platform is the name of the game and the move from the Dev Channel to Beta signifies a stable edition is on the way.

The first preview builds of Edge for Linux turned up in 2020. Penguinistas have not been treated to the daily updates of the Canary Channel – only Windows, HoloLens 2, and MacOS users get those – but they have been receiving regular drops on the Dev Channel. In March, for example, lucky Linux fans were able to synchronise their settings using their Microsoft account.

Continue reading

Facebook Oversight Board upholds decision to ban Trump, asks FB to look at own 'potential contribution' to 'narrative of electoral fraud'

Looks like you can safely ignore that friend request... forever

The Facebook Oversight Board has upheld former President Donald Trump’s ban from Facebook and Instagram - but not before advising the platform to look at its own role in the Capitol-storming mess.

The social media giant was the first major platform to ban Trump following the January 6 insurrection, when hundreds of his supporters stormed the US capitol with the aim to disrupt the certification of the 2020 election results.

In its ruling, the Oversight Board, which has been described as “the Supreme Court for Facebook,” affirmed the decision to ban Trump, although it criticised the social platform for failing to adhere to its existing content moderation policies.

Continue reading

East London council blurts thousands of residents' email addresses in To field blunder

'Was a Mailchimp sub too hard?!' asks Reg reader

A local authority in East London has committed a classic privacy blunder by emailing what appear to be thousands of residents – while forgetting to use the BCC field and exposing all of the email addresseses to each recipient.

The cockup, which happened on Monday, had locals in the borough of Tower Hamlets receive emails with hundreds of addresses visible.

Register reader Patrick, who was the unlucky recipient of one such message, told us: "The email I received had 400 recipients in the To: field, I assume because Outlook has a limit of 500... Just assuming that I received all the Bs and Cs (and I probably only received a chunk) – then that's ~5,000 email addresses they leaked."

Continue reading

As pandemic buying continues, Chromebook shipments soared 275% in Q1, says analyst

Crossing the chasm into mainstream computing

Shipments of Chromebooks reached 12 million globally in the first three months of 2021, according to analyst outfit Canalys, which pegged the year-on-year growth at a stratospheric 275 per cent.

The vendor with the largest total number of sales-in was HP, with 4.36 million units leaving its factories, up 633.7 per cent year-on-year. HP said Chromebook sales had quadrupled in its Q1 ended 31 January to account for $1.69bn or 16 per cent of its PC business revenues.

HP CEO Enrique Lores sounded like the company could have sold more if only those pesky component shortages hadn't been a determining factor, saying on a Q1 conference call it had "increased inventory" and was "changing...the connections that we have with certain component providers."

Continue reading

Twilio's private GitHub repositories cloned by Codecov attacker, cloud comms platform confirms

Used the GitHub Codecov Action? Credentials may have been pilfered

Cloud comms platform Twilio has confirmed its private GitHub repositories were cloned after it became the latest casualty of the compromised credential-stealing Codecov script.

Codecov, a cloud-based tool for assessing how much code is covered by software tests, revealed last month that a script called Bash Uploader had been altered by a criminal to export secrets stored in environmental variables to a third-party server. This script is widely used for Codecov integration, including within GitHub Actions, popular for Continuous Integration (CI) pipelines.

Twilio said: "We have Codecov tools, including the Bash Uploader component, in use in a small number of our projects and CI pipelines." The company added that these particular projects were "not in the critical path to providing updates or functionality to our communication APIs" and that it has "remediated the potential exposure by thoroughly reviewing and rotating any potentially exposed credentials."

Continue reading

Microsoft reassures Teams freebie fans: We're not going to delete all your data, honest

The bug: IF Tier = Free THEN PRINT "Can we offer you an upgrade?"

Microsoft has had its very own Who, Me? moment after being forced to apologise for a bug that spammed administrators of Teams Free organisations to suggest they should upgrade to avoid imminent deletion of data.

The oopsie actually occurred in April (although a full explanation was not shared until last night) and resulted in users of the company's freebie version of Teams receiving an email warning that their trial was coming to an end. If a new subscription was not swiftly acquired then users would lose access to their data after around 30 days. Administrators would subsequently have 90 days to upgrade or face permanent deletion.

Understandably, customers were left a little baffled. After all, Teams has a Free tier and a bunch of Frequently Asked Questions includes hits such as "Is Microsoft Teams really free?" (answer: "Yes!") and "Will my account my expire?" (answer: "No, your account will not expire.")

Continue reading