Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
'MouseJack' Attack Bites Non-Bluetooth Wireless Mice
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
2/25/2016 | 12:55:32 AM
Thought experiment
I'm curious to see when/if there will be a response by states with strong privacy system/data protection laws like Massachusetts amending their regulations to govern behavior not just of companies that actively store resident PII but also vendors that substantially participate in their respective jurisdictions.

Such regulation could have huge ramifications.  The problem, however, is that it would be difficult to enforce without the guidance in crafting the regulations by top InfoSec and data-protection experts.

And, unfortunately, few InfoSec people are also lawyers -- and lawyers are usually the ones drafting these things.
Dr.T
Dr.T,
User Rank: Ninja
2/24/2016 | 2:24:19 PM
Encryption is not optional
As article mentioned main issue is unscripted communication, solution is easy encrypt it. There should not be any unscripted communication between two devices in this word.
Dr.T
Dr.T,
User Rank: Ninja
2/24/2016 | 2:23:47 PM
Re: Unencrypted
Additional cost and performance is my guess. There is always cost of decryption when you do encryption.
Dr.T
Dr.T,
User Rank: Ninja
2/24/2016 | 2:22:04 PM
Re: Unencrypted
One thing I could guess, old legacy devices would not be talk to the new devices if they utilize a new encryption.
Dr.T
Dr.T,
User Rank: Ninja
2/24/2016 | 2:19:26 PM
Vulnerability vs. attacks
 

We may be taking things too far from time to time. Not all vulnerabilities will be exploited easily. It would be perfect if do not have a vulnerability but not all vulnerabilities will be resulting into attacks.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
2/23/2016 | 3:10:18 PM
Re: Unencrypted
No one knows for sure why they didn't encrypt here--maybe a shortcut, maybe cost, etc.--but it just goes to show that even the benign things like a wireless mouse can be exploited. 
RyanSepe
RyanSepe,
User Rank: Ninja
2/23/2016 | 3:05:53 PM
Unencrypted
Is there any justifiable reason as to why any communication/data transmission should be unecrypted nowadays?
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/23/2016 | 10:10:06 AM
Re: Broken Link
Thanks for letting us know. Link is working now!
dritchie
dritchie,
User Rank: Strategist
2/23/2016 | 9:46:15 AM
Broken Link
Link to "list of Vendors" is broken (https://www.darkreading.com/admin http://www.mousejack.com).

Trying to use just the www.mousejack.com sends to a Login Page with no ability to register or anything.

 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-0658
PUBLISHED: 2023-02-03
A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The ide...
CVE-2022-38389
PUBLISHED: 2023-02-03
IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233975.
CVE-2022-22486
PUBLISHED: 2023-02-03
IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226328.
CVE-2023-0634
PUBLISHED: 2023-02-02
An uncontrolled process operation was found in the newgrp command provided by the shadow-utils package. This issue could cause the execution of arbitrary code provided by a user when running the newgrp command.
CVE-2022-48114
PUBLISHED: 2023-02-02
RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.