Exploit zero-day contorna a criptografia padrão do BitLocker no Windows 11

14 de maio de 2026

Reportado por IA

Um exploit zero-day recém-publicado permite que invasores com acesso físico contornem a criptografia BitLocker em dispositivos Windows 11 em segundos. O ataque, chamado YellowKey, tem como alvo a configuração padrão baseada apenas em TPM e concede acesso total a unidades criptografadas por meio de um método simples via USB.

O exploit foi divulgado no início desta semana por um pesquisador sob o pseudônimo Nightmare-Eclipse. Ele funciona colocando uma pasta FsTx personalizada em uma unidade USB formatada em NTFS ou FAT. Após conectar a unidade e forçar a entrada na Recuperação do Windows, o sistema abre um prompt de comando com acesso irrestrito ao conteúdo da unidade, ignorando a necessidade da chave de recuperação do BitLocker.

Linux CopyFail exploit threatens root access amid Ubuntu outage

01 de maio de 2026 Reportado por IA Imagem gerada por IA

A critical Linux vulnerability known as CopyFail, tracked as CVE-2026-31431, allows attackers to gain root access on systems running kernels since 2017. Publicly released exploit code has heightened risks for data centers and personal devices. Ubuntu's infrastructure has been offline for over a day due to a DDoS attack, hampering security communications.

Daemon Tools app hit by monthlong supply-chain attack

Daemon Tools, a popular disk image mounting app, was compromised in a supply-chain attack starting April 8, delivering malware through official updates. Security firm Kaspersky reported infections on thousands of machines across over 100 countries. Users are urged to scan their systems immediately.

Research uncovers flaws in password managers' zero-knowledge claims

17 de fevereiro de 2026 Reportado por IA

New research from ETH Zurich and USI Lugano reveals vulnerabilities in popular password managers, challenging their assurances that servers cannot access user vaults. The study analyzed Bitwarden, Dashlane, and LastPass, identifying ways attackers with server control could steal or modify data, particularly when features like account recovery or sharing are enabled. Companies have begun patching the issues while defending their overall security practices.

Tecnologia

Microsoft patches critical ASP.NET Core vulnerability on macOS and Linux

Linux

New dirty frag exploit grants root access on linux systems

Cripto

U.S. Treasury sanctions Russian network for crypto-funded cyber tool theft

The hacker news publishes weekly threatsday bulletin

The Hacker News has released its latest ThreatsDay Bulletin, focusing on various cybersecurity issues. The bulletin covers topics such as Kali Linux combined with Claude, Chrome crash traps, WinRAR flaws, and activities related to LockBit. It also includes over 15 additional stories on emerging threats.

Duet Night Abyss launcher spreads malware on Steam

19 de março de 2026 Reportado por IA

Developers of the gacha RPG Duet Night Abyss have apologized for a cybersecurity incident that distributed malware to players' PCs via a launcher update on March 18. The malware, identified as Trojan:MSIL/UmbralStealer.DG!MTB, targets passwords and cryptocurrency. Players receive in-game compensation as the team implements security enhancements.

quarta-feira, 13 de maio de 2026, 20:07h

Exploit zero-day contorna a criptografia padrão do BitLocker no Windows 11

Artigos relacionados

Linux CopyFail exploit threatens root access amid Ubuntu outage

Daemon Tools app hit by monthlong supply-chain attack

Research uncovers flaws in password managers' zero-knowledge claims

Microsoft patches critical ASP.NET Core vulnerability on macOS and Linux

New dirty frag exploit grants root access on linux systems

U.S. Treasury sanctions Russian network for crypto-funded cyber tool theft

The hacker news publishes weekly threatsday bulletin

Duet Night Abyss launcher spreads malware on Steam

New fragnesia linux kernel flaw disclosed

Experts warn Microsoft Phone Link tool exploited by unknown threat

TotalRecall Reloaded exposes Windows Recall security gap

Researchers uncover new SysUpdate malware variant targeting Linux

New SysUpdate malware variant targets Linux systems

Dell zero-day flaw unpatched for nearly two years

Threat actors abuse Pastebin for ClickFix scam on crypto swaps

Este site usa cookies