informatique et high-tech (les meilleures news) %) - Page 1239

vince (./37144) :
et puis bon, crowdstrike, ça sonne comme un nom de virus

Security researcher Kevin Beaumont said (

I have obtained the Crowdstrike driver they pushed via auto update. I don't know how it happened, but the file isn't a validly formatted driver and causes Windows to crash every time.

— Kevin Beaumont (@GossiTheDog) July 19, 2024

) "I have obtained the CrowdStrike driver they pushed via auto update. I don't know how it happened, but the file isn't a validly formatted driver and causes Windows to crash every time."

Brunni (./37154) :
Tant que c'est pas connecté à l'internet je pense que c'est bon.

Zerosquare (./37153) :
Pour le coup, l'écran bleu existait déjà sous Windows 3.1

Mais comme dit Flan, je serais moyennement rassuré quand même...

Jonas (./37158) :
qu'on enlève du pouvoir le business qui ne pousse pas à la qualité et qu'on remette des profils techniques.

Zerosquare (./37159) :

Jonas (./37158) :
qu'on enlève du pouvoir le business qui ne pousse pas à la qualité et qu'on remette des profils techniques.

Je te souhaite bon courage pour convaincre les managers qu'il faut les déposséder d'une partie de leur pouvoir...

Je viens de raccrocher avec TF1 sur le sujet. On verra bien si je serai au JT pour expliquer un peu POURQUOI 💫 IL FAUT 💫 SE PRÉPARER 💫 À LA CRISE.

— Rayna ¯\_(ツ)_/¯ 😷🤓🧬🇪🇺👩‍💻📚✍️ (@MaliciaRogue) July 19, 2024

Cybersecurity awareness and training provider KnowBe4 hired a North Korean fake IT worker for a software engineering role on its AI team, and only realized its mistake once the guy started using his company-provided computer for evil.

KnowBe4 'fessed up to the hire in a Tuesday disclosure from CEO Stu Sjouwerman. He explained that his HR team conducted four video interviews with the candidate, confirmed his appearance matched a photo included with a job the application, and conducted background checks.

Everything checked out OK, the faker was hired, and a Mac dispatched so he could start work.

Which is when the trouble started.

"We sent them their Mac workstation, and the moment it was received, it immediately started to load malware," Sjouwerman wrote.

Data from deleted GitHub repos may not really be deletedwww.theregister.comAnd the forking Microsoft-owned code warehouse doesn't see this as much of a problem

Joe Leon, a security researcher with the outfit, said in an advisory on Wednesday that being able to access deleted repo data – such as APIs keys – represents a security risk. And he proposed a new term to describe the alleged vulnerability: Cross Fork Object Reference (CFOR).

"A CFOR vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks)," Leon explained.

For example, the firm showed how one can fork a repository, commit data to it, delete the fork, and then access the supposedly deleted commit data via the original repository.

The researchers also created a repo, forked it, and showed how data not synced with the fork continues to be accessible through the fork after the original repo is deleted.

(...)

Clearly this is a problem. But it's not so much of a problem that GitHub considers CFOR a legitimate vulnerability. In fact, the Microsoft-owned code-hosting giant considers it a feature, not a bug.

When informed of the situation through its Vulnerability Disclosure Program, GitHub responded: "This is an intention design decision and is working as expected as noted in our [documentation]."

This, evidentially, has been known for years. One individual claims to have notified GitHub of the vulnerability back in 2018 and received a similar response.

(...)

Ayrey said for GitHub, dangling commits can be downloaded via a fork if you have the identifying hash, or some portion of it.

"If you have the identifier you can download them from the repository that they were originally pushed to," he explained. "It turns out you can also download them through any fork of that repository. And it works bi-directionally. So from the parent, you can download that dangling commit from the fork and from the fork you can download that dangling commit from the parent."

"What we found is even if you delete the parent, and the commit was pushed to the parent, that dangling commit not only still lives on, but you can download it through the child even though it was pushed to the parent, it was never pulled into the child, and the parent was deleted, you can now access that dangling commit."

What's more, Ayrey explained, you don't even need the full identifying hash to access the commit. "If you know the first four characters of the identifier, GitHub will almost auto-complete the rest of the identifier for you," he said, noting that with just sixty-five thousand possible combinations for those characters, that's a small enough number to test all the possibilities.

Zerosquare (./37167) :

Des réseaux de fibre optique vandalisés dans six départements françaiseuronewsDes installations Free, SFR et Bouygues ont été la cible de sabotage dans la nuit. Ces actions n'ont pas été revendiquées. #EuropeNews