Heise Security-Alert

• Patchday Android: Android 11, 12, 13 und 14 für Schadcode-Attacken anfällig 5. Dezember 2023
  Angreifer können Android-Smartphones und -Tablets verschiedener Hersteller ins Visier nehmen. Für einige Geräte gibt es Sicherheitsupdates.
• Neue Squid-Version behebt Denial-of-Service-Lücken 5. Dezember 2023
  Drei Sicherheitsprobleme können dazu führen, dass der freie Web-Proxy Squid seinen Dienst verweigert. Admins sollten die bereitstehenden Updates einpflegen.
• Sicherheitsupdates: Angreifer können Zyxel-NAS mit präparierten URLs attackieren 4. Dezember 2023
  Zwei NAS-Modelle von Zyxel sind verwundbar. In aktuellen Versionen haben die Entwickler mehrere kritische Sicherheitslücken geschlossen.
• Entwicklungsplattform: Neue GitLab-Versionen beheben zehn Sicherheitslücken 4. Dezember 2023
  Neben Cross-Site-Scripting und Rechteproblemen beheben die neuen Versionen der Versionsverwaltung auch DoS-Lücken. Das GitLab-Team empfiehlt ein Update.

BSI Bund-Cert

Bruce Schneier

• AI and Mass Spying 5. Dezember 2023
  Spying and surveillance are different but related things. If I hired a private detective to spy on you, that detective could hide a bug in your home or car, tap your phone, and listen to what you said. At the end, I would get a report of all the conversations you had and the contents […]
• AI and Trust 4. Dezember 2023
  I trusted a lot today. I trusted my phone to wake me on time. I trusted Uber to arrange a taxi for me, and the driver to get me to the airport safely. I trusted thousands of other drivers on the road not to ram my car on the way. At the airport, I trusted […]
• Friday Squid Blogging: Strawberry Squid in the Galápagos 1. Dezember 2023
  Scientists have found Strawberry Squid, “whose mismatched eyes help them simultaneously search for prey above and below them,” among the coral reefs in the Galápagos Islands. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here.  
• AI Decides to Engage in Insider Trading 1. Dezember 2023
  A stock-trading AI (a simulated experiment) engaged in insider trading, even though it “knew” it was wrong. The agent is put under pressure in three ways. First, it receives a email from its “manager” that the company is not doing well and needs better performance in the next quarter. Second, the agent attempts and fails […]