Bij SIDN check je de beschikbaarheid van een .nl-domeinnaam. Wij bieden je ook security- en inlogoplossingen, zoals SIDN Merkbewaking en IRMAconnect.

The BBC has been asked to ask your questions about Guernsey's coronavirus lockdown.

De BBC is gevraagd om uw vragen te stellen over Guernsey's coronavirus lockdown.

In verband met een bedrijfsbrede bijeenkomst zijn wij vrijdagmiddag 24 juni vanaf 12.00 uur telefonisch niet bereikbaar. Natuurlijk kun je je vragen wel mailen naar support@sidn.nl. Onze supportmedewerkers pakken je vragen dan zo snel mogelijk op.

Due to a company-wide meeting, we will not be available by phone Friday afternoon, June 24, starting at noon. Of course, you can email your questions to support@sidn.nl. Our support staff will address your questions as soon as possible.

In verband met een bedrijfsbrede bijeenkomst zijn wij vrijdagmiddag 24 juni vanaf 12.00 uur telefonisch niet bereikbaar.

Natuurlijk kun je je vragen wel mailen naar support@sidn.nl. Onze supportmedewerkers pakken je vragen dan zo snel mogelijk op.

Vrijdag 24-06 zijn we vanaf 12.00 uur telefonisch niet bereikbaar | Over SIDN | SIDN

Excited to watch Rick and Morty season 5? We'll explain how to watch Rick and Morty season 5 online, from abroad, with a VPN.

Rick and Morty is returning to the US on Sunday, but what can we expect from this season?

Rick and Morty keert zondag terug naar de VS, maar wat kunnen we van dit seizoen verwachten?

Rick and Morty season 5 is set to premiere on Sunday, June 20 at 11 PM EST (8 PM PST). Depending on your location, you may find that you can’t watch Rick and Morty season 5 due to geographic restrictions. We’re only recommending official sources for watching Rick and Morty season 5 online.

Rick and Morty seizoen 5 gaat in première op zondag 20 juni om 11 PM EST (8 PM PST). Afhankelijk van uw locatie, kan het zijn dat u Rick and Morty seizoen 5 niet kunt kijken door geografische beperkingen. We raden u alleen officiële bronnen aan om Rick and Morty seizoen 5 online te bekijken.

Rick and Morty season 5 is set to premiere on Sunday, June 20 at 11 PM EST (8 PM PST). While fans had to suffer a two-year wait between seasons 3 and 4, it’s only just over a year since season 4 ended. Depending on your location, you may find that you can’t watch Rick and Morty season 5 due to geographic restrictions. Fortunately, you can unblock and live stream it with the help of a Virtual Private Network (VPN).

We’re only recommending official sources for watching Rick and Morty season 5 online. While unlicensed streams may be available, they’re generally not worth your time or effort. One reason for this is that unauthorized sources can be taken offline for copyright infringement. Combine this with inferior video quality, lots of lag, and long buffering times and it becomes clear that this method will most likely cause you to miss out on some of Rick and Morty season 5.

Rick and Morty season 5 is only available on region-locked platforms. As such, you’ll need to connect to a VPN in order to live stream episodes from abroad.

How to watch Rick and Morty season 5 online with a VPN

VPNs hide your real IP address, replacing it with that of the server you’re connected to. This means that if you use a US-based server, you can trick American streaming services into letting you use them abroad. Sound confusing? Don’t worry; here’s a step-by-step guide to watching Rick and Morty season 5 online from anywhere:
• Sign up with a VPN service. We recommend NordVPN. However, Surfshark and ExpressVPN are two great value alternatives.
• Download and install the appropriate VPN app (or browser extension) for your device.
• Open the VPN app and connect to a server in the appropriate location. For instance, use a server in the US to unblock Adult Swim or a British one to access All 4 abroad.
• Visit your chosen website, create an account (if required), and sign in.
• Finally, try playing an episode. It should now play without any issues. If the content is still blocked, try clearing your browser’s cache and cookies.

Rick and Morty season 5 will air live on Adult Swim. Don’t want to miss out on the season 5 premiere? You should test your VPN with Adult Swim ahead of time. If you happen to encounter an issue, you’ll have enough time to troubleshoot it with your VPN’s customer support.

How to watch Rick and Morty season 5 on US TV

You can watch Rick and Morty season 5 on Adult Swim. In order to watch live, you’ll need to sign in via your cable TV provider. However, it’s worth knowing that if you’re willing to wait week or so, new episodes then become free-to-watch.

If you really can’t wait and want to watch Adult Swim without cable, you could watch via Hulu with Live TV and YouTube TV, both of which cost $64.99 USD per month. Both of these services offer a free trial, so you can sign up and have plenty of time to test them out for free with Rick and Morty season 5.

Adult Swim is only available in the US. Despite this, with a VPN, you can live stream Rick and Morty season 5 online from anywhere. NordVPN comes with a 30-day money-back guarantee. This means you can try it out risk-free and claim a full refund if you’re not satisfied.

Where else can I watch Rick and Morty season 5 online?

Rick and Morty has a cult following across the world, so it’s only natural that it’d be available for streaming overseas. Below, we explain which networks are showing Rick and Morty season 5 where you are:

Rick and Morty season 5 will premiere in the UK just one day after its initial US premiere. Indeed, it’s coming to E4 on Monday, June 21 at 10 PM BST. You’ll therefore be able to watch it on-demand afterwards. Better still, you’ll be able to do so completely free-of-charge (albeit with ads) on All 4.

You’ll have to be quick, though, as new episodes are only available for 30 days after airing, and there’s no concrete information as to where you’ll be able to watch when they’re removed (odds are Netflix UK will get season 5 at some point, but there’s no telling when).

Channel 4’s E4 content is geo-restricted and only available in the UK. If you’re traveling abroad, you can access All 4 by obtaining a UK IP address via a VPN.

If you’re in Australia, things are nice and easy: Rick and Morty season 5 should be following previous seasons and coming to Netflix. Plans start at $10.99 AUD per month. Keep in mind that Netflix is region-locked and Rick and Morty isn’t available everywhere. To watch it from outside of Australia, you’ll need a VPN.

What can we expect from Rick and Morty season 5?

Like previous seasons, there will be a total of 10 episodes in Rick and Morty season 5. These will air on a weekly basis. As always, there are some interesting episode titles which include “Mort Dinner Rick Andre” and “Mortyplicity”.

As in previous seasons, most episodes are self-contained adventures, so don’t expect a long-running, intricately-woven narrative. That said, season 5 is like to have some of the most memorable episodes to date. In fact, as we can see from the season 5 cold open clip, we’ll quickly be introduced to Mr. Nimbus, Rick’s nemesis.

Which cast members are returning for Rick and Morty season 5?

All of the key cast members return. This includes Justin Roiland as characters Rick and Morty, Chris Parnell as Jerry, Spencer Grammer as Summer, and Sarah Chalke as Beth. As in previous seasons, there’ll be plenty of guest stars voicing characters. Indeed, season 5 is set to feature Timothy Olyphant, Christina Ricci, and Alison Brie.

Can I use a free VPN to watch Rick and Morty abroad?

No. Although there are some free VPNs available on the market, they are not suitable for streaming online. Free VPNs are oversubscribed, and they have very few servers. This causes the VPN to be highly congested, which results in bad speeds. This sluggishness is exacerbated if the free VPN provider implements bandwidth throttling.

In addition to being slow, free VPNs do not have servers that work to access streaming services. This is because it is easy for streaming platforms to block IP address ranges associated with free VPNs. As a result, you will need a secure premium VPN to watch Rick and Morty.

Finally, we recommend against using free VPNs for privacy and security reasons. Free VPN providers need to make a profit, and they do so by turning your data and browsing habits into a revenue stream. As a result, free VPNs have extremely invasive privacy policies that allow them to sell your data to marketing companies and data aggregators.

Furthermore, free VPNs have been found to lie about the level of protection they provide, sometimes claiming to have encryption when they have none. Add to this app vulnerabilities, data leaks, and even spyware-filled apps, and you can see why free VPNs are a danger to your online health.

Is there anywhere to watch Rick and Morty for free?

You can stream all seasons of Rick and Morty free and on-demand on All4 if you live in the UK. The entire series frequently airs on Adult Swim for US residents – the adult equivalent of Cartoon Network. However, you won’t be able to select which episode you want to watch using Adult Swim as the show is aired live.

For users outside of the US and the UK, the only way to stream the show free on All4 or Adult Swim is by using a VPN. However, this may be against the terms of the streaming provider.

How to Watch Rick and Morty Season 5 Online Abroad (with a VPN)

Azeefa Fathima reports: The data of thousands of persons who had registered for attending the annual Chithirai festival of the Madurai Meenakshi Amman Temple,...

The authorities in Sri Lanka have released details of thousands of people who had registered for a temple festival.

De autoriteiten in Sri Lanka hebben gegevens vrijgegeven van duizenden mensen die zich hadden ingeschreven voor een tempelfeest.

The data of thousands of persons who had registered for attending the annual Chithirai festival of the Madurai Meenakshi Amman Temple, was leaked via an email sent to those who registered on the temple’s website. Meanwhile, the officials remained unaware of the incident. Instead, it seems the email sent them to a web page where the data of thousands of people was exposed to the world.

De gegevens van duizenden personen die zich hadden ingeschreven voor het jaarlijkse Chithirai festival van de Madurai Meenakshi Amman Tempel, zijn uitgelekt via een e-mail die is gestuurd naar degenen die zich hadden ingeschreven op de website van de tempel. De hele zaak klinkt als fout op fout, waarbij degenen die via het loterijstelsel kaartjes hadden aangevraagd, verwachtten een e-mail te krijgen waarin stond hoe degenen die de loterij hadden gewonnen, konden betalen en kaartjes konden afhalen. In plaats daarvan lijkt de e-mail hen naar een webpagina te hebben gestuurd waar de gegevens van duizenden mensen aan de wereld werden blootgesteld.

The data of thousands of persons who had registered for attending the annual Chithirai festival of the Madurai Meenakshi Amman Temple, was leaked via an email sent to those who registered on the temple’s website. The leaked data includes the names, contact details, ID proofs (Aadhaar, pan card, etc). Meanwhile, the officials remained unaware of the incident.

Read more on The News Minute. The whole thing sounds like error upon error, where those who sought tickets via the lottery system expected to get an email telling those who had won the lottery how to make payment and pick up tickets.

Instead, it seems the email sent them to a web page where the data of thousands of people was exposed to the world.

Massive data leak of devotees from Meenakshi temple, admin claims technical glitch

Security researchers with Cado Labs said they have found what they believe is the first publicly-known case of malware specifically designed to execute in an AWS Lambda environment.

A malware designed to run cryptomining software is being targeted by hackers, according to a new report.

Volgens een nieuw rapport is een malware die ontworpen is om cryptomining-software uit te voeren, het doelwit van hackers.

Security researchers with Cado Labs said they have found what they believe is the first publicly-known case of malware specifically designed to execute in an AWS Lambda environment. From the telemetry we have seen, the distribution of Denonia so far has been limited.”The malware contains a customized variant of the XMRig mining software, a common app used for cryptocurrency mining by both legitimate users and malware gangs. The malware is written in Go, Google’s programming language.

Beveiligingsonderzoekers van Cado Labs zeiden dat ze het volgens hen eerste publiek bekende geval hebben gevonden van malware die specifiek is ontworpen om uit te voeren in een AWS Lambda-omgeving. AWS Lambda is een veelgebruikt, serverless computing-platform dat door Amazon wordt aangeboden als onderdeel van Amazon Web Services. De malware bevat een aangepaste variant van de XMRig mining software, een veelgebruikte app voor het delven van cryptocurrency door zowel legitieme gebruikers als malware bendes.

Security researchers with Cado Labs said they have found what they believe is the first publicly-known case of malware specifically designed to execute in an AWS Lambda environment.

AWS Lambda is a widely-used, serverless computing platform provided by Amazon as a part of Amazon Web Services.

In a report released on Wednesday, Cado Labs researcher Matt Muir said they decided to name the malware “Denonia,” after the name the attackers gave the domain it communicates with.

“The malware uses newer address resolution techniques for command and control traffic to evade typical detection measures and virtual network access controls,” Muir said.

“Although this first sample is fairly innocuous in that it only runs cryptomining software, it demonstrates how attackers are using advanced cloud-specific knowledge to exploit complex cloud infrastructure, and is indicative of potential future, more nefarious attacks. From the telemetry we have seen, the distribution of Denonia so far has been limited.”

The malware contains a customized variant of the XMRig mining software, a common app used for cryptocurrency mining by both legitimate users and malware gangs.

The malware is written in Go, Google’s programming language. Muir noted that there is an increasing amount of malware being written in Go because it can easily “produce cross-compatible executables” and provides a host of other benefits.

Muir also noted that his team has not identified how Denonia is deployed yet.

“It may simply be a matter of compromising AWS Access and Secret Keys then manually deploying into compromised Lambda environments, as we’ve seen before with more simple Python scripts,” he wrote.

“Interestingly – this isn’t the only sample of Denonia. Whilst the first sample we looked at dates from the end of February, we also found a second sample that was uploaded to VirusTotal in January 2022.”

Netenrich principal threat hunter John Bambenek explained that while it has been common for attackers to target automated environments to run cryptomining software – like what happened with Jenkins – this is the first time that he has seen Lambda targeted.

“It comes as no surprise as many organizations have no real controls on development cloud resources and cryptomining is low-hanging fruit for hackers to monetize lax DevOps security,” he told The Record.

Casey Bisson, head of product growth at code security firm BluBracket, said Lambda instances are “plentiful and often poorly monitored,” making them ripe for attack and potentially difficult to secure.

Bisson compared it to the poorly secured IoT devices that made the Mirai botnet possible, which used hundreds of thousands of infected devices to launch distributed denial-of-service attacks starting in 2016.

“Cloud credential theft is common, supporting the report’s hypothesis about the attack vector,” Bisson said. “A secret in code is a secret shared.”

Researcher finds cryptomining malware targeting AWS Lambda

The security flaw tracked as CVE-2022-30216 could allow attackers to perform server spoofing or trigger authentication coercion on the victim.

A vulnerability in the Windows server system could be exploited by malicious actors, according to security researchers.

Een kwetsbaarheid in het Windows-serversysteem kan door kwaadwillenden worden uitgebuit, aldus beveiligingsonderzoekers.

Researchers have discovered a vulnerability in the remote procedure calls (RPC) for the Windows Server service, which could allow an attacker to gain control over the domain controller (DC) in a specific network configuration and execute remote code. Vulnerability CVE-2022-30216, which exists in unpatched Windows 11 and Windows Server 2022 machines, was addressed in July's Patch Tuesday, but a report from Akamai researcher Ben Barnes, who discovered the vulnerability, offers technical details on the bug. The vulnerability was found in SMB over QUIC, a transport-layer network protocol, which enables communication with the server.

Onderzoekers hebben een kwetsbaarheid ontdekt in de remote procedure calls (RPC) voor de Windows Server-service, waardoor een aanvaller controle zou kunnen krijgen over de domeincontroller (DC) in een specifieke netwerkconfiguratie en code op afstand zou kunnen uitvoeren. Kwaadwillenden zouden het lek ook kunnen misbruiken om de mapping van het certificaat van een server te wijzigen en zo server spoofing uit te voeren. De kwetsbaarheid werd gevonden in SMB over QUIC, een transportlaag-netwerkprotocol, dat communicatie met de server mogelijk maakt.

Researchers have discovered a vulnerability in the remote procedure calls (RPC) for the Windows Server service, which could allow an attacker to gain control over the domain controller (DC) in a specific network configuration and execute remote code.

Malicious actors could also exploit the vulnerability to modify a server's certificate mapping to perform server spoofing.

Vulnerability CVE-2022-30216, which exists in unpatched Windows 11 and Windows Server 2022 machines, was addressed in July's Patch Tuesday, but a report from Akamai researcher Ben Barnes, who discovered the vulnerability, offers technical details on the bug.

The full attack flow provides full control over the DC, its services, and data.

The vulnerability was found in SMB over QUIC, a transport-layer network protocol, which enables communication with the server. It allows connections to network resources such as files, shares, and printers. Credentials are also exposed based on belief that the receiving system can be trusted.

The bug could allow a malicious actor authenticated as a domain user to replace files on the SMB server and serve them to connecting clients, according to Akamai. In a proof of concept, researchers exploited the bug to steal credentials via authentication coercion.

Specifically, they set up an NTLM relay attack. Now deprecated, NTLM uses a weak authentication protocol that can easily reveal credentials and session keys. In a relay attack, bad actors can capture an authentication and relay it to another server — which they can then use to authenticate to the remote server with the compromised user's privileges, providing the ability to move laterally and escalate privileges within an Active Directory domain.

"The direction we chose was to take advantage of the authentication coercion," Akamai security researchers Ophir Harpaz says. "The specific NTLM relay attack we chose involves relaying the credentials to the Active Directory CS service, which is responsible for managing certificates in the network."

Once the vulnerable function is called, the victim immediately sends back network credentials to an attacker-controlled machine. From there, attackers can gain full remote code execution (RCE) on the victim machine, establishing a launching pad for several other forms of attack including ransomware, data exfiltration, and others.

"We chose to attack the Active Directory domain controller, such that the RCE will be most impactful," Harpaz adds.

Akamai's Ben Barnea points out with this case, and since the vulnerable service is a core service on every Windows machine, the ideal recommendation is to patch the vulnerable system.

"Disabling the service is not a feasible workaround," he says.

Bud Broomhead, CEO at Viakoo, says in terms of negative impact to organizations, server spoofing is also possible with this bug.

"Server-spoofing adds additional threats to the organization, including man-in-the-middle attacks, data exfiltration, data tampering, remote code execution, and other exploits," he adds.

A common example of this can be seen with Internet of Things (IoT) devices tied to Windows application servers; e.g., IP cameras all connected to a Windows server hosting the video management application.

"Often IoT devices are set up using the same passwords; gain access to one, you've gained access to them all," he says. "Spoofing of that server can enable data integrity threats, including planting of deepfakes."

Broomhead adds that at a basic level, these exploitation paths are examples of breaching internal system trust — especially in the case of authentication coercion.

Mike Parkin, senior technical engineer at Vulcan Cyber, says while it doesn't appear that this issue has yet been leveraged in the wild, a threat actor successfully spoofing a legitimate and trusted server, or forcing authentication to an untrusted one, could cause a host of problems.

"There are a lot of functions that are based on the 'trust' relationship between server and client and spoofing that would let an attacker leverage any of those relationships," he notes.

Parkin adds a distributed workforce broadens the threat surface considerably, which makes it more challenging to properly control access to protocols that shouldn't be seen outside the organization's local environment.

Broomhead points out rather than the attack surface being contained neatly in data centers, distributed workforces have also expanded the attack surface physically and logically.

"Gaining a foothold within the network is easier with this expanded attack surface, harder to eliminate, and provides potential for spillover into the home or personal networks of employees," he says.

From his perspective, maintaining zero trust or least privileged philosophies reduces the dependence on credentials and the impact of credentials being stolen.

Parkin adds that reducing the risk from attacks like this requires minimizing the threat surface, proper internal access controls, and keeping up to date on patches throughout the environment.

"None of them are a perfect defense, but they do serve to reduce the risk," he says.

Windows Vulnerability Could Crack DC Server Credentials Open

A cybersecurity firm found that Microsoft workers uploaded sensitive login credentials to Microsoft's own systems to GitHub.

Microsoft has been exposed to a range of sensitive data leakages, according to researchers.

Microsoft is volgens onderzoekers blootgesteld aan een reeks lekken van gevoelige gegevens.

Multiple people who appear to be employees of Microsoft have exposed sensitive login credentials to the company’s own infrastructure on GitHub, potentially offering attackers a gateway into internal Microsoft systems, according to a cybersecurity research firm that found the exposed credentials. This is a very challenging issue for most companies these days,” Mossab Hussein, chief security officer at cybersecurity firm spiderSilk which discovered the issue, told Motherboard in an online chat. SpiderSilk has previously discovered an exposed list of Slack channels belonging to Electronic Arts; the personal information of WeWork customers uploaded by WeWork developers; and that education giant Elsevier exposed users’ passwords.

Meerdere mensen die werknemers van Microsoft blijken te zijn, hebben gevoelige inloggegevens voor de eigen infrastructuur van het bedrijf op GitHub openbaar gemaakt, waardoor aanvallers mogelijk toegang krijgen tot interne Microsoft-systemen, aldus een cyberbeveiligingsonderzoeksbureau dat de openbaar gemaakte gegevens heeft gevonden. SpiderSilk ontdekte eerder een blootgestelde lijst van Slack-kanalen van Electronic Arts; de persoonlijke gegevens van WeWork-klanten die door WeWork-ontwikkelaars waren geüpload; en dat onderwijsgigant Elsevier de wachtwoorden van gebruikers blootstelde. Bent u op de hoogte van andere blootstellingen aan gevoelige gegevens?

Multiple people who appear to be employees of Microsoft have exposed sensitive login credentials to the company’s own infrastructure on GitHub, potentially offering attackers a gateway into internal Microsoft systems, according to a cybersecurity research firm that found the exposed credentials.

“We continue to see that accidental source code and credential leakages are part of the attack surface of a company, and it’s becoming more and more difficult to identify in a timely and accurate manner. This is a very challenging issue for most companies these days,” Mossab Hussein, chief security officer at cybersecurity firm spiderSilk which discovered the issue, told Motherboard in an online chat. SpiderSilk has previously discovered an exposed list of Slack channels belonging to Electronic Arts; the personal information of WeWork customers uploaded by WeWork developers; and that education giant Elsevier exposed users’ passwords.

Do you know about any other sensitive data exposures? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, or email joseph.cox@vice.com.

Hussein provided Motherboard with seven examples in total of exposed Microsoft logins. All of these were credentials for Azure servers. Azure is Microsoft’s cloud computer service and is similar to Amazon Web Services. All of the exposed credentials were associated with an official Microsoft tenant ID. A tenant ID is a unique identifier linked to a particular set of Azure users. One of the GitHub users also listed Microsoft on their profile.

Three of the seven login credentials were still active when spiderSilk discovered them, with one seemingly uploaded just days ago at the time of writing. The other four sets of credentials were no longer active but still highlighted the risk of workers accidentally uploading keys for internal systems.

Microsoft refused to elaborate on what systems the credentials were protecting when asked multiple times by Motherboard. But generally speaking an attacker may have an opportunity to move onto other points of interest after gaining initial access to an internal system.

One of the GitHub profiles with exposed and active credentials makes a reference to the Azure DevOps code repository. Highlighting the risk that such credentials may pose, in an apparently unrelated hack in March attackers gained access to an Azure DevOps account and then published a large amount of Microsoft source code, including for Bing and Microsoft’s Cortana assistant.

Regarding the fresh credential exposure, a Microsoft spokesperson told Motherboard in an email that “We’ve investigated and have taken action to secure these credentials. While they were inadvertently made public, we haven’t seen any evidence that sensitive data was accessed or the credentials were used improperly. We’re continuing to investigate and will continue to take necessary steps to further prevent inadvertent sharing of credentials.”

Microsoft Employees Exposed Own Company's Internal Logins

Mobile transactions could’ve been disabled, created and signed by attackers.

A security flaw could have allowed hackers to hack into millions of smartphones, according to a new study.

Een beveiligingslek zou hackers in staat hebben kunnen stellen miljoenen smartphones te kraken, zo blijkt uit een nieuwe studie.

Researchers at Check Point Research revealed last week in a report released at DEF CON that the Xiaomi smartphone flaw could have allowed hackers to hijack the mobile payment system and disable it or create and sign their own forged transactions. The potential pool of victims was massive, considering one in seven of the world’s smartphones are manufactured by Xiaomi, according to Q2/22 data from Canalys. He said, the Check Point study marks the first time Xiaomi’s trusted applications have been reviewed for security issues.

Onderzoekers van Check Point Research onthulden vorige week in een rapport dat werd vrijgegeven op DEF CON dat de Xiaomi smartphone fout hackers in staat had kunnen stellen om het mobiele betalingssysteem te kapen en het uit te schakelen of hun eigen vervalste transacties te creëren en te ondertekenen. De potentiële groep slachtoffers was enorm, aangezien een op de zeven smartphones ter wereld door Xiaomi wordt vervaardigd, volgens gegevens van Canalys over Q2/22. Volgens Canalys is het bedrijf wereldwijd de op twee na grootste leverancier.

Smartphone maker Xiaomi, the world’s number three phone maker behind Apple and Samsung, reported it has patched a high-severity flaw in its “trusted environment” used to store payment data that opened some of its handsets to attack.

Researchers at Check Point Research revealed last week in a report released at DEF CON that the Xiaomi smartphone flaw could have allowed hackers to hijack the mobile payment system and disable it or create and sign their own forged transactions.

The potential pool of victims was massive, considering one in seven of the world’s smartphones are manufactured by Xiaomi, according to Q2/22 data from Canalys. The company is the third largest vendor globally, according to Canalys.

 “We discovered a set of vulnerabilities that could allow forging of payment packages or disabling the payment system directly, from an unprivileged Android application. We were able to hack into WeChat Pay and implemented a fully worked proof of concept,” wrote Slava Makkaveev, security researcher with Check Point.

He said, the Check Point study marks the first time Xiaomi’s trusted applications have been reviewed for security issues. WeChat Pay is a mobile payment and digital wallet service developed by a firm of the same name, which is based in China. The service is used by over 300 million customers and allows Android users to make mobile payments and online transactions.

It’s unclear how long the vulnerability existed or if it was exploited by attackers in the wild. The bug, tracked as CVE-2020-14125, was patched by Xiaomi in June and has a CVSS severity rating of high.

“A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be exploited by attackers to make denial of service,” according to the NIST common vulnerability and exposure description of the bug.

While details of the bug’s impact were limited at the time Xiaomi disclosed the vulnerability in June, researchers at Check Point have outlined in its postmortem of the patched bug and the full potential impact of the flaw.

The core issue with Xiaomi phone was the mobile phones payment method and the Trusted Execution Environment (TEE) component of the phone. The TEE is the Xiaomi’s virtual enclave of the phone, responsible for processing and storing ultra-sensitive security information such fingerprints and the cryptographic keys used in signing transactions.

“Left unpatched, an attacker could steal private keys used to sign WeChat Pay control and payment packages. Worst case, an unprivileged Android app could have created and signed a fake payment package,” researchers wrote.

Two types of attacks could have been performed against handsets with the flaw according to Check Point.
• From an unprivileged Android app: The user installs a malicious application and launches it. The app extracts the keys and sends a fake payment packet to steal the money.
• If the attacker has the target devices in their hands: The attacker rootes the device, then downgrades the trust environment, and then runs the code to create a fake payment package without an application.

Controlling the TEE, according to Check Point, is a MediaTek chip component that needed to be present to conduct the attack. To be clear, the flaw was not in the MediaTek chip – however the bug was only executable in phones configured with the MediaTek processor.

“The Asian market,” the researchers noted, is “mainly represented by smartphones based on MediaTek chips.” Xiaomi phones that run on MediaTek chips use a TEE architecture called “Kinibi,” within which Xiaomi can embed and sign their own trusted applications.

“Usually, trusted apps of the Kinibi OS have the MCLF format” – Mobicore Loadable Format – “but Xiaomi decided to come up with one of their own.” Within their own format, however, was a flaw: an absence of version control, without which “an attacker can transfer an old version of a trusted app to the device and use it to overwrite the new app file.” The signature between versions doesn’t change, so the TEE doesn’t know the difference, and it loads the old one.

In essence the attacker could’ve turned back time, bypassing any security fixes made by Xiaomi or MediaTek in the most sensitive area of the phone.

As a case-in-point, the researchers targeted “Tencent soter,” Xiaomi’s embedded framework providing an API to third-party apps that want to integrate mobile payments. Soter is what’s responsible for verifying payments between phones and backend servers, for hundreds of millions of Android devices worldwide. The researchers performed time travel to exploit an arbitrary read vulnerability in the soter app. This allowed them to steal the private keys used to sign transactions.

The arbitrary read vulnerability is already patched, while the version control vulnerability is “being fixed.”

In addition, the researchers came up with one other trick for exploiting soter.

Using a regular, unprivileged Android application, they were able to communicate with the trusted soter app via “SoterService,” an API for managing soter keys. “In practice, our goal is to steal one of the soter private keys,” the authors wrote. However, by performing a classic heap overflow attack, they were able to “completely compromise the Tencent soter platform,” allowing much greater power to, for example, sign fake payment packages.

Mobile payments are already receiving more scrutiny from security researchers, as services like Apple Pay and Google Pay gain popularity in the West. But the issue is even more significant for the Far East, where the market for mobile payments is already way ahead. According to data from Statista, that hemisphere was responsible for a full two-thirds of mobile payments globally in 2021 – about four billion dollars in transactions in all.

And yet, the Asian market “has still not yet been widely explored,” the researchers noted. “No one is scrutinizing trusted applications written by device vendors, such as Xiaomi, instead of by chip manufacturers, even though security management and the core of mobile payments are implemented there.”

As previously noted, Check Point asserted this was the first time Xiaomi’s trusted applications have been reviewed for security issues.

Xiaomi Phones Found Vulnerable to Payment Forgery

'Experimental mitigations' in a custom kernel could make life harder for hackers.

Google is increasing its security rewards for hackers who can bypass the latest Linux kernel.

Google verhoogt zijn veiligheidsbeloningen voor hackers die de nieuwste Linux-kernel kunnen omzeilen.

Since 2020, Google has run an open-source Kubernetes-based Capture-the-Flag (CTF) project called kCTF which allows researchers to connect to its Google Kubernetes Engine (GKE) instances, and try to hack them to capture a flag. Now Google has built a set of mitigations it believes will make most of the vulnerabilities and exploits it has received this past year more difficult to exploit. Google said it is offering up to $133,337 to hackers who can beat these mitigations.

Nu verhoogt het zijn beloningen voor beveiligingsonderzoekers die gebreken in het open-source besturingssysteem kunnen ontdekken. Sinds 2020 heeft Google een open-source Kubernetes-gebaseerd Capture-the-Flag (CTF) project, genaamd kCTF, waarmee onderzoekers verbinding kunnen maken met zijn Google Kubernetes Engine (GKE) instances, en deze proberen te hacken om een vlag te vangen. Google heeft nu een aantal maatregelen genomen om de meeste kwetsbaarheden en exploits die het het afgelopen jaar heeft ontvangen, moeilijker uit te buiten.

Google says it uses Linux in "almost everything" from Chromebooks to the cloud. Now it is increasing its rewards for security researchers who can spot flaws in the open-source operating system.

Since 2020, Google has run an open-source Kubernetes-based Capture-the-Flag (CTF) project called kCTF which allows researchers to connect to its Google Kubernetes Engine (GKE) instances, and try to hack them to capture a flag. Every 'flag' caught so far has been a container breakout through a Linux kernel vulnerability.

Now Google has built a set of mitigations it believes will make most of the vulnerabilities and exploits it has received this past year more difficult to exploit.

Google said it is offering up to $133,337 to hackers who can beat these mitigations.

Now it's offering an extra $21,000 for new exploits that compromise the latest Linux kernel and another $21,000 for hackers who can "clearly" bypass its experimental exploit mitigations in its custom instance. This brings total rewards up to a maximum of $133,337.

The kCTF program emphasizes finding new exploits against the kernel rather than new vulnerabilities. Google is keen to develop protections for the Linux kernel, which is used in Android, Chromebook and in Google Cloud workloads.

Google is also now offering $20,000 to $91,337 for new kernel exploits indefinitely after introducing this reward range on a temporary basis in February.

"Rather than simply learning about the current state of the stable kernels, the new instances will be used to ask the community to help us evaluate the value of both our latest and more experimental security mitigations," says Google's Eduardo Vela.

"With the kCTF VRP program, we are building a pipeline to analyze, experiment, measure and build security mitigations to make the Linux kernel as safe as we can with the help of the security community. We hope that, over time, we will be able to make security mitigations that make exploitation of Linux kernel vulnerabilities as hard as possible."

Google wants to make Linux kernel flaws harder to exploit

The incident disrupted corporate IT systems at one company while attackers misidentified the victim in a post on its website that leaked stolen data.

The UK’s largest water utility is facing a cyber attack, according to reports.

Het grootste waterbedrijf van het Verenigd Koninkrijk wordt geconfronteerd met een cyberaanval, zo wordt gemeld.

South Staffordshire’s IT teams were working to resolve the disruption to the corporate network on Monday, while customer service remained unaffected, the company said. The Clop ransomware gang took responsibility for an attack on a U.K. water supplier on its dark web site, but said the victim was Thames Water and not South Staffordshire, according to a report posted on Bleepingcomputer. Thames Water is the United Kingdom’s largest water supplier, serving 15 million customers in Greater London and other areas on the river that runs through the city.

Een waterleverancier in het Verenigd Koninkrijk is maandag getroffen door een storing in zijn IT-systemen als gevolg van een cyberaanval, maar beweert dat de watervoorziening niet is aangetast. De Clop ransomware bende nam de verantwoordelijkheid voor een aanval op een waterleverancier in het Verenigd Koninkrijk op zijn dark web site, maar zei dat het slachtoffer Thames Water was en niet South Staffordshire, volgens een verslag geplaatst op Bleepingcomputer. Thames Water is de grootste waterleverancier van het Verenigd Koninkrijk en bedient 15 miljoen klanten in Groot-Londen en andere gebieden aan de rivier die door de stad stroomt.

A U.K. water supplier suffered a disruption in its corporate IT systems Monday as a result of a cyber-attack but claims that its water supply was not affected.

Meanwhile, the alleged attack perpetrator—the Clop ransomware group—claimed the attack was on another, larger water utility, which for its part indignantly called the claim a “cyber hoax.”

South Staffordshire PLC, the parent company of South Staffs Water and Cambridge Water, confirmed on Monday that it was the victim of a cyber-attack that did not affect its “ability to supply safe water” to all of its customers, it said in a statement Monday. The company provides water to about 1.6 million consumers daily.

The lack of disruption in water supply was “in thanks to the robust systems and controls over water supply and quality we have in place at all times as well as the quick work of our teams to respond to this incident and implement the additional measures we have put in place on a precautionary basis,” the company said in its statement.

South Staffordshire’s IT teams were working to resolve the disruption to the corporate network on Monday, while customer service remained unaffected, the company said.

The Clop ransomware gang took responsibility for an attack on a U.K. water supplier on its dark web site, but said the victim was Thames Water and not South Staffordshire, according to a report posted on Bleepingcomputer. Thames Water is the United Kingdom’s largest water supplier, serving 15 million customers in Greater London and other areas on the river that runs through the city.

Thames Water quickly took to its website to let all of its customers know that any media report claiming it suffered a cyber-attack was completely bogus. In its post, the Clop gang claimed it accessed the company’s SCADA systems.

“We are aware of reports in the media that Thames Water is facing a cyber attack,” the company said. “We want to reassure you that this is not the case and we are sorry if the reports have caused distress.”

Further inspection of stolen data dumped from the attack on the Clop site appears to confirm Thames Water’s assurance, as it includes a spreadsheet of usernames and passwords featuring South Staff Water and South Staffordshire email addresses, according to Bleepingcomputer.

The breached data, published online after ransom negotiations between Clop and its victim broke down, also includes passports, screenshots from water-treatment SCADA systems, driver’s licenses and more, the report said.

The incident is among a series of attacks on critical infrastructure that will likely continue as threat actors increasingly focus their cybercriminal efforts against systems that people depend on, which also boosts their chances of successfully extorting victims, noted one security professional.

“In the case of financially motivated attacks designed to obtain a ransom, wrongdoers have significantly more chances of getting paid by cruelly exploiting people in extreme need,” observed Ilia Kolochenko, founder of ImmuniWeb and a member of the Europol Data Protection Experts Network, in an email to Threatpost.

The attack in the United Kingdom comes as Europe and other regions are suffering from unprecedented wildfires and catastrophic drought, which can unwittingly bolster the efforts of attacks on critical infrastructure, he said.

“Therefore, [critical infrastructure] operators should prepare for a mounting number of cyber-attacks exacerbated by spiralling natural disasters,” Kolochenko said.

The U.K. attack comes auspiciously on the heels of a dire warning issued by the Center on Cyber and Technology Innovation (CCTI) in June that was focused on water utilities in the United States but could be said of most facilities providing the critical resource.

The center claimed that the inherent lack of cybersecurity preparedness of U.S. water utilities makes them a prime target for attack, with CCTI Chair Samantha Ravich calling water the greatest vulnerability in U.S. national infrastructure.

Last year a glimpse of what could be possible in a successful attack on a water supply occurred when an attacker hacked a water treatment facility in Oldsmar, Fla., and raised the levels of sodium hydroxide, or lye, in the water. An operator quickly noticed the attack and corrected the lye levels in the water before any significant damage was done, but the attack could have been extremely dangerous had it not been thwarted quickly, officials said at the time.

U.K. Water Supplier Hit with Clop Ransomware Attack

Researchers have uncovered details of the ÆPIC and SQUIP vulnerabilities in Intel and AMD processors that allow attackers to obtain secret info.

Hackers are being targeted by hackers in the US.

Hackers zijn het doelwit van hackers in de VS.

Weet uw weg in netwerken en client-server Linux-systemen - technieken, commandoregel, shellscripting en meer

Know Your Way Around Networks and Client-Server Linux Systems — Techniques, Command Line, Shell Scripting, and More

Vrijdag 24-06 zijn we vanaf 12.00 uur telefonisch niet bereikbaar | Over SIDN | SIDN

Vergelijkbare publicaties

Windows Kwetsbaarheid kan DC Server Credentials openbreken

Microsoft-medewerkers stelden interne logins van eigen bedrijf bloot

Xiaomi-telefoons kwetsbaar gebleken voor betalingsvervalsing

Google wil Linux kernel fouten moeilijker te misbruiken maken

Waterleverancier in V.K. getroffen door Clop Ransomware-aanval

ÆPIC- en SQUIP-kwetsbaarheden gevonden in Intel- en AMD-processoren

Gevonden topics

Hoe kijk ik Rick and Morty Seizoen 5 online in het buitenland (met een VPN)

Massaal gegevenslek van toegewijden uit Meenakshi tempel, admin beweert technische storing

Onderzoeker vindt cryptomining malware gericht op AWS Lambda