Cybersecurity

Akamai researchers have confirmed a new attack vector using CUPS that could be leveraged to stage distributed denial-of-service (DDoS) attacks.

Research shows that, to begin the attack, the attacking system only needs to send a single packet to a vulnerable and exposed CUPS service with internet connectivity.

The Akamai Security Intelligence and Response Team (SIRT) found that more than 198,000 devices are vulnerable to this attack vector and are accessible on the public internet; roughly 34% of those could be used for DDoS abuse (58,000+).

Of the 58,000+ vulnerable devices, hundreds exhibited an “infinite loop” of requests.

The limited resources required to initiate a successful attack highlights the danger: It would take an attacker mere seconds to co-opt every vulnerable CUPS service currently exposed on the internet and cost the attacker less than a single US cent on modern hyperscaler platforms.

I have a question about hardware security keys. Like a yubikey.

I have not actually used one before so maybe I am missing some critical information.

Aren't they inherently less secure than a TOTP code?

If someone ( like a evil government ) gets your key and knows your password for a particular service or device, they can login.

If these same people try to login but it is secured with a TOTP code instead, they would need access to my phone, which requires a password to unlock and then biometric validation to open TOTP app.

I mean yeah, they could just beat me with a large wrench until I agreed to login for them, but that is true with any method.

I've heard that in the US, the 5th amendment protects you from being forced to divulge a password, but they can physically place your finger on the finger print scanner.

A $15.75 million promise.

With hundreds of courts and agencies affected, chances are one near you is, too.

The vulnerabilities have been identified in D-Link, DrayTek, Motion Spell, and SAP products.

cross-posted from: https://infosec.pub/post/18289000

Intruders accessed machines via tool bundled with ScienceLogic, 'limited' info taken, customers told not to worry Exclusive  Rackspace has told customers intruders exploited a zero-day bug in a third-party application it was using, and abused that vulnerability to break into its internal performance monitoring environment.…