A null pointer dereference vulnerability exists in the handle_ioctl_8314C functionality of Callback technologies CBFS Filter 20.0.8317. A specially-crafted I/O request packet (IRP) can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability.

CVE-2022-43589: TALOS-2022-1648 || Cisco Talos Intelligence Group

Plus: WikiLeaks’ website is falling apart, tax websites are sending your data to Facebook, and cops take down a big phone-number-spoofing operation.

Cybersecurity startup Corellium offered or sold its software to spyware and hacking-tool creators in multiple repressive countries, a WIRED investigation revealed this week. A previously unreported 507-page document, believed to have been prepared by Apple, details how Corellium offered a trial of its products to the controversial spyware firm NSO Group, to a cybersecurity company with ties to the UAE government, and to a firm in China that also has government links. In response, Corellium, which makes phone-virtualization software that can help find security bugs in iOS and Android, published a blog post detailing how it now vets potential customers.

As millions of people across the US celebrated Thanksgiving and attended parades, we looked at the US shortage of bomb-sniffing dogs. Experts say the pandemic has led to a drop in the supply of dogs in the country—85 to 90 percent of them come from overseas—and that the lack of trainer animals is fueling national security concerns.

In other national security news, US lawmakers are calling for stricter rules on autonomous vehicles (AVs), which are able to gather reams of real-time data about their environment. China is a chief concern. In a letter shared exclusively with WIRED, Republican congressman August Pfluger said, “AV technology has opened the door for a foreign nation to spy on American soil, as Chinese companies potentially transfer critical data to the People’s Republic of China.”

We also looked at how hidden data stored in PDF files helped researchers reveal names that had been redacted. Court filings, national security files, and responses to Freedom of Information Act requests have all exposed such information in this way. And we heard the cautionary tale of how one person lost $17,000 in crypto—and how you can avoid the same fate. 

Finally, we published part five of the series “The Hunt for the Dark Web’s Biggest Kingpin,” which chronicles the downfall of AlphaBay, the world’s largest dark-web marketplace. In this installment, investigators in Thailand swoop in on AlphaBay’s mastermind, Alexandre Cazes, and discover he had a fortune topping $20 million. 

But wait, there’s more! Each week, we highlight news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Apple’s privacy policy for analytics services on its devices, which gather data about how you use its products, claims the information collected isn’t used to identify you. However, a new analysis of the tools, reported by Gizmodo, claims a permanent ID number within the service is “tied to your full name, phone number, birth date, email address and more.” This ID number is sent to Apple alongside the analytics data about how you use your device, researchers from the software company Mysk told the publication. 

The findings appear to contradict the company’s privacy promises. Apple did not answer Gizmodo’_s_ questions on the report. In recent years, Apple has pushed a pro-privacy stance, using it as an advantage over competitors, and it has run ads saying the data on people’s iPhones stays on their devices. However, experts have increasingly questioned some of Apple’s practices. (At the same time, Apple has been growing its advertising business.) In separate research published earlier in November, Mysk researchers claimed that Apple collects detailed information on people using its products through its own apps, even when they turn tracking off.

In June, the UK government approved the extradition of WikiLeaks founder Julian Assange to the United States. While Assange waits on an appeal in the case, the website he created is falling apart. At one point, WikiLeaks hosted more than 10 million leaked documents. However, according to an analysis by the Daily Dot, fewer than 3,000 of the files are now available. Aside from the drop-in documents, the website also has technical issues: It is frequently inaccessible, people have problems searching its content, and parts of its navigation have vanished. 

Meta’s Pixel, formerly known as the Facebook Pixel, is a snippet of code that websites can install to track their visitors. The tool is useful for advertisers. Millions of websites use the tracking tool, and the data is sent back to Meta. This week, The Markup revealed that major US tax websites are using the Pixel and sending financial information to Meta. Some of the data transferred includes names, email addresses, income information, and tax filing status. Some tax websites stopped using Meta’s Pixel following the report. A spokesperson for Meta, Dale Hogan, said that advertisers “should not send sensitive information” about people through its tools. 

And finally, in a major blow to scammers, an international police operation took down the iSpoof website, which let people disguise their phone numbers and show fake caller IDs when making phone calls. It’s estimated that people using iSpoof were contacting up to 20 people every minute of the day as they used false identities to try and trick people into handing over their money. One person was tricked out of £3 million ($3.6 million), reports say. The website now shows a notice saying it has been seized by the FBI and United States Secret Service. In total, 142 people were arrested in the operation, including the alleged administrator of the website, who was arrested in the UK. Police from the UK, US, Ukraine, France, Germany, and five other countries were involved.

Apple Tracks You More Than You Think

By Owais Sultan
A parental control app is an effective software that can help parents stay on guard, prevent, and react timely to online and offline dangers.
This is a post from HackRead.com Read the original post: Top 6 Cell Phone Tracker Apps for Parental Control

Do you have difficulty knowing what your kids are up to when you’re not around? Do you want to ensure they’re not getting into trouble or spending excess time on their phones?

If so, then you need a cell phone tracker app. We have your back covered and have handpicked the 6 best free and paid tools for Android and iOS devices to quench your concerns. Forewarned is forearmed.

**Why Would You Need to Resort to a Cell Phone Tracker App?**

Whether a paid or free parental control app, effective software can help parents stay on guard, prevent, and timely react to the following online and offline dangers:

1.  Sexual predators that target kids online or in the real world
2.  Involvement in cyberbullying, either as victims or perpetrators
3.  Exchanging inappropriate photos or videos with others
4.  Communicating with strangers that try to lure children into meeting in person
5.  Risk of kidnap or trafficking if they spend excess time alone or unsupervised
6.  Access to inappropriate websites
7.  Kids spend excess time on phones and inadequate time doing homework or interacting with the family

The market is riddled with cell phone tracking apps, making picking the right one challenging. This article lists the most prominent and handy solutions for parents.

Did you know around 2100 children go missing in the US daily? Kids are usually easy to find when parents provide relevant information about them. Resorting to the right prevention measures can help parents ensure their kids’ safety. 

**6 Advanced Cell Phone Tracker Apps for Parental Control**

A family tracking app enables parents and guardians to monitor their children when they are not around. Therefore, if you are unsure whether your kids are where they claim to be or are lying, the app can help you know the truth. Here are some of the top-notch tracker apps to help monitor their whereabouts and not only.

**Keep Your Kids Safe with the uMobix Parental Control App**

uMobix is the best parental control app today. It allows real-time tracking of daily progress on their mobile phone or tablet. With this phone monitoring app, users are enabled to capture browser history, see screengrabs, and supervise over 30 apps, including Facebook, WhatsApp, Instagram, TikTok, Telegram, and Snapchat.

This phone tracking app has advanced monitoring features, including a GPS tracker, outgoing, incoming, and missed call records, mic and camera access, text message history, deleted call history, message, and contacts. Also, this monitoring app can capture keystrokes to see what your loved ones are up to.

Additionally, uMobix allows you to remotely pull videos and photos from the target phone and store them on your device. Its advanced GPS tracking feature lets you know the real-time location of the required gadget. Thus, your kid can’t lie about their location anymore if you use this app to track them without knowing.

**How to Use uMobix to Track Your Kid’s Location**

Since uMobix has a demo version, it is possible to use it as a free app to view your child’s phone. The 1-day trial offer allows users to start monitoring for $1. For the extended version, follow these steps to watch your kids with uMobix.

1.  Register by selecting a subscription plan and complete the purchase to receive detailed instructions.
2.  Access the target phone to install uMobix by following the instructions provided in the user account. The process differs for Android and iOS but is straightforward in both cases.
3.  Navigate to your account to receive real-time data about the required phone activity. The GPS location tab can identify your child’s whereabouts anytime.
4.  Cocospy – Multifunctional Parental Control App for Android and iOS

Cocospy is also among the best phone tracking apps. It makes it possible to supervise locations, calls, messages, and app usage. Also, this tracking software enables you to take a sneak peek at the saved contacts. Installing software is straightforward, after which it is possible to track all outgoing and incoming calls, received and sent messages, browser activity, and social media interactions, including iMessages. 

Some social media platforms to monitor Cocospy include Facebook Messenger, Snapchat, Instagram, WhatsApp, Snapchat, and Viber. The app can detect a SIM card change and check the device’s IMEI number.

You may want to know how to supervise a kid’s iPhone with Cocospy. Well, the process is also straightforward. Just sign up with an email ID, then verify your iCloud account. Add the target’s iCloud details and disable two-factor authentication. After that, monitor the device’s activity and location by logging into your Cocospy account.

Cocospy runs in stealth mode, meaning they won’t detect that you’re monitoring them. Also, it manages your kid’s screen time to ensure they spend only a little time on their device. Thus, it allows you to safeguard their health and keep them safe.

**Spyic – Top-Rated Parental Control App for Real-Time Monitoring**

Spyic is a surefire phone location tracking app that can spot your loved one’s whereabouts without their knowledge. It’s a widely used tool providing tracking solutions for iPhones and Android phones. Also, this web application is easy to use from a browser, meaning you don’t have to download anything.

The software has numerous features that make it ideal for location tracking. It’s a hidden family tracking app with a feature-packed online dashboard. For instance, Spyic is there for you to locate a phone’s location without installing an additional app. Access this feature by logging in to your Spyic account via a web browser.

Additionally, Spyic uses unique security protocols to ensure that nobody else can view data about the target device. It shares the target phone’s location coordinates directly with you, and its servers don’t store anything.

Using this app to pin down somebody’s location assures you that they won’t know you’re doing it. Thus, you may monitor their movements, the areas they previously visited, and check-ins. 

**Google Family Link Free Phone Tracker**

As the name suggests, Google Family Link is a family locator that enables you to keep loved ones safer online. Families have unique relationships regarding technology. Therefore, this device and location tracking app provide greater flexibility to allow users to select the right balance for their families. Also, this application helps you create healthy online habits for your family members.

**Find My Kids – Child Locator**

Find My Kids is a location tracker for ensuring child’s safety. It helps you keep in touch with children when they are not nearby or fail to respond to your calls. This GPS phone tracker allows parents to pin down their kids on Google Maps and see their movement history.

Another benefit is the opportunity to find out the apps your children use, including social media platforms and their interactions with them. The time tracking capability helps you know the duration your kids use their devices and the apps they use the most. The family chat feature may make this app unique. It lets you chat with the kids and use funny stickers to enhance the fun. 

This parental control app for free use makes it possible to keep track of your loved ones with minimum expenses, though its functionality is somehow limited compared to tracking apps outlined above. The app is available for Android and iOS users.

**Life360**

The last app on our list is Life360. It’s a well-known app in the US, offering only limited functionality outside the country. Here’s what the app can do for you: 

1.  The app allows you to plan routes and schedules with your family members. 
2.  You can request or send real-time locations. 
3.  You can set up smart notifications for when someone reaches a particular destination or leaves it. You also get alerts if someone’s phone battery is running dry. 

You’ll need Life360 installed on the target iPhone to get it to track the device’s location. You’ll also need permission from the target device, which may or may not be possible.

**Is it Legal to Supervise Your Child’s Device?**

It is legal for parents and guardians to supervise their children’s devices as long as they are minors. Provided the child is under 18 (pay attention that every state has a different age of being an adult), a US parent or guardian can monitor how they use their mobile phone or tablet. That means the parent can use a cell phone tracker to observe their whereabouts and interactions with other people.

The Children’s Online Privacy Protection Act gives parents control over the information that children can access online. This rule protects kids under 13 while considering the internet’s dynamic nature. Also, it applies to online service providers and commercial website operators. When it comes to monitoring an adult person, written consent is required.

**What Should I Look for in a Parental Control App?**

The following tips should help you choose an app to track cell phones.

*   Privacy: You don’t want to expose your loved one’s privacy to the wrong people. Therefore, pick an app that allows for secure and safe parental control.
*   Transparency: The top phone tracking apps are transparent in their operations. They ensure that users know what they can do and how they help them enhance their kids’ safety.
*   Network security: A good tracker app keeps a child safe from illicit content, cyberbullying, and other online crimes.
*   Activities: The primary phone tracker work is to check out the activities the target person does on their device. And this entails all the actions an individual can perform on their device. Therefore, go for an app that can track your phone when lost, monitor social media and online activities, and do everything your kid can do on their phone. Also, it should let you monitor websites and app usage.
*   Friendly interface: An ideal parental control application is easy to use and navigate.
*   Compatibility: Choose an app compatible with the phone required, whether iPhone or Android. Some apps require only the phone number only to track a mobile device.

**Keep Your Kids Safe with the Right Monitoring Software**

Although some make use of a free phone tracker to keep track of loved ones, premium applications are better due to extended functionality and glitch-free operation. That’s because they have more practical features and functionalities. Also, consider customer support, price, and user reviews. Ideally, take your time understanding how the phone tracker app you want to use works to pick one that suits your needs.

1.  What is a parental control app and what are your options
2.  Croatian Police arrests minor over A1 Telecom ransom demand
3.  9 risky apps that you need to monitor on your kids’ smartphone
4.  Germany bans kids’ smartwatches, asks parents to destroy them
5.  Medical Software Firm exposes vulnerable children’s sensitive data

Top 6 Cell Phone Tracker Apps for Parental Control

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.

**The API & platform builder, build your apps 10x faster, even more.**

It's open source & 100% free !

Try live demo

     

**Why badaso ?**

*   **100% FREE** - No need for extra thinking about finance to adopt badaso
*   **Modern PWA Dashboard** - Fast and SPA based on Vue.js with PWA technology
*   **Native installation** - Lazy to open the browser? Install badaso on Windows, Linux, MacOS, Android & iOS
*   **Working offline** - No more f\*cked with a bad internet connection, badaso can running offline
*   **Headless** - Badaso use JWT authentication & authorization as default
*   **Seamless integration** - Badaso use Rest API & GraphQL, no need to develop API for your mobile & IoT
*   **Modern design** - Keep your system design amazing and up to date
*   **Secure** - Build based on laravel make it secure as laravel
*   **Modular** - Install custom library in seconds like your other laravel projects
*   **Scalable** - Like your other laravel projects
*   **Easy maintenance** - Like your other laravel projects
*   **Long time support** - Great choice for your long-term project, maintain by uasoft

**Badaso features**

*   **Advanced CRUD generator** - Build your application faster and be more productive
*   **API generator** - Integrate your application (mobile, desktop, even IoT) through Rest API & GraphQL
*   **User management** - Manage your application user
*   **Role management** - Your application user can have a different role
*   **Permission management** - Each role has different access permission
*   **Menu management** - Manage your application menu so easy and faster
*   **Database management** - Handle your database migration via application
*   **Activity logging** - Keep your system safe, know who makes the trouble
*   **Log UI viewer** - No need to open your server to check the log, just stay focused on your application
*   **Daily database backup** - Keep your valuable database safety
*   **Media manager** - Manage your local & cloud media via application
*   Many more!

**Live demo**

Click here for live demo (some error may happen because random test by a lot of random people)

The live demo will reset every 1 hour

**Getting started (installation, how to use & more)**

You can see official badaso documentation.

**Support Badaso**

To keep badaso up to date and support this awesome long-term project you also can donate to badaso.

We appreciate it so much and will keep badaso up to update and support your awesome long-term projects!

*   Become a backer/sponsors on OpenCollective
*   Become a sponsor via github
*   One-time donation via Paypal
*   Direct (contact hello@uatech.co.id)

Good financial support will make badaso keep up to date and keep support your awesome long-term projects!

Thanks to all backers & sponsors!

**Sponsors****Contributing**

Thank you for considering contributing to badaso !

Please read our contributing guideline before submitting a Pull Request to the project.

Thanks to all contributors!

For documentation repo contributing click here.

**Community support**

For general help using badaso, please refer to the official badaso documentation.

For additional help, you can use one of these channels to ask a question:

*   Github discussion (Questions and Discussions)
*   Github issues (Bug reports, Contributions)
*   Facebook groups (Discussion for active facebook users)
*   Telegram groups (Discussion for active telegram users)
*   Youtube tutorial (For visual learner)

**Credits**

Thanks to these awesome projects that make badaso awesome :

*   laravel/laravel (Framework)
*   vuejs/vue (Javascript framework)
*   lusaxweb/vuesax (Vue component)
*   spatie/laravel-backup (automation production database & application backup)
*   spatie/laravel-activitylog (logging dashboard activity)
*   spatie/flysystem-dropbox (dropbox cloud storage integration)
*   nao-pon/flysystem-google-drive (google drive cloud storage integration)
*   league/flysystem-aws-s3-v3 (aws S3 cloud storage integration)
*   guzzlehttp/guzzle (advanced http request)
*   webpatser/laravel-uuid (uuid provider)
*   lcobucci/jwt (JWT provider)
*   tymon/jwt-auth (JWT auth provider)
*   arcanedev/log-viewer (application logging GUI)
*   the-control-group/voyager (reference)
*   UniSharp/laravel-filemanager (file manager)
*   Contact us for credit here.

All financial support that badaso gets will also shared to project above to support the ecosystem and make badaso keep up to date and keep your awesome long-term projects running.

**License**

See the LICENSE file for licensing information.

CVE-2022-41705: GitHub - uasoft-indonesia/badaso: Laravel Vue headless CMS / admin panel / dashboard / builder / API CRUD generator, anything !

New users and monetization methods are increasingly profitable for gaming industry, but many companies find they have to stem growth in cheats, hacks, and other fraud to keep customers loyal.

The video game industry has been booming of late — and cybercriminals are drawn to it as an expanding threat surface, seeing players as a potentially less cautious group of victims. As such, cybersecurity has risen in profile as a major business priority and differentiator for many in the industry.

There's been an influx of casual gamers drawn to new mobile platforms during the pandemic, and companies have found increasingly profitable ways of monetizing in-game items and social experiences. Gaming studios and affiliated games companies seek to keep those users playing while maintaining that growth and profitability in the post-pandemic era.

But with so much entertainment competition out there — not just from other games, but also streaming and digital platforms — it's easy enough for players hacked or cheated one too many times to drop one game and pick up another one instead. Gaming industry insiders like Jonathan Shroyer say that if gaming companies are lax in security, "their games will not succeed."

"Players of games depend on trust, credibility, and predictability when leveraging a brand's game," says Shroyer, chief CX innovation officer for Arise Gaming, a consulting firm that helps gaming companies improve customer satisfaction and gamer engagement in their platforms. "If they find out there was a hack, or fraud, or other security issues, you will see a dramatic drop in gameplay and spend."

He says this is especially true in mobile gaming as these are the least sticky and most casual games in the industry. But the impact of cyber trust is felt across console, PC, virtual reality (VR), and streaming customers as well.

**More Gamers, More Attacks & More Customer Expectations**

There's a lot of money at stake for gaming companies planning for the future. According to a recent study by PwC earlier this year, the video gaming industry will earn $235.7 billion in 2022. That's following a massive tear over the last few years, with the combination of PC, console, and casual gaming companies increasing their revenue by an astonishing 32% from 2019 through 2021. PwC says it expects gaming revenue to keep ticking up from now through 2026 by a healthy 8.4% compound annual growth rate.

As the money has been flowing into everything from eSports to hyper-casual gaming, so, too, have the attacks. Akamai reported recently that cyberattacks on player accounts and gaming companies has increased "dramatically" in the past year, with Web application attacks rising by 167%. The firm says gaming is the industry most hit by distributed denial-of-service (DDoS) attacks, making up 37% of all DDoS globally. That's double the volume of attacks lobbed at the financial sector, which is the second-most DDoS-attacked vertical industry.

Account takeovers, cheating hacks, and fraud are all growing problems, and gamers are taking note of which companies are addressing these cybersecurity issues and which aren't. A study of attitudes from 10,000 gamers worldwide that was released last week by Kaspersky showed that 70% of regular gamers think hacking is a big problem in the gaming world. Around 63% of respondents said their accounts aren't safe enough from attacks — with one in three reporting that their accounts have been hacked in the last two years. And 89% of gamers said they want game developers to pay more attention to cybersecurity issues.

These stats point to why cybersecurity is fast becoming a huge engagement pillar for game studios right alongside designing creative gameplay and immersive worlds. It's a tricky proposition for security executives in this world, because gamers also have big expectations when it comes to gameplay and the overall ambiance of a gaming environment, says Julie Tsai, a longtime cybersecurity executive with deep expertise in the gaming world.

"Users and the community expect things at a high level. They expect things to be intuitive, they expect things to be in the spirit of the gaming — and also sometimes in the spirit of the culture of the particular gamer community they're in," says Tsai, who was head of security for Roblox for the past three years prior to recently venturing on her own as a security consultant. "They're very, very passionate and attached to these things. And also for a security professional, it means that you're going to be dealing with some of the strongest attackers and the adversaries that you can think of because they're very creative and often gamers themselves."

**Today's Biggest Cyberthreats to Gaming**

Like any other vertical industry, games companies are tasked with protecting their organizations from all nature of cybersecurity threats to their business. Many of them are large enterprises with the same concerns for the protection of internal systems, financial platforms, and employee endpoints as any other firm.

"Gaming companies have the same responsibility as any other organization to protect customer privacy and preserve shareholder value. While not specifically regulated like hospitals or critical infrastructure, they must comply with laws like GDPR and CaCPA," explains Craig Burland, CISO for Inversion6, a managed security service provider and fractional CISO firm. "Threats to gaming companies also follow similar trends seen in other segments of the economy — intellectual property (IP) theft, credential theft, and ransomware."

IP issues are heightened for these firms, like many in the broader entertainment category, as content leaks for highly anticipated new games or updates can give a brand a black eye at best, and at worst hit them more directly in the financials. The industry saw this kind of fallout in full effect in September when a hack of Take-Two Interactive and subsequent public leak of Grand Theft Auto 6 resulted in a 2.3% stock drop for the firm.

Layered on top of all of those typical enterprise cybersecurity concerns are unique eccentricities in protecting gaming platforms and player ecosystems. The gaming platforms are their brands — financial and customer service engines all rolled into one. And they're supremely juicy targets for all nature of malfeasance.

Some of the most common concerns gaming companies must contend with are cheaters who seek to take advantage of technical or bugs or design flaws to their advantage, spammers finding ways to blast out links to gamers to everything from snake-oil products to porn, scammers seeking to take advantage of and steal from younger gamers. And then, of course, most common of all are the everyday cyber fraudsters cashing in on account theft.

"What you have to realize is that criminals attack games for one of three reasons: status, ideology, or cash," says Brett Johnson, chief criminal officer for Arkose Labs and a former cybercriminal who before he went straight ran ShadowCrew, the forerunner to today's Dark Web marketplaces. "Most attacks — 98% or more — are cash driven. So criminals are looking for the easiest access that gives the largest return on investment."

The black-hat ROI prospects have especially grown now that gaming companies have monetized in-game assets through means like direct purchase, voluntary advertising views, and recurring subscriptions. This presents endlessly more new ways to commit financial fraud and launder money through gaming platforms. From a gaming cyber defender's perspective, this means that cheating and hacks now not only threaten gameplay experience, but create more financial and legal risks.

"Any time real money value is tied to in game assets, you will see a spike in fraud and other bad actors," Shroyer explains.

Attackers are turning up the heat on game users and platform with credential stuffing attacks and social engineering scams to break into accounts and access in-game currency and unique items. They leverage third-party marketplaces to sell these in-game assets off the platform for real currency to other gamers who want to bolster their characters or speed up their progress. This creates an ideal situation to not only fence stolen in-game assets, but to launder money stolen elsewhere online.

A lot of this criminal activity is powered by bots and click farms to scale up the profitability of their criminal enterprise, Johnson says.

"The problem is, from an attacker point of view, it's not really worth it to me to attack people manually. If you consider most of these accounts, the dollar amounts are not high enough for me to do that," he says. "So I need to find a way to scale that without me having to manually sign on or try to take over to account. And the answer to that is bots."

**The Culture Wildcard**

Many of the criminal ploys targeting games will also play upon the emotional mindset of gamers, who just want to have as much fun as possible. It makes them more likely to maybe fall for a phishing lure in hopes of getting a sneak peek at a new feature, or go to great lengths to buy items from a third-party marketplace that could speed up their progress.

"The gamer almost immediately is not acting out of reason or logic — it's a knee-jerk type of emotional thing. They want to play that game," Johnson says. "It's much easier for me as an attacker to use that to my advantage because they're already going through that door of reacting emotionally."

This highlights the big balancing act that gaming companies generally have to manage when it comes to protecting their platforms and their users. They've got to design better technical controls and more cyber resilience in their systems without damaging player experience or the vibrancy of the gaming culture built up around their brands and their gaming titles.

As Tsai alluded, gamers are passionate and they're also often curious hackers by nature. That includes the creative and benign type, but also the black hats.

The game industry has always been a place where everyone from script kiddies to budding cybercriminals have come to cut their teeth. For the most part, though, the cohort is usually mostly made up of customers who want to be able to develop and share their custom mods and who are willing to spend a lot of engaged time and money on their games, building up a community that buoys up successful games and studio brands.

This means that a lot of the work of security executives is in detangling the malicious elements from that creative and loyal group of gamers. This takes user education and outreach, foresight in design, and engineering work.

**Engineering Good Choices for Gamers**

On the latter front, some of the easiest and most low-hanging fruit can come through layered protection measures that just make it more expensive for attackers to run roughshod over platform with automated bot attacks.

"If a security product can increase the cost of the attack, the chances of the criminal staying on that platform, not very good," Johnson says. "That criminal's going to find someplace else where they can profit easier and not have to have the investment to get the attack to be successful."

According to Shroyer, the industry is in a lot better place now with moderating and managing mods and curbing cheating because there's more technical measures available to developers.

"Gaming brands now have more tools in their toolkit to prevent these activities," he says. "A few examples are unique online accounts that  require the latest software update to play games, new tech and security placed in gaming data centers that make hacking more difficult, and the ability to turn off access via games online if bad behaviors are noticed. These don't eradicate the issues, but similar to how Netflix and Hulu curbed illegal movie downloading, these tools have had a similar effect in the gaming space."  

More fundamentally at the design level, though, Tsai says that security teams and gaming developers also have to work to create player journeys and experiences less hackable. This doesn't mean shutting off the faucet for mods and other beneficial hacking in the platform. Instead, it means doing better threat modeling of platforms, locking down the riskiest areas and providing guardrails for user "developers" almost in the same way that a DevSecOps team would do so for internal developers.

"There's a saying in engineering with regards to user centricity, which is 'Make me make good choices,'" she says. "And so in that respect, you want to create technology that either encourages or only allows users to make good choices."

This kind of effort takes significant effort and a security-first mentality for game development. However, it's an investment that has a definite ROI for gaming firms, she says.

"Security ties to how users in the community think of your integrity and trust you. These are long-term assets," she says. "If you gain credibility over the years, it can absolutely be a business value-add."

For Gaming Companies, Cybersecurity Has Become a Major Value Proposition

The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the shell of the system because the dir parameter of the FsCreateDir Ajax function is not sufficiently sanitized. The vendor's ID is BSECV-2022-21.

BSECV-2022-18Multiple vulnerabilities in BAT-C2 1.0 11.23.2022Security Bulletin BSECV-2022-21Authenticated Command Injection in Hirschmann BAT-C2 1.0 11.23.2022Security Bulletin BSECV-2022-20TinyXML vulnerability in Hirschmann HiLCOS products1.011.23.2022Security Bulletin BSECV-2022-12Multiple Java SE vulnerabilities in Belden/Hirschmann software products 1.0 11.10.2022Security Bulletin BSECV-2021-03Industrial HiVision: Configured external applications may result in execution of arbitrary binaries1.010.17.2022Security Bulletin BSECV-2022-13 Denial of Service Vulnerability in EagleSDV 1.0 08.01.2022Security Bulletin BSECV-2021-16 FragAttacks Hirschmann BAT 1.1 08.01.2022Security Bulletin BSECV-2022-09 FragAttacks ProSoft RadioLinx RLX2 1.0 07.01.2022Security Bulletin BSECV-2022-11 Multiple vulnerabilities in Provize Basic Frontend 1.0 05.03.2022Security Bulletin BSECV-2022-05 Multiple vulnerabilities in Provize Basic Backend 1.0 05.03.2022Security Bulletin BSECV-2022-01 Vulnerability in ‘axios’ HTTP client in Provize Basic 1.0 05.03.2022Security Bulletin BSECV-2021-05 Multiple Vulnerabilities in Tofino 1.101.11.2022Security Bulletin BSECV-2020-03 Potential denial of service vulnerability in PROFINET Devices via DCE-RPC Packets 1.010.21.2021Security Bulletin BSECV-2020-10Password Change Authentication Bypass Vulnerability in HiOS & HiSecOS 1.005.11.2021Security Bulletin BSECV-2019-08Hirschmann RSP, RSPE, and OS2 series HSR denial of service vulnerability 1.0 01.28.2021Security Bulletin BSECV-2021-02ICX35 Local Web Based Configuration Interface Password Set 1.0 01.15.2021Security Bulletin BSECV-2019-09IPsec Firewall Bypass Vulnerability in WLAN (HiLCOS) Products 1.0 01.11.2021Security Bulletin BSECV-2020-08 EtherNet/IP Vulnerability in 2012 release of (3) PLX31s 1.0 12.18.2020Security Bulletin BSECV-2019-14 HiOS EtherNet/IP stack vulnerability 1.0 09.09.2020Security Bulletin BSECV-2020-04Multiple dnsmasq Vulnerabilities in OWL 3G, LTE & LTE M12 1.0 06.15.2020Security Bulletin BSECV-2020-02JAVA SE vulnerability in Industrial HiVision1.0 06.15.2020Security Bulletin BSECV-2020-06pppd vulnerability in Hirschmann OWL Devices1.05.28.2020Security Bulletin BSECV-2020-01Web Server Buffer Overflow in HiOS & HiSecOS products 1.203.25.2020Security Bulletin BSECV-2019-05Multiple IP vulnerabilities in Hirschmann HiOS and Classic Firewall and GarrettCom DX products (URGENT/11) 1.3 11.27.2019Security Bulletin BSECV-2018-06Belden GarrettCom MNS 6K and 10K OpenSSL Vulnerabilities1.008.09.2019Security Bulletin BSECV-2018-08Belden GarrettCom MNS 6K and 10K SNMP Vulnerability1.008.09.2019Security Bulletin BSECV-2018-07Jackson vulnerability in Industrial HiVision1.006.06.2018Security Bulletin BSECV-2017-11strongSwan vulnerability in HiSecOS1.006.06.2018Security Bulletin BSECV-2017-16WPA2 Key Reinstallation Attack (KRACK) vulnerabilities in Hirschmann BAT devices 1.1 06.06.2018Security Bulletin BSECV-2017-15Web Server Authentication Bypass Vulnerability in HiOS & HiSecOS1.005.25.2018Security Bulletin BSECV-2018-02Weaknesses in Hirschmann Classic Platform Switches when using plaintext HTTP for remote management access1.103.09.2018Security Bulletin BSECV-2018-03Weaknesses in Hirschmann Classic Platform Switches in the user authentication module 1.103.09.2018Security Bulletin BSECV-2018-04RADIUS authentication vulnerability1.0 02.26.2018Security Bulletin BSECV-2017-14;  CVE-2017-11400;  CVE-2017-11401;  CVE-2017-11402Potential Tofino Firmware Signing / Protocol Filtering Evasion / Firewall Bypass1.011.06.2017Security Bulletin BSECV-2017-2Unauthenticated remote code execution vulnerability in Industrial HiVision1.0 08.18.2017Security Bulletin BSECV-2017-12Vulnerability in the bundled Java Runtime Environment lets local users execute arbitrary code in Industrial HiVision, HiFusion and HiView1.008.11.2017Security Bulletin BSECV-2017-10ICX35 User Interface Input Validation Issue  1.0 05.08.2017Security Bulletin BSECV-2017-9ICX35 Authentication Vulnerability1.0 05.08.2017Security Bulletin BSECV-2017-8Belden GarrettCom MNS 6K and 10K Device Access and Security Key Vulnerabilities1.0  05.08.2017Security Bulletin BSECV-2017-3Potential false forward of IPv4 multicast/broadcast traffic by HiLCOS Layer-2 Firewall 1.0 05.08.2017Security Bulletin BSECV-2017-7Possible Request Forgery Vulnerabilities for GECKO Devices 1.004.07.2017Security Bulletin BSECV-2017-1Restricted user roles may gain write access to devices managed by Industrial HiVision 1.001.06.2017Security Bulletin BSECV-2016-2Passwords Synchronization with SNMP v1/v2 communities 1.112.19.2016Security Bulletin BSECV-2016-5 Possible Information Disclosure for GECKO Devices1.0 12.19.2016Security Bulletin BSECV-2016-4HiOS TCP Initial Sequence Number Predictability 1.0 06.06.2016Security Bulletin BSECV-2016-1GECKO authentication bypass1.0 03.07.2016Security Bulletin BSECV-2015-5Identical SSH and SSL default keys in HiLCOS Products1.012.11.2015Security Bulletin BSECV-2015-4;CVE-2008-0960SNMPv3 Authentication Bypass 1.0 07.10.2015Security Bulletin

CVE-2022-40282: security-assurance

An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device.

From: Hyunwoo Kim <imv4bel@gmail.com>
To: eli.billauer@gmail.com, arnd@arndb.de, gregkh@linuxfoundation.org
Cc: linux-kernel@vger.kernel.org
Subject: \[PATCH\] char: xillybus: Fix use-after-free in xillyusb\_open()
Date: Sat, 22 Oct 2022 10:54:04 -0700	\[thread overview\]
Message-ID: <20221022175404.GA375335@ubuntu> (raw)

A race condition may occur if the user physically removes
the USB device while calling open() for this device node.

This is a race condition between the xillyusb\_open() function and
the xillyusb\_disconnect() function, which may eventually result in UAF.

So, add a mutex to the xillyusb\_open() and xillyusb\_disconnect()
functions to avoid race contidion.

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
 drivers/char/xillybus/xillyusb.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/drivers/char/xillybus/xillyusb.c b/drivers/char/xillybus/xillyusb.c
index 39bcbfd908b4..d615f74dcf36 100644
--- a/drivers/char/xillybus/xillyusb.c
+++ b/drivers/char/xillybus/xillyusb.c
@@ -63,6 +63,7 @@ static const struct usb\_device\_id xillyusb\_table\[\] = {
 };
 
 MODULE\_DEVICE\_TABLE(usb, xillyusb\_table);
+static DEFINE\_MUTEX(disconnect\_mutex);
 
 struct xillyusb\_dev;
 
@@ -1237,9 +1238,13 @@ static int xillyusb\_open(struct inode \*inode, struct file \*filp)
 	int rc;
 	int index;
 
+	mutex\_lock(&disconnect\_mutex);
+
 	rc = xillybus\_find\_inode(inode, (void \*\*)&xdev, &index);
\-	if (rc)
+	if (rc) {
+		mutex\_unlock(&disconnect\_mutex);
 		return rc;
+	}
 
 	chan = &xdev->channels\[index\];
 	filp->private\_data = chan;
@@ -1379,6 +1384,8 @@ static int xillyusb\_open(struct inode \*inode, struct file \*filp)
 			request\_read\_anything(chan, OPCODE\_SET\_PUSH);
 	}
 
+	mutex\_unlock(&disconnect\_mutex);
+
 	return 0;
 
 unfifo:
@@ -1410,10 +1417,14 @@ static int xillyusb\_open(struct inode \*inode, struct file \*filp)
 
 	kref\_put(&xdev->kref, cleanup\_dev);
 
+	mutex\_unlock(&disconnect\_mutex);
+
 	return rc;
 
 unmutex\_fail:
 	mutex\_unlock(&chan->lock);
+	mutex\_unlock(&disconnect\_mutex);
+
 	return rc;
 }
 
@@ -1698,6 +1709,8 @@ static int xillyusb\_release(struct inode \*inode, struct file \*filp)
 	struct xillyusb\_dev \*xdev = chan->xdev;
 	int rc\_read = 0, rc\_write = 0;
 
+	mutex\_lock(&disconnect\_mutex);
+
 	if (filp->f\_mode & FMODE\_READ) {
 		struct xillyfifo \*in\_fifo = chan->in\_fifo;
 
@@ -1760,6 +1773,8 @@ static int xillyusb\_release(struct inode \*inode, struct file \*filp)
 
 	kref\_put(&xdev->kref, cleanup\_dev);
 
+	mutex\_unlock(&disconnect\_mutex);
+
 	return rc\_read ? rc\_read : rc\_write;
 }
 
@@ -2172,6 +2187,8 @@ static void xillyusb\_disconnect(struct usb\_interface \*interface)
 	int rc;
 	int i;
 
+	mutex\_lock(&disconnect\_mutex);
+
 	xillybus\_cleanup\_chrdev(xdev, &interface->dev);
 
 	/\*
@@ -2228,6 +2245,8 @@ static void xillyusb\_disconnect(struct usb\_interface \*interface)
 	xdev->dev = NULL;
 
 	kref\_put(&xdev->kref, cleanup\_dev);
+
+	mutex\_unlock(&disconnect\_mutex);
 }
 
 static struct usb\_driver xillyusb\_driver = {
-- 
2.25.1


Dear,


This race condition can occur in the flow of:
\`\`\`
                cpu0                                                cpu1
       1. xillyusb\_open()
          xillybus\_find\_inode()
          mutex\_lock(&unit\_mutex);
          unit = iter;
          mutex\_unlock(&unit\_mutex);
                                                             2. xillyusb\_disconnect()
                                                                xillybus\_cleanup\_chrdev()
                                                                mutex\_lock(&unit\_mutex);
                                                                kfree(unit);
                                                                mutex\_unlock(&unit\_mutex);
       3. \*private\_data = unit->private\_data;   // UAF

\`\`\`

Because the interval between 1 and 3 in xillyusb\_open() is very short, this race condition is usually rare.

However, if someone wants to trigger this UAF, they can use the technique presented in this paper:
https://www.usenix.org/system/files/sec21-lee-yoochan.pdf

This is a method to increase the execution time between No. 1 and No. 3 using the Reschedule IPI.
This means you will be able to trigger the UAF much more reliably.

Here is the KASAN log:
\`\`\`
\[   66.645661\] ==================================================================
\[   66.645678\] BUG: KASAN: use-after-free in xillybus\_find\_inode+0x2c6/0x2ea \[xillybus\_class\]
\[   66.645712\] Read of size 8 at addr ffff88811eb45f90 by task xillyusb\_test/2143

\[   66.645735\] CPU: 2 PID: 2143 Comm: xillyusb\_test Not tainted 6.1.0-rc1+ #10
\[   66.645752\] Hardware name: Gigabyte Technology Co., Ltd. B460MDS3H/B460M DS3H, BIOS F3 05/27/2020
\[   66.645762\] Call Trace:
\[   66.645772\]  <TASK>
\[   66.645783\]  dump\_stack\_lvl+0x49/0x63
\[   66.645808\]  print\_report+0x177/0x46e
\[   66.645828\]  ? kasan\_complete\_mode\_report\_info+0x7c/0x210
\[   66.645846\]  ? xillybus\_find\_inode+0x2c6/0x2ea \[xillybus\_class\]
\[   66.645871\]  kasan\_report+0xb0/0x140
\[   66.645891\]  ? xillybus\_find\_inode+0x2c6/0x2ea \[xillybus\_class\]
\[   66.645917\]  \_\_asan\_report\_load8\_noabort+0x14/0x20
\[   66.645932\]  xillybus\_find\_inode+0x2c6/0x2ea \[xillybus\_class\]
\[   66.645960\]  xillyusb\_open+0xa6/0x1030 \[xillyusb\]
\[   66.645990\]  ? endpoint\_alloc+0x6d0/0x6d0 \[xillyusb\]
\[   66.646014\]  ? \_\_kasan\_check\_write+0x14/0x20
\[   66.646028\]  ? \_raw\_spin\_lock+0x88/0xe0
\[   66.646044\]  ? try\_module\_get.part.0+0xb8/0x1a0
\[   66.646062\]  chrdev\_open+0x230/0x6d0
\[   66.646082\]  ? cdev\_device\_add+0x1f0/0x1f0
\[   66.646099\]  ? fsnotify\_perm.part.0+0x1d9/0x4e0
\[   66.646118\]  do\_dentry\_open+0x449/0x1000
\[   66.646132\]  ? inode\_permission+0x125/0x560
\[   66.646148\]  ? cdev\_device\_add+0x1f0/0x1f0
\[   66.646167\]  vfs\_open+0x9f/0xd0
\[   66.646181\]  path\_openat+0xd58/0x3eb0
\[   66.646199\]  ? kasan\_save\_alloc\_info+0x1e/0x30
\[   66.646212\]  ? \_\_kasan\_slab\_alloc+0x90/0xa0
\[   66.646229\]  ? kmem\_cache\_alloc+0x1f6/0x310
\[   66.646244\]  ? getname\_flags.part.0+0x52/0x490
\[   66.646260\]  ? getname+0x7a/0xb0
\[   66.646275\]  ? \_\_x64\_sys\_openat+0x128/0x210
\[   66.646288\]  ? do\_syscall\_64+0x59/0x90
\[   66.646306\]  ? path\_lookupat+0x660/0x660
\[   66.646328\]  do\_filp\_open+0x1b1/0x3e0
\[   66.646344\]  ? debug\_smp\_processor\_id+0x17/0x20
\[   66.646363\]  ? may\_open\_dev+0xd0/0xd0
\[   66.646378\]  ? getname\_flags.part.0+0x52/0x490
\[   66.646399\]  ? \_raw\_spin\_lock\_bh+0xe0/0xe0
\[   66.646422\]  do\_sys\_openat2+0x132/0x450
\[   66.646435\]  ? recalc\_sigpending+0x144/0x1c0
\[   66.646450\]  ? build\_open\_flags+0x450/0x450
\[   66.646465\]  ? sigprocmask+0x201/0x360
\[   66.646478\]  ? \_\_ia32\_sys\_ssetmask+0x1d0/0x1d0
\[   66.646495\]  \_\_x64\_sys\_openat+0x128/0x210
\[   66.646509\]  ? \_\_ia32\_compat\_sys\_open+0x1b0/0x1b0
\[   66.646526\]  ? debug\_smp\_processor\_id+0x17/0x20
\[   66.646545\]  do\_syscall\_64+0x59/0x90
\[   66.646560\]  ? syscall\_exit\_to\_user\_mode+0x26/0x50
\[   66.646578\]  ? do\_syscall\_64+0x69/0x90
\[   66.646593\]  ? debug\_smp\_processor\_id+0x17/0x20
\[   66.646610\]  ? fpregs\_assert\_state\_consistent+0x52/0xc0
\[   66.646630\]  ? exit\_to\_user\_mode\_prepare+0x49/0x1a0
\[   66.646644\]  ? syscall\_exit\_to\_user\_mode+0x26/0x50
\[   66.646662\]  ? do\_syscall\_64+0x69/0x90
\[   66.646675\]  ? exit\_to\_user\_mode\_prepare+0x16a/0x1a0
\[   66.646689\]  ? syscall\_exit\_to\_user\_mode+0x26/0x50
\[   66.646706\]  entry\_SYSCALL\_64\_after\_hwframe+0x63/0xcd
\[   66.646722\] RIP: 0033:0x4534e4
\[   66.646736\] Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 d6 ab 02 00 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 18 ac 02 00 8b 44
\[   66.646751\] RSP: 002b:00007f8130000140 EFLAGS: 00000293 ORIG\_RAX: 0000000000000101
\[   66.646771\] RAX: ffffffffffffffda RBX: 00007f8130000640 RCX: 00000000004534e4
\[   66.646784\] RDX: 0000000000000000 RSI: 00000000004b1008 RDI: 00000000ffffff9c
\[   66.646795\] RBP: 00000000004b1008 R08: 0000000000000000 R09: 00007ffc22c66baf
\[   66.646806\] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
\[   66.646817\] R13: 0000000000000000 R14: 000000000041b2a0 R15: 00007f812f800000
\[   66.646834\]  </TASK>

\[   66.646848\] Allocated by task 2115:
\[   66.646859\]  kasan\_save\_stack+0x26/0x50
\[   66.646875\]  kasan\_set\_track+0x25/0x40
\[   66.646888\]  kasan\_save\_alloc\_info+0x1e/0x30
\[   66.646898\]  \_\_kasan\_kmalloc+0xb4/0xc0
\[   66.646911\]  kmalloc\_trace+0x4a/0xb0
\[   66.646924\]  xillybus\_init\_chrdev+0xf2/0x815 \[xillybus\_class\]
\[   66.646944\]  xillyusb\_probe.cold+0xa61/0xadf \[xillyusb\]
\[   66.646966\]  usb\_probe\_interface+0x266/0x740
\[   66.646981\]  really\_probe+0x1fa/0xa80
\[   66.646993\]  \_\_driver\_probe\_device+0x2cb/0x490
\[   66.647005\]  driver\_probe\_device+0x4e/0x140
\[   66.647017\]  \_\_driver\_attach+0x1a3/0x520
\[   66.647028\]  bus\_for\_each\_dev+0x11e/0x1c0
\[   66.647039\]  driver\_attach+0x3d/0x60
\[   66.647050\]  bus\_add\_driver+0x449/0x5a0
\[   66.647061\]  driver\_register+0x219/0x390
\[   66.647073\]  usb\_register\_driver+0x228/0x400
\[   66.647084\]  0xffffffffc033202d
\[   66.647094\]  do\_one\_initcall+0x97/0x310
\[   66.647109\]  do\_init\_module+0x19a/0x630
\[   66.647120\]  load\_module+0x6ca4/0x7d90
\[   66.647131\]  \_\_do\_sys\_finit\_module+0x134/0x1d0
\[   66.647142\]  \_\_x64\_sys\_finit\_module+0x72/0xb0
\[   66.647153\]  do\_syscall\_64+0x59/0x90
\[   66.647164\]  entry\_SYSCALL\_64\_after\_hwframe+0x63/0xcd

\[   66.647182\] Freed by task 2089:
\[   66.647191\]  kasan\_save\_stack+0x26/0x50
\[   66.647205\]  kasan\_set\_track+0x25/0x40
\[   66.647218\]  kasan\_save\_free\_info+0x2e/0x50
\[   66.647228\]  \_\_\_\_kasan\_slab\_free+0x174/0x1e0
\[   66.647241\]  \_\_kasan\_slab\_free+0x12/0x20
\[   66.647255\]  slab\_free\_freelist\_hook+0xd0/0x1a0
\[   66.647267\]  \_\_kmem\_cache\_free+0x193/0x2c0
\[   66.647280\]  kfree+0x79/0x120
\[   66.647291\]  xillybus\_cleanup\_chrdev+0x3c1/0x570 \[xillybus\_class\]
\[   66.647311\]  xillyusb\_disconnect+0xfe/0x790 \[xillyusb\]
\[   66.647332\]  usb\_unbind\_interface+0x187/0x7c0
\[   66.647345\]  device\_remove+0x117/0x170
\[   66.647357\]  device\_release\_driver\_internal+0x418/0x660
\[   66.647369\]  device\_release\_driver+0x12/0x20
\[   66.647381\]  bus\_remove\_device+0x28f/0x540
\[   66.647392\]  device\_del+0x501/0xc30
\[   66.647407\]  usb\_disable\_device+0x2a5/0x660
\[   66.647418\]  usb\_disconnect.cold+0x1f9/0x620
\[   66.647431\]  hub\_event+0x16d3/0x3d20
\[   66.647446\]  process\_one\_work+0x778/0x11c0
\[   66.647459\]  worker\_thread+0x544/0x1180
\[   66.647471\]  kthread+0x280/0x320
\[   66.647481\]  ret\_from\_fork+0x1f/0x30

\[   66.647501\] Last potentially related work creation:
\[   66.647510\]  kasan\_save\_stack+0x26/0x50
\[   66.647524\]  \_\_kasan\_record\_aux\_stack+0xb6/0xd0
\[   66.647534\]  kasan\_record\_aux\_stack\_noalloc+0xb/0x20
\[   66.647544\]  kvfree\_call\_rcu+0xaf/0xa50
\[   66.647555\]  memcg\_reparent\_list\_lrus+0x477/0x790
\[   66.647566\]  mem\_cgroup\_css\_offline+0x1ea/0x310
\[   66.647579\]  css\_killed\_work\_fn+0xe4/0x380
\[   66.647590\]  process\_one\_work+0x778/0x11c0
\[   66.647602\]  worker\_thread+0x544/0x1180
\[   66.647614\]  kthread+0x280/0x320
\[   66.647623\]  ret\_from\_fork+0x1f/0x30

\[   66.647642\] The buggy address belongs to the object at ffff88811eb45f80
                which belongs to the cache kmalloc-64 of size 64
\[   66.647656\] The buggy address is located 16 bytes inside of
                64-byte region \[ffff88811eb45f80, ffff88811eb45fc0)

\[   66.647677\] The buggy address belongs to the physical page:
\[   66.647686\] page:000000009bdb1cfb refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88811eb45a00 pfn:0x11eb45
\[   66.647701\] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff)
\[   66.647720\] raw: 0017ffffc0000200 ffffea000481fec8 ffffea0004544b48 ffff888100042640
\[   66.647731\] raw: ffff88811eb45a00 000000000020001e 00000001ffffffff 0000000000000000
\[   66.647738\] page dumped because: kasan: bad access detected

\[   66.647751\] Memory state around the buggy address:
\[   66.647760\]  ffff88811eb45e80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
\[   66.647771\]  ffff88811eb45f00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
\[   66.647781\] >ffff88811eb45f80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
\[   66.647790\]                          ^
\[   66.647800\]  ffff88811eb46000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
\[   66.647810\]  ffff88811eb46080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
\[   66.647818\] ==================================================================
\[   66.647826\] Disabling lock debugging due to kernel taint
\`\`\`


Regards,
Hyunwoo Kim.

next             reply	other threads:\[~2022-10-22 17:54 UTC|newest\]

**Thread overview:** 4+ messages / expand\[flat|nested\]  mbox.gz  Atom feed  top
**2022-10-22 17:54 Hyunwoo Kim \[this message\]**
2022-10-23 14:19 \` \[PATCH\] char: xillybus: Fix use-after-free in xillyusb\_open() Eli Billauer
2022-10-23 14:26   \` Hyunwoo Kim
2022-10-24  7:10     \` Eli Billauer

**Reply instructions:**

You may reply publicly to this message via plain-text email
using any one of the following methods:

\* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting\_style#Interleaved\_style

\* Reply using the **\--to**, **\--cc**, and **\--in-reply-to**
  switches of git-send-email(1):

  git send-email \\
    --in-reply-to=20221022175404.GA375335@ubuntu \\
    --to=imv4bel@gmail.com \\
    --cc=arnd@arndb.de \\
    --cc=eli.billauer@gmail.com \\
    --cc=gregkh@linuxfoundation.org \\
    --cc=linux-kernel@vger.kernel.org \\
    /path/to/YOUR\_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

\* If your mail client supports setting the **In-Reply-To** header
  via mailto: links, try the mailto: link

Be sure your reply has a **Subject:** header at the top and a blank line before the message body.

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.

CVE-2022-45888: [PATCH] char: xillybus: Fix use-after-free in xillyusb_open()

'Tis the season for swindlers and hackers. Use these tips to spot frauds and keep your payment info secure.

Black Friday attracts crowds, and crowds attract scammers, and that means you need to take extra care when shopping online over the Black Friday and Cyber Monday weekend. There'll be people out there eager to relieve you of more money than you'll save on a TV set or a gaming console.

The following precautions apply any time of year, but it's worth reminding yourself of them every time a serious holiday season comes around. In the rush to get gifts sorted, it's all too easy to miss a warning sign, or get complacent about online security.

Update All Your Software

Keeping programs and operating systems up to date is important enough that Microsoft, Apple, Google, Mozilla, and all the other big names in tech now make it difficult for anyone to lag behind with their updates—most of the time you'll be prompted regularly to install new versions of your software, and it might even happen automatically in the background without you noticing.

The biggest retail event of the year has grown into an entire month of sales that ebb and flow. Here’s how to make the most of it.

Today's browsers, apps, and OSes are adept at spotting scams as they happen, whether it's phishing emails (designed to lure you to a fake shopping or banking site) or unauthorized logins on your accounts. To make the most of this built-in security, ensure you're running the latest versions across the board, which means the latest security patches—if you've been putting off updates on your phone or your computer, then get them done ahead of Black Friday.

If you do have a laptop that's too old to run the latest versions of Windows or macOS, avoid using it if possible—you'll be safer shopping on your phone, as long as it's running the most recent Android or iOS updates. On Android, you can check for updates via **System** and **System Update** in Settings; on iOS, it's **Settings** and then **General** and **Software Update**.

Be Wary of Email and Social Media Deals

You're likely to be inundated with special offers over email and social media this Black Friday, but be careful when it comes to clicking through on deals that come from suspicious sources (stores you've never shopped at before, for example). Always check that the link you clicked sent you to the website you were expecting to visit.

There's no hard and fast way to guarantee you'll never get caught out by a dodgy link (apart from just ignoring them all completely), but you can minimize the risk: Check that the social media account or email address sending the link is genuine, head to the site in question in a separate browser window to see whether you can find the same offer advertised, and be sure the offer you're looking at is the one that was promoted.

If your browser is up to date, as we mentioned above, dangerous links should be blocked before you reach them, but we'd still recommend being wary. You'll see some great offers advertised over social media and email, but no discount is worth the risk of exposing yourself to scammers.

Make sure all your devices are updated before shopping.

Android via David Nield

Do Your Research

Wherever possible, stick to trusted stores online. All the major players have robust security procedures in place, so the chances of them (and you) getting hacked are smaller. Still, if you're buying from any site, always check you're on the store website you think you are by checking in your browser's address bar.

We're not saying you should never shop at smaller outlets, but make sure they're using HTTPS technology (indicated with a padlock in your browser's address bar). Look for contact details, an office with a physical address, and reviews left by other users (Trustpilot can be helpful here). See if they're on Twitter and Facebook—and whether those accounts are actually active.

Debit and credit card issuers will usually protect you against fraud—check their policies online if you're not sure about yours—but nevertheless, keep an eye on your bank accounts throughout the Black Friday weekend to make sure only the amounts you're expecting to be debited are going out.

Double-Check Deals

Retailers change their prices all the time—especially online—so a "big discount" you see might only apply to whatever the price was last week, not what it's been over the course of the past year. Price trackers such as CamelCamelCamel can help you work out whether you're getting a genuine bargain or just something that was already heavily reduced.

Checking out product reviews on the web is a useful way of determining how current something is and how much you should be spending on it. Are you looking at the genuine article, or just a cheap knock-off? Is the gadget you're about to buy future-proofed with the latest tech or will it be out of date in six months? And (especially on Amazon) is it being sent from your current region or the other side of the world? Who's the actual seller? Make sure you read what previous buyers have to say via the user reviews before spending your money.

Just be aware that stores also use the occasion to try and shift their remaining stock of older, less popular products. Make sure you're looking at what you're buying and not just the price drop.

CamelCamelCamel will show you previous price drops on Amazon.

CamelCamelCamel via David Nield

Protect Your Accounts

As always, keep your accounts locked down and protected on Black Friday. Use strong, unique passwords for all your accounts (a dedicated password manager or your browser's password management system can help here), and turn on two-factor authentication on every account that offers it (Microsoft, Apple, Google, Facebook, and Twitter ones all do, for a start).

While it may seem convenient to quickly set up a new shopping account with your “usual” password, it only takes one account sharing the same password to get exposed, and all the others can come tumbling down after it. If you're using the latest versions of Chrome and Safari, you'll notice you can now use a strong password suggested by your browser (the option should pop up automatically when you're in a password field).

If you're planning on shopping at outlets where you haven't purchased anything before, it's a good idea to get these accounts set up ahead of time—this means you aren't rushing when it comes to thinking up new passwords and entering potentially sensitive information into your web browser.

Guard Your Payment Info

Many places that you're shopping at on Black Friday and Cyber Monday will already have your payment info on file, but if you're entering details into a new site, again make sure the padlock symbol is showing in the address bar—the full URL should also begin “https://”, which indicates that your payment details will be encrypted in transit.

If you’re on vacation or out of town, we recommend waiting until you get back home before buying anything—or at least using the cellular data on your phone to make a connection rather than a public Wi-Fi hotspot, as it's much harder for hackers to intercept your details (or look over your shoulder as you're typing them). If you are shopping in-store, be careful to guard your PIN numbers and other sensitive details when you're surrounded by crowds—or even just one shop assistant.

As tempting as Black Friday offers might be, it's usually a good idea to shop in as few places as possible, if you can: The fewer companies that hold your payment data, the less likely you are to be victim to a data breach, and the risk of those breaches are really down to the company's security policies rather than any precautions you can take.

How to Avoid Black Friday Scams Online

The cyber espionage group known as Bahamut has been attributed as behind a highly targeted campaign that infects users of Android devices with malicious apps designed to extract sensitive information.
The activity, which has been active since January 2022, entails distributing rogue VPN apps through a fake SecureVPN website set up for this purpose, Slovak cybersecurity firm ESET said in a new

The cyber espionage group known as **Bahamut** has been attributed as behind a highly targeted campaign that infects users of Android devices with malicious apps designed to extract sensitive information.

The activity, which has been active since January 2022, entails distributing rogue VPN apps through a fake SecureVPN website set up for this purpose, Slovak cybersecurity firm ESET said in a new report shared with The Hacker News.

At least eight different variants of the spyware apps have been discovered to date, with them being trojanized versions of legitimate VPN apps like SoftVPN and OpenVPN.

The tampered apps and their updates are pushed to users through the fraudulent website. It's also suspected that the targets are carefully selected, since launching the app requires the victim to enter an activation key to enable the features.

This implies the use of an undetermined distribution vector, although past evidence shows that it could take the form of spear-phishing emails, SMS messages, or direct messages on social media apps.

The activation key mechanism is also designed to communicate with an actor-controlled server, effectively preventing the malware from being accidentally triggered right after launch on a non-targeted user device.

Bahamut was unmasked in 2017 by Bellingcat as a hack-for-hire operation targeting government officials, human rights groups, and other high-profile entities in South Asia and the Middle East with malicious Android and iOS apps to spy on its victims.

"Perhaps the most distinctive aspect of Bahamut's tradecraft that BlackBerry discovered is the group's use of original, painstakingly crafted websites, applications and personas," BlackBerry noted in October 2020.

Earlier this year, Cyble detailed two sets of phishing attacks orchestrated by the group to push counterfeit Android apps masquerading as chat applications.

The latest wave follows a similar trajectory, tricking users into installing seemingly innocuous VPN apps that can exfiltrate a wide swathe of information, including files, contact lists, SMSes, phone call recordings, locations, and messages from WhatsApp, Facebook Messenger, Signal, Viber, Telegram, and WeChat.

"The data exfiltration is done via the keylogging functionality of the malware, which misuses accessibility services," ESET researcher Lukáš Štefanko said.

In a sign that the campaign is well maintained, the threat actor initially packaged the malicious code within the SoftVPN application, before moving to OpenVPN, a shift explained by the fact that the actual SoftVPN app stopped functioning and it was no longer possible to establish a VPN connection.

"The mobile campaign operated by the Bahamut APT group is still active; it uses the same method of distributing its Android spyware apps via websites that impersonate or masquerade as legitimate services, as has been seen in the past," Štefanko added.

Found this article interesting? Follow THN on Facebook, Twitter __ and LinkedIn to read more exclusive content we post.

Bahamut Cyber Espionage Hackers Targeting Android Users with Fake VPN Apps

Months after a fix was issued by a vendor, downstream Android device manufacturers still haven't patched, highlighting a troubling trend.

It's called a "patch gap" and describes the time it takes a fix for a known vulnerability to trickle down from software vendor to individual device manufacturers. And the latest casualties are the millions of Pixel, Samsung, Xiaomi, and other Android device brands.  

According to Google's Project Zero, after its team discovered five separate bugs in the ARM Mali GPU driver, ARM  "promptly" issued a patch in July and August. Yet, Project Zero reported that every test device they looked at this week remains vulnerable. 

Until there's a better solution for tightening up the lag between the time a patch is issued and reaches the wider ecosystem, it's up to security teams to remain "vigilant," the Google Project Zero team advised. 

"Just as users are recommended to patch as quickly as they can once a release containing security updates is available, so the same applies to vendors and companies," the patch gap report explained. "Minimizing the 'patch gap' as a vendor in these scenarios is arguably more important, as end users (or other vendors downstream) are blocking on this action before they can receive the security benefits of the patch." 

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Tag

#ios