A team of researchers from China and the US have discovered a new potential attack on biometric security. Their paper titled "PrintListener: Uncovering the Vulnerability of Fingerprint Authentication via the Finger Friction Sound" describes a side-channel attack on the Automatic Fingerprint Identification System (AFIS). The attack exploits the sound characteristics of a user's finger swiping on a touchscreen to pull fingerprint pattern details.

Penn Engineers' groundbreaking new chip provides faster performance, lower energy consumption, and enhanced privacy. Since many computations can take place at the same time, sensitive information does not need to be stored in a computer's working memory, making a computer with such technology nearly unhackable. The new chip performs Artificial Intelligence (AI) computations using light waves rather than electricity, potentially resulting in significant increases in processing speed and energy efficiency. This article continues to discuss the new chip said to be virtually unhackable.

Apple recently unveiled PQ3, a new post-quantum cryptographic protocol for iMessage that is designed to protect encrypted communications even against future quantum computing attacks.  End-to-end encryption is present by default in many popular messaging applications, but the actual level of protection depends on the cryptographic protocols they use and how they are implemented.

Researchers from the University of Florida and CertiK have demonstrated a new set of attacks dubbed VoltSchemer that can inject voice commands to manipulate a smartphone's voice assistant via the magnetic field emitted by an off-the-shelf wireless charger. VoltSchemer can also be used to physically damage a mobile device or to heat items near the charger to a high temperature. The attack manipulates the charger's behavior using electromagnetic interference. The team tested nine of the world's best-selling wireless chargers, exposing security flaws in these products.

Google and Mozilla recently released Chrome and Firefox software updates to resolve multiple vulnerabilities in both browsers, including high-severity memory safety bugs. On Tuesday, Chrome 122 was released in the stable channel with patches for 12 security defects, including eight that were reported by external researchers. Two of these are high-severity flaws, the most severe of them, based on the paid bug bounty reward, being an out-of-bounds memory access bug in Blink.

A team of researchers in India developed a hybrid approach to improving the security of online applications, particularly within cloud computing. They have showed that merging two techniques, homomorphic encryption and the Squirrel Search Algorithm (SSA), significantly enhances the security of cloud computing models. Encryption is essential in protecting data from unauthorized access or breaches. The team assessed the effectiveness of their approach by measuring upload and download times, as well as encryption and decryption times.

Researchers recently discovered a fundamental design flaw in a Domain Name System (DNS) security extension that could lead to widespread Internet outages. The security vulnerability, called KeyTrap and tracked as CVE-2023-50387, was discovered by a team from the Germany-based ATHENE National Research Center for Applied Cybersecurity. According to the team, a single packet sent to a DNS server implementation using the DNSSEC extension to validate traffic could cause the server to enter a resolution loop, consuming all of its own computing power and stalling.

According to Veracode, 42 percent of applications and 71 percent of organizations have security debt, which is defined as flaws that have gone unfixed for more than a year. Forty-six percent of organizations have critical security flaws that risk confidentiality, integrity, and availability. Veracode found that 63 percent of applications have flaws in first-party code, and 70 percent have flaws in third-party code imported through third-party libraries. These findings emphasize the importance of testing both types throughout the Software Development Life Cycle (SDLC).

A representative of the Knight ransomware is selling the alleged source code for version 3.0 of the ransomware on a hacker forum. Knight ransomware, a rebrand of the Cyclops operation, was launched at the end of July 2023 and targets Windows, macOS, and Linux/ESXi systems. It gained popularity by providing infostealers and a 'lite' version of its encryptor to lower-tier affiliates targeting smaller organizations. This article continues to discuss the source code for the third iteration of the Knight ransomware being offered for sale to a single buyer on a hacker forum.

Researchers have found two malicious packages on the Python Package Index (PyPI) repository that used a technique known as DLL side-loading to avoid detection by security software and execute malicious code. The packages, NP6HelperHttptest and NP6HelperHttper, were downloaded 537 and 166 times before their takedown. According to ReversingLabs researcher Petar Kirhmajer, the latest discovery is an example of DLL side-loading carried out by an open-source package, suggesting that the scope of software supply chain threats is growing.