ICS-CERT

Episode 174: GE’s Very Bad Day – Unpacking the MDHex Vulnerabilities

The U.S. Department of Homeland Security warned of critical vulnerabilities in a range of products by GE. We speak with Elad Luz, the head of research at CyberMDX, which discovered the holes.

Russia Cozy Bear CrowdStrike

FBI, DHS warn Russian Dragonfly Group Still Targeting US Critical Infrastructure

The Department of Homeland Security and the FBI on Thursday warned that the so-called “Dragonfly” hackers linked to the government of Russia are engaged in a “multi-stage intrusion campaign” against U.S. critical infrastructure, including the energy, nuclear, aviation and manufacturing sectors. 

NXP ColdFire

Flaw in MQX Operating System Could Put Internet of Things in Crosshairs

Flaws in software run by a range of microprocessors could be widespread in embedded systems, security experts and the Department of Homeland Security are warning.

TP-Link WR-841n

Update: Flaw in widely used Wi-Fi Standard could allow snooping

Hundreds of millions of wireless devices may be affected by a flaw in WPA-2, a widely used standard for securing wireless Internet connections.  (Updated to add commentary by Bob Rudis of Rapid 7.)

Updated: Intel Fixes ‘Nightmarish’ Firmware Flaw But Nobody’s Safe

In-brief: Intel issued a patch for a serious vulnerability in firmware that has shipped with its chipsets for almost nine years, but it could take months for patches to reach affected customers from OEMs. (Editor’s note: updated with analysis from Matthew Garrett. PFR May 2, 2017.)