Étiquette : vulnerability (Page 12 of 40)

More details about the October 4 outage – Facebook Engineering

More details about the Oct. 4 Facebook outage

“One of the jobs performed by our smaller facilities is to respond to DNS queries. DNS is the address book of the internet, enabling the simple web names we type into browsers to be translated into specific server IP addresses. Those translation queries are answered by our authoritative name servers that occupy well known IP addresses themselves, which in turn are advertised to the rest of the internet via another protocol called the border gateway protocol (BGP).
To ensure reliable operation, our DNS servers disable those BGP advertisements if they themselves can not speak to our data centers, since this is an indication of an unhealthy network connection. In the recent outage the entire backbone was removed from operation, making these locations declare themselves unhealthy and withdraw those BGP advertisements. The end result was that our DNS servers became unreachable even though they were still operational. This made it impossible for the rest of the internet to find our servers.
All of this happened very fast. And as our engineers worked to figure out what was happening and why, they faced two large obstacles: first, it was not possible to access our data centers through our normal means because their networks were down, and second, the total loss of DNS broke many of the internal tools we’d normally use to investigate and resolve outages like this.”

Source : More details about the October 4 outage – Facebook Engineering

Ces Afghans qui effacent leurs traces numériques par crainte des talibans

Des talibans contrôlent des conducteurs dans le centre de Kaboul, en Afghanistan, le 15 septembre 2021.

“Lorsque Kaboul est tombée aux mains des talibans, le 15 août, Nilofar Ayoubi a créé, avec ses amies militantes des droits humains, un groupe WhatsApp sur lequel elles échangeaient les dernières informations. « C’est sur ce groupe que j’ai découvert le dispositif mis en place par Facebook pour les Afghans. Je l’ai donc utilisé pour verrouiller mon compte Facebook. J’ai aussi changé la photo et le nom de mes comptes Instagram et Twitter, tout en les rendant privés », explique cette entrepreneuse afghane. Figure de l’opposition aux talibans, cette mère de trois enfants vit aujourd’hui en exil en Pologne.”

Source : Ces Afghans qui effacent leurs traces numériques par crainte des talibans

Delays Aren’t Good Enough—Apple Must Abandon Its Surveillance Plans | Electronic Frontier Foundation

apple with an eye in the center

“The features Apple announced a month ago, intending to help protect children, would create an infrastructure that is all too easy to redirect to greater surveillance and censorship. These features would create an enormous danger to iPhone users’ privacy and security, offering authoritarian governments a new mass surveillance system to spy on citizens. They also put already vulnerable kids at risk, especially LGBTQ youth, and create serious potential for danger to children in abusive households. The responses to Apple’s plans have been damning: over 90 organizations across the globe have urged the company not to implement them, for fear that they would lead to the censoring of protected speech, threaten the privacy and security of people around the world, and have disastrous consequences for many children.”

Source : Delays Aren’t Good Enough—Apple Must Abandon Its Surveillance Plans | Electronic Frontier Foundation

Une action en justice pourrait bloquer l’accès aux plus importants sites pornographiques

Un panneau Pornhub à Las Vegas, Nevada, en 2017.

“Dans les faits, il est en réalité souvent compliqué pour la justice de remonter jusqu’aux propriétaires des grands sites pornographiques, qui s’abritent derrière des cascades de sociétés domiciliées dans plusieurs pays. MindGeek, l’entreprise leader du secteur – elle possède Pornhub, RedTube ou encore YouPorn, pour un chiffre d’affaires qui se compte en centaines de millions de dollars –, a ses bureaux au Canada, mais est fiscalement domiciliée au Luxembourg et possède des dizaines de filiales dans une demi-douzaine de pays. Les associations, en coordination avec la chancellerie, ont donc changé d’angle d’attaque : plutôt que les sites, elles ont ciblé les fournisseurs d’accès Internet (FAI), présents sur le territoire, Orange, SFR, Free, Bouygues… « Nous assignons les FAI en référé car il n’est pas toujours possible d’identifier les éditeurs de contenus pornographiques », reconnaît Me Laurent Bayon, le conseil des deux associations, qui espère que le ministère public appuiera leur demande.”

Source : Une action en justice pourrait bloquer l’accès aux plus importants sites pornographiques

“We’ve enhanced Android’s auto-rotate feature with face detection, using the front-facing camera to more accurately recognize when to rotate the screen. This is especially helpful for people who are using their devices while lying down on a couch or in bed, for example. For developers, this means that the auto-rotation behavior will provide a better user experience for users who have opted in through Settings. The enhanced auto-rotate feature lives within our recently announced Private Compute Core, so images are never stored or sent off the device. In Beta 3 this feature is available on Pixel 4 and later Pixel devices.To make screen rotation as speedy as possible on all devices, we’ve also optimized the animation and redrawing and added an ML-driven gesture-detection algorithm. As a result, the latency for the base auto-rotate feature has been reduced by 25%, and the benefits of the face detection enhancement build on top of those improvements. Give the auto-rotate improvements a try and let us know what yo”

Source : Android Developers Blog: Android 12 Beta 3 and final APIs

Reverse engineering generative models from a single deepfake image

“Deepfakes have become more believable in recent years. In some cases, humans can no longer easily tell some of them apart from genuine images. Although detecting deepfakes remains a compelling challenge, their increasing sophistication opens up more potential lines of inquiry, such as: What happens when deepfakes are produced not just for amusement and awe, but for malicious intent on a grand scale? Today, we — in partnership with Michigan State University (MSU) — are presenting a research method of detecting and attributing deepfakes that relies on reverse engineering from a single AI-generated image to the generative model used to produce it. Our method will facilitate deepfake detection and tracing in real-world settings, where the deepfake image itself is often the only information detectors have to work with.”

Source : Reverse engineering generative models from a single deepfake image

A Colonial Pipeline facility in Baltimore. Its pipelines feed large storage tanks up and down the East Coast.

« We are apolitical, we do not participate in geopolitics, do not need to tie us with a defined government and look for our motives, » it said in a statement posted on its website. « Our goal is to make money and not creating problems for society. »
The group seemed somewhat surprised that its actions resulted in closing a major pipeline and suggested that perhaps it would avoid such targets in the future.

Source : FBI Confirms DarkSide as Colonial Pipeline Hacker – The New York Times

Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app’s perspective

FFmpeg vulnerabiltiies by year

“Given the number of opportunities present, we found that it’s possible to execute arbitrary code on a Cellebrite machine simply by including a specially formatted but otherwise innocuous file in any app on a device that is subsequently plugged into Cellebrite and scanned. There are virtually no limits on the code that can be executed. For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question.”

Source : Signal >> Blog >> Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app’s perspective

« Older posts Newer posts »

© 2025 no-Flux

Theme by Anders NorenUp ↑