Seguridad informática

Esto es. La cadena de suministros no solo se refiere a al proveedor externo. Como dice Andrej:

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.
Hacer clic para expandir...

Software que utilizan las empresas (obteniendo beneficios) pero que no se hacen responsables de la securización de nada.
 
El canal veritasium denuncia y demuestra la vulnerabilidad de la combinación de VISA y IPhone que permite por contacto robar dinero sin desbloquear el teléfono y sin autorizar nada por parte del propietario. Esperemos que lo resuelvan aunque también dicen que se sabe del problema desde 2021.

 
King Conan dijo:
El canal veritasium denuncia y demuestra la vulnerabilidad de la combinación de VISA y IPhone que permite por contacto robar dinero sin desbloquear el teléfono y sin autorizar nada por parte del propietario. Esperemos que lo resuelvan aunque también dicen que se sabe del problema desde 2021.
Hacer clic para expandir...

www.macrumors.com

Here's How Researchers Stole $10,000 From MKBHD's Locked iPhone

An iPhone exploit that involves a linked Visa card can allow attackers to steal money from a locked device using NFC, but the process is complex, requiring physical access and specialized hardware. The exploit was highlighted by popular YouTube channel Veritasium, and it involves tricking an...
www.macrumors.com www.macrumors.com

Cybersecurity researchers from the University of Surrey and the University of Birmingham developed the attack to bypass an iPhone's locked status and steal funds from a mobile wallet. The exploit was first publicized in 2021, and it bypasses traditional limits on transaction size. Veritasium demonstrated the attack by collecting $10,000 from YouTuber Marques Brownlee's locked iPhone.

The attack works using an NFC card reader that intercepts the communication between an iPhone and a tap-to-pay terminal when a payment is made. The card reader is connected to a laptop that collects payment data and sends it to a separate burner phone, which is then tapped on a legitimate card reader. The NFC device has to be tuned to the same transit terminal identifier as a legitimate transit reader.

The process requires the victim to have Express Transit Mode enabled for payments, and a Visa card linked for those payments, among other steps. As it turns out, it's a Visa-related security loophole rather than an iPhone issue, and it doesn't work with a Mastercard or an American Express card because other cards use different security methods. It also doesn't work with Samsung Pay on Samsung devices, and it requires the specific combination of a Visa card and an iPhone. Apple told Veritasium that it's an issue with the Visa system, but something unlikely to occur in the real world.

This is a concern with the Visa system, but Visa does not believe this kind of fraud is likely to take place in the real world. Visa has made it clear that their cardholders are protected by Visa's zero liability policy.

Visa also told Veritasium that the exploit was very unlikely from a scaled real world setting, and any such transactions can be disputed. The researchers who shared the exploit said users can protect themselves by not using a Visa card on the iPhone for transit purposes.
 
Conéctate o regístrate para responder aquí
Atrás
Arriba Pie