FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

TikTok “Invisible Challenge” porn malware puts us all at risk

By Paul Ducklin
An injury to one is an injury to all. Especially if the other people are part of your social network.

Chrome fixes 8th zero-day of 2022 – check your version now (Edge too!)

By Paul Ducklin
There isn't a rhyme to remind you which months have browser zero-days... you just have to keep your eyes and ears open!

Voice-scamming site “iSpoof” seized, 100s arrested in massive crackdown

By Naked Security writer
Those numbers or names that pop up when a call comes up? They're OK as a hint of who's calling, but THEY PROVE NOTHING

S3 Ep110: Spotlight on cyberthreats – an expert speaks [Audio + Text]

By Paul Ducklin
Latest episode - security expert John Shier explains what the real-life cybercrime stories in the Sophos Threat Report can teach us

How to hack an unpatched Exchange server with rogue PowerShell code

By Paul Ducklin
Review your servers, your patches and your authentication policies - there's a proof-of-concept out

Firefox fixes fullscreen fakery flaw – get the update now!

By Paul Ducklin
What's so bad about a web page going fullscreen without warning you first?

Log4Shell-like code execution hole in popular Backstage dev tool

By Paul Ducklin
Good old "string templating", also known as "string interpolation", in the spotlight again...

bs-1200

S3 Ep108: You hid THREE BILLION dollars in a popcorn tin?

By Paul Ducklin
Patches, busts, leaks and why even low-likelihood exploits can be high-severity risks - listen now!

Emergency code execution patch from Apple – but not an 0-day

By Paul Ducklin
Not a zero-day, but important enough for a quick-fire patch to one system library...

Silk Road drugs market hacker pleads guilty, faces 20 years inside

By Paul Ducklin
Jurisprudence isn't like arithmetic... two negatives never make a positive!

The OpenSSL security update story – how can you tell what needs fixing?

By Paul Ducklin
How to Hack! Finding OpenSSL library files and accurately identifying their version numbers...

ossl-code-1200

OpenSSL patches are out – CRITICAL bug downgraded to HIGH, but patch anyway!

By Paul Ducklin
That bated-breath OpenSSL update is out! It's no longer rated CRITICAL, but we advise you to patch ASAP anyway. Here's why...

SHA-3 code execution bug patched in PHP – check your version!

By Paul Ducklin
As everyone waits for news of a bug in OpenSSL, here's a reminder that other cryptographic code in your life may also need patching!

Chrome issues urgent zero-day fix – update now!

By Paul Ducklin
We've said it before/And we'll say it again/It's not *if* you should patch/It's a matter of *when*. (Hint: now!)

Clearview AI image-scraping face recognition service hit with €20m fine in France

By Paul Ducklin
"We told you to stop but you ignored us," said the French regulator, "so now we're coming after you again."

Apple megaupdate: Ventura out, iOS and iPad kernel zero-day – act now!

By Paul Ducklin
Ventura hits the market with 112 patches, Catalina's gone missing, and iPhones and iPads get a critical kernel-level zero-day patch...

Zoom for Mac patches sneaky “spy-on-me” bug – update now!

By Paul Ducklin
Hey! That back door isn't supposed to be there at all, let alone propped open...

Mystery iPhone update patches against iOS 16 mail crash-attack

By Paul Ducklin
The problem with crashy messaging apps is that *other people* get to choose if and when to send you messages...

S3 Ep102: How to avoid a data breach [Audio + Transcript]

By Paul Ducklin
Latest episode - listen now! Tell fact from fiction in hyped-up cybersecurity news...

WhatsApp “zero-day exploit” news scare – what you need to know

By Paul Ducklin
Is WhatsApp currently under active attack by cybercriminals? Is this a clear and current danger? How worried should WhatsApp users be?

S3 Ep101: Uber and LastPass breaches – is 2FA all it’s cracked up to be? [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Learn why adopting 2FA isn't a reason to relax your other security precautions...

Interested in cybersecurity? Join us for Security SOS Week 2022!

By Paul Ducklin
Four one-on-one interviews with experts who are passionate about sharing their expertise with the community.

S3 Ep100.5: Uber breach – an expert speaks [Audio + Text]

By Paul Ducklin
Chester Wisniewski on what we can learn from Uber: "Just because a big company didn't have the security they should doesn't mean you can't."

S3 Ep100: Browser-in-the-Browser – how to spot an attack [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Cosmic rockets, zero-days, spotting cybercrooks, and unlocking the DEADBOLT...

s3-ep100-js-1200

Serious Security: Browser-in-the-browser attacks – watch out for windows that aren’t!

By Paul Ducklin
Simple but super-sneaky - use a picture of a browser, and convince people it's real...

pipe-light-not-1200

Apple patches zero-day holes – even in the brand new iOS 16

By Paul Ducklin
Five updates, one upgrade, plus two zero-days. Patch your Macs, iPhones and iPads as soon as you can (again)...

apple-plus-16-1200

How to deal with dates and times without any timezone tantrums…

By Paul Ducklin
Heartfelt encouragement to embrace RFC 3339 - find out why!

Chrome and Edge fix zero-day security hole – update now!

By Paul Ducklin
This time, the crooks got there first - only 1 security hole patched, but it's a zero-day.

Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43

By Paul Ducklin
This site, like millions of others, has a certificate from Let's Encrypt. Farewell, Peter Eckersley, PhD, who helped make it all possible.

URGENT! Apple slips out zero-day update for older iPhones and iPads

By Paul Ducklin
Patch as soon as you can - that recent WebKit zero-day affecting new iPhones and iPads is apparently being used against older models, too.

JavaScript bugs aplenty in Node.js ecosystem – found automatically

By Paul Ducklin
How to get the better of bugs in all the possible packages in your supply chain?

Firefox 104 is out – no critical bugs, but update anyway

By Paul Ducklin
Two trust-spoofing bugs were the main culprits this month - but neither one was a zero-day.

Breaching airgap security: using your phone’s gyroscope as a microphone

By Paul Ducklin
One bit per second makes the Voyager probe data rate seem blindingly fast. But it's enough to break your security assumptions...

Bitcoin ATMs leeched by attackers who created fake admin accounts

By Paul Ducklin
The criminals didn't implant any malware. The attack was orchestrated via malevolent configuration changes.

Laptop denial-of-service via music: the 1980s R&B song with a CVE!

By Paul Ducklin
We haven't validated this vuln ourselves... but the source of the story is impeccable. (Impeccably dressed, at least.)

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

Zoom for Mac patches critical bug – update now!

By Paul Ducklin
There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

By Paul Ducklin
If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

Traffic Light Protocol for cybersecurity responders gets a revamp

By Paul Ducklin
Traffic lights make a handy global metaphor for denoting the sensitivity of cybersecurity threat data - three colours that everyone knows.

❌