Aamir Lakhani, global security strategist and researcher at FortiGuard Labs, zeroes in on how adversaries are targeting 'remote everything'.

Aamir Lakhani, global security strategist and researcher at FortiGuard Labs, zeroes in on how adversaries are targeting ‘remote everything’.

The rise of remote work and learning opened new opportunities for many people – as we’ve seen by the number of people who have moved to new places or adapted to “workcations.” Cybercriminals are taking advantage of the same opportunities – just in a different way. Evaluating the prevalence of malware variants by region reveals a sustained interest by cyber adversaries in maximizing the remote work and learning attack vector.

****What Malware Trends are Showing****

Our FortiGuard Labs research team dug into the prevalence of malware variants by region for the second half of 2021. What they found shows a sustained interest by cyber adversaries in maximizing the remote work and learning attack vector. The team found that various forms of browser-based malware were prevalent. Often, this takes the form of phishing lures or scripts that inject code or redirect users to malicious sites.

Detections vary across regions, of course, but can be largely grouped into three broad distribution mechanisms: Microsoft Office executables (MSExcel/, MSOffice/), PDF files and browser scripts (HTML/, JS/). Files packed with the Microsoft Intermediate Language (MSIL) are another common feature.

It’s worthy of note that some kinds of browser-based malware occupy the top spots in all regions. Such techniques have gained prominence recently as a way to exploit peoples’ desire for the latest news about COVID-19, politics, sports or any current headline. And since many are browsing from their home networks these days, there are fewer layers of protection between such malware and would-be victims (e.g., no corporate web filters).

****The Rise of Exploit Kits****

The use of exploit kits (EKs) is one element that has clearly helped cybercriminals in their efforts to execute malware. These kits are automated programs attackers use to exploit systems or applications. What makes an exploit kit very dangerous is its ability to identify victims while they browse the web. After they target a potential victim’s vulnerabilities, attackers can download and execute their malware of choice.

Exploit kits work automatically and silently as they look for vulnerabilities on a user’s machine while they browse the web. Currently, exploit kits are the preferred method for the distribution of remote access tools (RATs) or mass malware by cybercriminals, especially those seeking to profit financially from an exploit.

What’s especially insidious is that EKs don’t require victims to download a file or attachment. The victim need only browse on a compromised website, and then that site pulls in hidden code that attacks vulnerabilities in the user’s browser.

Currently, older kits are available to the public. Attackers have been taking these older kits and modifying them, making them more resilient to newer security detection strategies. Also, many of these kits are being advertised for sale online. Attackers offer these kits for rent on these sites and offer support and update contracts to guarantee they work against future updates.

****Addressing the Remote Everything Security Problem****

As hybrid work and learning become embedded paradigms in our culture, there are fewer layers of protection between malware and would-be victims. And bad actors are gaining access to more tools to help them pull off their nefarious deeds – like exploit kits. At the same time, the attack surface has rapidly expanded and continues to do so.

That means enterprises must take a work-from-anywhere approach to their security. They need to deploy solutions capable of following, enabling and protecting users no matter where they are located. They need security on the endpoint (EDR) combined with zero trust network access (ZTNA) approaches.

Another vital component and best practice of modern security strategy is the development of a holistic security mesh, wherein fully integrated security, services and threat intelligence seamlessly follow users on the road, at home or in the office to provide enterprise-grade protection and productivity across the extended network.

This simplifies and satisfies the demands of today’s three most common WFA scenarios: the corporate office, the home office and the mobile worker. Enterprises must secure mission-critical applications, so securing access to those applications, the networks to connect to those applications, and the devices that run those applications remain a vital component of a layered defense – even when working from a traditional location.

In the home office, risk lurks in the home networks that are often poorly secured with retail wireless routers and contain vulnerable IoT devices, which can be a pathway for hacker to gain access. And mobile workers regularly rely on untrusted and unsecured networks to access critical business resources. This can introduce unique threats, enabling cybercriminals to launch attacks against inadequately protected devices or intercept exposed communications.

A holistic integration of endpoint security, network security and ZTA/ZTNA addresses the challenges that WFA presents.

Criminals will make the most of any possible threat scenario, and the past two years have provided many opportunities for network attack. Malware trends and the rise of exploit kits have proven this point, and it’s now incumbent upon IT security teams to re-evaluate their security posture and adjust as needed. A comprehensive, integrated security mesh that accounts for all work possibilities is a best practice.

**_Aamir Lakhani is cybersecurity researcher and practitioner at FortiGuard Labs_.**

**_Enjoy additional insights from Threatpost’s Infosec Insiders community by visiting our microsite._**

Bad Actors Are Maximizing Remote Everything

CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.

**Older versions of CSV-Safe gem doesn't filter out special characters which could trigger CSV Injection. (< 3.0.0)**

**Vulnerability Type**  
CSV Injection

**Product**  
csv-safe

**Affected Product Code Base**  
CSV-safe - <3.0.0 are effected

**Affected Component**  
Sanitization of CSV Injection vectors.

**Attack Type**  
Remote

**Attack Vector**  
**%0A-3+3+cmd|' /C calc'!D2** could be used to bypass CSV injection sanitizations in older versions.

**Discoverers**  
Danish Tariq

**Fixed by**  
Gabriel Rios - #8

**References**  
https://github.com/zvory/csv-safe  
#8  
https://hackerone.com/reports/223999  
WeblateOrg/weblate@d9e136f  
https://bugzilla.mozilla.org/show\_bug.cgi?id=1259881

CVE-2022-28481: Older versions of CSV-Safe gem doesn't filter out special characters which could trigger CSV Injection. (< 3.0.0)  · Issue #7 · zvory/csv-safe

A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.

**

Applications

**

Download PingID as a mobile application for your iOS or Android device, or as a simple and secure desktop application for macOS or Windows. Fully managed by Ping, these applications help enterprises provide convenient security factors that ensure their employees and partners are who they say they are.

**

Mobile

**

**

Desktop

**

SHA256 590269efe33ddf94cfaee5e5a45cf96afb14bf4493781d95d0f355530cee872b Copied!

SHA256 3ae57cb2b2847c2522ca13a926d1e8e5926c22c086ee97521da4e7562e4240c9 Copied!

**

SDK Integration Kit

**

The PingID SDK is a multi-factor authentication (MFA) solution for your customers that prioritizes security and convenience. For MFA, it allows you to send push notifications from your own mobile application, or to send one-time passcodes (OTPs) via email, SMS or voice. It also includes the ability to login with a QR code to give your customers passwordless and usernameless authentication. This integration kit has everything you need to deploy the PingID SDK standalone or with PingFederate. The download includes:

*   **A mobile SDK** to embed secure, user-friendly MFA into your own mobile app (including server-side and mobile sample apps).
    
*   **A PingFederate adapter** that allows you to trigger MFA from PingFederate policies.
    
*   **A PingFederate connector** to provision and manage user lifecycles in the PingID SDK.
    

_\* By downloading the PingID SDK Integration Kit you agree to the license terms._

**DOCUMENTATION**

Admins | Developers

**

Integrations

**

You can integrate PingID with a wide variety of products and services.  

Start Today

See how Ping can help you deliver secure employee and customer experiences in a rapidly evolving digital world.

CVE-2021-41992: PingID Downloads

A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.

This document

All documents

This document

Contents

Loading...

CVE-2021-41994: Ping Identity Documentation Portal

Red Planet Laundry Management System 1.0 is vulnerable to SQL Injection.

**About Us**

We **Red Planet Computers** has started development in Laundry Management System in 2017. We have 7+ years experience in development, customization and implementation Web, Mobile application Services.

*   Well and Experienced Staff.
*   User Friendly Services
*   24x7 remote support servies

Our team have hands-on experience in all aspects of IT planning, deployment, operational management and maintenance support. Our design consultants design solutions that fit best within your environment and help achieve your laundry business goals – working with you as trusted advisors to help determine the best solution for your laundry business.

See More

**Development Skills**

**Laundry Management System Developed in following skills**

Our professional and experience developers team are used skill to the top most computer launguages and framworks for ui design, developement, making user friendly and secure laundry application for small business.

Boostrap & CSS _Website and Admin UI Design_

Javascript & Ajax _Website Development_

PHP Codeigniter & Mysqli _Website and Admin Panel_

Flutter, Swift and Kotlin _Android, iOS Mobile App_

**Screenshots**

Here some application UI screens to help you how its look and work LMS Application

*   Admin
*   Website
*   Mobile

**Pricing**

**RPL Standard Package  
(Point Of Sale\*)****INR 30K USD $399/- for lifetime**

*   **Full 100% Source Code  
    Free Source Code for testing Click Here**
*   **License - Lifetime (25 Years)**
*   **Payment - One Time Payment** \[No need Renew/Payment every year\]
*   **Install - Unlimited Devices**
*   Bootstrap Admin Panel
*   Multi-Store Management
*   Multi-user Management
*   POS Screen Management
*   Multi-Launguage Management
*   Barcode Tag Management
*   POS/Laser Printer Management
*   Discount/Taxes Management
*   World Currency Management
*   Wallet/Credit Management
*   Laundry Packages Management
*   SMS, Email Management
*   Profit/Loss Reports
*   Daily/Monthly Reports
*   Mobile(Android, iOS) App
*   Customer / Driver App
*   Customer Front-End Website
*   Payment Gateway
*   Customized UI
*   One Year Free Service & Updates.

Buy Now

**RPL Professional Package  
(E-Commerce\*)****INR 50K USD $649/- for lifetime**

*   **Full 100% Source Code  
    Free Source Code for testing Click Here**
*   **License - Lifetime (25 Years)**
*   **Payment - One Time Payment** \[No need Renew/Payment every year\]
*   **Install - Unlimited Devices**
*   Bootstrap Admin Panel
*   Multi-Store Management
*   Multi-user Management
*   POS+E-Comm Management
*   Multi-Launguage Management
*   Barcode Tag Management
*   POS/Laser Printer Management
*   Discount/Taxes Management
*   World Currency Management
*   Wallet/Credit Management
*   Laundry Packages Management
*   SMS, Email Management
*   Profit/Loss Reports
*   Daily/Monthly Reports
*   Mobile(Android, iOS) App
*   Customer / Driver App
*   Customer Front-End Website
*   Payment Gateway
*   Customized UI (Mobile, Website)
*   One Year Free Service & Updates.

Buy Now

**RPL Development Package  
(Customization\*\*)****Extra 50% POS+50% (OR) E-Commerce+50%**

*   **Full 100% Source Code  
    Free Source Code for testing Click Here**
*   **License - Lifetime (25 Years)**
*   **Payment - One Time Payment** \[No need Renew/Payment every year\]
*   **Install - Unlimited Devices**
*   Bootstrap Admin Panel
*   Multi-Store Management
*   Multi-user Management
*   POS/E-Commerce Management
*   Multi-Launguage Management
*   Barcode Tag Management
*   POS/Laser Printer Management
*   Discount/Taxes Management
*   World Currency Management
*   Wallet/Credit Management
*   Laundry Packages Management
*   SMS, Email Management
*   Profit/Loss Reports
*   Daily/Monthly Reports
*   Mobile(Android, iOS) App
*   Customer / Driver App
*   Customer Front-End Website
*   Payment Gateway
*   Customized UI (Mobile, Website)         \[ as per your requirements\*\* \]
*   One Year Free Service & Updates.

Buy Now

\* Terms and Conditions apply (see FAQ section )  
\*\* Cost may vary depends on the customization

**Frequently Asked Questions**

Here are some of the most Frequently Asked Questions for Laundry Management Systems.

*   Can we get all liceses for lifetime ?
    
    Ans : Yes, if you purchase application with full source code then it's one-time payment and you will get multiple digital license \[lifetime\]. The amount is non-refundable , Once if you have got full source code then you will not getting return amount for any circumstances.
    
*   After purchase full source code can we sell this software ?
    
    Ans : Yes, after purchase application with full source code then you can use or sell anywhere with remove red planet computers company logo and name.
    
*   Can you will provide full source code ?
    
    Ans : Yes, you should have to pay 100% amount, if you want application with full source code. We will send full source code (zip or download link ) within half hours after successfully payment done. We will not provide any kind of equipment. Only RPL Business Package we will not provide source files.
    
*   What is **RPL Development / Customization Package** ?
    
    Ans : If you want manipulation or any changes in application through our professional developer team then you will have to pay selected (standard or professional) package amount plus extra 50% amount for manipulation charges. **Firstly, you have to pay 70% amount of total amount** and remaining 30% amount to pay after project completed, but note that in this period you will not getting full source code, you will getting our web hosting softwares link for testing, after completed project and 100% payment done then we will upload full source code in your website/web hosting server or send full source code link).  
    \- As per your requirement, project will be completed within 20-25 days or earlier.  
    \- Bulk SMS, Payment Gateway, Apple App Store, Google Map API & Play Store Console charges you will have to pay, if you are require.
    
*   Service and Support ?
    
    Ans : We will provide a FREE technical support upto one year after purchase LMS Application. We will answer your question regarding website management, technical details or anything about operating your own website; we can provide this through remotly in 24x7 Hours.
    

**Free Trail Full Version**

Not required fill any personal information or credit card details just click on button and login it

Username : admin  
Password : 1234  
\[ Admin Login Details \]

  
Best view in Desktop or Laptop

Mobile : 8767228990  
Password : 1983  
\[ Demo User Login Details \]

  
Best view in Desktop or Laptop

User Mobile : 8767228990  
Driver Mobile : 1234567890  
\[ Demo User / Driver Login Details \]

   
iOS app install : Download and Extract zip in Mac-OS then drag-drop .app file on Xcode 10+ simulator or connected iphone {iOS v10.0+}.

**Contact**

You can call to us 24x7 regarding Laundry Management System enquiry or solutions

**Location:**

B-02, Sai Sanklap Complex, Survey No. 145/0,  
Usarli Khurd, Panvel, Mumbai, India 410206

**Call:**

Mobile : +91 87672 28990.  
Whatsapp : +91 87672 28990.  
Skype : rpcits2013 / +918767228990.

CVE-2022-28452: Better solutions for Small Laundry and Dry Cleaning Business

**About Us**

We **Red Planet Computers** has started development in Laundry Management System in 2017. We have 7+ years experience in development, customization and implementation Web, Mobile application Services.

*   Well and Experienced Staff.
*   User Friendly Services
*   24x7 remote support servies

Our team have hands-on experience in all aspects of IT planning, deployment, operational management and maintenance support. Our design consultants design solutions that fit best within your environment and help achieve your laundry business goals – working with you as trusted advisors to help determine the best solution for your laundry business.

See More

**Development Skills**

**Laundry Management System Developed in following skills**

Our professional and experience developers team are used skill to the top most computer launguages and framworks for ui design, developement, making user friendly and secure laundry application for small business.

Boostrap & CSS _Website and Admin UI Design_

Javascript & Ajax _Website Development_

PHP Codeigniter & Mysqli _Website and Admin Panel_

Flutter, Swift and Kotlin _Android, iOS Mobile App_

**Screenshots**

Here some application UI screens to help you how its look and work LMS Application

*   Admin
*   Website
*   Mobile

**Pricing**

**RPL Standard Package  
(Point Of Sale\*)****INR 25K USD $349/- for lifetime**

*   **Full 100% Source Code  
    Free Source Code for testing Click Here**
*   **License - Lifetime (25 Years)**
*   **Payment - One Time Payment** \[No need Renew/Payment every year\]
*   **Install - Unlimited Devices**
*   Bootstrap Admin Panel
*   Multi-Store Management
*   Multi-user Management
*   POS Screen Management
*   Multi-Launguage Management
*   Barcode Tag Management
*   POS/Laser Printer Management
*   Discount/Taxes Management
*   World Currency Management
*   Wallet/Credit Management
*   Laundry Packages Management
*   SMS, Email Management
*   Profit/Loss Reports
*   Daily/Monthly Reports
*   Mobile(Android, iOS) App
*   Customer / Driver App
*   Customer Front-End Website
*   Payment Gateway
*   Customized UI
*   One Year Free Service & Updates.

Buy Now

**RPL Professional Package  
(E-Commerce\*)****INR 45K USD $599/- for lifetime**

*   **Full 100% Source Code  
    Free Source Code for testing Click Here**
*   **License - Lifetime (25 Years)**
*   **Payment - One Time Payment** \[No need Renew/Payment every year\]
*   **Install - Unlimited Devices**
*   Bootstrap Admin Panel
*   Multi-Store Management
*   Multi-user Management
*   POS+E-Comm Management
*   Multi-Launguage Management
*   Barcode Tag Management
*   POS/Laser Printer Management
*   Discount/Taxes Management
*   World Currency Management
*   Wallet/Credit Management
*   Laundry Packages Management
*   SMS, Email Management
*   Profit/Loss Reports
*   Daily/Monthly Reports
*   Mobile(Android, iOS) App
*   Customer / Driver App
*   Customer Front-End Website
*   Payment Gateway
*   Customized UI (Mobile, Website)
*   One Year Free Service & Updates.

Buy Now

**RPL Development Package  
(Customization\*\*)****Extra 50% POS+50% (OR) E-Commerce+50%**

*   **Full 100% Source Code  
    Free Source Code for testing Click Here**
*   **License - Lifetime (25 Years)**
*   **Payment - One Time Payment** \[No need Renew/Payment every year\]
*   **Install - Unlimited Devices**
*   Bootstrap Admin Panel
*   Multi-Store Management
*   Multi-user Management
*   POS/E-Commerce Management
*   Multi-Launguage Management
*   Barcode Tag Management
*   POS/Laser Printer Management
*   Discount/Taxes Management
*   World Currency Management
*   Wallet/Credit Management
*   Laundry Packages Management
*   SMS, Email Management
*   Profit/Loss Reports
*   Daily/Monthly Reports
*   Mobile(Android, iOS) App
*   Customer / Driver App
*   Customer Front-End Website
*   Payment Gateway
*   Customized UI (Mobile, Website)         \[ as per your requirements\*\* \]
*   One Year Free Service & Updates.

Buy Now

\* Terms and Conditions apply (see FAQ section )  
\*\* Cost may vary depends on the customization

**Frequently Asked Questions**

Here are some of the most Frequently Asked Questions for Laundry Management Systems.

*   Can we get all liceses for lifetime ?
    
    Ans : Yes, if you purchase application with full source code then it's one-time payment and you will get multiple digital license \[lifetime\]. The amount is non-refundable , Once if you have got full source code then you will not getting return amount for any circumstances.
    
*   After purchase full source code can we sell this software ?
    
    Ans : Yes, after purchase application with full source code then you can use or sell anywhere with remove red planet computers company logo and name.
    
*   Can you will provide full source code ?
    
    Ans : Yes, you should have to pay 100% amount, if you want application with full source code. We will send full source code (zip or download link ) within half hours after successfully payment done. We will not provide any kind of equipment. Only RPL Business Package we will not provide source files.
    
*   What is **RPL Development / Customization Package** ?
    
    Ans : If you want manipulation or any changes in application through our professional developer team then you will have to pay selected (standard or professional) package amount plus extra 50% amount for manipulation charges. **Firstly, you have to pay 70% amount of total amount** and remaining 30% amount to pay after project completed, but note that in this period you will not getting full source code, you will getting our web hosting softwares link for testing, after completed project and 100% payment done then we will upload full source code in your website/web hosting server or send full source code link).  
    \- As per your requirement, project will be completed within 20-25 days or earlier.  
    \- Bulk SMS, Payment Gateway, Apple App Store, Google Map API & Play Store Console charges you will have to pay, if you are require.
    
*   Service and Support ?
    
    Ans : We will provide a FREE technical support upto one year after purchase LMS Application. We will answer your question regarding website management, technical details or anything about operating your own website; we can provide this through remotly in 24x7 Hours.
    

**Free Trail Full Version**

Not required fill any personal information or credit card details just click on button and login it

Username : admin  
Password : 1234  
\[ Admin Login Details \]

  
Best view in Desktop or Laptop

Mobile : 8767228990  
Password : 1983  
\[ Demo User Login Details \]

  
Best view in Desktop or Laptop

User Mobile : 8767228990  
Driver Mobile : 1234567890  
\[ Demo User / Driver Login Details \]

   
iOS app install : Download and Extract zip in Mac-OS then drag-drop .app file on Xcode 10+ simulator or connected iphone {iOS v10.0+}.

**Contact**

You can call to us 24x7 regarding Laundry Management System enquiry or solutions

**Location:**

B-02, Sai Sanklap Complex, Survey No. 145/0,  
Usarli Khurd, Panvel, Mumbai, India 410206

**Call:**

Mobile : +91 87672 28990.  
Whatsapp : +91 87672 28990.  
Skype : rpcits2013 / +918767228990.

Red Hat Security Advisory 2022-1645-01 - Twisted is a networking engine written in Python, supporting numerous protocols. It contains a web server, numerous chat clients, chat servers, mail servers and more. Issues addressed include a HTTP request smuggling vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: Red Hat OpenStack Platform 16.2 (python-twisted) security update  
Advisory ID:       RHSA-2022:1645-02  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:1645  
Issue date:        2022-04-28  
CVE Names:         CVE-2022-24801  
====================================================================  
1. Summary:

An update for python-twisted is now available for Red Hat OpenStack  
Platform 16.2 (Train).

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - ppc64le, x86_64

3. Description:

Twisted is a networking engine written in Python, supporting numerous  
protocols. It contains a web server, numerous chat clients, chat servers,  
mail servers and more.

Security Fix(es):

* possible http request smuggling (CVE-2022-24801)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2073114 - CVE-2022-24801 python-twisted: possible http request smuggling

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:  
python-twisted-16.4.1-20.el8ost.src.rpm

ppc64le:  
python-twisted-debugsource-16.4.1-20.el8ost.ppc64le.rpm  
python3-twisted-16.4.1-20.el8ost.ppc64le.rpm  
python3-twisted-debuginfo-16.4.1-20.el8ost.ppc64le.rpm

x86_64:  
python-twisted-debugsource-16.4.1-20.el8ost.x86_64.rpm  
python3-twisted-16.4.1-20.el8ost.x86_64.rpm  
python3-twisted-debuginfo-16.4.1-20.el8ost.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-24801  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYmu7FNzjgjWX9erEAQhxtQ//UlvSrTbA7tD0YMy0oiex2Uvbjgl586PE  
t7A2LB0Q6wPQeA+42j6aoty6/inusb+h0ob11gukM9akZDEZUt36aqQpBZxNBULI  
kI+8k0RjpR3bp/BjylcwE9hrYfNvHqBsZrS/4llZH/YE2NOYUs2YQaRo2Lh2oFGw  
iCgjXk2SxE3NFGwrjsgAd87tq+hLmaIkjNLNGTKNYyy94mWMSyVJidTbYzoGt+1T  
kwFf9aUYiIz4RnBFavWOCoqGInV64jzKQSuCDij5htbNG9t9Vjvntv5u0HCjF/Ot  
DXKzzk4WlWc+P5bMNLkWnIKZJcXdr9pgMdZBWwzy35zG3YHvGMTuBdJicMkq8hTP  
jdu2zhb1d2EQKiWPwAOdCZzySBI4myyJBTHxZKj6fQ5CIWLJzes0SIbVNAebac+p  
0aMOjQ+M1GOE1O9wxhn+Daqo4AkdDWRvfQk554JNIQCwtfmPL23rfThZzze+I08f  
HI/zrToHbMvXNwiOSf9eM8SzpoeIP92cq2P9OULP3tLxggq/4S8RbaDn/jiakUQk  
OnMaqJzJn///xdwpM6iKtGo6v3X9/+rIAkXpIivUI0t4Tbk6n6HmZQRrwjZT5i4t  
KBFTqncZagZlIa0yD87wJcwcxgoAdZ6vJUoUqhk+8oLh5kh3P00bZyDlt/71RYvd  
DTSkkumsGJUjP  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-1645-01

Plus: Microsoft patched some 100 flaws, while Oracle issued more than 500 security fixes.

To find the update, you’ll need to check your device settings. Devices that have received the Android April update so far include Google’s Pixel devices and some third-party Android phones, including the Samsung Galaxy A32 5G, A51, A52 5G, A53 5G, A71, S10 series, S20 series, Note20 series, Z Flip 5G, Z Flip3, Z Fold, Z Fold2, and the Z Fold3, as well as the OnePlus 9 and OnePlus 9 Pro.

Google Chrome Emergency Updates

As the world’s biggest browser with over 3 billion users, it’s no surprise attackers are targeting Google Chrome. Browser-based attacks are particularly worrying because they can potentially be chained together with other vulnerabilities and used to take over your device.

It has been a particularly busy month for the team behind Google’s Chrome browser, which has seen several security updates within weeks of each other. The latest, pushed out in mid-April, fixes two issues including a high-severity zero-day vulnerability, CVE-2022-1364, which is already being used by attackers.

The technical details aren’t currently available, but the timing of the fix—just a day after it was reported—indicates it’s pretty serious. If you use Chrome, your browser should now be on version 100.0.4896.127 to include the fix. You’ll need to restart Chrome after the update has installed to ensure it activates.

The Chrome issue also impacts other Chromium-based browsers, including Brave, Microsoft Edge, Opera, and Vivaldi, so if you use one of those, make sure you apply the patch.

But that’s not all. On April 27, Google announced another Chrome update, fixing 30 security vulnerabilities. None of these have been exploited yet, the company says, but seven are rated as being a high risk. The update takes the browser to version 101.0.4951.41.

Oracle’s April 2022 Critical Patch Update

In mid-April, Oracle released its quarterly Critical Patch Update, including a whopping 520 security fixes. Some of the issues fixed in the update are serious—300 of them can be exploited remotely without authentication, and 75 security issues are rated as critical severity. Some of the Oracle patches address CVE-2022-22965, aka Spring4Shell, a remote code execution (RCE) flaw in the spring framework.

Microsoft’s Busy April Patch Tuesday

Microsoft had a major Patch Tuesday in April, issuing fixes for over 100 vulnerabilities, including 10 critical RCE flaws. One of the most important, CVE-2022-24521, is already being exploited by attackers, according to the company.

Reported by the NSA and researchers at CrowdStrike, the issue in the Windows Common Log File system driver doesn’t require human interaction to be exploited and can be used to obtain administrative privileges on a logged-in system. Other notable fixes include CVE-2022-26904—a publicly known issue—and CVE-2022-26815, a severe DNS Server flaw.

Mozilla Thunderbird 91.8.0 Fix

On April 5, Mozilla released a patch to fix security issues in its Thunderbird email client as well as its Firefox browser. The details are scant, but Thunderbird 91.8 fixes four vulnerabilities rated as having a high impact, some of which could be exploited to run arbitrary code.

Firefox ESR 91.8 and Firefox 99 also fix multiple security issues.

WordPress Plugin Elementor Version 3.6.3 

The Elementor website builder plug-in for WordPress has received a big security fix in April for a critical-rated vulnerability that could allow attackers to perform remote code execution and effectively take over a website.

Found by researchers at Plugin Vulnerabilities, the flaw was introduced in the plug-in in version 3.6.0, released on March 22. “We would recommend not using this plugin until it has had a thorough security review and all issues are addressed,” the researchers said.

Although the attacker must be authenticated to exploit the issue, it’s still pretty serious because anyone logged into an affected website can exploit it. The update for Elementor’s 5 million users, version 3.6.3, should be applied as soon as possible.

More Great WIRED Stories

*   📩 The latest on tech, science, and more: Get our newsletters!
*   This startup wants to watch your brain
*   The artful, subdued translations of modern pop
*   Netflix doesn't need a password-sharing crackdown
*   How to revamp your workflow with block scheduling
*   The end of astronauts—and the rise of robots
*   👁️ Explore AI like never before with our new database
*   ✨ Optimize your home life with our Gear team’s best picks, from robot vacuums to affordable mattresses to smart speakers

You Need to Update iOS, Android, and Chrome Right Now

Beyond accusations of rampant user copyright infringement, film companies have begun accusing VPNs of enabling a slew of more serious illegal activity.

A group of over two dozen film studios has repeatedly taken popular VPN providers to court, sometimes extracting judgements worth millions of dollars in damages. While piracy remains the central issue, recent legal arguments employed by Hollywood studios have surpassed accusations of copyright infringement and delved into dirtier waters.

Filmmakers attempting to recoup revenue lost to piracy have long alleged that VPN companies both encourage online privacy and have clear-cut evidence that their customers are abusing the privacy and security provided by virtual private networks. But court records show that studios’ legal teams have also accused VPN providers of enabling illegal activity far beyond copyright infringement and, legal experts say, are challenging the notion that VPNs should exist at all.

In March, 26 film companies brought allegations against ExpressVPN and Private Internet Access (PIA), popular “no-log” VPN companies owned by Kape Technologies. The plaintiffs include production companies like Millennium, Voltage, and others behind a slate of popular films. The lawsuit centers on allegations of user privacy. However, court documents reviewed by WIRED reveal plaintiffs arguing that these VPN providers refuse to prevent users from using their services to commit serious illegal acts and run marketing campaigns that openly “boast” that law enforcement is unable to extract any information about their users.

Generally speaking, VPNs give users greater privacy protections by encrypting their online activity and rerouting it through the company’s servers, concealing their IP addresses. Many VPN providers, including ExpressVPN and PIA, claim to maintain “no logs” of their users’ internet activities. This means VPN providers can’t access data to turn over to police or comply with copyright infringement claims. Similar to arguments against comprehensive encryption, the film companies paint VPN providers as culpable in any crimes committed while using their services.

“Emboldened by Defendants’ promises that their identities cannot be disclosed, Defendants’ end users use their VPN services not only to engage in widespread movie piracy, but other outrageous criminal conduct such as harassment, illegal hacking and murder,” reads the lawsuit, filed in US District Court in Colorado. “When these crimes become public, Defendants use these tragic incidents as opportunities to boast about their VPN services.”

The VPN companies responded in court filings that the “inflammatory topics” plaintiffs evoked are irrelevant to copyright infringement. Allegations as far afield as “hacking, stalking, bomb threats, political assassinations, child pornography, and anonymous online message board posts full of hate speech and appearing to encourage violence and murder” are a ploy to portray the VPNs in “a cruelly derogatory light," argue the VPNs’ legal teams.

Beyond vague examples of heinous crimes, the court filing mentions an Express VPN subscriber admitting to downloading child sexual abuse material (CSAM). The film companies also call out the personal political views or activities of those employed by the VPN companies. Specifically, they focus on Rick Falkvinge, who’s known for his political views and arguments that CSAM should be legal. Falkvinge is PIA’s Head of Privacy and creator of the political Pirate Party. He has repeatedly advocated for reforms to copyright laws, calling “copying and sharing” a “natural right.”

PIA’s attorney argues that these allegations must be stricken from the case because they are completely irrelevant and “serve only to inflame emotions in a misguided attempt to prejudice the Court and the public against the defendants by false association with the non-parties whose conduct is described in these paragraphs.”

ExpressVPN and PIA further denied these allegations in statements to WIRED. An ExpressVPN spokesperson also emphasized that the “operation of ExpressVPN’s service has not been changed or otherwise impacted in any way relevant to the parties’ dispute.”

PIA maintained that this litigation jeopardizes user privacy and that it will therefore keep fighting in court. “We assert that the use of VPNs is a legitimate way to protect one’s online privacy—a fundamental human right, which is increasingly in jeopardy of infringement,” the company said.

Legal counsel representing the movie studios did not respond to WIRED’s request for comment.

While Hollywood has waged legal battles around the globe for years, its fights against the VPN industry in the US ramped up last year. VPN company TorGuard, for example, landed in legal hot water with the same group of plaintiffs who successfully forced the VPN provider into blocking BitTorrent traffic for its US users. And in October 2021, VPN.ht also “settled” with these filmmakers, agreeing to not only block BitTorrent but also to log traffic on its US servers. Hollywood studios have also taken providers like Surfshark, VPN Unlimited, and Zenmate to court.

Film company Voltage, which is among the group of companies regularly suing VPN providers, goes a step further, mailing letters to internet customers demanding fines for alleged piracy and threatening them with legal action.

In March 2021, some of the same production companies suing ExpressVPN and PIA also sued no-log VPN provider LiquidVPN for “encouraging and facilitating” piracy. Later, the film companies demanded $10 million in damages from the company. A judge issued a default judgment against LiquidVPN this March, ordering it to pay the studios $14 million.

That lawsuit largely centered around LiquidVPN’s fiery marketing practices and claimed that the VPN is “optimized for torrenting” and lets you “unblock ISP banned streams.” These tactics, the studios argued, encouraged illicit use of the service by those willing to bypass legal restrictions around accessing online content. They might be right.

According to the Electronic Frontier Foundation (EFF), an internet civil liberties group, Hollywood’s demands are “extreme and not supported by law.” But VPNs are also treading into dangerous territory through their marketing tactics.

“The studios argued that a VPN provider _and its hosting company_ should have had a legal responsibility to monitor what their customers were doing with the service, to see if copyright infringement was going on,” says Mitch Stoltz, a senior staff attorney at EFF. “Not only is that not the law, it would undermine the whole purpose of a VPN service, which is to protect people’s internet communications against eavesdropping.” 

Stoltz warns, however, that bold marketing language used by VPNs, such as LiquidVPN’s “optimized for torrenting” claim, can very well be considered “inducement” in a legal context and incur liability for copyright infringement. Fearing the possibility of heavy monetary damages, VPN providers may instead choose to shut down some of their services or settle out of court.

“In contrast, a VPN that doesn’t advertise or encourage infringing uses generally won’t be liable in court even if some users do infringe,” says Stoltz. “That’s an important legal protection for VPN providers, who provide an important service that would be undermined if they were faced with broad monitoring and blocking requirements.”

More Great WIRED Stories

*   📩 The latest on tech, science, and more: Get our newsletters!
*   Sober influencers and the end of alcohol
*   For mRNA, Covid vaccines are just the beginning
*   The future of the web is AI-generated marketing copy
*   Keep your home connected with the best wi-fi routers
*   How to limit who can contact you on Instagram
*   👁️ Explore AI like never before with our new database
*   🏃🏽‍♀️ Want the best tools to get healthy? Check out our Gear team’s picks for the best fitness trackers, running gear (including shoes and socks), and best headphones

Hollywood’s Fight Against VPNs Turns Ugly

Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML injection.

Press Releases | 24 March 2022

**HTML Injection vulnerability found in Turtl Notes, disclosed by Cyber Citadel researchers, could affect iOS and Android users**.

Cyber Citadel’s Lead Security Researcher Rafay Baloch and Security Researcher Muhammad Samak disclosed an HTML Injection vulnerability found in the Turtl Notes application, which could lead to a potential RCE and NTLMv2 hash disclosure via abusing the arbitrary URI schemes.

Turtl Notes user interface

**Turtl Notes**

Turtl Notes is a cross-platform application that focuses on note-taking collaboration. The online service provides users with a notebook sharing platform that allows notes to be organised easily, synchronised across devices, shared with other Turtl users and shared via email. The application has been downloaded 10,000+ times on Google Play and an unknown number of times from the Turtl’s website for Windows, OSX, Linux, Android and iOS.

While Turtl encrypts user data, with an impressive 2,048-bit key encryption system, and boasts the implementation of high-grade firewalls, that protect from DDoS attacks, the HTML Injection vulnerability, found by Rafay Baloch and Muhammad Samak, has exposed a critical flaw in Turtl’s software.

Turtl remote code execution POC

Evidence of Turtle RCE vulnerability

Evidence of Turtle RCE vulnerability

**Response from Vendors**

Vendor

Service

Version

Platform

Reported Date

Fixed

CVE

Turtl

Turtl Notes

0.7.2.6

Windows, Mac, Linux, Android

11/12/2021

N/A

Processing

Tag

#ios