April 28, Softpedia – (International) Slack API credentials left in GitHub repos open new door for corporate hacking. Security researchers from Detectify Labs reported that companies in all industries may be at risk after finding that developers were leaving sensitive credentials inside open-sourced code following a scan on GitHub projects which revealed over 1,500 Slack access tokens were available online. The access tokens could allow attackers to access application program interfaces (APIs) and harvest user data, view Slack channel conversations, group information, private messages, and automate the use of Slack’s search feature. Source
April 28, Softpedia – (International) Google and Mozilla address security issues in Chrome 50 and Firefox 46. Google released its newest web browser, Chrome 50.0.2661.94 which patched nine security flaws including two use-after-free vulnerabilities, one vulnerability in the Blink engine’s V8 bindings, and one vulnerability in the browser’s extensions component, among other patched flaws. Source
April 28, Softpedia – (International) Microsoft patches Office 365 platform against SAML exploit. Microsoft released a temporary patch for its Security Assertion Markup Language (SAML) Service Provider implementation used for its Office 365 platform after two security researchers found the product had an authentication bypass vulnerability that allowed attackers to authenticate themselves on a service and access user’s data on all shared domains. Microsoft was working to release a permanent patch. Source
April 28, SecurityWeek – (International) OpenSSL to patch high severity vulnerabilities. The OpenSSL Project reported that it will release OpenSSL versions 1.0.2h and 1.0.1t May 3 to patch several flaws affecting the crypto library as well as flaws rated as high-severity vulnerabilities. Source
April 28, Agence France-Presse – (International) Pentagon working to ‘take out’ Islamic State’s internet. Pentagon officials reported April 28 that the U.S. military’s Cyber Command (CYBERCOM) was working to destroy the Islamic State’s Internet connection and leave the terrorist group in virtual isolation by interrupting the Islamic State’s command and control (C&C), interrupting the group’s ability to move funds, and interrupting the group’s ability to recruit externally, among other actions. The task will be the command’s first major combat operation in relation to the Islamic State threat. Source
Reprinted from the USDHS Daily Open Source Infrastructure Report