Techme101.com

Security experts have raised alarms over a critical vulnerability in ConnectWise ScreenConnect, a widely used remote access tool, which they describe as “trivial and embarrassingly easy” to exploit. According to TechCrunch, this flaw, with the highest severity rating, poses a significant risk as it allows for an authentication bypass that could enable attackers to remotely access and steal sensitive data or deploy malware on affected systems. As confirmed by the ConnectWise, the software’s developer, malicious hackers are actively exploiting this flaw, posing a significant threat to data security and system integrity.
Despite initial assurances of no public exploitation, the company later confirmed incidents of compromised accounts following an investigation by their incident response team. ConnectWise has also identified and shared IP addresses linked to the attackers.
The vulnerability, impacting a tool essential for IT providers and technicians to offer remote support, was first reported to ConnectWise on February 13, with the company disclosing it in a security advisory on Feb. 19. Although the exact number of affected customers remains undisclosed, ConnectWise spokesperson Amanda Lee mentioned “limited reports” of suspected intrusions, adding that 80% of their cloud-based customer environments were patched automatically within 48 hours.
Huntress, a cybersecurity firm, published an analysis indicating ongoing exploitation of this flaw, with adversaries deploying Cobalt Strike beacons and even installing ScreenConnect clients on compromised servers. Huntress CEO Kyle Hanslovan highlighted the severity of the situation, estimating that thousands of servers controlling numerous endpoints remain vulnerable, potentially leading to a surge in ransomware attacks.
ConnectWise has issued a patch for the vulnerability and is urging users, especially those with on-premise ScreenConnect installations, to apply the update promptly. The company also addressed a separate vulnerability in its remote desktop software but has not observed any exploitation of this flaw.
The post Hackers actively targeting severe authentication bypass flaw in ConnectWise software appeared first on ReadWrite.

Apple has confirmed its plans to launch its newest iMessage security protocol, named PQ3, in response to what it claims is a future threat from quantum computers, according to a recent PCMag report.
iMessage currently uses end-to-end encryption, ensuring that messages between the sender and receiver are secure and inaccessible to anyone else, including Apple. However, Apple is concerned that the advancement of quantum computers may soon reach a level where they could decrypt iMessage content. Such powerful quantum computers would presumably also be capable of decrypting messages sent through other apps, such as WhatsApp.
Last year, the Technical University of Denmark stated that although quantum computers are already operational, they lack the power to break end-to-end encryption at present, indicating it may take years to achieve this capability due to their current size limitations.
On Wednesday, Apple’s Security Engineering and Architecture (SEAR) team wrote about the evolution of encryption on messaging platforms. They explained that traditionally, platforms have relied on classical public key cryptography methods like RSA, Elliptic Curve signatures, and Diffie-Hellman key exchange to secure end-to-end encrypted connections. These methods are grounded in complex mathematical problems that were once deemed too challenging for computers to solve, even with advancements predicted by Moore’s law.
The SEAR team highlighted, however, that the advent of quantum computing could shift this balance. They noted that “a sufficiently powerful quantum computer could solve these classical mathematical problems in fundamentally different ways,” potentially fast enough to compromise the security of encrypted communications.
The team also raised concerns about future threats, stating that while current quantum computers can’t decrypt data protected by these methods, adversaries might store encrypted data now with the intention of decrypting it later using more advanced quantum technology. This strategy, known as “Harvest Now, Decrypt Later,” underscores the potential long-term vulnerabilities in current encryption techniques against the backdrop of quantum computing’s rapid development.
As a result, the tech giant has created PQ3, which it says has been built “from the ground up” to redesign iMessage from a security standpoint, adding a third level of protection to its end users.
When will Apple roll out PQ3 for iMessage?
PQ3 is expected to launch in March with iOS 17.4, as well as iPadOS 17.4, macOS 14.4 and watchOS 10.4.
The simultaneous rollout across multiple Apple operating systems underscores the company’s commitment to addressing the future threat quantum computers pose to end-to-end encryption. Apple is taking proactive steps to ensure that iMessage users on iPhones, tablets, computers, and wearables receive protection as swiftly as possible.
Featured Image: Photo by Mariia Shalabaieva on Unsplash
The post Apple to launch PQ3 update for iMessage, bolstering encryption against quantum computing appeared first on ReadWrite.