Frank Crast, Author at Securezoo

PwnKit: “Trivially exploitable” vulnerability found in Linux Polkit’s pkexec tool

Security Updates & Patches, Vulnerabilities & Exploits / Frank Crast / January 31, 2022 / CVE-2021-4034, Linux, pkexec, polkit, Qualys, setuid, SUID

Researchers have discovered a “trivially exploitable” local privilege escalation vulnerability (CVE-2021-4034) in Polkit’s pkexec tool that affects likely every major Linux distribution.

PwnKit: “Trivially exploitable” vulnerability found in Linux Polkit’s pkexec tool Read More »

DazzleSpy: macOS malware used in watering hole attacks to compromise Macs

Security Updates & Patches, Vulnerabilities & Exploits / Frank Crast / January 29, 2022 / CVE-2021-30869, DazzleSpy, GNU, macOS, Safari

Researchers have discovered a new macOS malware dubbed “DazzleSpy” used in watering hole attacks in Asia to compromise Mac computers.

DazzleSpy: macOS malware used in watering hole attacks to compromise Macs Read More »

NIST SP 800-53A Revision 5: Assessing Security and Privacy Controls in Information Systems and Organizations

Security Program, Standards & Guidelines / Frank Crast / January 29, 2022 / NIST, Privacy, SP 800-53A

The National Institute of Standards and Technology (NIST) has issued the NIST SP 800-53A “Assessing Security and Privacy Controls in Information Systems and Organizations.”

NIST SP 800-53A Revision 5: Assessing Security and Privacy Controls in Information Systems and Organizations Read More »

NIST SP 800-121 Revision 2: Guide to Bluetooth Security

Endpoint Security, Network Security, Standards & Guidelines, Wi-Fi Security / Frank Crast / January 29, 2022 / bluetooth, NIST, SP 800-121, Wireless

The National Institute of Standards and Technology (NIST) has issued the NIST SP 800-121 Revision 2: “Guide to Bluetooth Security.”

NIST SP 800-121 Revision 2: Guide to Bluetooth Security Read More »

FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors

Identity & Access Management, Standards & Guidelines / Frank Crast / January 29, 2022 / FIPS, FIPS 201-3, NIST

The U.S. Secretary of Commerce has approved the publication of FIPS 201-3, the National Institute of Standards and Technology (NIST) latest revision of “Personal Identity Verification (PIV) of Federal Employees and Contractors.”

FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors Read More »

CISA adds 8 new actively exploited vulnerabilities (to include latest Apple zero-day)

Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / Frank Crast / January 28, 2022 / Apple, CVE-2022-22587

The Cybersecurity and Infrastructure Security Agency (CISA) has published 8 new actively exploited vulnerabilities, one of those vulnerabilities (CVE-2022-22587) recently fixed by Apple.

CISA adds 8 new actively exploited vulnerabilities (to include latest Apple zero-day) Read More »

Apple releases iOS 15.3, macOS Monterey 12.2 and other product security updates (with fixes for zero-day vulnerability exploit in wild)

Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / Frank Crast / January 28, 2022 / Big Sur, CVE-2022-22587, iOS, iOS153, macOS, macOS Catalina, Monterey, Monterey122

Apple has released security updates for iOS 15.3, macOS Monterey 12.2, macOS Big Sur 11.6.3, and other Apple products. The updates also address a zero-day vulnerability (CVE-2022-22587) exploited in the wild.

Apple releases iOS 15.3, macOS Monterey 12.2 and other product security updates (with fixes for zero-day vulnerability exploit in wild) Read More »

Varonis discovers MFA bypass for Box accounts

Access Control, Authentication, Vulnerabilities & Exploits / Frank Crast / January 27, 2022

Varonis Threat Labs has discovered a multi-factor authentication (MFA) bypass vulnerability for Box accounts that use an SMS code for login verification.

Varonis discovers MFA bypass for Box accounts Read More »