#intel

Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as Enclaves. There are two issues that are mitigated in version 0.19.3. First, Open Enclave SDK does not properly sanitize the `MXCSR` register on enclave entry. This makes applications vulnerable to MXCSR Configuration Dependent Timing (MCDT) attacks, where incorrect `MXCSR` values can impact instruction retirement by at most one cycle, depending on the (secret) data operand value. Please find more details in the guidance from Intel in the references. Second, Open Enclave SDK does not sanitize x86's alignment check flag `RFLAGS.AC` on enclave entry. This opens up the possibility for a side-channel attacker to be notified for every unaligned memory access performed by the enclave. The issue has been addressed in version 0.19.3 and the current master branch. Users will need to recompile their applications against the patched libraries...

By Waqas South Korean Web3 Leader Xangle Joins Forces with US Firm Republic Crypto in Strategic Partnership. This is a post from HackRead.com Read the original post: Xangle and Republic Crypto Collaborate to Boost Asian Web3 Adoption

Cisco UCS-IMC Supervisor version 2.2.0.0 suffers from an authentication bypass vulnerability.

By Owais Sultan Discover how AI enhances cybersecurity, with a focus on SAP security. Learn about AI’s impact on threat detection,… This is a post from HackRead.com Read the original post: How AI is Tightening Cybersecurity for Businesses

Cyber attacks using infected USB infection drives as an initial access vector have witnessed a three-fold increase in the first half of 2023,  That's according to new findings from Mandiant, which detailed two such campaigns – SOGU and SNOWYDRIVE – targeting both public and private sector entities across the world. SOGU is the "most prevalent USB-based cyber espionage attack using USB flash

By Owais Sultan Let’s explore the steps involved in penetration testing and the methodology employed by cybersecurity professionals to conduct effective… This is a post from HackRead.com Read the original post: Steps Involved In Penetration Testing And Their Methodology In Cybersecurity

Plus: A fitness app may have leaked the location of a murdered submarine captain, the privacy risks of filing taxes online, and how Facebook data was used in an abortion trial.

With generative artificial intelligence (AI) becoming all the rage these days, it's perhaps not surprising that the technology has been repurposed by malicious actors to their own advantage, enabling avenues for accelerated cybercrime. According to findings from SlashNext, a new generative AI cybercrime tool called WormGPT has been advertised on underground forums as a way for adversaries to

Microsoft on Friday said a validation error in its source code allowed for Azure Active Directory (Azure AD) tokens to be forged by a malicious actor known as Storm-0558 using a Microsoft account (MSA) consumer signing key to breach two dozen organizations. "Storm-0558 acquired an inactive MSA consumer signing key and used it to forge authentication tokens for Azure AD enterprise and MSA

By Habiba Rashid A fake and malicious version of TeamViewer is being pushed as legitimate, which in reality infects devices with njRAT Malware (aka Bladabindi). This is a post from HackRead.com Read the original post: Fake TeamViewer Installer Used to Deliver njRAT Malware