Back to news

May 2, 2024 | International, Security

Popular Android Apps Like Xiaomi, WPS Office Vulnerable to File Overwrite Flaw

Popular apps like Xiaomi File Manager and WPS Office are vulnerable to a path traversal flaw that could let hackers overwrite files and execute malici

https://thehackernews.com/2024/05/popular-android-apps-like-xiaomi-wps.html

On the same subject

  • India’s first batch of Rafale fighters is on its way from France

    July 28, 2020 | International, Aerospace

    India’s first batch of Rafale fighters is on its way from France

    By: Christina Mackenzie PARIS – The first five of 36 Rafale fighter aircraft bought by India from France's Dassault Aviation are being flown from the manufacturing plant by Indian Air Force pilots to India between July 27-29. The three single-seater and two twin-seater aircraft are slated to make the trip in two stages, with air-to-air refueling during the first leg provided by a French Air Force A330 Phenix MRTT tanker. Also accompanying the Rafales is a second MRTT carrying 70 respirators, 100,000 test kits and 10 military health professionals to help India with its fight against the Covid-19 pandemic. The pilots took off from the Dassault Aviation Mérignac facility near Bordeaux in western France and will land at Ambala Air Force Station in northern India, some 125 miles north of Delhi, on July 29, according to the Indian Air Force official Twitter account. The first leg is to the Al Dhafra airbase in the United Arab Emirates where the aircraft landed on Monday afternoon. They were sent off in the presence of Shri Jawed Ashraf, the Indian ambassador to France, and Eric Trappier, CEO of Dassault Aviation, who saluted the “amazing efficiency and determination of the Indian Air Force and Indian Ministry of Defense, despite this unprecedented world health crisis” to ensure that the program remained on track. The Indian Air Force team flying the aircraft have been training in France for almost three years. The aircraft will integrate into the country's No 17 Squadron, dubbed “Golden Arrows.” https://www.defensenews.com/global/europe/2020/07/27/indias-first-batch-of-rafale-fighters-is-on-its-way-from-france/

  • Contract Awards by US Department of Defense - June 17, 2020

    June 18, 2020 | International, Aerospace, Naval, Land, C4ISR, Security

    Contract Awards by US Department of Defense - June 17, 2020

    AIR FORCE Accenture Federal Services LLC, Arlington, Virginia (FA7014-20-D-0006); Booz Allen Hamilton Inc., Arlington, Virginia (FA7014-20-D-0007); Deloitte Consulting LLP, Arlington, Virginia (FA7014-20-D-0008); Digital Mobilizations Inc., Warrenton, Virginia (FA7014-20-D-0010); KMPG LLP, McLean, Virginia (FA7014-20-D-0009); BCG Federal Corp., Bethesda, Maryland (FA7014-20-D-0005); Grant Thornton Public Sector LLC, Arlington, Virginia (FA7014-20-D-0004); and McKinsey & Co. Inc., Washington, D.C. (FA7014-20-D-0003), has been awarded a ceiling $990,000,000 multiple-award, indefinite-delivery/indefinite-quantity, firm-fixed-price contract to provide advisory and assistance services to support the Deputy Assistant Secretary of the Air Force Office of Business Transformation and Deputy Chief Management Officer in managing and improving strategic transformation initiatives at the enterprise level. Work will be performed at various locations and is expected to be completed June 16, 2027. This award is the result of a competitive acquisition and seven offers were received. Fiscal 2020 operations and maintenance funds in the amount of $500 for each contract are being obligated at the time of award. Air Force District of Washington, Joint Base Andrews, Maryland, is the contracting activity. NORTHCON Inc., Hayden, Indiana (FA4814-20-D-0005); Pro-Mark Services Inc., West Fargo, North Dakota (FA4814-20-D-0006); Danner Construction Co. Inc., Tampa, Florida (FA4814-20-D-0007); ABBA Construction Inc., Jacksonville, Florida (FA4814-20-D-0008); Bay Area Building Solutions, Tampa, Florida (FA4814-20-D-0009); HCR Construction Inc., Norcross, Georgia (FA4814-20-D-0010); OAC Action Construction Corp., Miami, Florida (FA4814-20-D-0011); Frazier Engineering, Melbourne, Florida (FA4814-20-D-0012); Benaka Inc., New Brunswick, New Jersey (FA4814-20-D-0013); RELYANT Global LLC, Maryville, Tennessee (FA4814-20-D-0014); Polu Kai Services LLC, Falls Church, Virginia (FA4814-20-D-0015); Nisou LGC JV LLC, Detroit, Michigan (FA4814-20-D-0016); KMK Construction Inc., Jacksonville, Florida (FA4814-20-D-0017); Burgos Group LLC, Medford, New Jersey (FA4814-20-D-0018); A&H-Ambica JV LLC, Livonia, Michigan (FA4814-20-D-0019); P&S Construction Inc., Chelmsfor, Massachusetts (FA4814-20-D-0020); Northstar Contracting Inc., Cleveland, Ohio (FA4814-20-D-0021); ESA South Inc., Cantonment, Florida (FA4814-D-20-0022); and RUSH Construction Inc., Titusville, Florida (FA4814-D-20-0023), have been awarded a $500,000,000 indefinite-delivery/indefinite-quantity contract for execution of a broad range of maintenance, repair and minor construction projects affecting real property at MacDill Air Force Base, Florida; and Avon Park Air Force Range, Florida. Work is expected to be completed June 16, 2027. Fiscal 2020 operations and maintenance funds in the amount of $9,500 will be obligated at the time of award. The 6th Contracting Squadron, Tampa, Florida, is the contracting activity. Northrop Grumman Systems Corp., Linthicum Heights, Maryland, has been awarded an $18,733,197 firm-fixed-price, cost-plus-fixed-fee modification (P00026) to contract FA8615-17-C-6047 for active electronically scanned array radars of Air Force F-16 aircraft. The contract modification is for definitization of the radio frequency target generator, additional support equipment and software development to support Phase Two. Work will be performed in Linthicum Heights, Maryland, and is expected to be completed by April 2023. Fiscal 2018 aircraft procurement funds in the amount of $3,510,172; and fiscal 2020 research, development, test and evaluation funds in the amount of $10,103,436 are being obligated at the time of award. Total cumulative face value of the contract is $1,027,044,025. Air Force Life Cycle Management Center, Wright-Patterson Air Force Base, Ohio, is the contracting activity. NAVY Huntington Ingalls Industries, Pascagoula, Mississippi, is awarded $145,598,728 for a not-to-exceed, undefinitized contract action for long lead time material in support of one Amphibious Assault Ship (General Purpose) Replacement (LHA(R)) and Flight 1 Ship (LHA 9). Work will be performed in Milwaukee, Wisconsin (42%); Baltimore, Maryland (24%); Pascagoula, Mississippi (17%); Cranberry Township, Pennsylvania (10%); Fairfield, Ohio (6%); and Warminster, Pennsylvania (1%). Work to be performed is the procurement of long lead-time material for LHA 9, the fourth (LHA(R)) America Class and the second LHA(R) Flight 1 variant. Work is expected to be complete by February 2024. Fiscal 2019 shipbuilding and conversion (Navy) advance procurement funding in the amount of $145,598,728 will be obligated at award and will not expire at the end of the current fiscal year. In accordance with 10 U.S. Code 2304(c)(1), this contract was not competitively procured with only one responsible source. No other supplies or services will satisfy agency requirements. The Naval Sea Systems Command, Washington, D.C., is the contracting activity (N00024-20-C-2437). Barnhart-Reese Construction Inc.,* San Diego, California (N62473-17-D-4635); Bristol Design Build Services LLC,* Anchorage, Alaska (N62473-17-D-4636); I.E.-Pacific Inc.,* Escondido, California (N62473-17-D-4637); and R.A. Burch Construction Co. Inc.,* Ramona, California (N62473-17-D-4638), are awarded $92,000,000 to increase the aggregate capacity of the previously awarded suite of firm-fixed-price, indefinite-delivery/indefinite-quantity, multiple award construction contracts. The maximum dollar value, including the base year and four option years for all four contracts combined, has increased from $99,000,000 to $191,000,000. The contracts are for new construction, renovation and repair, primarily by design-build or secondarily by design-bid-build, of general building construction at various federal sites and government installation locations within the Naval Facilities Engineering Command (NAVFAC) Southwest area of operations. Work will be performed in various locations, including but not limited to, California (90%); Arizona (6%); Nevada (1%); Utah (1%); Colorado (1%); and New Mexico (1%). No funds are being obligated on this award, and no funds will expire. Future task orders will be primarily funded by military construction (Navy); operations and maintenance (O&M), Navy; O&M, Marine Corps; and Navy working capital funds. The original contract was competitively procured via the Navy Electronic Commerce Online website. The NAVFAC Southwest, San Diego, California, is the contracting activity. L3 Technologies Inc. KEO, Northampton, Massachusetts, is awarded a $17,275,863 firm-fixed-price modification to previously awarded contract N00024-15-C-6250 for options to procure spare parts for the photonics mast program. Work will be performed in Northampton, Massachusetts, and is expected to be complete by February 2022. Fiscal 2020 other procurement (Navy) funding in the amount of $2,831,502 will be obligated at time of award. Funds will not expire at the end of the current fiscal year. The Naval Sea Systems Command, Washington, D.C., is the contracting activity. Epsilon Systems Solutions Inc.,* San Diego, California, is awarded a $17,175,335 cost-plus-fixed-fee contract for Southwest Regional Maintenance Center (SWRMC) support services. Work will be performed in San Diego, California. The SWRMC production department Code 900 is responsible for providing intermediate-level (I-Level) maintenance and repair support and selective maintenance training to over 100 surface ships, submarines, shore activities and other commands of the U.S. Pacific Fleet. SWRMC Production Department is broken into four product families, and each contains multiple product lines and shops. The SWRMC production department product families currently consist of corrosion control products, engine products, machine products and combat systems product family. Within the SWRMC production department, there are also production control division, I-Level planning division and an off-site facility. Work is expected to be complete by September 2021. This contract includes options which, if exercised, would bring the cumulative value of this contract to $106,240,249. Fiscal 2020 operations and maintenance (Navy) funding in the amount of $1,431,278 will be obligated at the time of award, and will expire at the end of the current fiscal year. This contract was competitively procured via the Federal Business Opportunities website, and four offers were received. The Southwest Regional Maintenance Center, San Diego, California, is the contracting activity (N55236-20-C-0003). Lockheed Martin Aeronautics Co., Fort Worth, Texas, is awarded a $16,026,098 modification (P00001) to cost-plus-fixed-fee order N00019-20-F-0817 against previously issued basic ordering agreement N00019-19-G-0008. This order procures support to manage diminishing manufacturing sources in support of the F-35 Program for the Air Force, Navy and non-Department of Defense (DOD) participants. Work will be performed in Fort Worth, Texas, and is expected to be complete by June 2021. Fiscal 2018 aircraft procurement (Air Force) funds in the amount of $6,586,406; fiscal 2020 aircraft procurement (Navy) funds in the amount of $6,586,406; and non-DOD participant funds in the amount of $2,853,286 will be obligated at time of award, of which $6,586,406 will expire at the end of the current fiscal year. The Naval Air Systems Command, Patuxent River, Maryland, is the contracting activity. Phillips Corp., Hanover, Maryland, is awarded a $12,790,000 fixed-price, indefinite-delivery/indefinite-quantity contract. This contract procures equipment related services necessary for the inspection, evaluation, repair, upgrade, training and rebuild for the sustainment of industrial plant equipment that is required to adequately support overhauling and repairing fleet aircraft, engines and components in support of the Commander Fleet Readiness Centers. Work will be performed in North Island, California (50%); Cherry Point, North Carolina (35%); and Jacksonville, Florida (15%), and is expected to be complete by June 2023. No funds will be obligated at the time of award. Funds will be obligated on individual orders as they are issued. This contract was not competitively procured, pursuant to Federal Acquisition Regulation 6.302-1. The Naval Air Warfare Center Aircraft Division, Lakehurst, New Jersey, is the contracting activity (N68335-20-D-0017). DEFENSE LOGISTICS AGENCY Federal Prison Industries Inc., Washington, D.C., has been awarded a maximum $17,548,000 modification (P00007) exercising the first one-year option period of one-year base contract SPE1C1-19-D-F027 with four one-year option periods for coveralls. This is a firm-fixed-price, indefinite-delivery/indefinite-quantity contract. Locations of performance are Georgia, Arizona, Washington, D.C., and Mississippi, with a June 20, 2021, ordering period end date. Using military service is Navy. Type of appropriation is fiscal 2020 through 2021 defense working capital funds. The contracting activity is the Defense Logistics Agency Troop Support, Philadelphia, Pennsylvania. The Entwistle Co., Hudson, Massachusetts, has been awarded a maximum $8,135,400 firm-fixed-price contract for air launch and recovery equipment shuttle assemblies. This was a sole-source acquisition using justification 10 U.S. Code 2304 (c)(1), as stated in Federal Acquisition Regulation 6.302-1. This is a 42-month contract with no option periods. Location of performance is Massachusetts, with a Dec. 31, 2023, performance completion date. Using military service is Navy. Type of appropriation is fiscal 2020 Navy working capital funds. The contracting activity is the Defense Logistics Agency Aviation, Philadelphia, Pennsylvania (SPRPA1-20-C-Z043). DEFENSE ADVANCED RESEARCH PROJECTS AGENCY PAR Government Systems Corp., Rome, New York, was awarded an $11,920,160 cost-plus-fixed-fee contract for a research project under the Semantic Forensics (SemaFor) program. The SemaFor program will develop methods that exploit semantic inconsistencies in falsified media to perform tasks across media modalities and at scale. Work will be performed in Rome, New York, with an expected completion date of June 2024. Fiscal 2020 research, development, test and evaluation funding in the amount of $1,500,000 are being obligated at time of award. This contract was a competitive acquisition under a full and open broad agency announcement and 37 proposals were received. The Defense Advanced Research Projects Agency, Arlington, Virginia, is the contracting activity (HR0011-20-C-0126). ARMY ControlPoint Surveying Inc.,* Honolulu, Hawaii (W9128A-20-D-0002); Masa Fujioka & Associates,* Aiea, Hawaii (W9128A-20-D-0003); and Sam O. Hirota Inc.,* Honolulu, Hawaii (W9128A-20-D-0004), will compete for each order of the $9,900,000 firm-fixed-price contract for indefinite-delivery architect-engineer services for miscellaneous projects in the Pacific region. Bids were solicited via the internet with four received. Work locations and funding will be determined with each order, with an estimated completion date of June 16, 2025. U.S. Army Corps of Engineers Honolulu, Hawaii, is the contracting activity. Honeywell International Inc., Phoenix, Arizona, was awarded a $7,738,247 modification (P00101) to contract W56HZV-12-C-0344 for hardware and services exercise of options for the Total Integrated Engine Revitalization Automated Gas Turbine 1500 program for the Abrams tank and family of vehicles. Work will be performed in Phoenix, Arizona, with an estimated completion date of Dec. 31, 2020. Fiscal 2020 Army working capital funds; and weapons and tracked combat vehicle procurement (Army) funds in the amount of $7,738,247 were obligated at the time of the award. U.S. Army Contracting Command, Detroit Arsenal, Michigan, is the contracting activity. *Small Business https://www.defense.gov/Newsroom/Contracts/Contract/Article/2223800/source/GovDelivery/

  • The Cybersecurity 202: Hackers just found serious vulnerabilities in a U.S. military fighter jet

    August 19, 2019 | International, Aerospace

    The Cybersecurity 202: Hackers just found serious vulnerabilities in a U.S. military fighter jet

    By Joseph Marks LAS VEGAS — In a Cosmopolitan hotel suite 16 stories above the Def Con cybersecurity conference this weekend, a team of highly vetted hackers tried to sabotage a vital flight system for a U.S. military fighter jet. And they succeeded. It was the first time outside researchers were allowed physical access to the critical F-15 system to search for weaknesses. And after two long days, the seven hackers found a mother lode of vulnerabilities that — if exploited in real life — could have completely shut down the Trusted Aircraft Information Download Station, which collects reams of data from video cameras and sensors while the jet is in flight. They even found bugs that the Air Force had tried but failed to fix after the same group of hackers performed similar tests in November without actually touching the device. “They were able to get back in through the back doors they already knew were open,” Will Roper, the Air Force's top acquisition official, told me in an exclusive briefing of the results. The hackers lobbed a variety of attacks — including injecting the system with malware and even going at it with pliers and screwdrivers. When I saw it, the metal box that's usually secure on the aircraft had wires hanging out the front. The hackers briefed Roper on the findings on Saturday afternoon. He was surrounded by discarded pizza boxes, iced coffee drinks — and the hotel's drinking glasses filled with screws, nuts and bolts removed from five fully dismantled TADS devices, which run about $20,000 a pop. He'd expected the results to be about this bad, Roper told me on a private tour of the hacking event. He pinned the weaknesses on decades of neglect of cybersecurity as a key issue in developing its products, as the Air Force prioritized time, cost and efficiency. He's trying to turn that around, and is hopeful about the results of the U.S. government's newfound openness to ethical hackers. He'd come straight from Def Con's first-ever Aviation Village, which the Air Force helped establish, and was wearing a gray T-shirt with the words “No, Mr. Bond, I expect you to hack,” emblazoned on the front — a riff on a classic line from the 1964 James Bond film “Goldfinger.” This is a drastic change from previous years, when the military would not allow hackers to try to search for vulnerabilities in extremely sensitive equipment, let alone take a literal whack at it. But the Air Force is convinced that unless it allows America's best hackers to search out all the digital vulnerabilities in its planes and weapons systems, then the best hackers from adversaries such as Russia, Iran and North Korea will find and exploit those vulnerabilities first, Roper told me. “There are millions of lines of code that are in all of our aircraft and if there's one of them that's flawed, then a country that can't build a fighter to shoot down that aircraft might take it out with just a few keystrokes,” he said. Roper wants to put his military hardware where his mouth is. During next year's Def Con conference, he wants to bring vetted hackers to Nellis or Creech Air Force bases near Las Vegas where they can probe for bugs on every digital system in a military plane, including for ways that bugs in one system can allow hackers to exploit other systems until they've gained effective control of the entire plane. He also wants to open up the ground control system for an operational military satellite for hacker testing, he said. “We want to bring this community to bear on real weapons systems and real airplanes,” Roper told me. “And if they have vulnerabilities, it would be best to find them before we go into conflict.” Those hacking challenges will also be useful for the private sector because military planes and satellites share many of their computer systems with the commercial versions of those products, Roper said, and the Air Force can share its findings. The seven hackers probing the TADS devices were all brought to Vegas by the cybersecurity company Synack, which sells the Pentagon third-party vulnerability testing services, under a contract with the Defense Digital Service, a team of mostly private-sector technology stars who try to solve some of the Pentagon's thorniest technology problems during short-term tours. The Defense Digital Service started by organizing large-scale hacking competitions in 2016, with names such as “Hack the Pentagon” and, eventually, “Hack the Air Force.” These were open to almost anybody — but included only public-facing hacking targets such as military service websites and apps. Shortly after, they also began opening more sensitive systems to a smaller number of vetted hackers who sign nondisclosure agreements. DDS has run about a dozen of those more sensitive hacking competitions so far, but this is the first time it has offered up the same system for hacking twice, said Brett Goldstein, DDS's director, who earned a reputation in technology as Open Table's IT director and chief data officer for the city of Chicago. “That's important because security is a continuous process,” he told me. “You can't do an exercise and say, ‘Oh, we found everything' and check the box. You need to constantly go back and reevaluate.” They also allowed the hackers to be more aggressive this time and to physically disassemble the TADS systems to get a better idea of what kinds of digital attacks might be effective, Goldstein said. That meant the hackers could simulate a cyberattack from adversaries that had infiltrated the vast network of suppliers that make TADS components and had sophisticated knowledge about how to compromise those elements. They could also advise the Air Force about flaws in how the TADS hardware was built that make it more susceptible to digital attacks. Moving forward, Roper told me, he wants to start using that knowledge to mandate that Air Force vendors build better software and hardware security controls into their planes and weapons systems upfront so the Air Force doesn't have to do so much cybersecurity work on the back end. He's up against an arcane and byzantine military contracting process, however, that's going to make those sorts of fundamental reforms extremely difficult, he acknowledged. In some cases, the company that built an Air Force system owns the software embedded in that system and won't let the Air Force open it up for outside testing, he says. In other cases, the Air Force is stuck with legacy IT systems that are so out of date that it's difficult for even the best technologists to make them more secure. “It's difficult to do this going backward, but we're doing our best,” Roper told me. “I can't underscore enough, we just got into the batter's box for what's going to be a long baseball game.” https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2019/08/14/the-cybersecurity-202-hackers-just-found-serious-vulnerabilities-in-a-u-s-military-fighter-jet/5d53111988e0fa79e5481f68/

All news