News Analysis India

Tag: CERT-In

  • CERT-In Finds Multiple Bugs In Microsoft Edge, Advises Users To Update |

    New Delhi: The Indian Computer Emergency Response Team (CERT-In), which comes under the Ministry of Electronics and Information Technology, on Monday, warned users of multiple vulnerabilities in Microsoft Edge (Chromium-based) which could allow an attacker to compromise the targeted system.

    The affected software includes Microsoft Edge Stable versions prior to 126.0.2592.68. “Multiple vulnerabilities have been reported in Microsoft Edge (Chromium-based) which could allow an attacker to compromise the targeted system,” said the CERT-In advisory.

    According to the cyber agency, these vulnerabilities exist in Microsoft Edge (Chromium-based) due to “type confusion in V8, inappropriate implementation in WebAssembly, out of bounds memory access in dawn and use after free in dawn”.

    An attacker could exploit these vulnerabilities by persuading a victim to visit a specially crafted webpage, the agency mentioned. CERT-In advised users to apply appropriate security updates as mentioned by the company.

    Meanwhile, CERT-In has joined hands with financial giant Mastercard to promote cooperation and information sharing in the area of cybersecurity related to the financial sector.

    The two entities will leverage their shared expertise regarding the financial sector in the fields of cybersecurity incident response, capacity building, sharing cyber threat intelligence specific to the financial sector and advanced malware analysis. 

  • Govt Issues Alert On Critical Vulnerability In TP-Link Router: Here’s How To Protect Your Device |

    New Delhi: The Indian Computer Emergency Response Team (CERT-In) has issued an urgent advisory about a critical flaw in TP-Link routers which is a widely used brand in India’s internet infrastructure. CERT-In is renowned for quickly identifying flaws in popular software and devices like Apple, Windows, Google Chrome and Mozilla has highlighted a critical threat which might not be obvious to most users.

    TP-Link routers which are essential for connecting devices like smartphones, laptops and tablets to the internet via Wi-Fi are at the centre of this concern. These routers serve as intermediaries between users and their internet service providers which allows seamless internet access without the need for physical cables. (Also Read: Poco F6 5G Smartphone Goes On Sale In India On Flipkart; Check Specs, Price And Discount Offer)

    What are the Affected TP-Link Routers?

    CERT-In has identified a vulnerability in TP- Link Archer routers  with versions prior to C5400X(EU)_V1_1.1.7 Build 20240510. Hence, Tp-Link routers using older firmware versions have this security flaw. (Also Read: What Is India’s EU-Like Anti-Trust Proposal That Irked Tech Giants Google, Amazon, Apple?)

    What’s the root cause of the problem according to CERT-In?

    The issue stems from the improper neutralisation of a special element in a binary which is known as rf test. As outlined by CERT-In, this flaw exposes a network service to unauthenticated command injection.

    How to protect your device:

    To tackle this urgent matter, CERT-In recommends taking prompt action by patching TP-Link software without delay. Moreover, users are strongly encouraged to take proactive steps to bolster the security of their Wi-Fi networks and fend off potential threats:

    1. Make sure to keep your router’s firmware up to date by installing the latest security patches provided by the manufacturers.

    2. Avoid potential exploitation by changing the default login credentials. Replace commonly used usernames and passwords with unique and strong ones.

    3. Safeguard your data transmissions from interception by utilising WPA3 or WPA2 encryption protocols.

    4. Minimise risks by turning off remote management features which could potentially be exploited by unauthorised parties.

  • Google Releases New Security Update To Fix Zero-Day Vulnerability In Chrome; Here’s How To Update

    Earlier, the Indian Computer Emergency Response Team (CERT-In) also issued a warning against the vulnerability on Google Chrome for desktop.

  • ALERT! Govt Issues High-Risk Warning For Google Chrome And Apple iTunes: Here's How To Stay Safe

    ‘Remote Code Extension’ is a security vulnerability in Apple products which happens from inadequate checks in the CoreMedia component.

  • Indian Cyber Agency Finds Multiple Bugs In Cisco Products

    The ‘Command Injection Vulnerability’ exists in the reported software due to the contents of a backup file being improperly sanitised at restore time.

  • Security Alert For Android Users! Indian Govt Issued High-Risk Warning: Read More |

    New Delhi: In the age of digitalisation, many tough things become easy and can be done in a few clicks. But one thing that is growing parallel with the digital age is risks and vulnerabilities. Yes, this is the thing that may be encountered by you. Read on further to find out about the latest incident.

    In the latest and recent security alert issued by the Indian Computer Emergency Response Team (CERT-In), Android users across India have been cautioned about a significant security threat. (Also Read: ‘You Give More Money To Govt Than Spend On Yourself’: Social Media Post On Income Tax Concerns Goes Viral)

    As per the reports, the threat can impact a vast number of Android devices across the country. This latest high-severity issue could potentially enable hackers to steal important and sensitive data from affected smartphones. (Also Read: High-Security Alert For Apple Users! CERT-In Asked To Deploy Immediate Measures)

    How It Has Originated?

    According to CERT-In’s April 2024 bulletin, the vulnerabilities stem from various weaknesses in Android’s framework, system, and Google Play system updates, as well as components from major hardware suppliers like Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm, including their closed-source components.

    Which Android Versions Can Be Affected?

    The advisory specifies the Android versions susceptible to this security risk. Some of them include:

    Android 12 And 12L

    The report suggests that Android 12 and 12L are amongst the Android versions that may be affected. 

    Android 13

    Android 13 is also on the list.

    Android 14

    Android 14 features on the list of  Android versions susceptible to this security risk.

    Why The Concern Is Alarming?

    The different media reports claim that over 90 percent of active Android devices in India running on these versions. Now the ongoing situation raises considerable concern among users.

    The identified vulnerabilities could potentially allow attackers to access sensitive information, gain elevated privileges, and even cause denial of service conditions on targeted devices.

  • ALERT! Indian Government Warns Apple Users Of Major Security Risk

    Notably, the security issue affects various Apple devices, including Vision Pro, Apple TV HD and 4K models, Apple Watch Series 4, and later models.

  • Government Releases Urgent Alert For Google Chrome Users, Urging Them To Promptly Update Their Browser |

    New Delhi: The Indian Computer Emergency Response Team (Cert-In) has issued a high-risk warning concerning several vulnerabilities found in Google Chrome OS. According to their latest security advisory dated February 8, 2024, identified as CIVN-2024-0031, the government research team has disclosed that these vulnerabilities are deemed high-risk and present substantial threats to users of Google Chrome OS versions preceding 114.0.5735.350 (Platform Version: 15437.90.0) on the LTS channel.

    As per CERTIn’s findings, the identified vulnerabilities can be utilized by a remote attacker to execute arbitrary code, attain elevated privileges, circumvent security measures, or induce denial of service situations on the targeted system.

    What are the risks involved?

    The risk associated with these vulnerabilities stems from two primary issues:

    -Use-after-free in Side Panel Search: This vulnerability enables attackers to exploit memory errors within the Side Panel Search feature, potentially resulting in the execution of arbitrary code or the circumvention of security protocols. (Also Read: Meta Will Stop Suggesting Political Content To Users On Both Instagram And Threads)

    -Insufficient data validation in Extensions: This vulnerability arises from inadequate validation of input data in extensions, providing attackers with the opportunity to execute malicious actions on compromised systems. (Also Read: OpenAI Introduces Watermarking For AI-Generated Images Via DALL-E 3; Check Details)

    According to Cert-In’s vulnerability note, remote attackers can exploit these vulnerabilities by enticing unsuspecting users to visit specially crafted websites. Upon accessing these sites, the vulnerabilities would be triggered, allowing attackers to compromise the security of unsuspecting users.

    How to ensure safety

    To stay protected from these vulnerabilities, Cert-In strongly recommends updating Google Chrome to the latest version, which includes security patches from Google. Users should promptly update their Google Chrome OS to version 114.0.5735.350 (or newer) on the LTS channel to address these vulnerabilities and improve system security.

    Furthermore, users should:

    -Be cautious: Exercise care when browsing the internet, especially on unfamiliar or suspicious websites. Avoid clicking on links from untrusted sources or engaging with unsolicited emails or messages.

    -Follow security best practices: Implement robust security measures such as using trusted antivirus software, regularly updating software and applications, and enabling firewalls to enhance protection against potential threats.

    CERT-In is currently conducting a “Cyber Swachhta Fortnight” from February 1 to 15, 2024. This initiative aims to safeguard the nation’s digital security by protecting cyberspace from botnets, which have the potential to infect and compromise users’ systems.

    To achieve this goal, CERT-In has introduced the ‘Cyber Swachhta Kendra’ (CSK), which provides the eScan Botnet Scanning & Cleaning Toolkit for laptops, desktops, and smartphones. Developed in partnership with eScan, a reputable cybersecurity solutions provider, this toolkit empowers individuals to scan and cleanse their devices, shielding them from botnet threats.