Heise Security-Alert

• SAP-Patchday: 16 Sicherheitsmitteilungen zu diversen Produkten 10. September 2024
  Am September-Patchday hat SAP 16 neue Sicherheitsmitteilungen herausgegeben. Sie behandeln Lücken, die als mittleres oder niedriges Risiko gelten.
• Loadbalancer: Angreifer können LoadMaster kompromittieren 9. September 2024
  Es sind wichtige Sicherheitspatches für LoadMaster und MultiTenant Hypervisor von Progress Kemp erschienen.
• Schadcode-Lücken gefährden Visualiserungsplattform Kibana 9. September 2024
  Ein Sicherheitsupdate schließt zwei kritische Sicherheitslücken in Kibana.
• Jetzt patchen! Angreifer attackieren Firewalls von Sonicwall 9. September 2024
  Mittlerweile ist klar, dass eine Schwachstelle nicht nur SonicOS, sondern auch die SSLVPN-Funktion betrifft. Sicherheitsupdates sind verfügbar.

BSI Bund-Cert

Bruce Schneier

• Australia Threatens to Force Companies to Break Encryption 9. September 2024
  In 2018, Australia passed the Assistance and Access Act, which—among other things—gave the government the power to force companies to break their own encryption. The Assistance and Access Act includes key components that outline investigatory powers between government and industry. These components include: Technical Assistance Requests (TARs): TARs are voluntary requests for assistance accessing encrypted […]
• Live Video of Promachoteuthis Squid 6. September 2024
  The first live video of the Promachoteuthis squid, filmed at a newly discovered seamount off the coast of Chile. Blog moderation policy.
• YubiKey Side-Channel Attack 6. September 2024
  There is a side-channel attack against YubiKey access tokens that allows someone to clone a device. It’s a complicated attack, requiring the victim’s username and password, and physical access to their YubiKey—as well as some technical expertise and equipment. Still, nice piece of security analysis.
• Long Analysis of the M-209 5. September 2024
  Really interesting analysis of the American M-209 encryption device and its security.