Hackers are actively exploiting a server side request forgery vulnerability in the Apache HTTP server.
Specialists from the German Federal Office for Information Security and Cisco warned about cyber attacks in which criminals exploit a vulnerability (CVE-2021-40438) in the Apache HTTP server.
The issue is a Server Side Request Forgery (SSRF) vulnerability that can be exploited against httpd (The Apache HTTP Server) web servers with the mod_proxy module enabled. An attacker could exploit the vulnerability by sending a specially crafted request and force the module to redirect the request to an arbitrary origin server.
The issue was discovered by the Apache HTTP Security Team while investigating another vulnerability. The vulnerability affects server versions 2.4.48 and earlier and was fixed in mid-September this year with the release of version 2.4.49.
“By sending a specially crafted request, attackers can force the enabled mod_proxy module to route connections to the originating server of their choice, thereby stealing secrets (metadata or infrastructure keys) or gaining access to other internal servers.” explained experts from Fastly. According to experts, vulnerable versions of httpd have been launched on more than 500 thousand servers. Since cloud services such as AWS, Microsoft Azure and Google Cloud Platform provide protection against cyber attacks, the vulnerability mainly affects organizations that independently manage httpd servers.
Several experimental PoC codes have appeared on the web to exploit the vulnerability, and the Federal Information Security Administration of Germany and Cisco fixed at least one attack exploiting this issue.
Scissors undercut: Windows 11 vulnerability reveals sensitive information from screenshots, including deleted parts
A dangerous vulnerability has been discovered in one of the standard Windows 11 applications that could lead to the disclosure of sensitive information to the user. Moreover, at the moment the vulnerability is not closed and attackers can use it.
We are talking about the application Snipping Tool (Scissors). The vulnerability, called aCropalypse, allows you to undo changes made by a user when editing a screenshot, including cropped or blurred parts that hide sensitive data.
When you edit a screenshot, you can save it with the same name as the original file by overwriting it. However, as it turns out, the Windows 11 Snipping Tool does not remove the original information from the file, but simply leaves it added at the end, which is usually invisible to users. With some trickery, a potential attacker can extract hidden information from a file and see what information has been edited.
As you can see, edited screenshots are usually much larger due to the inclusion of information from the original image.
This is a pretty serious vulnerability. For example, if you share a screenshot of an order confirmation page on Amazon, it may contain an address, the same goes for credit card numbers and other sensitive data.
In 2018, Google had an AI ready for a ChatGPT-style chatbot, but it was closed due to security issues.
In recent months, the ChatGPT chatbot has been on the news pages, and this has forced many companies to catch up with OpenAI. Among them are Microsoft, Google and a number of Chinese corporations. However, reportedly, the situation could be different.
As early as 2018, Google is said to have had a natural language processing AI similar to ChatGPT. However, company executives closed the project, considering it too dangerous. One of the developers was research engineer Daniel De Freitas, and Noam Shazeer, a software engineer at Google, also contributed to the project.
The project was called Meena and was a chatbot that could talk about different topics. With him you could discuss TV shows, have discussions about philosophy and joke. At the same time, the developers believed that this technology could be added to the search engine, however, in the end, Google stopped development. The company said the bot did not meet its AI security standards.
Note that later, on the basis of these developments, the LaMDA chat bot was created, which flies into the basis of Bard. Thus, the development nevertheless reached the mass user, albeit with a great delay.
Two-way satellite communications and military-grade security. Presented smartphone Motorola Defy 2
The British company Bullitt Group and Motorola, now owned by the Chinese Lenovo, introduced a new smartphone of the protected Motorola Defy series. The highlights of the Motorola Defy 2 are support for two-way satellite communication, combined with 5G fifth-generation cellular networks, and a very durable design.
The smartphone is resistant to dust, sand, dirt and water (IP68 and IP69K) and has been tested to military standard Mil-Spec 810H for extreme high and low temperatures, humid environments, salt fog, vibration and shock. The Motorola Defy 2 can be washed with soap and water and can also be cleaned with alcohol wipes.
The smartphone itself is equipped with a 6.6-inch Full HD + display with a refresh rate of 120 Hz, an 8 MP front camera, a main triple camera (50 MP, 8 and 2 MP), SoC MediaTek Dimensity 930, 6 GB of RAM and 128 GB flash memory that can be expanded with microSD cards, and a 5000 mAh battery with support for 15W charging and Qi wireless charging.
MediaTek Bullitt and 3GPP NTN technology, Bullitt satellite messaging service are supported. The smartphone is running Android 12 operating system, two major Android updates and 5 years of security updates are promised.
The Motorola Defy 2 smartphone will be available from Q2 2023 on select carriers in North America, Latin America and Canada starting at $599.
NASA postpones first manned flight of Boeing’s Starliner
NASA announced the postponement of the first test manned flight of the Boeing CST-100 Starliner. It will take place not...
Former head of Google China is preparing his own AI that will surpass ChatGPT
Looks like the AI race is just getting underway. Former Google China president and Chinese-Taiwan venture capitalist Li Kaifu has...
In China, an orgy of discounts on cars is raging. Discounts reach 5000-6000 dollars, and somewhere they can give a whole car
In China, prices for cars fell. According to the Chinese Cars resource, many brands or their dealers offer cars at...
Ryzen 7000 “obsolete” this year? Gigabyte is talking about some kind of successor for these CPUs that will come out at the end of the year
AMD has already released both the Ryzen 7000 and Ryzen 7000X3D, but this CPU for the AM5 platform does not...
News4 days ago
Nvidia CEO Jensen Huang wants to run the company for another 30-40 years, and then become a robot and continue to hold this post
News6 days ago
Nikon Z8 Full-Frame Mirrorless Camera Coming in April, May Be Cheaper Than Expected
Gaming6 days ago
News7 days ago
6000 mAh, 48 MP and big screen. Huawei Enjoy 60 battery monster launches March 23