Search

The article discusses open source firmware. Topics include the use of open source firmware to make computing more secure by making the actions of firmware more visible and less likely to do harm, and the security levels of rings one through three which are comprised of userspace, kernel, hypervisor, system management mode (SMM), and management engine.

The article offers information on introducing a Security Information and Event Management (SIEM) solution, NIKSUN LogWave by the NIKSUN Inc. Topics discussed include views of Dr. Parag Pruthi, Founder, Chairman & chief executive officer of NIKSUN, on issue; giving access around encrypted network flows as the logs on the server; and cost effective solution for achieving maximum visibility into the network by monitoring and analyzing endpoints.

The article discusses ways on how to reset and delete password for Microsoft Windows 8. Topics discussed include the use of a hack or third party tool to reset local accounts, cautions on resetting a password, and need for computer users to temporarily disable Windows 8's Secure Boot and Unified Extensible Firmware Interface features.

Asus also recommends resetting the router to factory default settings and changing the default administrator password. Today Asus is telling owners of its Wi-Fi routers to update their firmware in order to protect against the Cyclops Blink botnet. [Extracted from the article]

A firmware-update utility that comes preinstalled on at least 128 models of Dell laptops, desktops, servers, and tablets has multiple vulnerabilities that could allow a privileged attacker to install rogue code over the network, the computer maker and security firm Eclypsium announced on Thursday. Sophisticated malware frequently has firmware modules that attempt to infect the basic input/output system (BIOS), which, as the first software to run, has a privileged place in the order in the system boot sequence. [Extracted from the article]

Several letters to the editor are presented in response to the article "Lock It Up!," by Joe Kissell, published in the November 2007 issue, an article about wireless security which recommends AnchorFree's Hotspot Shield virtual private network (VPN) service and an article recommending the use of Open Firmware Password.

The article focuses on the vulnerability of firmware to cyberattacks and methods that computer security experts are using to prevent cyberattacks. It states the networking of embedded computers used for power grids, water treatment facilities and other systems are increasingly vulnerable to cyberattacks. Director Scott Borg of the nonprofit Cyber Consequences Unit mentioned that circuits are designed to accept multiple rewrites and talked about programs that scan firmware code to detect changes.

Fortinet Inc., a Santa Clara, California-based provider of ASIC-powered, network-based antivirus firewall systems for real-time network protection, has unveiled FortiOS (TM) 2.5, a new release of the firmware available for all FortiGate (TM) Antivirus Firewalls. FortiOS 2.5 adds significant new features such as intrusion prevention, as well as over 50 enhancements to the firewall, VPN, antivirus, intrusion detection, and content filtering capabilities of the FortiGate line — without requiring any hardware upgrades.

The article reports on scenarios when the security of a basic input/output system computer or a mobile device is threatened and the measures that prevent its occurrence. It discusses the crash of a computer system when a flash-based memory code, a file that is loaded in the core operating system and a sector loaded from data storage into the memory are corrupt. It explains how a unified extensible firmware interface helps support boot security that will allow the system to run.

What's a UEFI rootkit...? So it's about firmware for interoperability, but now it's vulnerable to attacks too? What should we do about it then? [ABSTRACT FROM AUTHOR]

The article offers information on the issue of updates for Intel-based computer systems including personal computers and servers for computer security by chip maker Intel. Topics discussed include launch of software patches and firmware updates; updating their products and services by operating system vendors, public cloud service providers, and device manufacturers; and workload-dependent performance impact of updates.

The author discusses the Unified Extensible Firmware Interface (UEFI), by several computer technology companies like Microsoft, and software developer Oracle's claim over copyrights of Java Application Programming Interface (API). The UEFI design, which will have a secure boot, will protect installed programs on computer systems. He states that the secret service companies are focusing on cryptology, for accessing encrypted materials, through Secure Sockets Layer (SSL) certificates.

The article reports various developments related to computer and smartphone security. Western Digital Corp. has urged customers to update the firmware on their MyCloud range of NAS drives that lets attackers log into the device using a pre-set username and password. Researchers from the Nanyang Technological University (NTU) in Singapore has claimed that smartphone sensors help hackers guess one's PIN code.

The article provides information on warning issued by computer technology platform Intel Corp. on unwanted reboots that could occur in Spectre CPU due to firmware patches. Topics discussed include view of Navin Shenoy, executive vice president at Intel on the same; updated microcodes; and antivirus suites.

The article reports that users of Western Digital Corp.'s (WD) My Cloud network-attached storage devices are being asked to upgrade the latest firmware version to protect themselves against security issues like a built-in backdoor vulnerability. The Mirai Internet of things (IoT) botnet that affected organizations globally at the end of 2016 was made up of vulnerable devices that had known usernames and passwords. WD regularly updates the firmware for its devices to fix security issues.

The article reports on the ThinkPwn exploit by security researcher Dmytro Oleksiuk which found that a vulnerable code exists on the firmwares of technology companies Lenovo, HP and Gigabyte Technology. According to Lenovo, the code was developed in a Unified Extensible Firmware Interface (UEFI) package provided by independent basic input/output system (BIOS) vendors (IBVs).

The article discusses Dell's offering of basic input and output system (BIOS) verification for commercial personal computers as part of Dell's Endpoint Security Suite. Topics include a description of Dell's Endpoint Security Suite Enterprise which uses Cylance technology, how the Endpoint Security can protect BIOS firmware, and the addition of the Dell One Identity Safeguard for Privileged Passwords.

The article reviews the DLTSage Tape Security firmware for data encryption from Quantum.

The article focuses on the warning given by Cisco Systems to customers in cases where attackers have replaced the boot firmware on devices running Apple iPhone smartphone operating system (IOS). Topics discussed include replacement of the ROMMON image on IOS devices by attackers, the benefit of installing a malicious ROMMON image on a device for attackers, and advice from the Cisco product security incident response team.

The article reports on the initiative of computer technology company Lenovo Group Ltd. to fix its basic input/output system (BIOS) firmware, as of August 13, 2015. Topics covered include the security glitch in Lenovo Service Engine, response of Microsoft Corp. to the security issues in Lenovo's pre-loaded software, and the impacts of the vulnerability issues on Lenovo laptop and desktop users. Also mentioned are the effects of Superfish Visual Discovery, a Lenovo pre-loaded program.

The article reports on the Remote Control System (RCS) Unified Extensible Firmware Interface (UEWFI) rootkit developed by the surveillance software maker Hacking Team which can modify UEFI of a computer. It says that the tool can silently reinstall its surveillance tool despite the hard drive was replaced or reformatted. Other topics include the development of UEFI firmware by different companies, the need of physical access to install the UEFI rootkit, and the behavior of the rootkit.

The article reports on the plan of software company Microsoft Corp. to tighten the Secure Boot feature of Windows 10 operating system (OS) and its impact to Linux OS users. Topics include the unified extendible firmware interface (UEFI) Secure Boot feature of Windows 8 computers, the toggle option for user-configuration in Windows 10, and the Linux Foundation Secure Boot System generic loader.

The article focuses on the documents released by former U.S. National Security Agency contractor Edward Snowden which show the attempt of the U.S. Central Intelligence Agency (CIA) of defeating the device security of the computer manufacturer Apple. Topics discusses include the ways to break the device, the Group ID (GID) technique for extracting the firmware, and the concern voiced by the U.S. Federal Bureau of Investigation (FBI) and the U.S. intelligence agencies on encryption.

The author reflects on a report from international software security group Kaspersky Lab on the emergence of cyberespionage group, Equation, with a toolset similar to ones used by U.S. intelligence agencies which has infiltrated key institutions in various countries. He reveals the ability of Equation to infect the firmware of a hard drive that acts as an interface between hardware and software. The use of interdiction techniques to deliver malicious software to targets is also tackled.

The article focuses on a new version of the EKI-1200 firmware from industrial computer manufacturer Advantech which protects vulnerability in ADAM-4572 devices known as Modbus gateways. It states that the vulnerability was identified by researchers from computer security company Core Security in the Advantech EKI-1200 series of firmware. It adds that users are advised to use the new version as soon as possible.

The article discusses a paper published in the periodical "Forbes" that focused on the vulnerability of a car monitoring dongle from Xirgo Technologies to hacking. Topics mentioned include the use of a dongle, provided by insurance provider Progressive Insurance, to monitor driving habits and security features that are lacking in the dongle found by security researcher Corey Thuen such as outdated firmware and absence of secure boot and cellular authentication.

The article reports on an advisory from the U.S. Computer Emergency Readiness Team which states the release of technology vendors of fixes for vulnerabilities found in the critical firmware used during a computer's startup. It mentions the efforts of American Megatrends Inc. (AMI) to address the issue on a generic basis while working with original equipment manufacturers (OEMs) to implement fixes for projects. Intel Corp. and Phoenix Technologies Ltd. also resolved problems on vulnerabilities.

The article explores the risk of web-connected household devices to hacking. It highlights that hacking could be more destructive if more devices are connected to the Internet such as an average broadband router which rarely get firmware updates. It also mentions that Lookout Mobile chief technology officer Kevin Mahaffey tested hacking his heating thermostats and coffee machine which are web-enabled.

The article offers information on the data from research company Rapid7 which shows that Intelligent Platform Management Interface (IPMI) implementation in motherboards from server manufacturer Super Micro Computer Inc. is experiencing serious vulnerabilities which may allow attackers to remotely compromise the server's management controllers. The researchers also found several security issues in Supermicro's IPMI firmware version SMT_X9_226.

This article focuses on brands of security camera systems that are vulnerable to hacker hijacking, according to two studies from security researchers. A study by Rapid7 chief security officer H. D. Moore reveals that 58,000 of the video boxes that use firmware from Ray Sharp are accessible via the Internet. Meanwhile, a study posted on a blog by someLuser discovered that commands sent to camera systems built by Swann were accepted without authentication.

The article focuses on the development of the Phoenix SecureCore Tiano basic input/output system (BIOS) firmware of Phoenix Technologies Ltd. to instantly boot up Windows personal computers (PCs). It mentions that the firmware is developed to deal with the slow booting process of PCs in spite of the faster computer equipment like processors, hard drives and memory. It notes that BIOS enables the Windows 7 to appear one second after booting without compromising security and reliability.

The article reports that Blade PC maker ClearCube Technology Inc. will introduce new I/Port access devices in a compact design to the current date. It will enable the users to move from one location to another, along with new patch management tools to keep the I/Port firmware up to date. The ClearCube architecture centralizes desktop PCs into racks of separate blades, accessed via desktop ports. The new I8810 and I8820 I/Ports are basically smaller versions of existing models, according to ClearCube. The I8820 is designed to access Windows-based PC blades, while the I8810 is aimed at customers running Linux blades. Ken Knotts, ClearCube chief technologist, said the firm's kit is widely used in environments where data security is a concern.

This article offers tips for securing and ensuring efficiency of PowerBook or iBook systems during travel. Before a travel, set an Open Firmware password on the notebook. Once it is set, nobody will be able to boot it without that password, even if they try booting off of an external drive, a compact disc or in FireWire Target Disk Mode. Apple Computer provides a simple, safe utility for setting up Open Firmware password security along with detailed instructions at http://docs.info.apple.com. Panther's FileVault offers additional security by encrypting the contents of the home folder. However, passwords should not be forgotten. An excellent and safer alternative is to create an encrypted disk image with Disk Utility. Disk Utility asks for a password; once supplied , the new disk image mounts on the desktop, ready to securely stash the files. When unmounted, password will be needed again. A typical laptop uses as much power during two hours in sleep mode as it does booting up, so shut the system when not in use for an extended period of time. Avoid plugging in external mouse, iPod or any other peripheral. Use F1 and F2 to dim the display to the lowest comfortable level.

Armed only with a small download, computer hackers are uncovering everything from gigabytes of DVD space to extra drive speeds and hidden menus. The free features are unlocked by flashing the hardware with a firmware update file Upgrading to a new 8.5GB Double Layer DVD burner, for instance, might not be necessary with the discovery that some single layer drives can already burn the new discs after a firmware update. Users at the CDRInfo forum discovered that the firmware for NEC's new Double Layer 2510A DVD burner could be flashed into a 2100A or 2500A DVD burner. NEC's single layer 8x burner sells for $159, several hundred dollars less than the Double Layer versions currently hitting the shelves. The NEC DVD burners are also supplied in some Dell and HP systems. "We haven't been told by NEC that users can do it," said Andrew Scalise of Carol, the drive's Australian distributor. "But if NEC gave it the official green light, we wouldn't have a problem with it." Unofficial firmware updates are also being used to unlock features in Canon's EOS 300D digital SLR camera, including menus and options found in a more expensive model.

The article reports on service management solutions being offered by companies in the U.S. in 2010. Aside from outsourced security and ongoing system management solutions which Kastle Systems International have started offering in 1972, the company also offers services involving the Internet, cloud computing, and hosting. The article also offers information on the efforts done by Keri Systems Inc. to embed Mercury Security firmware in its NXT controllers.

The article reports that John Sawyer, a security researcher, has found a backdoor vulnerability in Android firmware provided by Foxconn and dubbed it as Pork Explosion which allows attackers to gain a root shell to an affected device. Only Foxconn's own firmware is affected and, as Sawyer said in his blogpost, vendors InFocus, Nextbit, and more were affected. Checking the Android internal partition table, said Sawyer, will be able to tell if a device is vulnerable to the attack.

The article offers information on ThinkPwn, a firmware exploit published by Dmytro Oleksiuk that has the capacity to disable Windows security features in Lenovo ThinkPads. Among its uses include disabling Secure Boot and defeating the Credential Guard feature of Windows 10. It notes that ThinkPwn targets escalation flaw in a Unified Extensible Firmware Interface (UEFI).