Vulnerabilities
NCSC‑Engineered SilentGlass Blocks Malicious HDMI/DisplayPort Connections
The National Cyber Security Centre has released SilentGlass, a plug‑in device that actively blocks unexpected or malicious HDMI and DisplayPort links between monitors and laptops. The product, manufactured by Goldilock Labs under an NCSC‑licensed brand, protects organisations from compromised display‑link attacks. Defenders should deploy SilentGlass on critical workstations and monitor for unauthorized cable activity.
What happened
The NCSC announced SilentGlass, a plug‑and‑play hardware module that intercepts HDMI and DisplayPort connections and blocks any link that is not explicitly authorised. The device is the first commercial product to carry an NCSC‑approved security label.
Impact
Vulnerable organisations that rely on external monitors or use unmanaged display‑link cables are exposed to a class of side‑channel attacks that can inject malicious video streams or exfiltrate data. SilentGlass mitigates this risk by enforcing a whitelist of trusted devices and terminating any connection that fails authentication.
What to do
- Identify all workstations and servers that use HDMI or DisplayPort to external displays.
- Replace or insert SilentGlass between the host and the monitor; the device requires no drivers and is fully plug‑and‑play.
- Configure the device’s management console to maintain a list of approved display adapters and to receive alerts for blocked connections.
- Integrate SilentGlass logs into your SIEM or endpoint detection platform to correlate with other display‑link activity.
Deployment notes
SilentGlass is compatible with all major operating systems and supports both 4K and legacy 1080p resolutions. The unit is powered via the same HDMI/DP cable, so no additional power supply is needed. It is available through NCSC‑certified resellers and can be deployed in less than 30 minutes per workstation.
Further reading
For detailed configuration instructions and firmware updates, consult the NCSC product guide or contact your local NCSC representative.
Related vulnerabilities
FortiPAM Chrome Extension Vulnerability Enables Remote Traffic Proxying (CWE-287)
Fortinet’s Privileged Access Agent Chrome Extension contains an improper authentication flaw (CWE‑287) that lets an unauthenticated attacker proxy a user’s browser traffic through malicious servers when the user visits a compromised site. The vulnerability scores 9.1 on CVSS v3 and affects all users of the extension. Immediate action is required: update or remove the extension, block outbound connections to untrusted proxies, and monitor for anomalous traffic.
Read briefing
CrowdStrike Tightens Falcon Sensor to Block Malicious Open‑Source Packages in Real Time
CrowdStrike has upgraded its Falcon platform to embed supply‑chain protection directly into the endpoint sensor. The new capability detects and blocks malicious open‑source packages the moment they’re downloaded, giving defenders a first‑line defense against supply‑chain attacks before code ever runs.
Read briefing
PhantomRaven: LLM‑Generated JavaScript Stealer Targeting Bug Bounty Hunters
CrowdStrike uncovered PhantomRaven, a JavaScript‑based information stealer engineered by a financially motivated threat actor posing as a bug‑bounty researcher. The tool harvests credentials and sensitive data from compromised web pages, and its code is distributed via malicious sites and phishing campaigns. Defenders should audit third‑party scripts, enforce strict CSP, and monitor for anomalous data exfiltration.
Read briefing
Zero-Click Candiru Spyware Reaches Al Jazeera via Targeted Online Ads
Researchers confirm that Candiru spyware infected at least 45 Al Jazeera devices through invisible ads, requiring no user interaction. The attack chain began with a Discover‑Tech ad server that identified targets and delivered malicious code to browsers or apps. Defenders should audit ad networks, block suspicious ad domains, and monitor for unexpected outbound connections to known spyware command‑and‑control hosts.
Read briefing