Découvrez l’actualité Sécurité de la semaine avec la newsletter Adacis:
Au menu:
- Encore et toujours la Loi sur le Renseignement, plusieurs liens : François Hollande va saisir le Conseil Constitutionnel et certains hébergeurs partent de France mais la majorité des français sondés sont à priori favorables
« While not quite as bad as last month’s 14 security bulletins, April’s Patch Day is bursting with updates. According to their summary, Microsoft released 11 security bulletins, some fixing serious issues. »
« The SANS Institute has warned Windows IIS web server admins to get patching as miscreants are now exploiting a flaw in the software to crash websites.
The security bug (CVE-2015-1635) allows attackers to knock web servers offline by sending a simple HTTP request. Microsoft fixed this denial-of-service vulnerability on Tuesday with a patch numbered MS15-034″
- Mais aussi des mises à jour Apple et Adobe pour Flash et Oracle (98 failles) :
Apple : lien
Adobe : lien
Oracle : lien
« Google has released Chrome 42, a major security upgrade to the browser that includes patches for 45 vulnerabilities.
The latest version of Chrome carries with it fixes for a number of high-severity bugs, including a cross-origin bypass in the HTML parser. That vulnerability earned an anonymous security researcher a reward of $7,500 from Google. In all, the company paid out more than $21,000 in rewards to external researchers who reported bugs fixed in this version »
« The 2015 Verizon Data Breach Investigations Report (DBIR) did some mythbusting on two fronts: the estimated cost per record lost in a breach is much lower than reported elsewhere; and mobile malware is a no-go »
« Le spécialiste français de la cyber-sécurité s’est fait prendre à son propre jeu. D’après des informations du Canard Enchainé, confirmées par Thales, le groupe a été victime d’une attaque informatique de grande envergure. »
« A decade-long cyber espionage operation focused on stealing sensitive information for the Chinese government is claimed to have been uncovered by security firm FireEye.
The FireEye intelligence report (PDF), APT30 and the Mechanics of a Long-Running Cyber Espionage Operation, has revealed that the group, dubbed APT30, has been maintaining an advanced persistent threat operation, likely sponsored by the Chinese government, since 2005. »
« L’organisation internationale Interpol affirme avoir fermé un nouveau botnet, avec l’aide de plusieurs spécialistes de la sécurité. Diverses actions ont ainsi été lancées simultanément à travers le monde.
Un réseau d’ordinateurs zombis infectant 770 000 machines au cours des six derniers mois a finalement été fermé. Baptisé Simda, ce dernier redirigeait le trafic Internet et téléchargeait des malware sur chacune des machines, afin qu’elles puissent être contrôlées à distance. «
« HACKERS HAVE FOR years bought and sold their secrets in a de facto gray market for zero-day exploits—intrusion techniques for which no software patch exists. Now a new marketplace hopes to formalize that digital arms trade in a setting where it could flourish: under the cover of the Dark Web’s anonymity protections »
« Security expert Bruce Schneier has looked at and written about difficulties the Internet of Things presents – such as the fact thatthe “things” are by and large insecure and enable unwanted surveillance– and concludes that it’s a problem that’s going to get worse before it gets better.«
- Publication de l’ActuSecu de la société XMCO
