Information has been revealed about vulnerabilities in the Squid proxy server, which were quietly fixed last year in the Squid 4.8 release. The issues exist in the code handling the '@' block at the beginning of the URL ('user@host') and allow bypassing access restrictions, injecting cache content, and performing cross-site scripting attacks. CVE-2019-12524 — a client can exploit this with specially crafted […]
Fixes for the Postfix mail server — versions 3.5.1, 3.4.11, 3.3.9, and 3.2.14 — are now available, which include code to address the DANE/DNSSEC functionality issue due to the use of the Glibc 2.31 library, where backward compatibility concerning DNSSEC flags transmission was broken. Specifically, the DNSSEC flag AD (authenticated data) is no longer transmitted by default, but only when specified in […]
Ryuk is one of the most well-known variants of ransomware in recent years. Since its first appearance in the summer of 2018, it has accumulated an impressive list of victims, particularly in the business sector, which is the primary target of its attacks. 1. General information This document contains an analysis of the Ryuk ransomware variant, as well as the downloader responsible for loading the malware.
ASUS is working to update its current smartphone lineup to Android 10, and one way to achieve this is by releasing a version of the firmware based on the AOSP reference build. Just over a week ago, it was reported that the Zenfone 5 received a beta version of the Android 10 update based on AOSP, and now four more ASUS phones are undergoing a similar process. The Taiwanese manufacturer […]
A significant new release of the AWK programming language implementation from the GNU project has been introduced — Gawk 5.1.0. AWK was developed in the 1970s and has not undergone major changes since the mid-1980s, when the core structure of the language was defined, allowing it to maintain its original stability and simplicity over the decades. Despite its age, AWK […]
Corrective updates for the stable branches of the BIND DNS server, versions 9.11.18 and 9.16.2, as well as the experimental development branch 9.17.1, have been released. The new versions resolve a security issue related to ineffective protection against DNS rebinding attacks when functioning in the DNS server query forwarding mode (the "forwarders" block in settings). Additionally, work has been done to reduce the size of the stored memory statistics for digital […]
The ecosystem of containerization technologies is rapidly evolving and changing, which creates a lack of good working practices in this area. Nevertheless, Kubernetes and containers are being used more and more — both for modernizing legacy applications and for developing modern cloud applications. The Kubernetes aaS team from Mail.ru has gathered forecasts, advice, and best practices for market leaders from Gartner, 451.
The release of the TimescaleDB 1.7 database management system has been announced, designed for storing and processing time-series data (snapshots of parameter values at specified time intervals, where time forms a set of corresponding values). This storage format is optimal for applications such as monitoring systems, trading platforms, and metrics collection systems. Tools for integration with the […]
An experimental release of the Firefox Preview 4.3 browser for the Android platform has been published, developed under the codename Fenix as a replacement for the Firefox edition for Android. The release will soon be available in the Google Play catalog (requires Android 5 or newer). Firefox Preview uses the GeckoView engine, built on Firefox Quantum technologies, and a set of Mozilla Android libraries […]
Cloudflare has launched the site isBGPSafeYet.com, aimed at raising awareness about the issue of incorrect BGP route leaks and the potential for traffic redirection attacks using the BGP protocol. The site allows users to check the implementation of incorrect route filtering technology by providers and assess the adoption of RPKI support. Many operators remain vulnerable to BGP announcements of subnets with false routing length information, […]
A system for analyzing traffic without decrypting it. This method is simply called 'machine learning.' It turns out that if a very large volume of varied traffic is fed into a special classifier, the system can detect the actions of malicious code within encrypted traffic with a very high degree of probability. Network threats have changed and become 'smarter.' Recently, the very concept of attack and defense has evolved.
That which has been will be; and that which has been done will be done; and there is nothing new under the sun. Ecclesiastes 1:9 Eternal wisdom, highlighted in the epigraph, is applicable to almost any industry, including one as rapidly changing as IT. It turns out that many innovations that are only now being discussed are based on older ideas.
Russian Russian
Italian
German
Polish
Estonian
Albanian
Bulgarian
Croatian
Czech
Danish
Dutch
English
French
Hungarian
Latvian
Norwegian
Portuguese
Romanian
Slovak
Slovenian
Spanish
Swedish