Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
'MouseJack' Attack Bites Non-Bluetooth Wireless Mice
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/25/2016 | 12:55:32 AM
Thought experiment
I'm curious to see when/if there will be a response by states with strong privacy system/data protection laws like Massachusetts amending their regulations to govern behavior not just of companies that actively store resident PII but also vendors that substantially participate in their respective jurisdictions.

Such regulation could have huge ramifications.  The problem, however, is that it would be difficult to enforce without the guidance in crafting the regulations by top InfoSec and data-protection experts.

And, unfortunately, few InfoSec people are also lawyers -- and lawyers are usually the ones drafting these things.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/24/2016 | 2:24:19 PM
Encryption is not optional
As article mentioned main issue is unscripted communication, solution is easy encrypt it. There should not be any unscripted communication between two devices in this word.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/24/2016 | 2:23:47 PM
Re: Unencrypted
Additional cost and performance is my guess. There is always cost of decryption when you do encryption.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/24/2016 | 2:22:04 PM
Re: Unencrypted
One thing I could guess, old legacy devices would not be talk to the new devices if they utilize a new encryption.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/24/2016 | 2:19:26 PM
Vulnerability vs. attacks
 

We may be taking things too far from time to time. Not all vulnerabilities will be exploited easily. It would be perfect if do not have a vulnerability but not all vulnerabilities will be resulting into attacks.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
2/23/2016 | 3:10:18 PM
Re: Unencrypted
No one knows for sure why they didn't encrypt here--maybe a shortcut, maybe cost, etc.--but it just goes to show that even the benign things like a wireless mouse can be exploited. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/23/2016 | 3:05:53 PM
Unencrypted
Is there any justifiable reason as to why any communication/data transmission should be unecrypted nowadays?
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/23/2016 | 10:10:06 AM
Re: Broken Link
Thanks for letting us know. Link is working now!
dritchie
50%
50%
dritchie,
User Rank: Strategist
2/23/2016 | 9:46:15 AM
Broken Link
Link to "list of Vendors" is broken (https://www.darkreading.com/admin http://www.mousejack.com).

Trying to use just the www.mousejack.com sends to a Login Page with no ability to register or anything.

 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8291
PUBLISHED: 2021-10-18
A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks.
CVE-2021-21796
PUBLISHED: 2021-10-18
An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause an object containing the path to a document to be destroyed and then later reused, resulting in a use-after-free vulnerability, which can lead to code executio...
CVE-2021-21797
PUBLISHED: 2021-10-18
An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a reference to a timeout object to be stored in two different places. When closed, the document will result in the reference being released twice. This can lead t...
CVE-2021-22942
PUBLISHED: 2021-10-18
A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.
CVE-2021-22961
PUBLISHED: 2021-10-18
A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary code execution from a file in the user path on first execution.