Aggregator

Written by: Nick Harbour

When it's pumpkin spice season, that means it's also Flare-On Challenge season. The Flare-On Challenge is a reverse engineering contest held every year by the FLARE team, and this marks its eleventh year running. It draws thousands of players from around the world every year, and is the foremost single-player CTF-style challenge for current and aspiring reverse engineers. It provides individual players with a gauntlet of increasingly challenging puzzles to test their ability, and earn a position in our hall of fame. Veteran competitors who have been following the live countdown over at flare-on.com may have already marked their calendar for the contest launch at 8:00pm ET on Sept. 27th, 2024. It will run for six weeks, ending at 8:00pm ET on Nov. 8th, 2024.

The Flare-On contest always features a diverse array of architectures, but with a strong representation of Windows binaries. This year’s contest may be the most diverse ever, with 10 challenges covering architectures including Windows, Linux, JavaScript, .NET, YARA, UEFI, Verilog, and Web3. Yes, you read that correctly, there is a YARA challenge this year. The challenges are often designed to represent Reverse Engineering challenges the FLARE team has encountered on the frontlines of cybersecurity.

If you successfully crush all 10 challenges you will be eligible to receive a prize, which will be revealed later. This crucial bit of gear will distinguish you from your colleagues who have not mastered the arcane art of Reverse Engineering, and will thus be an object of their envy. Your name or handle, should you choose to be included, will be permanently etched into the Hall of Fame on the Flare-On website. 

Please check the Flare-On website for the live countdown and, upon launch, the link to the game server. Early account registration will open approximately two days before launch. While you’re there, check out last year’s challenges and official solutions to prepare yourself. For official news and information, we will be using the Twitter/X hashtag #flareon11.

An FBI and CISA alert highlighted false claims of breaches of voter registration databases, designed to undermine confidence in US elections

To prevent this, organizations should focus on developing secure hardware and firmware foundations, enabling them to manage, monitor, and remediate hardware and firmware security.

A vulnerability has been found in Tenda O6 1.0.0.7(2054) and classified as critical. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. This vulnerability was named CVE-2024-46049. The attack can be initiated remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as critical, was found in Tenda CH22 1.0.0.6(468). This affects the function frmL7PlotForm of the file /goform/frmL7ProtForm. The manipulation of the argument page leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2024-46045. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.6(468). Affected by this issue is the function fromqossetting of the file /goform/fromqossetting. The manipulation of the argument qos leads to stack-based buffer overflow. This vulnerability is handled as CVE-2024-46044. The attack may be launched remotely. Furthermore, there is an exploit available.

Kali Linux 2024.3, the most recent iteration of Offensive Security’s highly regarded Debian-based distribution designed for ethical hacking and penetration testing, has been released. This new release is a major update that includes 11 new hacking tools and focuses on behind-the-scenes updates and optimizations. According to the Kali Linux team, there have been a few […]

The post Kali Linux 2024.3 Released With New Hacking Tools appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability, which was classified as critical, was found in Google Android up to 7.1. This affects an unknown part of the component libnl. The manipulation leads to improper access controls. This vulnerability is uniquely identified as CVE-2017-0386. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

Details have emerged about a now-patched security flaw impacting Apple's Vision Pro mixed reality headset that, if successfully exploited, could allow malicious attackers to infer data entered on the device's virtual keyboard. The attack, dubbed GAZEploit, has been assigned the CVE identifier CVE-2024-40865. "A novel attack that can infer eye-related biometrics from the avatar image to

Сотрудничество правоохранителей и регуляторов показывает пример глобального противодействия кибератакам.

A vulnerability was found in Google Android and classified as critical. Affected by this issue is the function get_futex_key of the file futex.c. The manipulation leads to use after free. This vulnerability is handled as CVE-2018-9422. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in gnuedu. This affects an unknown part of the file web/login.php. The manipulation of the argument LIBSDIR leads to code injection. This vulnerability is uniquely identified as CVE-2007-2609. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

British authorities on Thursday announced the arrest of a 17-year-old male in connection with a cyber attack affecting Transport for London (TfL). "The 17-year-old male was detained on suspicion of Computer Misuse Act offenses in relation to the attack, which was launched on TfL on 1 September," the U.K. National Crime Agency (NCA) said. The teenager, who's from Walsall, is said to have been

A vulnerability classified as critical has been found in Linux Kernel up to 4.13.4. This affects an unknown part of the component Keyring Handler. The manipulation leads to credentials management. This vulnerability is uniquely identified as CVE-2017-18270. An attack has to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.

Are you confident your vulnerability management is doing its job, or do you sometimes feel like it’s falling short? Many companies invest time and resources into managing vulnerabilities, yet still...

The post Top 5 Vulnerability Management Mistakes Companies Make (Plus a Bonus Mistake to Avoid) appeared first on Strobes Security.

The post Top 5 Vulnerability Management Mistakes Companies Make (Plus a Bonus Mistake to Avoid) appeared first on Security Boulevard.

MIT чествует нестандартные научные достижения.