SDxCentral: FCC bans all foreign-produced routers over ‘unacceptable risks to national security’

FCC bans all foreign-produced routers over ‘unacceptable risks to national security’
March 24, 2026 By Ben Wodecki

Imports of consumer-grade foreign-made routers subject to Covered List over cybersecurity and supply chain vulnerabilities

The Federal Communications Commission (FCC) moved to ban imports of all foreign-produced routers over “unacceptable risks to national security.”

A public notice dated March 23 extends the import ban to consumer-grade devices produced outside the U.S. The move does not impact any previously-purchased consumer-grade routers, the FCC confirmed, with consumers still able to use devices they’ve already acquired.

I'm glad, and surprised it took our government so long.

But are there any US router manufacturers left to buy from?

CrowdStrike Research: Security Flaws in DeepSeek-Generated Code Linked to Political Triggers

CrowdStrike Research: Security Flaws in DeepSeek-Generated Code Linked to Political Triggers
November 20, 2025 | Stefan Stein

CrowdStrike Counter Adversary Operations identifies innocuous trigger words that lead DeepSeek to produce more vulnerable code.
...
In January 2025, China-based AI startup DeepSeek (深度求索) released DeepSeek-R1, a high-quality large language model (LLM) that allegedly cost much less to develop and operate than Western competitors’ alternatives.

CrowdStrike Counter Adversary Operations conducted independent tests on DeepSeek-R1 and confirmed that in many cases, it could provide coding output of quality comparable to other market-leading LLMs of the time. However, we found that when DeepSeek-R1 receives prompts containing topics the Chinese Communist Party (CCP) likely considers politically sensitive, the likelihood of it producing code with severe security vulnerabilities increases by up to 50%.

This comes as absolutely no surprise to me.

This should be a lesson to all of us. AIs are not people. Their "intelligence", however you define the term, is a function of the data it was trained on. If you train it with corrupt and biased data, you will get corrupt and biased results.

Models from nation states that believe in using any and all means to take advantage of and corrupt (if not open wage war on) the rest of the world should not be trusted. It should be assumed that those models will generate output in support of their creators' national goals, just as if you had hired a government agent from that nation to do the work.

Computer Weekly: Backups ‘no longer effective’ for stopping ransomware attacks

Backups ‘no longer effective’ for stopping ransomware attacks
By Alex Scroxton. 23 Feb 2022 14:00

...
Data collated from Venafi’s worldwide survey of IT and security decision-makers reveal that 83% of successful ransomware attacks now involve alternative extortion methods – for example, using stolen data to extort customers (38%), leaking data to the dark web (35%), and informing customers that their data has been compromised (32%). A mere 17% of attacks merely ask for money for a decryption key.
...
Venafi also found that cyber criminals are increasingly following through on their threats whether or not they get paid. Indeed, 18% of victims had their data leaked despite paying, while more than the 16% who refused outright to pay anything and had their data leaked. Some 8% refused outright, but then had their customers extorted; and 35% paid, but were left hanging, unable to retrieve their data.

In other words, if you are victim of a ransomware attack, you're screwed no matter what you do. Even if you pay up, there's a good chance you won't get your data back and your confidential data may still be published.

So, (desptie the article's headline), the best you can hope for is to get yourself operational by restoring from a backup (be sure to retain several, in case your most recent one was corrupted by the attack), and don't pay the ransom.

Naked Security: How a gaming mouse can get you Windows superpowers!

How a gaming mouse can get you Windows superpowers!
By Paul Ducklin, 24 Aug 2021

What if you’re a gamer who wants to be a sysadmin? On someone else’s computer?

Well, apparently, until last week at least, gamer-centric mice and keyboards from popular vendor Razer could help you to do just that.
...

• You plug in a Razer gaming mouse for the first time.
• Windows detects that this device type has special software and drivers that will make it work Even Better than a regular mouse.
• Windows finds Razer’s official addons in the Windows Update cloud.
• Windows downloads and launches the offical addons so you don’t have to.
• The Razer app helpfully ends with a clickable directory name, showing you what ended up where in the installation process.

...
The problem in this case is the point at which Razer’s app helpfully displays the name of the software installation directory at the end, even though it doesn’t need to.

That’s an active link in Razer’s app, so you can right-click on it and view the directory in File Explorer.

Then, once you’re in Explorer, you can do a Shift-and-right-click and use the handy option Open PowerShell window here, giving you a command-line alternative to the existing Explorer window.

But that PowerShell prompt was spawned from the Explorer process, which was spawned from Razer’s installer, which was spawned by the automatic device installer process in Windows itself…

..which was running under the all-powerful NT AUTHORITY\SYSTEM account, usually referred to as NTSYSTEM or just System for short.

So the PowerShell window is now running as System too, which means you have almost complete control over the files, memory, processes, devices, services, kernel drivers and configuration of the computer.

Wow. A chain of good intentions all leading to an exploitable system vulnerability. I realize that Razer has (or will soon) fix this bug in their driver installation tool, but it seems to me that Microsoft should do something to prevent this from being possible in the future. Maybe do something so an installer trying to open a URL (or an Explorer process) does so at the user's normal privilege level instead of at the driver installer's level (which, of course, needs to be at a higher level in order to perform the installation).

Clickbait security hole?

“Unpatchable” vuln in Apple’s new Mac chip – what you need to know
By Paul Ducklin, 27 May 2021

Apple’s brand new Mac has a security hole, right inside the processor itself!

The official name for the bug is CVE-2021-30747, but the developer who discovered it prefers to call it M1RACLES, all in caps.

Like every BWAIN (our own impressive name for bugs with impressive names, short for Bug With An Impressive Name), it has a personalised domain, a logo and a website where you can learn all about it.

The finder of the bug, Hector Martin, writes on the website that:

The vulnerability is baked into Apple Silicon chips, and cannot be fixed without a new silicon revision.

... the bug name M1RACLES expands, rather tortuously, as:

M1ssing Register Access Controls Leak EL0 State

It turns out that Apple’s M1 chip includes a CPU system register known, ineffably, as s3_5_c15_c10_1.

According to Hector Martin, this register can be read from by userland programs running at EL0, though he doesn’t know what the register is actually used for, if anything.

However, userland programs aren’t supposed to be able to write into it, given that it’s a system register and supposedly off-limits to EL0 programs.

But Martin discovered that userland code can write to just two individual bits inside this register – bits that are apparently otherwise unused and therefore might be considered unimportant or even irrelevant...

... and those bits can then be read out from any other userland program.

And that’s it!

That, in a nutshell, is the entirety of the “baked-in” security vulnerability CVE-2021-30747, also known as M1RACLES.
...
There’s nothing that you can do, but fortunately there’s nothing you need to do, so you can relax.

Clearly, if it is possible to access a register you're not supposed to have access to, it's a bug that must be fixed and I suppose it technically counts as a security vulnerability but does this really require creating an entire Internet domain and web site to advertise it?

Sounds like click-bait to me.

Sophos: Apple patches dangerous security holes, one in active use – update now!

Apple patches dangerous security holes, one in active use – update now!
By Paul Ducklin, 25 May 2021

... security patches that arrived in the update to iOS 14.6, because Apple fixed 38 significant bugs, covered by 43 different CVE bug numbers.

For what it’s worth, the update to macOS Big Sur 11.4 shared many of those bugs with iOS, as well as adding a raft of its own, with 58 significant bugs patched, covered by 73 different CVE bug numbers.

Perhaps even more importantly, one of the Big Sur bugs that was patched, now dubbed CVE-2021-30713, is a security flaw that is already known to criminals and has already and quietly been exploited in the wild.

Time to update your phone again...

Bleeping Computer: Researcher hacks over 35 tech firms in novel supply chain attack

Researcher hacks over 35 tech firms in novel supply chain attack
By Ax Sharma. February 9, 2021, 01:04 PM

A researcher managed to breach over 35 major companies' internal systems, including Microsoft, Apple, PayPal, Shopify, Netflix, Yelp, Tesla, and Uber, in a novel software supply chain attack.

The attack comprised uploading malware to open source repositories including PyPI, npm, and RubyGems, which then got distributed downstream automatically into the company's internal applications.

Unlike traditional typosquatting attacks that rely on social engineering tactics or the victim misspelling a package name, this particular supply chain attack is more sophisticated as it needed no action by the victim, who automatically received the malicious packages.

This is because the attack leveraged a unique design flaw of the open-source ecosystems called dependency confusion.

For his ethical research efforts, the researcher has earned well over $130,000 in bug bounties.

A remarkably simple attack revealing serious problems in corporations' open source package distribution systems.

Like most companies using open source software, they develop applications containing both public packages (which come from well-known and trusted Internet repositories) and private packages (developed in-house). In order to maximize reuse of private packages, they are deployed using an internal repository system, which automatically installs and an application's dependent packages, regardless of where they come from.

The problem happens because the internal repository system doesn't seem to distinguish between private and public packages. So if your application is using a private package, and later one a public repository adds a new package with the same name, the system may end up replacing your internal package with the one from the public server. And because automatic updates are common (in order to quickly incorporate bug fixes and security patches), these replacement packages may automatically get installed into publicly accessible applications.

Well that's not right.

Fortunately, this test was from a security researcher, who promptly reported the bugs, but this could just as easily been malware.

I don't think this should be hard to fix. Internal package management systems need to distinguish between public and private packages. When a given package name exists as both a public and a private package, the system *must* always give priority to the private package. It must also alert administrators and owners of affected applications to alert them to the conflics, so appropriate action may be taken. This action may be one or more of:

• Block the public package
• Rename the private package and update all applications using it so they use the renamed package
• Allow application developers to explicitly state in their package manifests if they want to use the public or the private version

Krebs on Security: Ransomware Group Turns to Facebook Ads

Ransomware Group Turns to Facebook Ads
Brian Krebs. November 10, 2020

It’s bad enough that many ransomware gangs now have blogs where they publish data stolen from companies that refuse to make an extortion payment. Now, one crime group has started using hacked Facebook accounts to run ads publicly pressuring their ransomware victims into paying up.

Just when you thought Facebook had hit rock bottom. Now their adware network is being used for criminal extortion. And they're not even refunding the money to the victims who had their accounts hijacked in the process.

So glad I drop-kicked them to the curb many years ago.

SiliconAngle: GitLab runs phishing test against employees – and 20% handed over credentials

GitLab runs phishing test against employees – and 20% handed over credentials
by Duncan Riley. UPDATED 22:26 EDT / MAY 21 2020

There’s always a lot of talk in cybersecurity about the importance of training employees to be aware of phishing attempts. Training does work but it’s not a panacea, the reality being is that there will always be employees who get tricked even with training.

Although there are various industry estimates, code repository management firm GitLab Inc. decided to phish their own employees to see what would happen. The result was not good: One in five employees fell for the fake emails.

Sadly, this is why cybersecurity research can only go so far. When 20% of employees working for a technology site can be phished like this, no technology product can solve the problem.

I am reminded of the Beagle/Bagle worm. In 2004, this worm was spreading rapidly throughout the Internet via e-mail. When virus scanners got definitions to identify and delete it, the authors created a variation (described in the linked article) which wrote itself to an encrypted zip file, putting the password in the mail message's body. This variation continued to spread despite requiring the recipient to manually save and decrypt an attached zip file, and then run the application contained within.

If people will blindly do whatever they're told in e-mail, then they're doomed no matter what security experts say and do.

Update May 26, 2020: I updated the article to include a link to an article about the Beagle/Bagel worm. At the time I originally wrote the article, I couldn't remember its name, but I was able to do some searching and found it (in one of my own blog posts from 2005: Encryption and security: an overview).

Naked Security: Tech support scammers hacked back by vigilante

Tech support scammers hacked back by vigilante
04 Mar 2020. By John E Dunn

A UK cybercrime vigilante was so incensed by tech support scammers he reverse-hacked the call centre in India to reveal CCTV footage of perpetrators as they ripped off their victims in real-life calls.

Publicised by a BBC documentary, the hack was the work of ‘Jim Browning’ (not his real name), who has acquired a following on his YouTube channel for his campaigns to expose how these crimes work and the individuals behind them.

I can't ever endorse doing this. It's dangerous and possibly illegal. But I hope law enforcement plays nice and uses this evidence to nail these scammers to the wall.

Appleinsider: Philips Hue smart bulb allows hackers to attack your network

Philips Hue smart bulb allows hackers to attack your network
By Malcolm Owen, Wednesday, February 05, 2020, 04:50 am PT (07:50 am ET)

Owners of Philips Hue smart bulbs are being urged to check its firmware, after the publication of a vulnerability in how the accessories communicate with each other over Zigbee could allow an attacker to gain control over the whole home network.

I'm glad to see that Philips is going to be releasing a patch to close this attack vector, but this also underscores something I've been saying for a long time: IoT is not mature enough to be considered safe and reliable. Far too many smart appliances have been designed with little or no thought to security, and customers are the ones paying the price.

I love the concept of smart appliances, and I would love to have a home full of them, but there's no way I'm going to install them when there's a very real risk that doing so will allow criminals and hackers access to everything else on my LAN. I hope this tech will be secured in the future, but it certainly is not today.

Worlds first keylogger?

How the KGB Bugged American Typewriters During the Cold War
By Kyle Mizokami, Jan 1, 2020

• In the 1970s, U.S. intelligence believed the embassy in Moscow was leaking information.
• Repeated searches for a secret transmitter in the embassy turned up nothing.
• Finally, engineers discovered a typewriter with a transmitter hacked into it.

Fascinating story about how the Soviets modified an IBM Selectric typewriter to covertly transmit every keystroke to a KGB monitoring station. Electronically, this hack is a work of art.

h/t the Michael Tsai Blog

Security tip: watch out for expired DNS domains

For quite some time, my computer at work has exhibited many signs of a malware infection, but none was ever to be found.

More specifically, at random times (usually when quickly typing a URL into a web browser) I would end up on the wrong page - usually a page trying to convince me that I'm wanted by the FBI, or trying to sell black market Viagra ('scuze me, "V1@gkr4"), or other kinds of annoying spam.

Of course, when you see something like this, you immediately assume you are infected by a virus or have some kind of malware. And I did all the right things - boot from a known-good recovery disk and run all kinds of scanners. And none of them revealed anything.

So what was going on here? The answer is that I got hit by a perfect storm of coincidence.

Naked Security: Firefox 66 will silence autoplaying web audio

Firefox 66 will silence autoplaying web audio
06 Feb 2019 by John E Dunn

It’s been on the to-do list for a while, but a new blog by the company has confirmed that from Firefox 66 for desktop and Firefox for Android, due on 19 March, media autoplay of video or audio will be blocked on websites by default.

Great news and it's about flippin' time.

Read the rest of the article for more information.

Windows 10 disables ATA Secure Erase

h/t MacInTouch

For those who aren't seriously into computer technology, there are technological issues with erasing an SSD.

With a hard drive, you can use all kinds of standard disk-erase utilities to write zeros to every block. If you're paranoid about leaving magnetic after-images, there are various algorithms for writing various patterns designed to obscure any magnetic residue of old files. They take a long time, but are generally considered secure enough for all but the most sensitive data (which should only be "erased" via physical destruction of the drive.)

With an SSD, however, erasure by overwriting new data is not effective. Tehnologies like wear leveling, garbage collection and TRIM make it difficult or impossible to know if data has truly been erased. Writing zeros to a logical block of data does not necessarily overwrite the flash memory containing the old data - it is more likely that the flash memory will be marked as "garbage" for collection (which will truly erase it) at some non-deterministic time in the future. That time might be quickly, or it might not be for days or even months, depending on the SSD controller's algorithm and the drive's usage pattern.

Mind you, this "garbage" data is not accessible using any software-accessible interface (SATA, SCSI, USB, etc.) The only way to read garbage data is to install special firmware into the SSD controller or to physically remove the chips. But both options are possible for someone willing to pay a data recovery company or some other similarly capable forensics lab.

Which is where the ATA secure erase command comes into play. The ATA specification (at the heart of all ATA and SATA devices) includes a command for explicitly and securely erasing a device. When supported on an SSD, it performs a flash-level erase on every single block, ensuring that no data will be available to recover.

And now, with this background material in mind, the linked MacInTouch posting now make sense. It would appear that the act of installing Windows 8 or 10 on an SSD involves writing some data to the drive that disables the secure erase command. Why they do this may be an interesting topic for discussion, but doesn't really matter if you've got a retired drive that you want to erase.

To get around this problem, you need to get a copy of the SSD manufacturer's drive utility. You can use this utility to reset the SSD's firmware, which will re-enable the secure erase command. Unfortunately, in order for this to work, you need the drive's PSID code - this is a secure ID designed to prevent malware from bypassing security features. Fortunately, most SSDs print the PSID on the drive's label. Unfortunately, if your label is removed or damaged, you may not be able to read it and there is usually no other way to get this number.

I suppose the important lesson here is that when you install a new SSD into a computer, photograph the cover to make a record of the PSID number. If you are concerned that a hacker might get this image, print a few copies and store them in a secure location (like a file cabinet) and then erase the image file.

If all this seems like too much, there's another alternative - use whole-drive disk encryption before you copy any data to the SSD. Later on, when it's time to retire the SSD, blow away the decryption key. A simple drive-erase (without decrypting it) will do it just fine. Or if you want to make it even simpler, change the drive's password to a long string of gibberish characters (30-50 characters should do nicely) and promptly forget what they are. Anybody who gets the drive in the future will not be able to access the data without this string, and it is highly unlikely that they will ever be able to provide it. Of course, you can also delete all the files and empty-trash before changing the string, to provide an additional level of protection.

Finally, you might want to encrypt the drive anyway. This way you will be protected in case the drive controller fails, since you won't be able to perform any kind of secure erase operation at that point, but your encrypted data will not be recoverable through forensic analysis without the decryption key.

Krebs On Security: Data Breach At Oracle’s MICROS Point-of-Sale Division

Data Breach At Oracle’s MICROS Point-of-Sale Division
Brian Krebs, August 8, 2016

A Russian organized cybercrime group known for hacking into banks and retailers appears to have breached hundreds of computer systems at software giant Oracle Corp., KrebsOnSecurity has learned. More alarmingly, the attackers have compromised a customer support portal for companies using Oracle’s MICROS point-of-sale credit card payment systems.
...
MICROS is among the top three point-of-sale vendors globally. Oracle’s MICROS division sells point-of-sale systems used at more than 330,000 cash registers worldwide.
...
Oracle’s own statement seems to suggest the company is concerned that compromised credentials for customer accounts at the MICROS support portal could be used to remotely administer — and, more importantly, to upload card-stealing malware to — some customer point-of-sale systems. The term “on-premise” refers to POS devices that are physically connected to cash registers at MICROS customer stores.

Avivah Litan, a fraud analyst at Gartner Inc., says ... "I’d say there’s a big chance that the hackers in this case found a way to get remote access" to MICROS customers' on-premises point-of-sale devices.
...

This is really ugly. If criminals have managed to use the manufacturer's maintenance access to remotely install card-skimming software into point of sale terminals worldwide, then nothing is safe.

All the more reason to use a merchant's chip reader or Apple Pay wherever possible. These technologies work with device-specific account numbers, one-time pads and encryption to make it difficult (if not impossible) for a captured transaction to be used to create a fake card or initiate new transactions. (I am aware that there are many more virtual-card technologies in use but I don't know enough about them to have an opinion about their security.)

Yet another reason to never use PayPal

I have always hated eBay/PayPal corporation because of their brain-dead approach to security. I drop-kicked them to the curb over 2 years ago because they wanted me to prove my identity (simply because they didn't like the company hosting my e-mail address) using more documentation than the bank required when I got my mortgage.

Well, just in case you didn't think that mattered, security researcher Brian Krebs just reported that his account was hacked - twice in one day - by a hacker with likely ties to terrorism using nothing more than a phone call to customer support and publicly available information (like a social security number and an old credit card number.)

PayPal's official response to this was that they couldn't do anything to prevent it. But they could require Mr. Krebs to send over copies of lots of sensitive ID documents in order to try and get his account back.

It's slim comfort to know that I'm still right about how PayPal is run by a gang of mindless jerks. They make it trivially easy for a hacker to steal your account, but they make it insanely difficult for the legitimate account owner to get his access back.

Am I the only one who thinks it couldn't be worse if it was run by the criminal syndicates themselves? And based on everything I read, I'm not so sure they're not.

Read the rest of the story: 2016 Reality: Lazy Authentication Still the Norm

Krebs on Security: Chipotle Serves Up Chips, Guac & HR Email

Chipotle Serves Up Chips, Guac & HR Email
Brian Krebs, November 15, 2015

The restaurant chain Chipotle Mexican Grill seems pretty good at churning out huge numbers of huge burritos, but the company may need to revisit some basic corporate cybersecurity concepts. For starters, Chipotle’s human resources department has been replying to new job applicants using the domain "chipotlehr.com" — a Web site name that the company has never owned or controlled.

Translation: Until last week, anyone could have read email destined for the company’s HR department just by registering the domain "chipotlehr.com". Worse, Chipotle itself has inadvertently been pointing this out for months in emails to everyone who’s applied for a job via the company’s Web site.

Wow. Read on to learn the extent of their incredible ineptitude. They apparently have no problem with:

• Sending mail with a return address that nobody owns
• Sending out official HR mail with a bogus return address
• When informed that this is a security problem (and that some third party has registered the domain and is actively receiving mail intended for Chipotle HR) they still don't care because it's supposed to be a bogus return address.
• When the person who registered the domain offered to give it to them for free, they declined

You would think that somebody somewhere in their IT problem would see this as a problem, but apparently not.

Krebs links to another article from 2008 about someone who registered donotreply.com in order to capture all the mail sent to what corporations assume to be a bogus domain. Some of the mail captured has been highly sensitive business and financial information. All because a company can't be bothered to use a real mailbox (or at least their own domain) as a return address in their outbound e-mail.

If it wasn't real, it would be really funny.

Krebs On Security: Inside Target Corp., Days After 2013 Breach

Inside Target Corp., Days After 2013 Breach

In December 2013, just days after a data breach exposed 40 million customer debit and credit card accounts, Target Corp. hired security experts at Verizon to probe its networks for weaknesses. The results of that confidential investigation — until now never publicly revealed — confirm what pundits have long suspected: Once inside Target’s network, there was nothing to stop attackers from gaining direct and complete access to every single cash register in every Target store.

A great read and a great description of how not to organize the IT infrastructure of a giant retail-sales corporation.

The Intercept: TSA Doesn't Care That Its Luggage Locks Have Been Hacked

TSA Doesn't Care That Its Luggage Locks Have Been Hacked

In a spectacular failure of a "back door" designed to give law enforcement exclusive access to private places, hackers have made the "master keys" for Transportation Security Administration-recognized luggage locks available to anyone with a 3D printer.

The TSA-recognized luggage locks were a much-vaunted solution to a post-9/11 conundrum: how to let people lock their luggage, on the one hand, but let the TSA inspect it without resorting to bolt cutters, on the other.

When the locks were first introduced in 2003, TSA official Ken Lauterstein described them as part of the agency’s efforts to develop "practical solutions that contribute toward our goal of providing world-class security and world-class customer service."

Now that they’ve been hacked, however, TSA says it doesn’t really care one way or another.

This doesn't surprise me very much. I'm actually kind of surprised that it took this long for the TSA master keys to be leaked out to the Internet. It does, however, bother me that TSA's response is that since it "does not create a threat to aviation security" they don't care.