US Appeal court rules Snowden right - US data grab was illegal, but you're still guilty and going down
(2020/09/07)
- Reference: 1599458464
- News link: https://www.theregister.co.uk/2020/09/07/in_brief_security/
- Source link:
In Brief The US Court of Appeals for the Ninth Circuit ruled last week that the activities of American intelligence agencies unmasked by Edward Snowden were illegal.
The ruling had nothing to do with Snowden himself. Instead is concerned four Somalis [1]convicted of funneling funds to terrorist organizations in 2013 who had their appeal denied, but with a caveat. The court [2]ruled that the evidence that put the four away was gathered using the US intelligence agency's post-9/11 surveillance schemes, which were both illegal and unconstitutional. However, it rejected the rest of the appeal due to the weight of other evidence.
Snowden took to Twitter with a celebration of sorts.
"Seven years ago, as the news declared I was being charged as a criminal for speaking the truth, I never imagined that I would live to see our courts condemn the NSA's activities as unlawful and in the same ruling credit me for exposing them," Snowden [3]tweeted . "And yet that day has arrived."
Darknet market's peacemaker sentenced to 11 years in prison
A Colorado man is looking at more than a decade behind bars for trying to settle a few arguments, albeit on an online souk selling highly illegal stuff.
Bryan Connor Herrell, aka "penissmith" and/or "botah" [4]has been sentenced to 11 years for his work as a sort of problem solver on the Alphabay crime market. The moderator was tasked with settling disputes between sellers and their customers, usually involving drugs.
In addition to handling disputes, he was also tasked with watching for scammers who might give 'honest' drug dealers, identity thieves, and gun-runners a bad name. For his troubles, he was paid a nice chunk of Bitcoin.
"Cases like these exemplify how the FBI and our international partners are eliminating the false promise of anonymity dark marketplaces claim to provide and are successfully dismantling criminal organizations which prey upon communities through use of sophisticated computer code,” said Sean Ragan, special agent in charge of the FBI Sacramento Field Office.
Go language found to contain cross-site scripting bug
A flaw in a library for the Go language could leave some applications vulnerable to cross-site scripting attacks.
Bug-hunters with RedTeam Pentesting GmbH [5]say that the way Go code handles CGI and FastCGI requests could potentially create cross-site scripting holes that would only show up in the finished web application.
The problem arises because the Go application and the HTTP server itself handle data in different ways, and in some cases the data type for an upload will not be properly checked.
"For example, consider a web application which allows uploading PDF files and pictures," the team writes. "During upload, the application checks (via the DetectContentType() mentioned in the documentation) that the uploaded content is either "application/pdf" or "image/png" and rejects all other data. When an uploaded file is requested again, the application does not set a Content-Type header and depends on the auto detection."
The bug can be patched by updating to versions 1.14.8 and 1.15.1.
What an Os-lo blow! Norway's parliament hit with attack
A targeted attack on the Norwegian parliament [6]has resulted in the email accounts of several lawmakers and their staffers being accessed by hackers.
Norway's government has confirmed the incident, saying that it was part of a "significant" operation aimed at members of the opposition Labour party. An exact number of accounts or details on exactly who was hacked were not given.
Details of the attack's impact are scanty. Reportedly, the country's National Security Authority has been called in to assist, and at this time it is not known who was behind the attack or their goals.
Cisco warns of critical Jabber bug
Headlining this latest crop of 16 security updates from Cisco is [7]a patch for a critical security flaw in the Jabber messaging client.
The Windows version of Jabber has been found to contain a remote code execution flaw (CVE-2020-3495) which can be exploited simply by opening a message. The bug has been issued a CVSS score of 9.9 on a scale of ten.
"The vulnerability is due to improper validation of message contents," says Cisco.
"An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence Protocol (XMPP) messages to the affected software."
Users and admins are advised to update to the latest version of the Jabber for Windows client to get the fix. Watchcom's Olav Sortland Thoresen was credited with the discovery.
WhatsApp sinks six flaws, including remote code bug
WhatsApp has [8]issued fixes for six CVE-listed bugs in both the mobile and desktop versions of its client.
The bulletin is headlined by CVE-2020-1894. The stack write overflow for both Android and iOS would have potentially allowed for remote code execution when the target opened a malformed push-to-talk message.
Also addressed was an out-of-bounds write flaw in video calls (CVE-2020-1891), a URL validation bug in Android (CVE-2020-1890), a security bypass in the desktop client (CVE-2020-1889), an out-of-bounds write flaw in Android (CVE-2020-1886), and an input validation flaw on the desktop client (CVE-2019-11928).
In each case, the flaws have already been patched, so users can protect themselves by making sure they're running the latest version of the WhatsApp software. ®
Get our [9]Tech Resources
[1] https://archives.fbi.gov/archives/sandiego/press-releases/2013/san-diego-jury-convicts-four-somali-immigrants-of-providing-support-to-foreign-terrorists
[2] https://www.reuters.com/article/us-usa-nsa-spying/u-s-court-mass-surveillance-program-exposed-by-snowden-was-illegal-idUSKBN25T3CK
[3] https://twitter.com/Snowden/status/1301251393832050688
[4] https://www.justice.gov/usao-edca/pr/colorado-man-operating-under-nicknames-penissmith-and-botah-sentenced-11-years-prison
[5] https://seclists.org/fulldisclosure/2020/Sep/5
[6] https://www.nytimes.com/reuters/2020/09/01/world/europe/01reuters-norway-parliament.html
[7] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-UyTKCPGg
[8] https://www.whatsapp.com/security/advisories/2020/
[9] https://whitepapers.theregister.com/
The ruling had nothing to do with Snowden himself. Instead is concerned four Somalis [1]convicted of funneling funds to terrorist organizations in 2013 who had their appeal denied, but with a caveat. The court [2]ruled that the evidence that put the four away was gathered using the US intelligence agency's post-9/11 surveillance schemes, which were both illegal and unconstitutional. However, it rejected the rest of the appeal due to the weight of other evidence.
Snowden took to Twitter with a celebration of sorts.
"Seven years ago, as the news declared I was being charged as a criminal for speaking the truth, I never imagined that I would live to see our courts condemn the NSA's activities as unlawful and in the same ruling credit me for exposing them," Snowden [3]tweeted . "And yet that day has arrived."
Darknet market's peacemaker sentenced to 11 years in prison
A Colorado man is looking at more than a decade behind bars for trying to settle a few arguments, albeit on an online souk selling highly illegal stuff.
Bryan Connor Herrell, aka "penissmith" and/or "botah" [4]has been sentenced to 11 years for his work as a sort of problem solver on the Alphabay crime market. The moderator was tasked with settling disputes between sellers and their customers, usually involving drugs.
In addition to handling disputes, he was also tasked with watching for scammers who might give 'honest' drug dealers, identity thieves, and gun-runners a bad name. For his troubles, he was paid a nice chunk of Bitcoin.
"Cases like these exemplify how the FBI and our international partners are eliminating the false promise of anonymity dark marketplaces claim to provide and are successfully dismantling criminal organizations which prey upon communities through use of sophisticated computer code,” said Sean Ragan, special agent in charge of the FBI Sacramento Field Office.
Go language found to contain cross-site scripting bug
A flaw in a library for the Go language could leave some applications vulnerable to cross-site scripting attacks.
Bug-hunters with RedTeam Pentesting GmbH [5]say that the way Go code handles CGI and FastCGI requests could potentially create cross-site scripting holes that would only show up in the finished web application.
The problem arises because the Go application and the HTTP server itself handle data in different ways, and in some cases the data type for an upload will not be properly checked.
"For example, consider a web application which allows uploading PDF files and pictures," the team writes. "During upload, the application checks (via the DetectContentType() mentioned in the documentation) that the uploaded content is either "application/pdf" or "image/png" and rejects all other data. When an uploaded file is requested again, the application does not set a Content-Type header and depends on the auto detection."
The bug can be patched by updating to versions 1.14.8 and 1.15.1.
What an Os-lo blow! Norway's parliament hit with attack
A targeted attack on the Norwegian parliament [6]has resulted in the email accounts of several lawmakers and their staffers being accessed by hackers.
Norway's government has confirmed the incident, saying that it was part of a "significant" operation aimed at members of the opposition Labour party. An exact number of accounts or details on exactly who was hacked were not given.
Details of the attack's impact are scanty. Reportedly, the country's National Security Authority has been called in to assist, and at this time it is not known who was behind the attack or their goals.
Cisco warns of critical Jabber bug
Headlining this latest crop of 16 security updates from Cisco is [7]a patch for a critical security flaw in the Jabber messaging client.
The Windows version of Jabber has been found to contain a remote code execution flaw (CVE-2020-3495) which can be exploited simply by opening a message. The bug has been issued a CVSS score of 9.9 on a scale of ten.
"The vulnerability is due to improper validation of message contents," says Cisco.
"An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence Protocol (XMPP) messages to the affected software."
Users and admins are advised to update to the latest version of the Jabber for Windows client to get the fix. Watchcom's Olav Sortland Thoresen was credited with the discovery.
WhatsApp sinks six flaws, including remote code bug
WhatsApp has [8]issued fixes for six CVE-listed bugs in both the mobile and desktop versions of its client.
The bulletin is headlined by CVE-2020-1894. The stack write overflow for both Android and iOS would have potentially allowed for remote code execution when the target opened a malformed push-to-talk message.
Also addressed was an out-of-bounds write flaw in video calls (CVE-2020-1891), a URL validation bug in Android (CVE-2020-1890), a security bypass in the desktop client (CVE-2020-1889), an out-of-bounds write flaw in Android (CVE-2020-1886), and an input validation flaw on the desktop client (CVE-2019-11928).
In each case, the flaws have already been patched, so users can protect themselves by making sure they're running the latest version of the WhatsApp software. ®
Get our [9]Tech Resources
[1] https://archives.fbi.gov/archives/sandiego/press-releases/2013/san-diego-jury-convicts-four-somali-immigrants-of-providing-support-to-foreign-terrorists
[2] https://www.reuters.com/article/us-usa-nsa-spying/u-s-court-mass-surveillance-program-exposed-by-snowden-was-illegal-idUSKBN25T3CK
[3] https://twitter.com/Snowden/status/1301251393832050688
[4] https://www.justice.gov/usao-edca/pr/colorado-man-operating-under-nicknames-penissmith-and-botah-sentenced-11-years-prison
[5] https://seclists.org/fulldisclosure/2020/Sep/5
[6] https://www.nytimes.com/reuters/2020/09/01/world/europe/01reuters-norway-parliament.html
[7] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-UyTKCPGg
[8] https://www.whatsapp.com/security/advisories/2020/
[9] https://whitepapers.theregister.com/