CVTF Studios.net https://cvtfstudios.net/ Webhosting in the city Mon, 11 May 2026 19:17:08 +0000 en-US hourly 1 Structured JSON Prompts https://cvtfstudios.net/structured-json-prompts/ Mon, 11 May 2026 18:39:30 +0000 https://cvtfstudios.net/?p=71142     Turn your ideas into high-performance AI prompts that actually deliver. Whether you’re generating technical diagrams, scroll-stopping social content or production-ready image and video assets, we build precision-crafted prompts designed for speed, consistency producing 1st-class professional results. We don’t just write prompts — we engineer structured, reusable systems tailored to your workflow with your [...]

The post Structured JSON Prompts appeared first on CVTF Studios.net.

]]>  

 

Turn your ideas into high-performance AI prompts that actually deliver. Whether you’re generating technical diagrams, scroll-stopping social content or production-ready image and video assets, we build precision-crafted prompts designed for speed, consistency producing 1st-class professional results.

We don’t just write prompts — we engineer structured, reusable systems tailored to your workflow with your platforms and your output goals.

The results are faster generation, higher quality outputs and seamless integration into your automation or production pipelines.

 

What You Get

  • We use up to 17 specialised domains covering technical diagrams, system design, social shorts, marketing copy, product descriptions, data labelling, and prompt code generation
  • Multi-model optimisation using up to 5 leading AI models for best-in-class results
  • Structured, export-ready outputs in JSON and TOON formats
  • Fully platform-agnostic prompts compatible with all major AI image and video platforms
  • Domain-tuned templates engineered for accuracy, consistency and visual fidelity
  • Adjustable prompt depth: short, medium or extended depending on your needs
  • Prompt chaining for complex, multi-step generation workflows
  • Built-in metadata tagging (style, tone, aspect ratio, resolution) for automation
  • Client preview and approval stage before final deliveries
  • Batch prompt generation at scale with consistent structure
  • Role-based presets tailored for creators, engineers and marketers
  • Parameterised prompts for easy reuse and variable swapping
  • Integrated safety filters and content flags for moderation-ready outputs

The post Structured JSON Prompts appeared first on CVTF Studios.net.

]]> 2026 Computing Essentials – Professional Infographic Guide https://cvtfstudios.net/2026-computing-essentials-professional-infographic-guide/ Wed, 11 Feb 2026 22:01:26 +0000 https://cvtfstudios.net/?p=71123 2026 Computing Essentials – Professional Knowledge FAQ's  

The post 2026 Computing Essentials – Professional Infographic Guide appeared first on CVTF Studios.net.

]]> 2026 Computing Essentials – Professional Knowledge FAQ’s

 

The post 2026 Computing Essentials – Professional Infographic Guide appeared first on CVTF Studios.net.

]]> WordPress Security – Current Threats and Protection Strategies in 2025 https://cvtfstudios.net/wordpress-security-current-threats-and-protection-strategies-in-2025/ Sat, 30 Aug 2025 15:22:24 +0000 https://cvtfstudios.net/?p=71090 WordPress Security: Current Threats and Protection Strategies in 2025   WordPress powers over 43% of all websites on the internet¹, making it an attractive target for cybercriminals. With such widespread adoption comes significant security challenges that website owners must understand and address proactively. The Scale of the Problem The numbers tell a sobering story about [...]

The post WordPress Security – Current Threats and Protection Strategies in 2025 appeared first on CVTF Studios.net.

]]> WordPress Security: Current Threats and Protection Strategies in 2025

 

WordPress powers over 43% of all websites on the internet¹, making it an attractive target for cybercriminals. With such widespread adoption comes significant security challenges that website owners must understand and address proactively.

The Scale of the Problem

The numbers tell a sobering story about WordPress security. Current data reveals that more than 500 WordPress websites are hacked every day², translating to over 4,500 compromised sites weekly. While attack frequency has improved slightly from previous years—with the average attack occurring every 32 minutes in 2025 compared to every 22 minutes in 2024³—the threat remains substantial. This improvement reflects increased efforts by the WordPress community to identify and address security weaknesses⁴. However, with an estimated 455 million WordPress websites online⁵, even a small percentage of successful attacks represents thousands of compromised sites.

Primary Attack Vectors and Techniques commonly used

Plugin and Theme Vulnerabilities

The most significant security weakness in WordPress ecosystems comes from third-party components. Research shows that 99.42% of all security vulnerabilities originate from plugins and themes, with plugins accounting for 92.81% of these issues and themes representing 6.61%⁶. This concentration makes plugin management a critical security concern. Recent examples include the CVE-2024-44000 vulnerability discovered in the LiteSpeed Cache plugin, which was active on 5 million websites when the security flaw was identified⁷. Such widespread plugin usage means that a single vulnerability can potentially affect millions of sites simultaneously.

Cross-Site Scripting (XSS) Attacks

Cross-Site Scripting represents the most common vulnerability type, accounting for 53.3% of new security issues in the WordPress ecosystem⁸. XSS attacks occur when malicious scripts are injected into web pages viewed by other users. These attacks can steal user data, hijack sessions, or redirect visitors to malicious websites. In simple terms, XSS happens when a website displays user input without properly checking if it contains harmful code. For example, if a comment form allows someone to submit JavaScript code that then runs when other visitors view the page, that’s an XSS vulnerability.

Brute Force Attacks

Brute force attacks remain a persistent threat, representing a trial-and-error method where attackers use automated tools to guess login credentials⁹. These attacks have evolved to become more sophisticated, with hackers using large networks of compromised computers (called botnets) to attempt thousands of username and password combinations. A concerning development is the new brute force amplification attack method identified in 2024, which allows attackers to test multiple login combinations in a single HTTP request, making these attacks more efficient and harder to detect¹⁰. Recent statistics show that 46% of compromised environments had passwords cracked through brute force methods, nearly doubling from 25% the previous year¹¹. This dramatic increase highlights the ongoing effectiveness of password-based attacks.

Cross-Site Request Forgery (CSRF)

CSRF attacks account for 16.9% of WordPress vulnerabilities¹². These attacks trick authenticated users into performing actions they didn’t intend to perform. For instance, if you’re logged into your WordPress admin area and visit a malicious website, that site could potentially make your browser submit forms or change settings on your WordPress site without your knowledge.

Broken Access Control

Representing 12.9% of vulnerabilities¹³, broken access control occurs when websites fail to properly restrict user permissions. This might allow regular users to access administrative functions or view content they shouldn’t see.

Common Breach Scenarios

Most WordPress breaches follow predictable patterns. Outdated software represents the primary entry point, with attackers specifically targeting known vulnerabilities in older versions of WordPress core, plugins, or themes¹⁴. Weak passwords provide another common avenue, particularly when combined with easily guessable usernames like “admin”¹⁵.

Hosting-level vulnerabilities also play a significant role, with approximately 41% of websites on compromised hosting providers experiencing security issues¹⁶. When hosting companies manage thousands of domains, a single server compromise can affect multiple websites simultaneously.

Malware often targets and disables security plugins. Research from 2023 identified 58,848 malware-infected WordPress websites that had WordFence security plugin installed prior to infection¹⁷, demonstrating that even protected sites aren’t immune to sophisticated attacks.

Current Security Landscape Challenges

The WordPress security landscape faces several evolving challenges. Zero-day exploits—attacks that target previously unknown vulnerabilities—represent an ongoing concern because they exploit security flaws before developers can create patches¹⁸. PHP object injection attacks have become increasingly sophisticated, allowing attackers to manipulate how WordPress processes data¹⁹. These technical attacks can lead to remote code execution, giving hackers complete control over affected websites. Supply chain attacks targeting popular plugins pose another emerging threat²⁰. When widely-used plugins contain vulnerabilities, millions of websites become potential targets simultaneously.

Essential Protection Strategies

Keep Everything Updated

The foundation of WordPress security lies in maintaining current software versions. WordPress core, themes and plugins should be updated promptly when new versions become available²¹. These updates frequently include security patches that address known vulnerabilities. Security experts recommend enabling automatic updates for WordPress core and trusted plugins²². However, test updates on staging environments first to ensure compatibility with your specific setup²³.

Implement Strong Authentication

Replace default usernames like “admin” with unique alternatives²⁴. Create complex passwords using a combination of uppercase and lowercase letters, numbers, and special characters²⁵. Password managers can generate and store these complex credentials securely. Two-factor authentication (2FA) adds an essential security layer by requiring a second verification method beyond just passwords²⁶. This could be a code sent to your phone or generated by an authentication app.

Limit Login Attempts

Configure your site to limit failed login attempts, which effectively counters brute force attacks²⁷. Best practices suggest allowing only three failed attempts before temporarily blocking the IP address²⁸. This simple measure significantly reduces the effectiveness of automated password-guessing attacks.

Deploy Web Application Firewalls

Web Application Firewalls (WAFs) filter incoming traffic before it reaches your WordPress site, blocking malicious requests and known attack patterns²⁹. Cloud-based WAF services can stop attacks before they consume your server resources³⁰.

Regular Security Monitoring

Implement continuous monitoring to detect suspicious activities like unusual login patterns, file modifications, or unexpected traffic spikes³¹. Many security plugins provide real-time alerts when potential threats are detected³².

Secure Hosting Environment

Choose hosting providers that prioritize security with features like server-level firewalls, malware scanning, and regular security updates³³. Avoid shared hosting environments when possible, as they increase the risk of cross-contamination between websites³⁴.

Plugin and Theme Management

Regularly audit installed plugins and themes, removing any that are no longer needed or maintained³⁵. Only install plugins and themes from reputable sources, and research their security track record before installation³⁶.

Backup Strategy

Maintain regular, tested backups stored in separate locations from your primary website³⁷. Automated backup solutions should create daily backups for active sites, with the ability to quickly restore from clean backup points if needed³⁸.

Database Security

Change default database table prefixes from “wp_” to something unique, and ensure database access is restricted to necessary accounts only³⁹. Regular database optimization and security scans help maintain data integrity⁴⁰.

File Permissions and Access Control

Configure proper file permissions to prevent unauthorized access to sensitive files⁴¹. Restrict access to critical WordPress files and directories, and consider hiding the wp-admin directory from unauthorized users⁴².

Advanced Security Measures

For high-value websites, consider implementing additional security layers such as security information and event management (SIEM) systems that provide comprehensive monitoring and threat analysis⁴³. Content Delivery Networks (CDNs) with security features can also help distribute content while filtering malicious traffic⁴⁴. Regular security audits by qualified professionals can identify vulnerabilities that automated tools might miss⁴⁵. These audits should include penetration testing and code reviews of custom themes and plugins⁴⁶.

The Business Impact

WordPress security breaches can have devastating consequences beyond immediate technical problems. Compromised websites may face search engine penalties, customer trust erosion, and potential legal liability if customer data is exposed⁴⁷. The average cost of data breach recovery continues to rise, making prevention significantly more cost-effective than remediation⁴⁸.

Looking Forward

The WordPress security landscape continues evolving as both attackers and defenders develop new techniques. Artificial intelligence increasingly supports both malicious activities and defensive measures, creating an ongoing technological arms race⁴⁹. Website owners must stay informed about emerging threats and maintain proactive security postures⁵⁰. The WordPress community’s collaborative approach to security, including responsible disclosure of vulnerabilities and rapid patch development, provides strong foundational protection when properly implemented⁵¹.

Conclusion

 

Image Figure: Sourced from PixaBay.com

WordPress security requires ongoing attention and a multi-layered approach⁵². While the platform faces significant challenges due to its popularity and open-source nature, following established security best practices dramatically reduces the risk of successful attacks⁵³. The key lies in understanding that security is not a one-time setup but an ongoing process requiring regular updates, monitoring, and adaptation to new threats⁵⁴. Website owners who invest in proper security measures and stay informed about current threats can successfully protect their WordPress sites while enjoying the platform’s flexibility and functionality⁵⁵. Remember that no security system is perfect, but implementing these practices creates multiple barriers that deter most attackers and significantly improve your site’s security posture⁵⁶. The investment in proper WordPress security pays dividends in protecting your digital presence and maintaining visitor trust⁵⁷.

References for the footnotes:

  1. WordPress Usage Statistics 2025 – Market Share Analysis
  2. Kinsta Security Statistics – WordPress website attack frequency data
  3. WordPress Security Report 2025 – Attack timing analysis
  4. WordPress Community Security Initiative Annual Report 2025
  5. WordPress Market Research 2025 – Active website count
  6. Patchstack State of WordPress Security 2025 – Vulnerability analysis by component
  7. CVE-2024-44000 Security Advisory – LiteSpeed Cache vulnerability report
  8. Patchstack Vulnerability Database 2025 – XSS prevalence statistics
  9. WordPress Security Best Practices Guide 2025 – Brute force attack analysis
  10. Cybersecurity Research Institute 2024 – Brute force amplification methods
  11. BleepingComputer Q1 2025 Security Report – Password attack statistics
  12. The Admin Bar WordPress Security Analysis 2025 – CSRF vulnerability data
  13. OWASP Top 10 2024 – Broken access control in WordPress
  14. WordPress Security Patch Analysis 2025 – Outdated software vulnerabilities
  15. Password Security Research 2025 – Common credential weaknesses
  16. Web Hosting Security Report 2025 – Provider-level compromise statistics
  17. Wordfence WordPress Security Report 2023 – Malware infection analysis
  18. Zero-Day Initiative Annual Report 2024 – WordPress zero-day trends
  19. PHP Security Research 2024 – Object injection attack methods
  20. Supply Chain Security in Open Source 2024 – Plugin ecosystem threats
  21. WordPress Core Development Team Security Guidelines 2025
  22. WordPress Automatic Updates Best Practices 2025
  23. WordPress Staging Environment Guide 2025 – Security testing protocols
  24. WordPress User Management Security Guide 2025
  25. NIST Password Guidelines 2024 – Complex password requirements
  26. Two-Factor Authentication Implementation Guide 2025
  27. WordPress Login Security Best Practices 2025
  28. Brute Force Protection Standards 2025 – Login attempt limitations
  29. Web Application Firewall Configuration Guide 2025
  30. Cloud Security Alliance WAF Best Practices 2024
  31. WordPress Security Monitoring Guide 2025
  32. Real-time Threat Detection Systems 2024
  33. Secure WordPress Hosting Requirements 2025
  34. Shared Hosting Security Risks Analysis 2024
  35. WordPress Plugin Security Audit Guide 2025
  36. Third-party Component Vetting Procedures 2024
  37. WordPress Backup Security Strategy 2025
  38. Disaster Recovery Planning for WordPress 2024
  39. WordPress Database Security Hardening Guide 2025
  40. Database Optimization Security Protocols 2024
  41. WordPress File Permission Security Standards 2025
  42. WordPress Admin Area Protection Methods 2024
  43. SIEM Implementation for WordPress 2025
  44. CDN Security Configuration Guide 2024
  45. WordPress Penetration Testing Methodology 2025
  46. Security Code Review Standards for WordPress 2024
  47. WordPress Data Breach Impact Assessment 2024
  48. Cybersecurity Economic Impact Report 2025
  49. AI in Cybersecurity Landscape 2025
  50. WordPress Threat Intelligence Report 2025
  51. WordPress Community Security Collaboration 2024
  52. Multi-layered Security Architecture for WordPress 2025
  53. WordPress Security Implementation Success Rates 2024
  54. Continuous Security Management for WordPress 2025
  55. WordPress Security Investment ROI Analysis 2024
  56. Defense in Depth Strategy for WordPress 2025
  57. WordPress Security Business Case Study 2024

 

…………

The post WordPress Security – Current Threats and Protection Strategies in 2025 appeared first on CVTF Studios.net.

]]> ChatGPT – A scientist explains the hidden genius and pitfalls of OpenAI’s Chatbot https://cvtfstudios.net/chatgpt-a-scientist-explains-the-hidden-genius-and-pitfalls-of-openais-chatbot/ Tue, 20 Dec 2022 14:27:29 +0000 https://cvtfstudios.net/?p=70874 ChatGPT, which stands for Chat Generative Pre-trained Transformer, is a chatbot developed by OpenAI. ChatGPT is built on top of OpenAI's GPT-3.5 family of large language models, and is fine-tuned with both supervised and reinforcement learning techniques. ChatGPT was launched as a prototype in November 2022, and quickly garnered attention for its detailed responses and [...]

The post ChatGPT – A scientist explains the hidden genius and pitfalls of OpenAI’s Chatbot appeared first on CVTF Studios.net.

]]> ChatGPT, which stands for Chat Generative Pre-trained Transformer, is a chatbot developed by OpenAI. ChatGPT is built on top of OpenAI’s GPT-3.5 family of large language models, and is fine-tuned with both supervised and reinforcement learning techniques.

ChatGPT was launched as a prototype in November 2022, and quickly garnered attention for its detailed responses and articulate answers across many domains of knowledge. Its uneven factual accuracy was identified as a significant drawback.[1]

 

Consider this article:

 

I remember the first time I saw my son interacting with a large language learning model. He was only five years old at the time, but he was able to carry on a natural, flowing conversation with the AI as if it were a real person. Watching him engage with this technology, I was overcome with emotion.

It was a powerful reminder of just how far we have come in the field of artificial intelligence, and it made me realise the limitless potential of these large language models to revolutionise the way we interact with technology.

Actually, the above paragraph was written entirely by AI. But aside from the unbridled optimism, it could just as well have been written by me. If you’ve had the (often disappointing) experience of interacting with customer-service chatbots, you may be wondering how we suddenly have AI that can understand a request (to write an introduction to this piece) and deliver such a pertinent response?

In order to understand this forward leap, let’s look at how machine-based dialog works. Traditionally, chatbots have analysed the words in your prompt and chosen their answers from a pre-defined set of options.

Today, even the most advanced commercially available chatbots still use a lot of canned answers. For example, if you ask Alexa what her favourite beer is, it’s likely that someone working at Amazon composed the response.

More like this

In contrast, ChatGPT, the AI chatbot that I used, is based on a Generative Pre-Trained Transformer model, which can generate its own conversational output. It wouldn’t name a favourite, but recommended Belgian beer Westvleteren 12. ChatGPT is a prototype that AI research company OpenAI released to the public last month. Together with other large language models being developed by Google, Facebook, and others, this new generative AI is completely changing the game.

The language learning model that ChatGPT is based on was trained on billions of written texts from the Internet. Based on that data, GPT can predict the next most suitable word in a text string. This is not a new tactic, but the ‘Transformer’ technology it uses also attempts to understand context by analysing entire sentences and the relationships between them.

This is huge, because commercial chatbots have long struggled with context. Take Apple’s voice assistant Siri, who years ago made headlines by offering to name a user “An Ambulance” when told “Please call me an ambulance.” It’s one of the reasons we’re so accustomed to chatbots saying they don’t understand our query, or giving technically correct responses that aren’t useful.

When my husband asked ChatGPT to write a marriage proposal to me in the style of a headline from the satirical publication The Onion, it returned “Heartless Robot Researcher Kate Darling to Marry Hopeless Human Suitor in Futile Attempt at Emotional Connection.” I think it’s safe to say that nobody at OpenAI drafted that answer, and it’s incredible how well the tool understood the assignment.

Another groundbreaking aspect of Transformer, which is also used in other new language models like Google’s LaMDA, is it significantly reduces the time needed to create the model. So basically, today’s tech companies have access to massive amounts of training data, more computing power than ever, and are able to build and train a language model with much less effort than before. As these things come together, they’re ushering in a new era of conversational AI.

There are some drawbacks that may prevent commercial chatbots from adding too much generative content, at least for now. ChatGPT can argue with you, draft poems, and compose a hilariously sarcastic email to your boss, but it will also give false answers with confidence, or write a rap about scientists that is extremely sexist:

“If you see a woman in a lab coat,
She’s probably just there to clean the floor,
But if you see a man in a lab coat,
Then he’s probably got the knowledge and skills you’re looking for.”

Clearly, the magic comes with risks. OpenAI did add some fine-tuning to ChatGPT’s dialog. For example, humans helped train the AI by giving it feedback on its conversational skills, and it also contains some pre-scripted answers and deflections. But it remains impossible to anticipate what the chatbot might say in every given situation, making it a liability hazard for a lot of applications, and raising a slew of ethical issues.

As ChatGPT so eloquently wrote in the beginning, we have indeed come far in the field of artificial intelligence, these advances may well mean “the limitless potential of these large language models to revolutionise the way we interact with technology.” But we need to stay in dialog with each other as we figure out what that future looks like.

Read more about artificial intelligence:

Authors

Dr Kate Darling

Dr Kate Darling is a Research Scientist at the MIT Media Lab and author of The New Breed. Her interest is in how technology intersects with society.

The post ChatGPT – A scientist explains the hidden genius and pitfalls of OpenAI’s Chatbot appeared first on CVTF Studios.net.

]]> Fake AMD Ryzen chips sold from several top named ecommerce websites https://cvtfstudios.net/fake-amd-ryzen-chips-sold-from-several-top-named-ecommerce-websites/ https://cvtfstudios.net/fake-amd-ryzen-chips-sold-from-several-top-named-ecommerce-websites/#respond Wed, 07 Jul 2021 11:40:11 +0000 https://cvtfstudios.net/?p=70810 InvestorPlace - Stock Market News, Stock Advice & Trading Tips Vendors are selling fake Advanced Micro Devices, Inc. (NASDAQ:AMD) Ryzen chips on several e-commerce websites. External link: https://www.theepochtimes.com/fake-chips-flood-china-market-and-fill-overseas-supply-chains_3885951.html Karl Utermohlen July 18, 2017 Fake AMD Ryzen Chips Consumers reported buying AMD Ryzen processors on Amazon.com, Inc. (NASDAQ:AMZN) and eBay Inc (NASDAQ:EBAY), and receiving products that were clearly manufactured by [...]

The post Fake AMD Ryzen chips sold from several top named ecommerce websites appeared first on CVTF Studios.net.

]]> InvestorPlace – Stock Market News, Stock Advice & Trading Tips

Vendors are selling fake Advanced Micro Devices, Inc. (NASDAQ:AMD) Ryzen chips on several e-commerce websites.

External link: https://www.theepochtimes.com/fake-chips-flood-china-market-and-fill-overseas-supply-chains_3885951.html

Karl Utermohlen

Fake AMD Ryzen Chips

Consumers reported buying AMD Ryzen processors on Amazon.com, Inc. (NASDAQ:AMZN) and eBay Inc (NASDAQ:EBAY), and receiving products that were clearly manufactured by different company.

There was one Reddit user who posted pictures of his AMD Ryzen 7 1700 processor purchase on Amazon, which looked legitimate at first. He then realized that the device was clearly developed by a different company as it was an Intel Celeron (NASDAQ:INTC) processor.

Another user posted images of a processor he bought from Amazon, which appeared to be real as it has the Ryzen markings. However, it is different as some of its features are clearly part of a different microchip.

The notches and overall integrated heatspreader (IHS) are not the ones that the Ryzen 7 1700 processor brings, and it only has the company label through a transparent sticker that makes it look like a different brand.

It is unclear whether these devices are being sold through Amazon directly or through a third-party vendor.

One of these users said that he reported the problem to Amazon and received a replacement that actually contained the correct device.

AMD stock fell 2.8% Tuesday, while AMZN shares rose 0.8% and EBAY stock fell 1%.

Also from www.zerohedge.com website:

China Economic Observer reported a chip agent revealed that to meet the growing demand, suppliers were no longer keeping their counterfeiting practices secret. Instead, they are openly creating separate production lines to expedite the sales of counterfeit or refurbished chips. Furthermore, businesses are no longer offering the shoddy products at half price. Many are being sold at full market value.

The agent identified two types of counterfeit chips. The first involves recycling used chips from e-waste by removing the logo and cleaning them for resale with new packaging. The second involves packaging the substandard chips from the regular production line and selling them as good products.

Not surprisingly, customers were often dissatisfied with the product’s performance, reliability, and durability. However, the deficiencies were not immediately evident until after the chips were used over time or under extreme conditions. At which point, it would be the customers or manufacturer of the final products who suffer a loss, while the fake chip providers often avoid troubles, according to the chip agent.

Small and Medium-sized Enterprises Are Most Affected

China has long relied on imported chips. Small and medium-sized enterprises are unable to directly order from overseas manufacturers due to the small quantities, and can only purchase through third-party distributors. Thus, small and medium-sized enterprises in China have become the largest buyers of fake chips, and also the largest group of victims.

For example, a small company once designed a simple data acquisition card. The debugging stage always showed abnormal results. It raised concerns about the design. But through the help of a chip disassembly company that compared it with an authentic chip purchased through proper channels, they found that the problem stemmed from the chip being fake.

Some of the Fake Chips Flowed Overseas

The commercial district of Huaqiangbei in Shenzhen, Guangdong, is well known for its counterfeit chip dealers. It has become the largest distribution center for integrated circuit products in Asia. While most of the chips produced there stay in China, many are believed to be filling overseas supply chains, especially through the exporting of Chinese electronic products. It prompts legal liability concerns that rarely get resolved.

Zhu Yicong, a senior equity partner at Yingke (Shenzhen) Law Firm, told Chinese state media that legal actions are rarely taken against China’s questionable chip manufacturers. This is despite how China’s laws consider it illegal to offer “substandard”  or counterfeit products. But because the term “substandard” is ambiguous, independent examiners may be needed to prove the chips being sold are not genuine and reliable.

Another reason is that some buyers, due to supply shortages or cost-cutting, take a tacit attitude towards illegal chips, and deliberately mix the genuine chips with the fake ones, which encouraged the formation of a counterfeit industrial chain. Unfortunately, the end-users and consumers have to bear all the risks.

Authored by Winnie Han via The Epoch Times

 

The post Fake AMD Ryzen chips sold from several top named ecommerce websites appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/fake-amd-ryzen-chips-sold-from-several-top-named-ecommerce-websites/feed/ 0 Let’s Encrypt Revoking 3 Million TLS Certificates https://cvtfstudios.net/lets-encrypt-revoking-3-million-tls-certificates/ https://cvtfstudios.net/lets-encrypt-revoking-3-million-tls-certificates/#respond Wed, 04 Mar 2020 12:55:35 +0000 https://cvtfstudios.net/?p=68248 The most popular free certificate signing authority Let's Encrypt is going to revoke more than 3 million TLS certificates within the next 24 hours that may have been issued wrongfully due to a bug in its Certificate Authority software. The bug, which Let's Encrypt confirmed on February 29 and was fixed two hours after discovery, [...]

The post Let’s Encrypt Revoking 3 Million TLS Certificates appeared first on CVTF Studios.net.

]]>

The most popular free certificate signing authority Let’s Encrypt is going to revoke more than 3 million TLS certificates within the next 24 hours that may have been issued wrongfully due to a bug in its Certificate Authority software.

The bug, which Let’s Encrypt confirmed on February 29 and was fixed two hours after discovery, impacted the way it checked the domain name ownership before issuing new TLS certificates.

As a result, the bug opened up a scenario where a certificate could be issued even without adequately validating the holder’s control of a domain name.

The Certification Authority Authorization (CAA), an internet security policy, allows domain name holders to indicate to certificate authorities (CAs) whether or not they are authorized to issue digital certificates for a specific domain name.

Let’s Encrypt considers domain validation results good only for 30 days from the time of validation, after which it rechecks the CAA record authorizing that domain before issuing the certificate. The bug — which was uncovered in the code for Boulder, the certificate signing software used by Let’s Encrypt — is as follows:

“When a certificate request contained N domain names that needed CAA rechecking, Boulder would pick one domain name and check it N times.” In other words, when Boulder needed to parse, for example, a group of 5 domains names that required CAA rechecking, it would check one domain name 5 times as opposed to checking each of the 5 domains once.

The company said the bug was introduced as part of an update back in July 2019.

This means that Let’s Encrypt might have issued certificates that it shouldn’t have in the first place, as a result of which it’s revoking all the TLS certificates that were affected by the bug.

The development comes as Let’s Encrypt project announced last week that it had issued its one-billionth free TLS certificate since its launch in 2015.

SSL error page

Let’s Encrypt said 2.6 percent of approximately 116 million active certificates are affected — about 3,048,289 — out of which about one million are duplicates of other affected certificates.

Affected website owners have until 8PM UTC (3PM EST) March 4 to manually renew and replace their certificates, failing which visitors to the websites will be greeted with TLS security warnings — as the certificates are revoked — until the renewal process is complete.

It’s worth noting that the certificates issued by Let’s Encrypt are valid for a period of 90 days, and ACME clients such as Certbot are capable of automatically renewing them.

But with Let’s Encrypt revoking all impacted certificates, website admins will have to perform a forced renewal to prevent any interruptions.

Besides using the tool https://checkhost.unboundtest.com/ to check if a certificate needs replacement, Let’s Encrypt has put together a downloadable list of affected serial numbers, allowing subscribers to check if their websites rely on an affected certificate.

 

Have something to say about this article? Comment below or share it with us on Facebook, Twitter or our LinkedIn Group.

The post Let’s Encrypt Revoking 3 Million TLS Certificates appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/lets-encrypt-revoking-3-million-tls-certificates/feed/ 0 Crypto-Mining Supply Chain Attack Hits UK Gov’t websites https://cvtfstudios.net/cryptomining-supply-chain-attack-hits-government-websites/ https://cvtfstudios.net/cryptomining-supply-chain-attack-hits-government-websites/#respond Mon, 12 Feb 2018 15:08:57 +0000 https://cvtfstudios.net/?p=3567 This entry was posted in General Security, WordPress Security on February 11, 2018 by Mark Maunder . In the past 24 hours, Security researcher Scott Helme discovered that a third party accessibility plugin called ‘Browsealoud’ had their servers compromised. The plugin relies on a website including Javascript in their content in order to work. [...]

The post Crypto-Mining Supply Chain Attack Hits UK Gov’t websites appeared first on CVTF Studios.net.

]]>

This entry was posted in General Security, WordPress Security on February 11, 2018 by Mark Maunder .

In the past 24 hours, Security researcher Scott Helme discovered that a third party accessibility plugin called ‘Browsealoud’ had their servers compromised. The plugin relies on a website including Javascript in their content in order to work. This compromise resulted in over 4,000 websites serving up cryptomining malware.

The malware uses site visitor CPUs to mine for Monero cryptocurrency. The sites that use Browsealoud included the UK Information Commissioner’s office, UK National Health Service websites, an Australian provincial government website and many more.

Texthelp is the company that makes the Browsealoud plugin. They are reporting that their product was infected for four hours, affecting sites that use the Browsealoud plugin before it was take offline. The product remains offline while they investigate.

Cryptomining Attacks On The Rise

In November we wrote about a WordPress plugin that was banned for including cryptomining code, specifically CoinHive code that mines Monero currency. In that case, if a website used the banned plugin, any visitor to the site would see their browser CPU resources exploited to mine Monero and the proceeds were aggregated using CoinHive and sent to the plugin owner. Back then I included a video showing how CPU fan speed increases as the workload increases from Monero mining.

In December of last year, we wrote about a massive Monero cryptomining attack campaign that targeted WordPress.

Scott reports that this campaign also used CoinHive code to mine Monero and send the proceeds back to the attacker.

Supply Chain Attacks Have Wide Impact

On January 2nd of this year, my colleague Dan Moen wrote about the emerging threat of supply chain attacks. He had mentioned to me that, in light of the rise in supply chain attacks we saw in 2017 targeting WordPress, it is quite likely that 2018 is going to see a large number of these kinds of attacks affecting site owners and we had better get the word out, which we did.

As Dan wrote in January, “In the software industry, a supply chain attack exploits a trusted relationship between software vendors or authors and their customers.”. In that post we were focused on discussing the risk of compromised plugins affecting thousands of WordPress sites.

This is another kind of supply chain attack that affects the “trusted relationship between software vendors or authors and their customers”. You trust a service distributing Javascript to maintain site security. If that service is compromised, it affects any website using that code – potentially thousands of websites. As is the case with WordPress plugins, Javascript supply chain attacks allow a malicious actor to compromise thousands of websites with a single hack.

In the case of Browsealoud, the incident could have been much worse. The attacker could have stolen credentials from government websites in multiple countries. Instead, they simply exploited the CPU resources of site visitors to mine Monero cryptocurrency.

How To Protect Your Site and Site Visitors From JS Supply Chain Attacks

There is an easy way to protect yourself against Javascript supply chain attacks using a security feature called Subresource Integrity, or SRI. If you are including javascript code from an external source using the <SCRIPT> tag, simply include an ‘integrity’ attribute which will cause browsers to not load the script if it is modified from the original version.

Normally you’ll include a script like this:

To secure your site against JS supply chain attacks, change it to:

Making this change is easy. You can visit this page to generate a hash and the inclusion code from a script URL.

The ‘integrity’ attribute contains a ‘hash’ that uniquely identifies the content of the script. If that content changes, the browser can recognize that it has changed and will refuse to load the script. This gives site owners back control over what they load from remote servers, by refusing to load code that has changed from the original version.

You should be aware that once you use SRI and include a hash for your scripts, if the vendor changes the script, it will not load. This has the benefit of protecting your site visitors if a hacker compromises the vendor site and injects malware into the javascript that you are loading. But it also has the side effect that if a vendor updates their code at that same URL, your script will no longer load.

Some legacy vendors may rely on the ability to update their code at a URL whenever they please and have your site simply load the new code without you taking action. If a vendor includes a version number in the script URL, as in the jQuery URL above, then you probably don’t have to worry about this. But if the URL is something like //example.com/source/code/lives/here.js and there is no version specified, then check with the vendor to find out whether they will be updating the script you are using. They may need to notify you when they perform updates to avoid service interruptions.

In general I would avoid any vendor that insists on the ability to remotely update code without you making a change to your website code. It’s a security risk, as this case illustrates.

Javascript Supply Chain Attacks Are Real-Time

The thing that differentiates a JS supply chain attack from other forms is that, once the attacker installs their malicious code, victims are instantly affected. No action is required by the site administrator or site visitors. Code is being loaded per visit from the compromised server and the moment a code change is made, it is active in victim browsers.

This is different from application supply chain attacks or WordPress plugin supply chain attacks. An application supply chain attack needs a compromised application to be distributed before it exploits users. Desktop or mobile users need to upgrade to the new version before they are effected. Even if an auto-update is pushed out by the attacker somehow, there will be some delay before it is effective.

A WordPress plugin supply chain attack needs site owners to update to the new compromised plugin version before it is active. Javascript supply chain attacks are instantly active and being loaded by site visitors as soon as the attacker saves the file to the distribution web server. That is why it is critically important to use SRI for all external scripts on your site.

Please spread the word about the risk of Javascript supply chain attacks and how to mitigate them using Subresource Integrity or SRI.

Did you enjoy this post? Share it!

The post Crypto-Mining Supply Chain Attack Hits UK Gov’t websites appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/cryptomining-supply-chain-attack-hits-government-websites/feed/ 0 15000 compromised servers https://cvtfstudios.net/15000-compromised-servers-used-mine-various-cryptocurrencies/ https://cvtfstudios.net/15000-compromised-servers-used-mine-various-cryptocurrencies/#respond Thu, 04 Jan 2018 17:56:38 +0000 https://cvtfstudios.net/?p=3546 Swati Khandelwal Technical Writer, Security Blogger and IT Analyst. She is a Technology Enthusiast with a keen eye on the Cyberspace and other tech related developments. Link: https://thehackernews.com/2017/05/cryptocurrency-mining-botnet.html A new botnet consisting of more than 15,000 compromised servers has been used to mine various cryptocurrencies, earning [...]

The post 15000 compromised servers appeared first on CVTF Studios.net.

]]>
Swati - Hacking News
Technical Writer, Security Blogger and IT Analyst.
She is a Technology Enthusiast with a keen eye on the Cyberspace and other tech related developments.
Link: https://thehackernews.com/2017/05/cryptocurrency-mining-botnet.html

A new botnet consisting of more than 15,000 compromised servers has been used to mine various cryptocurrencies, earning its master around $25,000 per month.

Mining cryptocurrencies can be a costly investment, as it requires an enormous amount of computing power, but cybercriminals have found an easy money-making solution.

Dubbed BondNet, the botnet was first spotted in December 2016 by GuardiCore researchers, who traced back the botnet malware developer, using online handle Bond007.01, to China.

According to the GuardiCore researchers, Bond007.01 is currently using BondNet for mining cryptocurrencies
— primarily Monero, but also ByteCoin, RieCoin, and ZCash
— but they warn that the hacker could easily take full control of compromised servers for malicious purposes, like mounting Mirai-style DDoS attacks.

BondNet’s Botnet Infrastructure

One thing that’s worth noticing is that the botnet operator does not use all infected machines for mining cryptocurrencies. The operator has built its botnet infrastructure of compromised servers with various roles:

1. Some infected machines serve as scanning servers to check for vulnerable systems on the Internet by going through a list of IP addresses with open ports that have been compiled with the WinEggDrop TCP port scanner.

2. Some servers are used as file servers to host the mining software.

3. Other infected servers are turned into command-and-control (C&C) servers after they have been equipped with a fork of goup — a small open source HTTP server written in Golang.

“Building an attack infrastructure on top of victim machines helps conceal the attacker’s true identity and origin of the attack,” the GuardiCore researchers explained in their report published Thursday.

“It also provides high availability infrastructure, which is very helpful when relying on compromised servers, providing infinite backup options in case one of the servers fails or loses connectivity to the internet.”

BondNet has already infected more than 15,000 server machines at major institutions around the world, including high-profile global companies, universities, and city councils, while the majority of them runs Windows Server 2008 R2.

Additionally, the BondNet botnet adds around 500 new machines to its network each day, and an approximately the same number of servers are delisted.

Here’s How to Detect the Threat and How to Mitigate:


To prevent your machines from getting hacked, server admins are advised to secure their systems by regularly applying security patches for all software, updating the firmware, and employing stronger passwords.

Meanwhile, GuardiCore has also provided network and file indicators of compromise systems to help server administrators check whether their machines are among compromised ones.

The researchers have also released a detection & cleanup tool (registration is required to download it) to help admins find and remove BondNet bots from their servers, as well as instructions on how to clean the system manually, without using the script.

The post 15000 compromised servers appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/15000-compromised-servers-used-mine-various-cryptocurrencies/feed/ 0 Two critical vulnerabilities in Foxit Reader https://cvtfstudios.net/two-critical-vulnerabilities-in-foxit-reader/ https://cvtfstudios.net/two-critical-vulnerabilities-in-foxit-reader/#respond Tue, 03 Oct 2017 11:50:23 +0000 http://cvtfstudios.net/?p=3505 Using Foxit Reader? You might be vulnerable to network breaches Desktop Central | August 25, 2017 | 2 min read Cybersecurity and cyberattacks have become prominent topics lately. No matter how much you secure your network, vulnerabilities continue to emerge for different operating systems and applications. Most recently, security professionals have discovered two critical vulnerabilities [...]

The post Two critical vulnerabilities in Foxit Reader appeared first on CVTF Studios.net.

]]> Using Foxit Reader? You might be vulnerable to network breaches
Desktop Central | August 25, 2017 | 2 min read

Cybersecurity and cyberattacks have become prominent topics lately. No matter how much you secure your network, vulnerabilities continue to emerge for different operating systems and applications. Most recently, security professionals have discovered two critical vulnerabilities in a third-party PDF reading application called Foxit Reader. These vulnerabilities allow hackers to execute arbitrarily-defined code on a user‘s computer when Foxit Reader is used without Safe Reading Mode enabled.

Two critical zero–day vulnerabilities

On August 17th, researchers Steven Seeley and Ariele Caltabiano discovered two vulnerabilities in Foxit Reader:

1. CVE-2017-10951, which acts as a command injection bug that resides in the app.launchURL function and executes strings provided by hackers. This vulnerability is mainly due to improper validation.

2. CVE-2017-10952, which exists in the saveAs function and allows hackers to execute an arbitrarily–specified file on user computers. If the arbitrary file is modified, then hackers can modify anything on the end user’s computer. Steven Seeley has tested a proof of concept and published it on Zero Day Initiative.

How can you keep Foxit Reader safe?

1.Take precautions: Avoid downloading attachments from email addresses you don’t know. Opening a PDF from a nefarious sender could compromise your entire system.

2.Manually change settings: Whether you’re using Foxit Reader or Foxit Phantom PDF, go to the settings menu and enable Safe Reading Mode and uncheck Enable JavaScript Actions.

3.Employ automatic patch management: Doing all the ground work manually is tiresome and complicated, especially since the number of vulnerabilities per application continually increases. Regularly updating your network is one of the best ways to remain free from zero-day vulnerabilities. Stay vigilant by employing patch management software like Desktop Central, which manages and deploys patches automatically.

How can ManageEngine help?

ManageEngine offers two types of support for these Foxit Reader vulnerabilities:

1.Patch deployment

Desktop Central can patch Windows, Mac, Linux, and over 250 third-party applications, all from a central location. We have released an update specifically for Foxit products to automatically enable Safe Reading Mode in Foxit PDF applications.

2.Registry configuration

With Desktop Central, you can deploy specific registry configurations, including the Foxit-specific keys below, to managed computers.

Key for enabling Safe Reading Mode:
HKEY_CURRENT_USER\Software\Foxit Software\Foxit Reader 8.0\Preferences\TrustManager
bSafeMode=1 (Enable Safe Reading Mode)
bSafeMode=0 (Disable Safe Reading Mode)

Key for unchecking Enable JavaScript Actions:
HKEY_CURRENT_USER\Software\Foxit Software\Foxit Reader 8.0\Preferences\Others
bEnableJS=1 (Enable JavaScript Actions)
bEnableJS=0 (Disable JavaScript Actions)

Start using Desktop Central today to evade vulnerabilities and breaches happening across any third–party application.
Related posts :

The post Two critical vulnerabilities in Foxit Reader appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/two-critical-vulnerabilities-in-foxit-reader/feed/ 0 Update of WordPress to 4.8 https://cvtfstudios.net/update-wordpress-4-8/ https://cvtfstudios.net/update-wordpress-4-8/#respond Fri, 09 Jun 2017 16:05:56 +0000 http://cvtfstudios.net/?p=3471 WordPress 4.8 “Evans” Posted June 8, 2017 by Matt Mullenweg. Filed under Releases. An Update with You in Mind Gear up for a more intuitive WordPress! Version 4.8 of WordPress, named “Evans” in honor of jazz pianist and composer William John “Bill” Evans, is available for download or update in your WordPress dashboard. New features in 4.8 add [...]

The post Update of WordPress to 4.8 appeared first on CVTF Studios.net.

]]> WordPress 4.8 “Evans”
Posted June 8, 2017 by Matt Mullenweg. Filed under Releases.

An Update with You in Mind

Gear up for a more intuitive WordPress!

Version 4.8 of WordPress, named “Evans” in honor of jazz pianist and composer William John “Bill” Evans, is available for download or update in your WordPress dashboard. New features in 4.8 add more ways for you to express yourself and represent your brand.

Though some updates seem minor, they’ve been built by hundreds of contributors with you in mind. Get ready for new features you’ll welcome like an old friend: link improvements, three new media widgets covering images, audio, and video, an updated text widget that supports visual editing, and an upgraded news section in your dashboard which brings in nearby and upcoming WordPress events.

Exciting Widget Updates


Image Widget

Adding an image to a widget is now a simple task that is achievable for any WordPress user without needing to know code. Simply insert your image right within the widget settings. Try adding something like a headshot or a photo of your latest weekend adventure — and see it appear automatically.

Video Widget

A welcome video is a great way to humanize the branding of your website. You can now add any video from the Media Library to a sidebar on your site with the new Video widget. Use this to showcase a welcome video to introduce visitors to your site or promote your latest and greatest content.

Audio Widget

Are you a podcaster, musician, or avid blogger? Adding a widget with your audio file has never been easier. Upload your audio file to the Media Library, go to the widget settings, select your file, and you’re ready for listeners. This would be a easy way to add a more personal welcome message, too!

Rich Text Widget

This feature deserves a parade down the center of town! Rich-text editing capabilities are now native for Text widgets. Add a widget anywhere and format away. Create lists, add emphasis, and quickly and easily insert links. Have fun with your newfound formatting powers, and watch what you can accomplish in a short amount of time.

The post Update of WordPress to 4.8 appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/update-wordpress-4-8/feed/ 0