uTalk

According to Ireland's Data Protection Commission (DPC), Instagram Threads, Meta's upcoming Twitter rival, won't be made available in the EU due to privacy concerns.

The Irish Independent reported the development and stated that the watchdog had spoken with the social media behemoth about the new product and received confirmation that the release would not include the E.
U.
"as of this moment. ".

Beginning on July 6, 2023, Threads will be Meta's response to Twitter. According to its description, it's a "text-based conversation app" that lets Instagram users "discuss everything from the topics you care about today to what'll be trending tomorrow.". ".

Users can also continue following the accounts they already follow on Instagram. Despite not yet being accessible for download, the app already has a listing in the Google Play Store and Apple App Store.

According to the App Store's "App Privacy" section, the app is anticipated to gather a variety of user data, including Health and Fitness, Purchases, Financial Info, Location, Contact Info, Contacts, User Content, Search History, Browsing History, Identifiers, Usage Data, Sensitive Info, and Diagnostics.

Although the DPC isn't actively preventing Threads from going live, it's thought that Meta is proceeding cautiously to bring the service to the area, which has strict privacy protections. It's important to remember that Google delayed the release of Bard in the E, its artificial intelligence chatbot.
U.
because they are related.

The change takes place at the same time as a number of policy changes at Twitter, which started preventing unregistered users from using the website and implemented temporary rate limits for logged-in users to limit the number of posts they can view per day.

The Elon Musk-owned business announced that it is taking action to "detect and eliminate bots and other bad actors that are harming the platform" by "scraping people's public Twitter data to build AI models" and "manipulating people and conversation on the platform in various ways.

The Node.js npm registry. The JavaScript runtime environment is vulnerable to a type of attack known as a manifest confusion attack, which could allow threat actors to cloak malware in project dependencies or run arbitrary scripts during installation.

An ex-GitHub and npm engineering manager named Darcy Clarke stated in a technical article posted last week that "A npm package's manifest is published independently from its tarball.". "Manifests are never completely checked against the contents of the tarball. ".

In general, Clarke continued, "the ecosystem has assumed the contents of the manifest and tarball are consistent.".

The manifest and package metadata are not cross-referenced against one another, which is the root cause of the issue. This results in unexpected behavior and misuse when there is a mismatch.

As a result, a threat actor could use this flaw to publish a module with a manifest file (package). Run install scripts and download files (such as json) that have hidden dependencies, which could lead to a supply chain attack and the contamination of a developer's environment.

Ax Sharma, a researcher and journalist for Sonatype, noted that "Manifest confusion becomes problematic in development environments without effective DevSecOps workflows and tooling in place, especially when applications blindly trust application manifests rather than the actual (vulnerable or malicious) files contained within open source packages.".

The discovery highlights the fact that users must take precautions to scan packages for any unusual features and exploits and emphasizes the fact that package manifest files' metadata alone cannot be relied upon when downloading a package from the open-source repository.

Attack with Manifest Confusion.

Clarke claims that GitHub has been aware of the issue since at least early November 2022 and that, as of March 2023, the Microsoft subsidiary plans to internally address it. However, no solution has been found for the problem as of yet.

Security researcher Felix Pankratz has made a Python script that can be used to check for discrepancies between the manifests in npm modules available in the absence of an official fix.

The development also comes after developer security company Snyk, working with Redhunt Labs, looked at 11,900 repositories from the top 1,000 GitHub organizations for insecure dependencies. They found 1,229,601 flaws in 15,584 vulnerable dependency files.

With a staggering 130,831 occurrences in Java repositories, de-serialization of untrusted data was the most common vulnerability type, accounting for 40% of all vulnerabilities found, according to the study.

Prototype pollution emerged as the biggest flaw in JavaScript-based projects with 343,332 occurrences. With 19,652 and 56,331 instances, respectively, denial-of-service (DoS) flaws were the biggest contributors in Python and Ruby projects.

Security researchers Umair Nehri and Vandana Verma Sehgal asserted that the risk of weak dependencies impairing the security of software supply chains "is here to stay.". "Therefore, developers must exercise caution when choosing the dependencies they incorporate into their projects and maintain them so that any known vulnerabilities are patched. ".

The critical security flaw CVE-2023-27997, which affects Fortinet devices and has been actively exploited in the wild, is still present in no less than 330000 FortiGate firewalls and leaves them open to attack.

According to a report released by the cybersecurity company Bishop Fox last week, out of the nearly 490,000 Fortinet SSL-VPN interfaces that are exposed online, about 69 percent are still unpatched.

In addition to being known as XORtigate, CVE-2023-27997 (CVSS score: 9.8) affects Fortinet FortiOS and FortiProxy SSL-VPN appliances and could allow a remote attacker to execute arbitrary code or commands through carefully crafted requests.

Last month, Fortinet released patches for versions 6.0. 17, 6.2. 15, 6.4. 13, 7.0. 12 and 7 point two. 5, but the business acknowledged that it may have been "exploited in a limited number of cases" in attacks against the manufacturing, critical infrastructure, and government sectors.

Further investigation by Bishop Fox revealed that 153,414 of the discovered appliances had been upgraded to a patched FortiOS version.

A significant finding was that many of the Fortinet devices that were available to the general public were still running versions 5 and 6 of FortiOS, which had not been updated in the previous eight years.

It's critical that users act quickly to update to the newest version as soon as possible given that security flaws in Fortinet devices have historically been lucrative attack vectors.

The Spanish National Police (Polica Nacional) received assistance from Europol in dismantling a criminal organization that was smuggling Syrian migrants into the EU. The investigation also included participation from French, German, and Norwegian law enforcement agencies.

The investigation found that the criminal organization, which may have been operating since 2017, was engaged in a number of illegal activities, such as the smuggling of migrants and the trafficking of drugs and weapons. The criminal network, which was well-established in a number of EU and Middle Eastern nations, used an unusually convoluted and expensive route to smuggle irregular migrants from Syria into the EU; after leaving Syria, they were transported via Sudan or the UAE to Libya. Before traveling through the Mediterranean to reach Europe, they were transported from Libya to Algeria.

The suspects assisted their unauthorized crossing of the Western Mediterranean for the last leg of their journey into Spain. Typically, Syrian nationals are transported illegally from Turkey to Greece via the Eastern Mediterranean. Despite the fact that some undocumented immigrants chose to remain in Spain, the majority of them ended up in France, Belgium, Germany, or Norway after they managed to reach Spanish soil.

What happened on the action day was.

13 places were investigated.

arrests of 15 people.

Among the items seized are two speedboats, six vehicles, electronic equipment (laptops, a tablet, a GPS, storage devices), drugs, fuel, 42 cell phones, two satellite phones, over EUR 500 000 in cash, and documents.
Nine different countries were covered by the network.
The criminal organization, which was headed by a suspect from Syria, profited from the extensive infrastructure present in the nations along the route, particularly in Lebanon, Sudan, Libya, and Algeria. The suspects planned the migration of at least 200 people through the infrequently used route from Syria through Sudan or the United Arab Emirates. The migrants were transferred from Libya to Algeria through the use of dishonest officials, who then helped arrange the passage of the migrants on fast boats to Spain. Members of the criminal organization with bases in Belgium, Germany, and Spain organized the sea crossings and facilitated the secondary movements to the target nations. For the trip, the suspects charged each passenger between EUR 7,000 and EUR 20,000.

The entire journey's logistical support was provided by the criminal network, including travel, visa requirements in some countries, airline tickets, and lodging along the way. A transfer from the arrival point on the Spanish mainland and lodging in Spain were among the extras offered by the "VIP service," which can cost up to EUR 20 000. To ensure that its unlawful operations were successful, the criminal network put in place strict security measures. The suspects had set up physical and electronic watchpoints at a number of covert locations along the coast where the undocumented migrants were supposed to be brought.

An essential part of the investigation is the exchange of information.
Information exchange was facilitated, operational coordination was provided, and analytical support was given by Europol. Throughout this 365-day investigation, a number of operational meetings were scheduled. In order to facilitate the real-time information exchange and cross-check operational information against Europol's databases in order to provide leads to investigators in the field, Europol sent teams of investigators and the lead analyst to Spain during the action week. The Spanish authorities were given extensive forensic assistance by Europol to analyze the fresh data gathered during the operational actions after the actions.

The Information Clearing House, which was established to improve the intelligence picture on organized migrant smuggling from source and transit countries, served as the foundation for a significant portion of the operational analysis. In the world of migrant smuggling, new trends and operating procedures have been identified as a result of the exchange of criminal intelligence. Investigators from national authorities receive valuable investigation leads on the scope of the criminal activity and the extensive geographic reach of such criminal network from the exchange of intelligence related to such trends and smuggling incidents discovered en route.