New BLUFFS Bluetooth Attack Expose Devices to Adversary-in-the-Middle Attacks

New research has unearthed multiple novel attacks that break Bluetooth Classic's forward secrecy and future secrecy guarantees, resulting in adversary-in-the-middle (AitM) scenarios between two already connected peers.
The issues, collectively named BLUFFS, impact Bluetooth Core Specification 4.2 through 5.4. They are tracked under the identifier CVE-2023-24023 (CVSS score: 6.8)

https://thehackernews.com/2023/12/new-bl...xpose.html

LogoFAIL: UEFI Vulnerabilities Expose Devices to Stealth Malware Attacks

The Unified Extensible Firmware Interface (UEFI) code from various independent firmware/BIOS vendors (IBVs) has been found vulnerable to potential attacks through high-impact flaws in image parsing libraries embedded into the firmware.
The shortcomings, collectively labeled LogoFAIL by Binarly, "can be used by threat actors to deliver a malicious payload and bypass Secure Boot, Intel

https://thehackernews.com/2023/12/logofa...xpose.html

Critical 'LogoFAIL' Bugs Offer Secure Boot Bypass for Millions of PCs

Hundreds of consumer and enterprise-grade x86 and ARM models from various vendors, including Intel, Acer, and Lenovo, are potentially vulnerable to bootkits and takeover.


https://www.darkreading.com/endpoint-sec...llions-pcs

The Latest Delinea Secret Server Release Boosts Usability With New Features




https://www.darkreading.com/endpoint-sec...w-features

Flow Security Launches GenAI DLP




https://www.darkreading.com/cloud-securi...-genai-dlp

The European Space Agency Explores Cybersecurity for Space Industry

An ESA cybersecurity expert explains how space-based data and services benefit from public investment in space programs.


https://www.darkreading.com/ics-ot-secur...e-industry

Interpol Arrests Smuggler With New Biometric Screening Database

Interpol has upgraded its biometric background check tech. It'll help catch criminals, but will it protect sensitive, immutable data belonging to the innocent?


https://www.darkreading.com/cyber-risk/i...g-database

North Korea's state hackers stole $3 billion in crypto since 2017


North Korean-backed state hackers have stolen an estimated $3 billion in a long string of hacks targeting the cryptocurrency industry over the last six years since January 2017. [...]


https://www.bleepingcomputer.com/news/se...ince-2017/

Linux version of Qilin ransomware focuses on VMware ESXi

A sample of the Qilin ransomware gang's VMware ESXi encryptor has been found and it could be one of the most advanced and customizable Linux encryptors seen to date. [...]


https://www.bleepingcomputer.com/news/se...ware-esxi/

Hackers use new Agent Raccoon malware to backdoor US targets


A novel malware named 'Agent Raccoon' (or Agent Racoon) is being used in cyberattacks against organizations in the United States, the Middle East, and Africa. [...]


https://www.bleepingcomputer.com/news/se...s-targets/