Kaspersky cleans up poisoned watering hole, Google presses pause on cookie crackdown

Kaspersky has detailed its takedown of a massive so-called watering-hole attack appearing to target certain folks in China, in the top story in The Reg's infosec roundup that looks at issues of the past week beyond our own detailed coverage. The security firm said the operation, designed to target "more than 10 websites …

[macjules]

Microsoft talks up COVID-19 efforts with hospitals

Say what you like, but they do have experience of fighting viruses .. ever since Windows 95

[Ima Ballsy]

Re: Microsoft talks up COVID-19 efforts with hospitals

Perhaps they need to teach Lennart Poettering a think or 2 ;>

[druck]

Re: Microsoft talks up COVID-19 efforts with hospitals

Viruses have been around a lot longer than Windows 95, starting with Brain for DOS in 1986.

[bombastic bob]

cve.mitre.org appears to require script for proper rendering

seems strange (even ironic) to me that a web site that has CVE reports on it would REQUIRE SCRIPT in order to render properly,...

went to see what was up with SystemD, clicked on the link, saw poorly formatted text etc. and noscript telling me that one site had been blocked.

You'd think SECURITY PEOPLE would GET IT, ya know?

[Doctor Syntax]

"Red Hat Enterprise Linux 7 is unaffected, for example."

So is Devuan.

[Ima Ballsy]

So Is .....

Slackware :>

[nematoad]

PCLinuxOS has steered clear of systemd so anyone using the distro can sit back and enjoy a little schadenfreude.

[Dazed and Confused]

Systemd

A flaw in SystemD could potentially be exploited by a local attacker or malware to elevate their privileges to fully hijack a machine.

Which is why something as critical to the functioning of the system shouldn't have an attack surface visible to unprivileged users.

[Anonymous Coward]

Watering hole

"Kaspersky has detailed its takedown of a massive so-called watering-hole attack appearing to target dissidents in China,"

I found a suspicious script in a website of a popular Uyghur actress.

It contained a very long ASCII string that was actually hex without the backslash and zero.

I used sed to add these between each two charecters to make it easier to reverse the hex.

I posted the semi-deobfuscated code to Pastebin:

https://pastebin.com/fQxHeFt0

There is very similar code found on a blog by Confiant regarding malvertising here:

https://blog.confiant.com/malvertiser-egobbler-exploits-chrome-webkit-bugs-infects-over-1-billion-ads-6b8ccc41b0e6?gi=74ec47d15f0

[Anonymous Coward]

SystemD = SystemV*L

[Anonymous Coward]

actually

SystemD = SystemV/L

[Pascal Monett]

Automobile makers : here's a free tip

Make your entertainment bus separate from your CAN bus before somebody gets killed due to a hack and you have a ginormous lawsuit and an impossible recall on your hands.

It'll cost you less in money, PR and image costs, I promise.

[Anonymous Coward]

Re: Automobile makers : here's a free tip

How can the the vehicle tell you that you're about out of gas if it doesn't have acess to the audio system?

On the other hand, playing a Sammy Hagar song shouldn't nail your accellerator pedal to the floorboard...

[Ima Ballsy]

Re: Automobile makers : here's a free tip

Nor should AC/DC, but it does ;>

[Intractable Potsherd]

Re: Automobile makers : here's a free tip

"How can the the vehicle tell you that you're about out of gas if it doesn't have acess [sic] to the audio system?"

The same way cars used to - a gauge with (possibly) a light on the dash and (maybe) a simple "bong" sound. No need for connection to the audio system.

When I started to drive (and a long time after), drivers were taught to monitor the fuel gauge. When the needle got to a certain point, it was time to look for a filling station - no lights, no audible alerts.

[Bck]

How last century... Don't you know that hardware costs money (except if you just need 8 more Gigabytes of RAM for software to run)?