Connect with us

Technology

Student raised security concerns about Mobile Guardian MDM weeks before cyberattack

Published

on

Student raised security concerns in Mobile Guardian MDM weeks before cyberattack

An individual posing as a student in Singapore publicly posted documentation showing weak security at a wildly popular school mobile device management service called Mobile Guardian, weeks before a cyberattack on the corporate led to a mass wipe of student devices and major disruptions to its operations.

In an email to TechCrunch, the coed — who declined to offer his last name, citing fear of legal retaliation — said he reported the bug to the Singapore government via email in late May, but couldn’t make certain if the bug was ever fixed. The Singapore government told TechCrunch that the bug had been fixed before the Mobile Guardian cyberattack on Aug. 4, but the coed said the bug was really easy to search out and exploit by an inexperienced attacker that he fears there are more vulnerabilities with similar exploitability.

Mobile Guardian, a U.K.-based company that gives software to administer student devices in hundreds of faculties worldwide, disclosed the breach on Aug. 4 and shut down its platform to dam malicious access, but before it could discover the intruder had used his access to remotely wipe hundreds of scholars’ devices.

Advertisement

A day later, the coed published details of the vulnerability that he had previously sent to the Singapore Ministry of Education, primary customer Mobile Guardian from 2020.

IN Reddit poststudent said a security bug he present in Mobile Guardian granted any logged-in user “super admin” access to the corporate’s user management system. With that access, the coed said, a malicious actor could perform actions reserved for college administrators, including the power to “reset anyone’s personal learning device,” he said.

The student wrote that he reported the problem to Singapore’s Ministry of Education on May 30. Three weeks later, the ministry responded to the coed saying the flaw was “no longer an issue” but declined to offer him with further details, citing “commercial sensitivity,” in line with an email seen by TechCrunch.

When contacted by TechCrunch, the ministry confirmed that it had received information about the bug from a security researcher and that “the vulnerability was discovered during a previous security review and has already been patched,” spokesman Christopher Lee said.

Advertisement

“We also confirmed that the disclosed exploit was no longer usable after the patch was installed. In June, an independent certified penetration tester conducted further evaluation and did not detect any such vulnerability,” the spokesperson said.

“Nevertheless, we are aware that cyber threats can evolve rapidly and uncover new vulnerabilities,” the spokesperson said, adding that the ministry “takes such disclosures of vulnerabilities seriously and will investigate them thoroughly.”

The bug might be exploited in any browser

The student described the bug to TechCrunch as a client-side privilege escalation vulnerability that allowed anyone on the web to create a brand new Mobile Guardian user account with extremely high levels of system access, using only web browser tools. This happened because Mobile Guardian servers allegedly didn’t perform proper security checks and didn’t trust responses from a user’s browser.

The bug was that the server might be tricked into accepting the next level of system access for a user account by modifying network traffic within the browser.

Advertisement

TechCrunch obtained a video — recorded on May 30, the day it was disclosed — showing how the bug works. The video shows a user making a “super admin” account using only the browser’s built-in tools to switch web traffic containing the user role to raise that account’s access from “admin” to “super admin.”

The recording shows the server accepting the modified network request and, after logging in with the newly created “super administrator” user account, getting access to a dashboard displaying the lists of faculties signed up for Mobile Guardian.

Mobile Guardian CEO Patrick Lawson didn’t reply to multiple requests for comment before publication, including questions about the coed vulnerability report and whether the corporate had fixed the bug.

After we reached out to Lawson, the corporate updated its statement to read: “Internal and external investigations into previous vulnerabilities in the Mobile Guardian platform have been confirmed and no longer pose a threat.” The statement didn’t specify when the previous vulnerabilities were resolved, nor did it specifically rule out a connection between the previous vulnerabilities and the August cyberattack.

Advertisement

This is second security incident this 12 months to harass Mobile Guardian. In April, Singapore’s education ministry confirmed that the corporate’s management portal had been hacked and that the non-public information of fogeys and college staff from tons of of faculties across Singapore had been compromised. The ministry a violation was assigned This was as a result of Mobile Guardian’s lax password policy moderately than a security flaw in its systems.


This article was originally published on : techcrunch.com

Technology

Lime scooter and Ebike batteries will be recycled by Redwood Materials

Published

on

By

The joint company Micromobility Lime has reached an agreement on sending batteries utilized in scooters and electronic bikes to Sewoi materials that extract and recycle critical minerals, comparable to lithium, cobalt, nickel and copper.

The agreement announced on Monday makes Redwood Materials the only real battery recycling partner for common scooters and e-bike bikes situated in cities within the United States, Germany and the Netherlands. The contract doesn’t cover every region where lime worksAn inventory covering cities throughout Europe, Asia and Australia.

In Lime up to now he had other recycling partnerships, especially with Sprout through his suppliers. However, for the primary time, the joint company Micromobility had direct relations with battery recycling in North America, which might directly process the fabric for recovery and returns it to the availability chain.

Advertisement

Redwood Materials, The Carson City, Startup from Nevada founded by the previous CFO Tesla JB Straubel, will get better battery materials when they can’t be used. After recovering and recycling, the materials will be re -introduced within the battery production process. This production system of a closed loop-which can reduce the demand for extraction and refining of minerals-is on the Redwood Materials business center.

The effort can also be consistent with its own goals of limestone sustainable development. Lime is geared toward decarbonization of operations by 2030. The company has made progress in reducing the range 1, 2 and 3 of emissions by 59.5% in five years of basic years 2019. Wapno plans to report the outcomes of carbon dioxide emissions 2024 in May.

“This cooperation means significant progress in the establishment of a more round supply chain, helping our batteries not only to recycled responsibly after reaching the end of their lives, but that their materials are returned to the battery supply chain,” said Andrew Savage, vice chairman for balanced development in Lime.

Lime also has partnerships from Gomi in Great Britain and Voltr in France and other European countries to gather these live battery cells for “Second Life” applications, including, amongst others, in the sphere of consumer electronics, comparable to portable speakers and battery packages.

Advertisement

Redwood Materials has contracts with other micromobility corporations, including Lyft, RAD Power Bikes and bicycle batteries and scooters specialized in recycling. Redwood, which collected over $ 2 billion in private funds, announced at first of this month, opened the research and development center in San Francisco.

(Tagstranslat) ebikes

This article was originally published on : techcrunch.com
Continue Reading

Technology

The Legal Defense Fund withdraws from the META civil law advisory group over Dei Rolback

Published

on

By

Legal Defense Fund,, Meta, dei,


On April 11, the Legal Defense Fund announced that he was leaving the external advisory council for civil rights regarding the fear that the changes in technology company introduced diversity, own capital, inclusion and availability in January.

According to those changes that some perceived as the capitulation of meta against the upcoming Trump administration, contributed to their decision To leave the advisory council of the technology company.

In January, LDF, along with several other organizations of civil rights, which were a part of the board, sent a letter to Marek Zuckerberg, CEO of Meta, outlining their fears As for a way changes would negatively affect users.

Advertisement

“We are shocked and disappointed that the finish has not consulted with this group or its members, considering these significant changes in its content policy. Non -compliance with even its own advisory group of experts on external civil rights shows a cynical disregard for its diverse users base and undermines the commitment of the meta in the field of freedom of speech with which he claims to” return “.

They closed the letter, hoping that the finish would recommend the ideals of freedom of speech: “If the finish really wants to recommend freedom of speech, he must commit to freedom of speech for all his services. As an advisory group from external civil rights, we offer our advice and knowledge in creating a better path.”

These fears increased only in the next months, culminating in one other list, which from the LDF director, Todd A. Cox, who indicated that the organization withdraws its membership from the META civil law advisory council.

“I am deeply disturbed and disappointed with the announcement of Medical on January 7, 2025, with irresponsible changes in content moderation policies on platforms, which are a serious risk for the health and safety of black communities and risk that they destabilize our republic,” Cox wrote.

Advertisement

He continued: “For almost a decade, the NACP Legal Defense and Educational Fund, Inc. (LDF) has invested a lot of time and resources, working with META as part of the informal committee advising the company in matters of civil rights. However, the finish introduced these changes in the policy of the content modification without consulting this group, and many changes directly with the guidelines from the guidelines from LDF and partners. LD can no longer participate in the scope. ” Advisory Committee for Rights “

In a separate but related LDF list, it clearly resembled a finish about the actual obligations of the Citizens’ Rights Act of 1964 and other provisions regarding discrimination in the workplace, versus the false statements of the Trump administration, that diversity, justice and initiative to incorporate discriminates against white Americans.

“While the finish has modified its policy, its obligations arising from federal regulations regarding civil rights remain unchanged. The title of VII of the Act on civic rights of 1964 and other regulations on civil rights prohibit discrimination in the workplace, including disconnecting treatment, principles in the workplace which have unfair disproportionate effects, and the hostile work environment. Also when it comes to inclusion, and access programs.

In the LDF press release, announcing each letters, Cox He called attention Metal insert into growing violence and division in the country’s social climate.

Advertisement

“LDF worked hard and in good faith with meta leadership and its consulting group for civil rights to ensure that the company’s workforce reflects the values ​​and racial warehouses of the United States and to increase the security priorities of many different communities that use meta platforms,” ​​said Cox. “Now we cannot support a company in good conscience that consciously takes steps in order to introduce changes in politics that supply further division and violence in the United States. We call the meta to reverse the course with these dangerous changes.”

(Tagstranslate) TODD A. COX (T) Legal Defense Fund (T) META (T) Diversity (T) Equality (T) inclusion

This article was originally published on : www.blackenterprise.com
Advertisement
Continue Reading

Technology

Students of young, talented and black yale collect $ 3 million on a new application

Published

on

By


Nathaneo Johnson and Sean Hargrow, juniors from Yale University, collected $ 3 million in only 14 days to finance their startup, series, social application powered by AI, designed to support significant connections and challenge platforms, similar to LinkedIn and Instagram.

A duo that’s a co -host of the podcast A series of foundersHe created the application after recognizing the gap in the way in which digital platforms help people connect. SEries focuses moderately on facilitating authentic introductions than gathering likes, observing or involvement indicators.

“Social media is great for broadcasting, but it does not necessarily help you meet the right people at the right time,” said Johnson in an interview with Entrepreneur warehouse.

Advertisement

The series connects users through AI “friends” who communicate via IMessage and help to introduce. Users introduce specific needs-are on the lookout for co-founders, mentors, colleagues or investors-AI makes it easier to introduce based on mutual value. The concept attracts comparisons to LinkedIn, but with more personal experience.

“You publish photos on Instagram, publish movies on Tiktok and publish work posts on LinkedIn … And that’s where you have this microinfluuncer band,” Johnson added.

The application goals to avoid the superficial character of typical social platforms. Hargrow emphasized that although aesthetics often dominates on Instagram and the content virus drives tabktok, Number It is intentional, deliberate contacts.

“We are not trying to replace relationships in the real world-we are going to make it easier for people to find the right relationships,” said Hargrow.

Advertisement

Parable projects carried out before the seeded (*3*)Funding roundwhich included participation with Pear VC, DGB, VC, forty seventh Street, Radicle Impact, UNCASMON Projects and several famous Angels Investors, including the General Director of Reddit Steve Huffman and the founder of GPTZERO Edward Tian. Johnson called one meeting of investors “dinner for a million dollars”, reflecting how their pitch resonated with early supporters.

Although not the principal corporations, Johnson and Hargrow based pre-coreneuring through their podcast, through which they interviews the founders and leaders of C-Suite about less known elements of constructing the company-as accounting, business law and team formation.

Since the beginning of the series, over 32,000 messages between “friends” have been mentioned within the test phases. The initial goal of the application is the entrepreneurs market. Despite this, the founders hope to develop in finance, dating, education and health – ultimately striving to construct probably the most available warm network on the earth.

Advertisement

(Tagstranslate) VC (T) Yale (T) Venture Capital (T) Technology (T) APP

This article was originally published on : www.blackenterprise.com
Continue Reading
Advertisement

OUR NEWSLETTER

Subscribe Us To Receive Our Latest News Directly In Your Inbox!

We don’t spam! Read our privacy policy for more info.

Trending