FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers.
The post TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices appeared first on SecurityWeek.
Welcome back, aspiring cyberwarriors!
You may know that privacy laws aren’t respected everywhere. In some places you can be forced to decrypt your files, or worse, get accused of a violation just for having encryption. A VeraCrypt hidden volume helps with the first problem but not the second. That’s why the project developer built Phantomdrive.
Phantomdrive is a fully open source USB drive that shows up as an 8GB disk when you plug it in. The OS has no way to detect the rest of the storage. To unlock the hidden partition, you open a text file on the visible part of the drive, type password: YOURPASSWORDHERE and save it. The drive disconnects, remounts the hidden partition, and AES-256 handles the encryption and decryption on the fly.
The hardware, firmware, and mechanical design are all open source. The developer built it around a small chip called the CH569, from the same company behind the CH340 USB-to-Serial chip you’ll find on most Arduino clones. It has USB3, SD/eMMC support, and a hardware AES block built in.
eMMC was too expensive due to AI-driven demand, so the developer went with an SD card instead. If someone tears the device apart they’ll find it, but everything on it is encrypted. The enclosure is sealed with epoxy, so any attempt to get inside means destroying it first. Once eMMC prices drop, a version using it will follow.
The board itself is simple. It’s a CH569 chip, a USB port, two buck converters, a firmware update button, an SD card, and some supporting components.
The developer verified encryption works through functional tests and ran it against OpenSSL’s AES implementation. Most of the GitHub issues that surfaced were AI-generated noise or already fixed bugs, with one real exception around AES-XTS covered below.
A Key Derivation Function (KDF) turns your password into an encryption key. The naive approach is padding the password to 32 bytes and using it directly.
That’s weak. A precomputed table could crack it without even brute forcing. To fix that, Phantomdrive adds a unique salt per device.
With different salts, an attacker has to compute keys for each device separately, and you can’t swap the SD card between devices. You can read your salt like this:
Loginudevadm info --query=property --name=/dev/sdc | grep ID_SERIAL_SHORT
ID_SERIAL_SHORT=Phantomdrive:34FC1FA7145467F7So, 34FC1FA7145467F7 is the salt for this device, which you will need to recover the data if it ever fails. Save that value. You can also change the Phantomdrive name and the USB PID/VID in firmware if you want more stealth. On top of the salt, the KDF runs 100,000 rounds of SHA-256.
That adds about 3 seconds to unlock time, which is already at the limit of what the chip can handle. Argon2 isn’t an option since it needs too much memory. If you need stronger security, you can increase the round count, use a software encryption layer on top, or look for a different device.
AES is a block cipher that works on 16-byte chunks. Different modes turn it into a stream cipher.
AES-ECB is the naive approach, encrypting each block directly. The problem is that identical plaintext blocks produce identical ciphertext blocks, which leaks patterns. Attackers can also manipulate the ciphertext in predictable ways. Not good.
AES-CTR solves this by encrypting a counter and XORing the output with plaintext.
uint64_t i = 0;
while(i < len(ciphertext)) {
ctr = aes_encrypt(i);
ciphertext[i] = plaintext[i] ^ ctr
i++;
}The main risk with CTR is nonce reuse. If an attacker copies your ciphertext twice and can guess one version, they can recover the other. The developer gets around 9 MB/s write and 20 MB/s read with AES-CTR.
AES-XTS is the disk encryption standard and uses two keys. K1 protects the data, K2 generates a tweak per sector.
Each 16-byte block gets its own adjustment (T0, T1… Tn), then blocks are encrypted one by one to produce the final ciphertext.
It’s more secure but slower, around 6 MB/s write and 10 MB/s read on this hardware.
The firmware is built on two open source libraries:
BSP: https://github.com/hydrausb3/wch-ch56x-lib
ISP: https://github.com/hydrausb3/wch-ch56x-isp
The device doesn’t understand file systems. It just handles raw USB WRITE10/READ10 commands and passes them to the SD card. To detect the unlock password, the firmware scans every write for the string password: before passing data through.
void phantomdrive_snoop_write(uint8_t *buf, uint32_t len)
{
const char *prefix = "password:";
const size_t prefix_len = 9;
uint32_t i;
for (i = 0; i + prefix_len <= len; i++) {
if (buf[i] != 'p')
continue;
if (memcmp(buf + i, prefix, prefix_len) != 0)
continue;
size_t pw_start = i + prefix_len;
size_t pw_end = pw_start;
while (pw_end < len && (pw_end - pw_start) < sizeof(pending_pw) &&
buf[pw_end] != '\n' && buf[pw_end] != '\r' && buf[pw_end] != '\0')
pw_end++;
size_t pw_len = pw_end - pw_start;
memcpy(pending_pw, buf + pw_start, pw_len);
pending_pw_len = pw_len;
memset(buf + i, 0, pw_end - i);
return;
}
}Once the password is found, it gets copied into RAM and the buffer gets zeroed out so the password never touches the disk. Keep in mind, if you store a lot of data on the unencrypted partition and any of it contains the string password:, you could get a false match. If that’s a concern, you can change the trigger string in firmware or look for a different approach.
The developer has also published a video, if you want to get into details of this project.
Phantomdrive is an open source USB drive that shows up as a plain 8GB disk while hiding the rest of its storage. You unlock the hidden partition by saving a password in a text file on the visible disk. The firmware catches it in the raw write traffic, keeps it in RAM, and never writes it to disk. Encryption is AES-256 on a CH569 chip, with a per-device salt and 100,000 SHA-256 rounds for key derivation. It’s limited by the hardware, so it’s weaker than memory-hard options like Argon2.
If you want to go deeper into how privacy can be preserved on real systems and how forensic traces are created and analyzed, our Anti-Forensics training is your next step. We covered advanced techniques for preserving your privacy and understanding what investigators can still see even when you think you have covered your tracks.
The post Anti-Forensics: Building a Phantomdrive first appeared on Hackers Arise.
UK-based secure data exchange specialist DOQEX has achieved Cyber Essentials certification, adding another recognised security standard to its existing portfolio of accreditations.
The York-based company, which specialises in protecting sensitive information shared between organisations, already holds ISO 27001, ISO 27017 and ISO 27018 certifications. The latest achievement reflects its continued focus on maintaining strong security controls and protecting customer information.
Cyber Essentials is a UK Government-backed scheme designed to help businesses defend themselves against common cyber threats. It assesses five fundamental areas of cybersecurity: firewalls, secure configuration, security update management, user access control and malware protection.
While DOQEX already operates under established international security standards, the company said completing the Cyber Essentials certification process provided a valuable opportunity to revisit its existing controls.
Nick Case, Director and Co-Founder of DOQEX, admitted that the company had initially underestimated the process.
“Having already achieved ISO 27001, ISO 27017 and ISO 27018, I’ll admit we initially underestimated Cyber Essentials. We thought we had the fundamentals well covered, but going through the process reminded us why they matter.”
He explained that the certification’s emphasis on practical security measures provided an important reminder that even organisations with mature cybersecurity programmes need to regularly assess their defences.
“Cyber Essentials has a clear focus on practical, verifiable security controls, and that has genuine value. It’s easy to concentrate on more complex security challenges, but the basics still need attention.”
The certification comes as organisations face increasing pressure to demonstrate that appropriate security measures are in place, particularly when handling sensitive business information or working with external suppliers.
As businesses become more reliant on third-party technology providers and external partners, cybersecurity certifications are playing a growing role in procurement decisions and supplier assurance.
Recognised standards can help organisations demonstrate that they have implemented appropriate safeguards, providing customers and partners with greater confidence in how their information is managed.
Case believes improving baseline security across UK businesses is particularly important as supply chains become more interconnected.
“We fully support what Cyber Essentials is trying to achieve. Raising the baseline of cybersecurity across UK businesses is important, particularly as organisations become increasingly dependent on suppliers and third parties. Stronger security across the supply chain benefits everyone.”
Founded in 2013, DOQEX helps organisations securely manage and exchange sensitive information between employees, customers, suppliers and business partners.
Its services combine security technology with managed support, helping businesses maintain control over information as it moves between organisations.
The Cyber Essentials certification builds on the company’s existing ISO standards and reinforces its approach to security governance, accountability and data protection.
For DOQEX, the achievement also highlights a wider message for businesses: while cybersecurity threats continue to become more sophisticated, maintaining effective fundamental controls remains an essential part of protecting sensitive information.
The post DOQEX Achieves Cyber Essentials Certification to Strengthen Security Standards appeared first on IT Security Guru.
The $25 billion award far exceeds a $5 billion fine the Federal Trade Commission levied against Facebook in 2019.
The post Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook appeared first on SecurityWeek.
Protections have been added against scams and social engineering, including new site warnings and server-side Gemini analysis.
The post Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections appeared first on SecurityWeek.
The Thoma Bravo-owned Proofpoint will acquire Varonis in an all-cash transaction and Varonis will become a private company.
The post Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis appeared first on SecurityWeek.
Beginning February 2027, all newly issued certificates will have a 64-day validity period by default.
The post Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch appeared first on SecurityWeek.
Citing growing risks posed by more capable and autonomous AI agents, Apple will introduce additional controls.
The post Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks appeared first on SecurityWeek.
PwC’s survey found that only 22% of leaders would use fully autonomous AI for cyber defense, while just 21% are implementing quantum-resistant security measures.
The post Enterprises Struggle to Prepare for AI and Quantum Threats, PwC Says appeared first on SecurityWeek.
Roughly 200,000 of the credentials were exposed after GitHub enabled push protections by default.
The post 500,000 Active Credentials Left Exposed on GitHub appeared first on SecurityWeek.
Giving AI Freedom Without Losing Control Who’s Really in Control? AI agents are stepping into a bigger role inside the enterprise. They are not just providing answers anymore. They are...
The post Innovator Spotlight: Snowflake appeared first on Cyber Defense Magazine.
Cybersecurity has become one of the most defining business challenges of recent times. Organisations have invested heavily in protecting their networks, securing cloud environments and strengthening identity and access management. At the same time, organisations are under increasing pressure to prove they are handling sensitive information securely, not just storing it safely but protecting it throughout its journey.
Yet despite this progress, one area continues to receive far less attention than it deserves: how data is shared.
Most organisations have become very good at protecting data while it is stored. Files are encrypted, key handling is properly managed, access is restricted and systems are monitored around the clock. However, once that information needs to leave the organisation, whether it’s being sent to a customer, supplier, auditor or business partner, the controls often become less robust.
Every day, organisations exchange contracts, financial information, employee records, legal documents and commercially sensitive files. More often than not, this happens via email attachments or cloud-based file-sharing services because they are familiar and convenient. The problem is that convenience does not always equal security.
Email remains one of the most common routes for cyber attacks. Phishing, spoofed domains, malicious attachments and business email compromise continue to account for a significant proportion of successful breaches. However, most incidents do not involve a sophisticated bad actor. The official UK annual Cyber Security Breaches Survey continues to show the majority of incidents stem from everyday mistakes. An email sent to the wrong recipient, an attachment forwarded outside the organisation or a file shared with overly broad permissions can expose sensitive information in seconds.
Human error remains one of the biggest cyber risks organisations face, particularly as businesses become increasingly connected. Information now flows constantly between employees, customers, suppliers, consultants and regulators. Every transfer creates another opportunity for something to go wrong.
What is often overlooked is that securing data is not just about protecting where it is stored. It is also about understanding the journey it takes.
Many organisations assume that because they operate in the UK, their sensitive information remains within UK borders. In reality, emails and attachments may be routed through multiple countries and cloud infrastructures before arriving at their destination. While this is often an invisible part of modern digital communications, it raises important questions around governance, compliance and data sovereignty.
For organisations operating in regulated sectors, this matters. Financial services firms, local authorities, healthcare providers and legal organisations are increasingly expected to demonstrate not only that data is protected, but also that it is managed responsibly throughout its entire lifecycle. Knowing where information is stored is only part of the picture. Understanding where it travels, who has access to it and how it is controlled has become equally important.
This is why conversations around geofencing and data sovereignty are gaining momentum. Rather than simply encrypting information and hoping for the best, organisations are beginning to ask whether they should have greater control over where sensitive data is permitted to travel. If businesses routinely place restrictions on the movement of physical assets, it seems only logical that they should apply similar thinking to digital information.
At the same time, regulators and auditors are asking more searching questions about how organisations exchange information with third parties. They want to understand how access is controlled, whether there is a complete audit trail and what safeguards exist once information leaves the organisation. These are no longer technical questions reserved for IT teams. They are governance issues that increasingly involve compliance, procurement, risk and senior leadership.
There is also a growing disconnect between the way organisations work and the security controls they have in place. Hybrid working, cloud collaboration and increasingly complex supply chains mean information rarely stays within a single organisation. Yet many businesses continue to rely on processes that were designed for a very different way of working.
This is where a change in mindset is needed.
Cybersecurity should not end when a document is saved securely on a server or in the cloud. Information is often at its most vulnerable when it is moving between people, organisations and systems. Protecting data in transit should therefore be considered just as important as protecting data at rest.
That does not mean making it harder for employees to do their jobs. Quite the opposite. Security should support the way people work, allowing information to be shared safely without creating unnecessary barriers or encouraging workarounds that introduce even greater risk.
Organisations need to take a more holistic view of information security. Protecting sensitive data means understanding its entire lifecycle, from creation and storage through to sharing, collaboration and eventual deletion. It means knowing not only who can access information, but where that information is travelling and whether that journey aligns with the organisation’s security, compliance and governance obligations.
Threats aren’t standing still, and neither are regulators. Focusing only on data that’s sitting in storage means missing one of the biggest holes in your security. It’s not enough to just lock data away; it needs to stay safe wherever it travels.
*DOQEX provides a secure data exchange and email gateway platform that helps businesses protect confidential information.
The post The Hidden Risk in Data Transfer appeared first on IT Security Guru.
A threat actor is claiming to have stolen millions of employee records from the Microsoft Azure environments of several major companies, raising concerns that the information could be used to launch targeted phishing, impersonation, and privilege escalation attacks.
The threat actor, known as “TheHatman,” has reportedly posted internal employee directories belonging to companies including McDonald’s, Vodafone, Kyndryl, Tata Consultancy Services (TCS), HCL Technologies, InterContinental Hotels Group, Gap, Hexaware Technologies, and Wyndham Hotels for sale on cybercrime forums.
According to various sources, samples of the data contained corporate email addresses and fields consistent with standard Azure directory exports. However, the exact method used to gain access remains unconfirmed.
Researchers said compromised credentials linked to many of the affected organisations had previously circulated following infostealer infections. Possible routes into the environments include stolen session tokens, phishing, weak MFA protections, or third-party integrations with excessive permissions.
The allegedly stolen information includes employee IDs, job titles, departments, reporting structures, group memberships, service accounts, and, in some cases, details of Global Administrator accounts.
Cian Heasley, Principal Consultant at Acumen Cyber, warned that information that initially appears relatively harmless can provide the foundations for further attacks.
“Names, job titles, phone numbers, service account labels, and global administrator identities are precisely the precursors required to build convincing spear-phishing, phone based social engineering and helpdesk request employee impersonation attacks against higher value accounts or systems,” Heasley said.
He also warned against dismissing older employee information as irrelevant.
“Enterprise org charts change slowly, service account naming conventions rarely change and historic breached data dumps can remain useful for aiding in the planning and execution of new attacks years after the original compromise took place.”
TCS has said it found no credible evidence that its systems or customer environments were breached. The company said the referenced information appeared to be more than four years old and limited to basic employee details.
Muhammad Yahya Patel, vCISO and Cybersecurity Advisor for EMEA at Huntress, said the incident demonstrates how infostealer infections can ultimately lead to cloud compromise.
“Infostealers harvesting credentials from corporate devices, those credentials landing in criminal marketplaces, and a threat actor using them to access cloud environments that trusted those credentials without adequate verification. Same playbook. Different logos on the breach notification.”
Patel said cloud identity infrastructure is only as secure as the credentials and devices accessing it.
“Conditional access policies, continuous access evaluation, device compliance checks, and real-time credential compromise detection are the controls that close the gap between ‘credentials stolen by an infostealer’ and ‘attacker inside your cloud environment.'”
He described the employee information reportedly being sold as a “precision targeting kit” for spear phishing and executive impersonation.
Simon Pamplin, CTO at Certes, said the incident also raises questions about what attackers can do once legitimate credentials have been compromised.
“Stolen credentials should not automatically mean stolen data. That is the real issue with this campaign,” Pamplin said.
“The reported ability to use compromised credentials to extract huge volumes of information from enterprise cloud environments shows what can happen when successful authentication is effectively treated as permission to access and move data.”
Pamplin argued that organisations need to assume credentials will sometimes be stolen and ensure that compromising an identity does not automatically make sensitive information readable.
“Cloud security needs to separate identity from control of the data itself. Sensitive data flows should be independently encrypted, segmented and governed so that compromising an account does not provide unrestricted movement across the environment.”
The incident also carries potential supply chain implications. Heasley pointed to the presence of major IT service providers among the organisations named, warning that businesses should review which suppliers hold privileged access to their environments.
The case is also a reminder that data theft does not always arrive with a ransom demand. In this instance, the threat actor appears to be attempting to sell the information directly, meaning affected organisations may only become aware of the theft once their data surfaces on criminal forums.
The post Hacker Claims Millions of Records Stolen From Azure Tenants appeared first on IT Security Guru.
