Sécurité info - Page 78

https://www.tomshardware.com/tech-industry/cyber-security/china-says-it-has-foiled-a-series-u-s-cyberattacks-on-its-critical-infrastructure-ministry-of-state-security-says-it-has-irrefutable-evidence-nsa-tried-to-cause-international-time-chaos
China’s Ministry of State Security (MSS) has taken to social media to boast about foiling a series of cyberattacks it says were directed by the U.S. National Security Agency (NSA) (machine translation). Moreover, the MSS claims to have “irrefutable evidence” to back up its allegations.

According to the MSS WeChat post, the target of the NSA’s sustained series of attacks, dating back to 2022, was China’s National Time Service Center (NTSC).

CVE, CVSS scores need overhauling, argues Codific CEOwww.theregister.com: CVE and CVSS systems suffer from misaligned incentives and inconsistency

Aram Hovespyan, co-founder and CEO of security biz Codific, says that the rating systems for identifying security vulnerabilities and assessing threat risk need to be overhauled.

Having examined the CVE (Common Vulnerabilities and Exposures) vulnerability identification numbering system, Hovespyan argues that about a third of CVEs are meaningless.

His analysis cites academic research published in August as part of the USENIX Security Symposium. The paper, "Confusing Value with Enumeration: Studying the Use of CVEs in Academia," (Moritz Schloegel et al.), reports that 34 percent of 1,803 CVEs cited in research papers over the past five years either have not been publicly confirmed or have been disputed by maintainers of the supposedly vulnerable software projects. The authors argue that CVEs should not be taken as a proxy for the real-world impact of claimed vulnerabilities.

Iran’s MOIS-linked Ravin Academy hit by data breachwww.theregister.com: Ravin Academy confirms the intrusion on Telegram, says student data was stolen

Iran's school for state-sponsored cyberattackers admits it suffered a breach exposing the names and other personal information of its associates and students.

The Ravin Academy was established in 2019, ostensibly to train individuals in all facets of cybersecurity and recruit the best to work on Iranian intelligence (MOIS) projects.

As part of some broader actions against Iran, Ravin was sanctioned by the UK, US, and EU between 2022 and 2023 for its role in recruiting cyber specialists to carry out human rights violations.

In a statement posted to its Telegram channel on October 22, Ravin confirmed that the attack targeted one of the online platforms it hosts, and highlighted the timing as an attempt to undermine confidence in Iranian security.

"As a result of this attack, some of the public information of participants (including username and phone number) on this platform has not been recorded," the statement read, according to a machine translation from Persian that likely meant the data had been recorded.

Cette opération au long cours s’appuie sur cinq extensions piégées. Trois ont été mises en ligne entre 2018 et 2019, dont Clean Master, qui a dépassé les 200 000 installations.

Pendant des années, ce nettoyeur de cache et de données, censé accélérer le navigateur et protéger la vie privée, a rempli sa promesse, au point d’obtenir les labels « à la une » et « vérifiée » sur les marketplaces de Chrome et d’Edge.​

Puis, courant 2024, ShadyPanda, qui contrôlait discrètement l’extension, a diffusé une mise à jour malveillante, infectant automatiquement les centaines de milliers d’utilisateurs via le mécanisme de mise à jour automatique des navigateurs. Le code malveillant fraichement injecté offre une surveillance complète du navigateur et interroge chaque heure une infrastructure de commande pour récupérer de nouvelles instructions distillées par les assaillants.

Une caractéristique particulièrement sournoise qui alerte les chercheurs : « Il ne s’agit pas d’un logiciel malveillant à fonction fixe, mais d’une porte dérobée. ShadyPanda décide de son fonctionnement. Aujourd’hui, il s’agit de surveillance ; demain, ce pourrait être un ransomware, un vol d’identifiants ou de l’espionnage industriel. »

A Microsoft zero-day vulnerability that allows an unprivileged user to crash the Windows Remote Access Connection Manager (RasMan) service now has a free, unofficial patch - with no word as to when Redmond plans to release an official one - along with a working exploit circulating online.

Researchers from 0patch, the micropatching site, uncovered the denial-of-service (DoS) bug while investigating CVE-2025-59230, a Windows RasMan privilege escalation vulnerability that Redmond fixed in October, but not before attackers found and exploited the vulnerability.

RasMan is a critical Windows service that manages VPN and other remote network connections, and CVE-2025-59230 allows an authorized attacker to elevate privileges locally and gain SYSTEM privileges. It essentially takes advantage of the fact that when RasMan is not running, any process can impersonate RasMan and execute code on an RPC endpoint - a condition the exploit depends on.

Zerosquare (./2325) :
Très lucratif ? Bon, va falloir que je revoie mes tarifs, alors.

Iceman RGC (./2330) :

Ethical Hackingwww.facebook.comYour headphones just became a backdoor to your phone. No pairing. No popup. Just Bluetooth range. 70 million chips. Sony. Bose. Marshall. JBL. A debug protocol active on production devices. Attackers...

Bluetooth Headphones Can Be Weaponized to Hack Phones  | eSecurity PlaneteSecurity PlanetHigh-severity flaws in popular Bluetooth headphones can enable eavesdropping and smartphone hijacking, with many devices still unpatched.

Mandiant releases rainbow table that cracks weak admin password in 12 hoursArs TechnicaWindows laggards still using the vulnerable hashing function: Your days are numbered.

Security firm Mandiant has released a database that allows any administrative password protected by Microsoft’s NTLM.v1 hash algorithm to be hacked in an attempt to nudge users who continue using the deprecated function despite known weaknesses.

The database comes in the form of a rainbow table, which is a precomputed table of hash values linked to their corresponding plaintext. These generic tables, which work against multiple hashing schemes, allow hackers to take over accounts by quickly mapping a stolen hash to its password counterpart. NTLMv1 rainbow tables are particularly easy to construct because of NTLMv1’s limited keyspace, meaning the relatively small number of possible passwords the hashing function allows for. NTLMv1 rainbow tables have existed for two decades but typically require large amounts of resources to make any use of them.

On Thursday, Mandiant said it had released an NTLMv1 rainbow table that will allow defenders and researchers (and, of course, malicious hackers, too) to recover passwords in under 12 hours using consumer hardware costing less than $600 USD. The table is hosted in Google Cloud. The database works against Net-NTLMv1 passwords, which are used in network authentication for accessing resources such as SMB network sharing.

Despite its long- and well-known susceptibility to easy cracking, NTLMv1 remains in use in some of the world’s more sensitive networks. One reason for the lack of action is that utilities and organizations in industries, including health care and industrial control, often rely on legacy apps that are incompatible with more recently released hashing algorithms. Another reason is that organizations relying on mission-critical systems can’t afford the downtime required to migrate. Of course, inertia and penny-pinching are also causes.