FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

BEC fraudster and romance scammer sent to prison for 25 years

By Paul Ducklin
Two years of scamming + $10 million leeched = 25 years in prison. Just in time for #Cybermonth.

rs-1200

Scammers and rogue callers – can anything ever stop them?

By Paul Ducklin
Some thoughts for Cybersecurity Awareness Month: Is is worth reporting nuisance calls? Is it even worth reporting outright scams?

S3 Ep102: How to avoid a data breach [Audio + Transcript]

By Paul Ducklin
Latest episode - listen now! Tell fact from fiction in hyped-up cybersecurity news...

Optus breach – Aussie telco told it will have to pay to replace IDs

By Paul Ducklin
Licence compromised? Passport number burned? Need a new one? Who's going to pay?

WhatsApp “zero-day exploit” news scare – what you need to know

By Paul Ducklin
Is WhatsApp currently under active attack by cybercriminals? Is this a clear and current danger? How worried should WhatsApp users be?

Uber and Rockstar – has a LAPSUS$ linchpin just been busted (again)?

By Paul Ducklin
Is this the same suspect as before? Is he part of LAPSUS$? Is this the man who hacked Uber and Rockstar? And, if so, who else?

Morgan Stanley fined millions for selling off devices full of customer PII

By Paul Ducklin
Critical data on old disks always seems inaccessible if you really need it. But when you DON''T want it back, guess what happens...

S3 Ep101: Uber and LastPass breaches – is 2FA all it’s cracked up to be? [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Learn why adopting 2FA isn't a reason to relax your other security precautions...

Interested in cybersecurity? Join us for Security SOS Week 2022!

By Paul Ducklin
Four one-on-one interviews with experts who are passionate about sharing their expertise with the community.

LastPass source code breach – incident response report released

By Paul Ducklin
Wondering how you'd handle a data breach report if the worst happened to you? Here's a useful example.

S3 Ep100.5: Uber breach – an expert speaks [Audio + Text]

By Paul Ducklin
Chester Wisniewski on what we can learn from Uber: "Just because a big company didn't have the security they should doesn't mean you can't."

UBER HAS BEEN HACKED, boasts hacker – how to stop it happening to you

By Paul Ducklin
Uber is all over the news for a widely-publicised data breach. We help you answer the question, "How do I stop this happening to me?"

S3 Ep100: Browser-in-the-Browser – how to spot an attack [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Cosmic rockets, zero-days, spotting cybercrooks, and unlocking the DEADBOLT...

s3-ep100-js-1200

Serious Security: Browser-in-the-browser attacks – watch out for windows that aren’t!

By Paul Ducklin
Simple but super-sneaky - use a picture of a browser, and convince people it's real...

pipe-light-not-1200

Apple patches zero-day holes – even in the brand new iOS 16

By Paul Ducklin
Five updates, one upgrade, plus two zero-days. Patch your Macs, iPhones and iPads as soon as you can (again)...

apple-plus-16-1200

How to deal with dates and times without any timezone tantrums…

By Paul Ducklin
Heartfelt encouragement to embrace RFC 3339 - find out why!

DEADBOLT ransomware rears its head again, attacks QNAP devices

By Paul Ducklin
NAS devices make it easy for anyone to add high-capacity file servers to their network. Guess why cybercrooks love NAS devices too...

Chrome and Edge fix zero-day security hole – update now!

By Paul Ducklin
This time, the crooks got there first - only 1 security hole patched, but it's a zero-day.

Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43

By Paul Ducklin
This site, like millions of others, has a certificate from Let's Encrypt. Farewell, Peter Eckersley, PhD, who helped make it all possible.

URGENT! Apple slips out zero-day update for older iPhones and iPads

By Paul Ducklin
Patch as soon as you can - that recent WebKit zero-day affecting new iPhones and iPads is apparently being used against older models, too.

JavaScript bugs aplenty in Node.js ecosystem – found automatically

By Paul Ducklin
How to get the better of bugs in all the possible packages in your supply chain?

LastPass source code breach – do we still recommend password managers?

By Paul Ducklin
What does the recent LastPass breach mean for password managers? Just a bump in the road, or a reason to ditch them entirely?

Firefox 104 is out – no critical bugs, but update anyway

By Paul Ducklin
Two trust-spoofing bugs were the main culprits this month - but neither one was a zero-day.

Breaching airgap security: using your phone’s gyroscope as a microphone

By Paul Ducklin
One bit per second makes the Voyager probe data rate seem blindingly fast. But it's enough to break your security assumptions...

Bitcoin ATMs leeched by attackers who created fake admin accounts

By Paul Ducklin
The criminals didn't implant any malware. The attack was orchestrated via malevolent configuration changes.

Laptop denial-of-service via music: the 1980s R&B song with a CVE!

By Paul Ducklin
We haven't validated this vuln ourselves... but the source of the story is impeccable. (Impeccably dressed, at least.)

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

US offers reward “up to $10 million” for information about the Conti gang

By Naked Security writer
Wanted - Reward Offered - Five unknown individuals (plus a man with a weird hat)

Zoom for Mac patches critical bug – update now!

By Paul Ducklin
There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

By Paul Ducklin
If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

Slack admits to leaking hashed passwords for five years

By Paul Ducklin
"When those invitations went out... somehow, your password hash went out with them."

Traffic Light Protocol for cybersecurity responders gets a revamp

By Paul Ducklin
Traffic lights make a handy global metaphor for denoting the sensitivity of cybersecurity threat data - three colours that everyone knows.

GitHub blighted by “researcher” who created thousands of malicious projects

By Paul Ducklin
If you spew projects laced with hidden malware into an open source repository, don't waste your time telling us "no harm done" afterwards.

Post-quantum cryptography – new algorithm “gone in 60 minutes”

By Paul Ducklin
And THIS is why you don't knit your own home-made encryption algorithms and hope no one looks at them.

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

How to celebrate SysAdmin Day!

By Paul Ducklin
I've just popped in to wish you all/The best SysAdmin Day!

Critical Samba bug could let anyone become Domain Admin – patch now!

By Paul Ducklin
It's a serious bug... but there's a fix for it, so you know exactly what to do!

Mild monthly security update from Firefox – but update anyway

By Paul Ducklin
You're probably thinking we're going to say, "Don't delay/Do it today"... and that's exactly what we are saying!

T-Mobile to cough up $500 million over 2021 data breach

By Paul Ducklin
Technically, it's not a fine, and the lawyers will get a big chunk of it. But it still adds up to a half-billion-dollar data breach.

Office macro security: on-again-off-again feature now BACK ON AGAIN!

By Paul Ducklin
20 years to turn it on, then 20 weeks to turn it off, then just 2 weeks to turn it back on again. That's progress!

Last member of Gozi malware troika arrives in US for criminal trial

By Paul Ducklin
His co-conspirators went into and got out of prison years ago, while he remained free. Now the tables have turned...

7 cybersecurity tips for your summer vacation!

By Paul Ducklin
Here you go - seven thoughtful cybersecurity tips to help you travel safely...

S3 Ep91: CodeRed, OpenSSL, Java bugs, Office macros [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Great discussion, technical content, solid advice... all covered in plain English.

Facebook 2FA scammers return – this time in just 21 minutes

By Paul Ducklin
Last time they arrived 28 minutes after lighting up their fake domain... this time it was just 21 minutes

Paying ransomware crooks won’t reduce your legal risk, warns regulator

By Paul Ducklin
"We paid the crooks to keep things under control and make a bad thing better"... isn't a valid excuse. Who knew?

❌