FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Harmony blockchain loses nearly $100M due to hacked private keys

By Paul Ducklin
The crooks needed at least two private keys, each stored in two parts... but they got them anyway.

FTC warns of LGBTQ+ extortion scams – be aware before you share!

By Paul Ducklin
It's a simple jingle and it's solid advice: "If in doubt, don't give it out!"

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

Capital One identity theft hacker finally gets convicted

By Paul Ducklin
It took three years, but the Capital One cracker was convicted in the end. Don't get caught out in a data breach of your own!

Interpol busts 2000 suspects in phone scamming takedown

By Paul Ducklin
Friends don't let friends get scammed. Not everyone knows how typical scams unfold, so here are some real-world examples...

You’re invited! Join us for a live walkthrough of the “Follina” story…

By Paul Ducklin
Live demo, plain English, no sales pitch, just a chance to watch an attack dissected in safety. Join us if you can!

SSNDOB Market domains seized, identity theft “brokerage” shut down

By Paul Ducklin
The online identity "brokerage" SSNDOB Market didn't want people to be in any doubt what it was selling.

Firefox 101 is out, this time with no 0-day scares (but update anyway!)

By Paul Ducklin
After an intriguing month of Firefox releases, here's one with a bit less drama, probably to the collective relief of Mozilla's coders.

Mysterious “Follina” zero-day hole in Office – here’s what to do!

By Paul Ducklin
News has emerged of a "feature" in Office that has been abused as a zero-day bug to run evil code. Turning off macros doesn't help!

Beware the Smish! Home delivery scams with a professional feel…

By Paul Ducklin
Home delivery scams are getting leaner, and meaner, and more likely to "look about right". Here's an example to show you what we mean...

Who’s watching your webcam? The Screencastify Chrome extension story…

By Paul Ducklin
When you really need to make exceptions in cybersecurity, specify them as explicitly as you can.

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

Clearview AI face-matching service fined a lot less than expected

By Paul Ducklin
The fine has finally gone through... but it's less than 45% of what was originally proposed.

eleceye-1200

Microsoft patches the Patch Tuesday patch that broke authentication

By Paul Ducklin
Remember the good old days when security patches rarely needed patches? Because security patches themlelves were rare enough anyway?

US Government says: Patch VMware right now, or get off our network

By Paul Ducklin
Find and patch. Right now. If you can't patch, get it off the network. Right now! Oh, and show us what you did to comply.

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

Apple patches zero-day kernel hole and much more – update now!

By Paul Ducklin
You'll find fixes for numerous kernel-level code execution holes, including an 0-day vulnerability in many (though not all) versions.

Firefox out-of-band update to 100.0.1 – just in time for Pwn2Own?

By Paul Ducklin
A new point-release of Firefox. Not unusual, but the timing of this one is interesting, with Pwn2Own coming up in a few days.

He sold cracked passwords for a living – now he’s serving 4 years in prison

By Paul Ducklin
Crooks don't need a password for every user on your network to break in and wreak havoc. One could be enough...

S3 Ep82: Bugs, bugs, bugs (and Colonial Pipeline again) [Podcast]

By Paul Ducklin
Latest episode - lots to learn - plain English - fun with a serious side - listen now!

Serious Security: Learning from curl’s latest bug update

By Paul Ducklin
Learn how to write plain-speaking and purposeful security advisories from one of the most widely-used open source tools in the world.

Colonial Pipeline facing $1,000,000 fine for poor recovery plans

By Paul Ducklin
How good is your cybersecurity? Are you making the same mistakes as lots of other people? Here's some real-life advice...

RubyGems supply chain rip-and-replace bug fixed – check your logs!

By Paul Ducklin
Imagine if you could assume the identity of, say, Franklin Delano Roosevelt simply by showing up and calling yourself "Frank".

ruby-1200

You didn’t leave enough space between ROSE and AND, and AND and CROWN

By Paul Ducklin
What weird Google Docs bug connects the words THEREFORE, AND, SECONDLY, WHY, BUT and BESIDES?

World Password Day – the 1960s just called and gave you your passwords back

By Paul Ducklin
Yes, passwords are going away. No, it won't happen tomorrow. So it's still worth knowing the basics of picking proper passwords.

Android monthly updates are out – critical bugs found in critical places!

By Paul Ducklin
Android May 2022 updates are out - with some critical fixes in some critical places. Learn more...

Firefox hits 100*, fixes bugs… but no new zero-days this month

By Paul Ducklin
Despite concerns that some websites might break when Chromium and then Firefox reached version 100, the web still seems to be intact.

GitHub issues final report on supply-chain source code intrusions

By Paul Ducklin
Learn how to find out which apps you've given access rights to, and how to revoke those rights immediately in an emergency.

Ransomware Survey 2022 – like the Curate’s Egg, “good in parts”

By Paul Ducklin
You might not like the headline statistics in this year's ransomware report... but that makes it even more important to take a look!

Phishing goes KISS: Don’t let plain and simple messages catch you out!

By Paul Ducklin
Sometimes we receive phishing tricks that we grudgingly have to admit are better than average, just because they're uncomplicated.

QNAP warns of new bugs in its Network Attached Storage devices

By Paul Ducklin
Here's what you need to know - plus some sensible advice for all the devices on your home or small biz network!

nas-1200

Critical cryptographic Java security blunder patched – update now!

By Paul Ducklin
Either know the private key and use it scrupulously in your digital signature calculation.... or just send a bunch of zeros instead.

Beanstalk cryptocurrency heist: scammer votes himself all the money

By Paul Ducklin
Voting safeguards based on commuity collateral don't work if one person can use a momentary loan to "become" 75% of the community.

Yet another Chrome zero-day emergency update – patch now!

By Paul Ducklin
The third emergency Chrome 0-day in three months - the first one was exploited by North Korea, so you might as well get this one ASAP.

US cryptocurrency coder gets 5 years for North Korea sanctions busting

By Naked Security writer
Cryptocurrency expert didn't take "No" for an answer when the US authorities said he couldn't pursue cryptocoin opps in North Korea.

Hospital robot system gets five critical security holes patched

By Paul Ducklin
Fortunately, we're not talking about a robot revolution, or about hospital AI run amuck. But these bugs could lead to ransomware, or worse...

OpenSSH goes Post-Quantum, switches to qubit-busting crypto by default

By Paul Ducklin
Useful quantum computers might not actually be possible. But what if they are? And what if they arrive, say, tomorrow?

cat-1200

Popular Ruby Asciidoc toolkit patched against critical vuln – get the update now!

By Paul Ducklin
A rogue line-continuation character can trick the code into validating just the second half of the line, but executing all of it.

ruby-1200

Serious Security: Darkweb drugs market Hydra taken offline by German police

By Paul Ducklin
Why are Tor sites hard to locate and therefore difficult to take down? We explain in plain English...

Firefox 99 is out – no major bugs, but update anyway!

By Paul Ducklin
Firefox's four-weekly updates just dropped - here's what you need to know.

Google’s monthly Android updates patch numerous “get root” holes

By Paul Ducklin
Get the update now... if it's available for your phone. Here's how to check.

android-1200

LAPSUS$ hacks continue despite two hacker suspects in court

By Paul Ducklin
Do you know where in your company to report security anomalies? If you receive such reports, do you have an efficient way to process them?

Apple pushes out two emergency 0-day updates – get ’em now!

By Paul Ducklin
More Apple zero-days - mobile devices, laptops and desktops affected. Update now!

apple-1200

❌