Drone threats, PixieFail firmware, HIBP dataset: a data adventure

The FBI and CISA have issued new guidance regarding the potential risks posed by Chinese-made drones to critical infrastructure. The guidance advises companies to ensure that their drones are using up-to-date patches and to treat drones as IoT devices, siloing their network traffic and performing regular log analysis. Researchers have also discovered nine vulnerabilities in the open source UEFI specification TianoCore EDK II that could be used to download malicious firmware to a server by capturing local traffic. On a different note, the leak alert site Have I Been Pwned has added a “statistically significant” dataset to its listings, containing over 70 million unique email addresses with associated plaintext passwords. Additionally, Trail of Bits has reported on vulnerabilities in GPUs that could enable attackers to exfiltrate memory data, warning of a significant potential risk. The Internet Watch Foundation has found that the majority of child sexual abuse imagery is now self-generated rather than being reshared content. However, the IWF has taken this as an opportunity to advocate against end-to-end encryption in the UK, arguing that better detection is the reason behind the increase.