SWN #388- Big Tech, Fighting a Junta, Keylogger in Microsoft , APT Hackers, Free Laundry, Joshua Marpet & more
May 21, 2024
auto_awesome
Cybersecurity expert Joshua Marpet discusses critical vulnerabilities in Fluent Bit and QNAP NAS devices, activists in Myanmar fighting a junta, keylogger on Microsoft Exchange servers, APT hackers targeting South Korean companies, reused malicious code, threat hunting, Microsoft's co-pilot PCs, and security flaws in internet-connected laundry machines allowing free usage.
Fluent Bit's critical memory corruption vulnerability CVE 20244323 impacted billions of cloud deployments, requiring version upgrades and vigilant monitoring.
Activists in Myanmar face limitations in resisting military rule due to big tech dependencies, emphasizing the need for user-centric privacy-focused technology solutions.
Deep dives
Fluent bit tool vulnerability threatens cloud security
Fluent bit, an open-source data collector used for logging and metrics in cloud environments, faced a critical memory corruption vulnerability, CVE 20244323. This vulnerability posed significant risks, including crashing the service, information disclosure, and remote code execution, affecting billions of cloud deployments. Mitigation strategies involve upgrading to version 3.0.4, reviewing configurations, and ensuring timely updates from cloud providers.
QNAP QTS Zero Day RCE flaw exploited in targeted attacks
Researchers demonstrated a proof of concept exploit for a zero-day remote code execution flaw in the QTS operating system of QNAP's NAS devices. The vulnerability, named CVA 2024-27130, allowed unauthorized code execution without authentication. Users are advised to limit file sharing, monitor device behavior, and install security updates to mitigate risks.
Activists in Myanmar face challenges with big tech dependency
Activists in Myanmar leverage technology to resist military rule, but face challenges due to big tech dependencies and restrictions. Facebook's Free Basics package, offering affordable internet, can compromise user privacy and enable surveillance. The dependency on specific services hinders access to more secure communication tools like Signal, highlighting the need for tech solutions that prioritize user privacy and security.