U.N. human rights chief Volker Turk said on Friday he was determined to engage with Beijing over the findings of a report issued by his predecessor that said China’s treatment of Uyghurs and other Muslims in its Xinjiang region may constitute crimes against humanity.

Grappling with the human rights record of powerful ‘P5’ Security Council member China is one of the thorniest issues facing the new high commissioner since he started in October.

Beijing pressured Turk’s predecessor, Michelle Bachelet, not to publish the report, Reuters revealed, and she only did so within a few minutes of the end of her term.

“The report that was issued on 31 August is a very important one and has highlighted very serious human rights concerns,” Turk told reporters at a Geneva briefing in his first public comments on the matter since taking office.

“I will personally continue engaging with the authorities. I’m very determined to do so,” he said, adding that “hope springs eternal.”

China, which denies the Xinjiang allegations, has previously indicated that it would close the door to cooperation with the U.N. human rights office after the report’s release.

A Western-led effort to launch a debate on the Xinjiang report at the Human Rights Council failed in October amid heavy lobbying against it from China.

---

World stocks rose on Friday on expectations China’s economy would strengthen as COVID-19 curbs ease, but stocks were heading for a 2% weekly loss in nervy markets ahead of the Federal Reserve’s policy meeting next week.

U.S. S&P futures were up 0.18%, while European stocks (.STOXX) were steady.

China’s Premier Li Keqiang, in comments carried by state media, said on Thursday the country’s shift in COVID-19 policy would allow the economy to pick up pace, a day after a top-level party meeting pledged to focus on stabilising growth while optimising pandemic measures.

Fed policymakers meet next week and are likely to announce a 50 basis point hike in the U.S. central bank’s lending rate, while indicating a slower pace of future rate hikes.

“The market is very much focused on what the Fed is going to do on Wednesday, no one wants to take on any big positions,” said Giles Coghlan, chief currency analyst at HYCM, though he added that Chinese stocks were helped by the fact that China had “made that COVID pivot”.

The MSCI world equity index (.MIWD00000PUS) rose 0.22%, while MSCI’s broadest index of Asia-Pacific shares outside Japan gained 1.2% (.MIAPJ0000PUS), edging closer to a three-month high hit earlier in the week.

Japan’s Nikkei (.N225) climbed 1.2%. Britain’s FTSE (.FTSE) lost 0.2% to an 11-day low, hurt by energy stocks .

Hong Kong’s Hang Seng index (.HSI) jumped 2.3% to three-month highs, with mainland developers (.HSMPI) up a whopping 9.9% to a four-month high. Chinese blue chips (.CSI300) rose 1% to their highest in nearly three months.

The world’s largest investment banks expect global economic growth to slow further in 2023 following a year roiled by the Ukraine conflict and soaring inflation, which triggered one of the fastest monetary policy tightening cycles in recent times.

The U.S. producer price index for final demand is forecast later on Friday to show a rise of 7.2% in the 12 months through October, down from 8% last month, ahead of closely-watched consumer price inflation data next week.

University of Michigan sentiment data is also due later on Friday.

Data on Thursday showed some loosening in the U.S. labour market, with weekly jobless claims rising moderately.

Futures have priced in a near-certain possibility that the Fed will slow down its rate hike to 50 basis points next week, but the target U.S. federal funds rate would have to peak around 4.9% by next May.

“This slowing is not a signal that the central bank’s job is nearly done…the slower pace of hikes starts a new phase of the Fed’s tightening cycle,” said Brian Martin, head of G3 economics at ANZ.

“With inflation proving sticky and the labour market still buoyant, the risks to our 5.00% terminal view are to the topside.”

In addition to the Fed, the European Central Bank and the Bank of England are also set to announce interest rate decisions next week as policymakers continue to tap the brakes on economic growth through firmer rates to thwart stubbornly high inflation.

The U.S. dollar was steady against a basket of major currencies on Friday. It weakened 0.3% against the Japanese yen to 136.28 yen.

The euro was flat against the greenback at $1.0557, below a recent five-month high of $1.0594.

The yield on benchmark 10-year Treasury notes eased 2 basis points to 3.4760%. The two-year yield weakened 3 bps to 4.28%.

Treasury yields fell to the lowest in three years earlier in the week on expectations of slower growth or that a recession will curb the rise in U.S. rates.

German 10-year government bond yields , the benchmark for the euro zone, gained 3 bps to 1.85%.

Commodity prices rallied, with prices for iron ore surging 4.7% to the highest in six months amid hopes of improved demand from China.

Oil was steady as closure of a major Canada-to-U.S. crude pipeline disrupted supplies, but both benchmarks were heading for a weekly loss on worries over slowing global demand growth.

U.S. West Texas Intermediate (WTI) crude futures dipped 0.1% to $71.43 per barrel, while Brent crude was steady at $76.09 a barrel.

Spot gold rose 0.1% to $1791.59 per ounce.

Related Galleries:

Claroty researchers devised a technique for bypassing the web application firewalls (WAF) of several vendors.

Researchers at industrial and IoT cybersecurity firm Claroty devised an attack technique for bypassing the web application firewalls (WAF) of several industry-leading vendors.

The technique was discovered while conducting unrelated research on Cambium Networks’ wireless device management platform.

The researchers discovered a Cambium SQL injection vulnerability that they used to exfiltrate users’ sessions, SSH keys, password hashes, tokens, and verification codes.

The experts pointed out that they were able to exploit the SQL injection vulnerability against the on-premises version, while hacking attempts against the cloud version were blocked by the Amazon Web Services (AWS) WAF.

Then the experts started investigating how to bypass the AWS WAF.

The researchers discovered that appending JSON syntax to SQL injection payloads allows bypassing the WAF because it is unable to parse it. 

“Using JSON syntax, it is possible to craft new SQLi payloads. These payloads, since they are not commonly known, could be used to fly under the radar and bypass many security tools.” reads the report published by Claroty. “Using syntax from different database engines, we were able to compile the following list of true statements in SQL:

• PostgreSQL: ‘{“b”:2}’::jsonb <@ ‘{“a”:1, “b”:2}’::jsonb Is the left JSON contained in the right one? True.
• SQLite: ‘{“a”:2,”c”:[4,5,{“f”:7}]}’ -> ‘$.c[2].f’ = 7 Does the extracted value of this JSON equals 7? True.
• MySQL: JSON_EXTRACT(‘{“id”: 14, “name”: “Aztalan”}’, ‘$.name’) = ‘Aztalan’ Does the extracted value of this JSON equals to ‘Aztalan’? True.”

Claroty researchers used the JSON operator ‘@<’ to throw the WAF into a loop and supply malicious SQLi payloads.

The researchers verifies that the bypass attack technique also worked against firewalls from other vendors, including Cloudflare, F5, Imperva, and Palo Alto Networks.

“We discovered that the leading vendors’ WAFs did not support JSON syntax in their SQL injection inspection process, allowing us to prepend JSON syntax to a SQL statement that blinded a WAF to the malicious code.” the report concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, WAF)

The post Experts devised a technique to bypass web application firewalls (WAF) of several vendors appeared first on Security Affairs.

The U.S. health regulator has authorized COVID-19 shots from Moderna (MRNA.O) and Pfizer (PFE.N) and its partner BioNTech (22UAy.DE) that target both the original coronavirus and Omicron sub-variants for use in children as young as 6 months of age.

The amended authorization on Thursday from the Food and Drug Administration allows use of Moderna’s bivalent shot as a booster in children 6 months through 5 years of age, two months after their initial vaccination.

Pfizer/BioNTech’s updated shot can now be given as a third dose to those aged 6 months through 4 years, who have not completed their primary vaccination series or are yet to receive the third dose.

Children who have completed their initial three-dose vaccination with Pfizer’s original shot are not yet eligible to receive the bivalent booster, the agency said.

The regulator added that data supporting use of Pfizer/BioNTech’s bivalent shot as a booster in this age group is expected in January.

Shots for youngest children in the United States were only approved in June this year, making them the last group to become eligible for vaccination.

Government data shows that only 2.7% children under the age of two and less than 5% of children aged two to four years who are eligible have completed their primary vaccination series as of Nov. 30, representing a slow uptake of the initial vaccine doses in young children.

Moderna’s vaccine for children under 6 is a two-dose, 25 microgram vaccine, with the shots given about four weeks apart. The Pfizer/BioNTech vaccine for the youngest children is a lower dose, 3-shot regimen given over at least 11 weeks.

Overall, 39.7 million people in United States have received a bivalent booster as of Nov. 30, data from the Centers for Disease Control and Prevention showed.

Related Galleries: