Microsoft has released patches to fix zero-day vulnerabilities in two popular open source libraries that affect several Microsoft products, including Skype, Teams and its Edge browser. But Microsoft won’t say if those zero-days were exploited to target its products, or if the company knows either way. From a report: The two vulnerabilities — known as zero-days because developers had no advance notice to fix the bugs — were discovered last month, and both bugs have been actively exploited to target individuals with spyware, according to researchers at Google and Citizen Lab. The bugs were discovered in two common open source libraries, webp and libvpx, which are widely integrated into browsers, apps and phones to process images and videos. The ubiquity of these libraries coupled with a warning from security researchers that the bugs were abused to plant spyware prompted a rush by tech companies, phone makers and app developers to update the vulnerable libraries in their products.

In a brief statement Monday, Microsoft said it had rolled out fixes addressing the two vulnerabilities in the webp and libvpx libraries which it had integrated into its products, and acknowledged that exploits exist for both vulnerabilities. When reached for comment, a Microsoft spokesperson declined to say if its products had been exploited in the wild, or if the company has the ability to know. Security researchers at Citizen Lab said in early September that they had discovered evidence that NSO Group customers, using the company’s Pegasus spyware, had exploited a vulnerability found in the software of an up-to-date and fully patched iPhone.

Read more of this story at Slashdot.

Source: Slashdot – Microsoft Won’t Say If Its Products Were Exploited By Spyware Zero-Days

A parallel acquisition system — buying needed apps by monthly or yearly subscription to meet changing mission requirements — could improve deterrence by complicating an enemy’s war planning, Lockheed Martin’s top executive suggested Wednesday. From a report: Jim Taiclet, Lockheed’s CEO, said the idea behind this approach is similar to allowing a customer to buy a 5G phone in Seoul and have it operate with new applications as needed in Washington. Although “digital insertion” in this manner “hasn’t caught on yet” inside the Pentagon, across the tech industry or the broad industrial base, Taiclet said it has the potential “to move that deterrence goal post every three to six months.”

Traditionally, the Defense Department and defense industry think in big contracts for platforms that take years to design, build and manufacture and service. Taiclet, however, sees large defense contractors such as Lockheed Martin as a bridge from the subscription-based tech sector to the big-contract Pentagon acquisition process. “We have to get our expertise together.” He added this approach “is starting to get some traction” among large investors in the tech sector.

Read more of this story at Slashdot.

Source: Slashdot – Lockheed CEO Pitches Pentagon on Subscription Software

samleecole writes: Tickets for rapper Travis Scott’s upcoming tour sold out fast. Check StubHub right now, however, and you can find thousands of tickets to “sold out” shows in many cities for between $10 and $20, far below the face value for his cheapest tickets at $61.50 before fees when they first went on sale. In ticket reseller lingo, Scott’s tour is a “bloodbath,” the result of overzealous brokers and noobs “overbuying” tickets based on a miscalculation of the likely value of his tickets on the secondary market. Many brokers now stand to lose a lot of money on Scott’s shows. At least part of this buying frenzy was fueled by a bet placed by PFS Buyers Club, a credit card maxing site I wrote about earlier this week that has recently pivoted from buying rare coins to buying concert tickets. PFS told its members to buy as many tickets to Scott’s shows as possible, according to emails viewed by 404 Media.

PFS itself stands to lose more than $1 million on Travis Scott alone when all is said and done, it told members. The entire situation, which has become a complicated mess, sheds light on a little-known segment of the ticket broker industry, where resellers partner with credit card “buyers clubs” to obtain tickets. The fiasco also highlights the risks associated with ticket reselling and shows how Ticketmaster profits from the secondary market, helping it sell out artists even before their ability to sell out venues is guaranteed, and passing that risk on to resellers.

Read more of this story at Slashdot.

Source: Slashdot – Low Demand For Travis Scott Creates Liquidity Crisis In Ticket Reselling Economy