The Trusted Platform Module (TPM) 2.0 specification is affected by two buffer overflow vulnerabilities that could allow attackers to access or overwrite sensitive data, such as cryptographic keys. TPM is a hardware-based technology that provides operating systems with tamper-resistant secure cryptographic functions. It can be used to store cryptographic keys, passwords, and other critical data, making any vulnerability in its implementation a cause for concern.

While a TPM is required for some Windows security features, such as Measured Boot, Device Encryption, Windows Defender System Guard (DRTM), Device Health Attestation, it is not required for other more commonly used features.

However, when a Trusted Platform Module is available, Windows security features get enhanced security in protecting sensitive information and encrypting data.

The TPM 2.0 specification gained popularity (and controversy) when Microsoft made it a requirement for running Windows 11 due to its required boot security measures and ensuring that Windows Hello face recognition provides reliable authentication.

The TPM 2.0 vulnerabilities – The new vulnerabilities in TPM 2.0 were discovered by Quarkslab’s researchers Francisco Falcon and Ivan Arce who said the flaws could impact billions of devices. The vulnerabilities are tracked as CVE-2023-1017 (out-of-bounds read) and CVE-2023-1018 (out-of-bounds write).

The CERT Coordination Center has published an alert about the vulnerabilities and has been informing vendors for months, trying to raise awareness while mapping the impact. Unfortunately, only a handful of entities have confirmed they are impacted.

TPM is a highly-secured space that should theoretically be shielded even from malware running on the device, so the practical importance of these vulnerabilities shouldn’t be ignored or downplayed.

…

Tagged:

LayerX has published its annual browser security report in which the company highlights the most prominent browser security risks of 2022. The report includes predictions and recommendations for 2023 as well.The report focuses on Enterprise environments, but several of its key takeaways apply to small business and home environments as well. The browser security threats of 2022 make up the largest part of the document, but users find predictions, recommendations and an interesting monthly overview of major security events in the report as well.

The nine major threats that LayerX identified in 2022 were the following ones:

• Phishing attacks via high reputation domains.
• Malware distribution via file sharing systems.
• Data leakage through personal browser profiles.
• Outdated browsers.
• Vulnerable passwords.
• Unmanaged devices.
• High-risk extensions.
• Shadow SaaS.
• MFA bypass with AiTM attacks.

…

The recommendations focus on SaaS and Enterprise-grade protections, but all users may use the listed threats to improve security. For example, outdated browsers may be updated more frequently, and weak or reused passwords may be replaced with unique strong passwords.

The report is available for download here, but a short form needs to be filled out before the download link is made available.

Filed: https://www.ghacks.net/category/software/security/

In September, the U.S. Security and Exchange Commission (SEC) issued $1.8 billion in fines to some of Wall Street’s biggest banks for their inability to keep private information secure when using internal communications. These banks, including Barclay’s, Bank of America, Citigroup Global Markets, Goldman Sachs, JP Morgan Chase and others, received these fines for their “widespread and longstanding failures to maintain and preserve work-related electronic communications,” according to a 451 Research report.While financial institutions were the latest to be hit, this is not an isolated incident. Businesses across all industries are at risk of compromised data through unreliable messaging apps. And with the rise in remote and hybrid work environments and the adoption of bring-your-own-device (BYOD) practices in the workplace, data breaches and ransomware attacks are increasingly surfacing. 451 Research’s report stated that 68% of workers use their personal smartphones for both personal and business purposes, putting private company and client information at risk.

This year, the price of a HIPAA violation increased to adjust for inflation. HIPAA violations are now subject to penalties of up to $60,226 per violation and up to $1,919,173 per calendar year. Unless a business has an extra few hundred thousand sitting around for penalty fines, they can’t afford to be non-compliant.

…

Filed: https://venturebeat.com/security/

Americans Can’t Consent [24-page PDF + footnotes] – Companies’ Use of Their Data – They Admit They Don’t Understand It, Say They’re Helpless to Control It, and Believe They’re Harmed When Firms Use Their Data —Making What Companies Do Illegitimate: A Report from the Annenberg School for Communication, University of Pennsylvania – “Overview – Consent has always been a central part of Americans’ interactions with the commercial internet. Federal and state laws, as well as decisions from the Federal Trade Commission (FTC), require either implicit (“opt out”) or explicit (“opt in”) permission from individuals for companies to take and use data about them. Genuine opt out and opt in consent requires that people have knowledge about commercial data-extraction practices as well as a belief they can do something about them. As we approach the 30th anniversary of the commercial internet, the latest Annenberg national survey finds that Americans have neither. High percentages of Americans don’t know, admit they don’t know, and believe they can’t do anything about basic practices and policies around companies’ use of people’s data….

In short, we find that informed consent at scale is a myth, and we urge policymakers to act with that in mind.”

More than two years after an alleged Russian hacking campaign exposed glaring weakness in US federal defenses, the Department of Homeland Security’s cyber agency has not updated a key agency blueprint for maintaining communications in the event of a major hack, the department’s inspector general said Monday. The watchdog’s finding highlights the continued fallout from the 2020 Russian cyber-espionage campaign, which infiltrated at least nine US federal agencies and prompted major changes to US cybersecurity policy.

In the two years since the campaign’s discovery, DHS’s Cybersecurity and Infrastructure Security Agency has “improved its ability to detect and mitigate risks from major cyberattacks, but work remains to safeguard Federal networks,” the inspector general’s report says.

CISA also still needs to update its “continuity of operations plan” and a separate backup plan for communicating securely in the event of another breach, the inspector general said. In a written response to the inspector general, CISA officials said that updates to both plans will come this year.