FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Tracers in the Dark: The Global Hunt for the Crime Lords of Crypto

By Paul Ducklin
Hear renowned cybersecurity author Andy Greenberg's thoughtful commentary about the "war on crypto" as we talk to him about his new book...

Finnish psychotherapy extortion suspect arrested in France

By Naked Security writer
Company transcribed ultra-personal conversations, didn't secure them. Criminal stole them, then extorted thousands of vulnerable patients.

Password-stealing “vulnerability” reported in KeePass – bug or feature?

By Paul Ducklin
Is it a vulnerability if someone with control over your account can mess with files that your account is allowed to access anyway?

Serious Security: The Samba logon bug caused by outdated crypto

By Paul Ducklin
Enjoy our Serious Security deep dive into this real-world example of why cryptographic agility is important!

GoTo admits: Customer cloud backups stolen together with decryption key

By Paul Ducklin
We were going to write, "Once more unto the breach, dear friends, once more"... but it seems to go without saying these days.

S3 Ep118: Guess your password? No need if it’s stolen already! [Audio + Text]

By Paul Ducklin
As always: entertaining, informative and educational... and not bogged down with jargon! Listen (or read) now...

Serious Security: Unravelling the LifeLock “hacked passwords” story

By Paul Ducklin
Four straight-talking tips to improve your online security, whether you're a LifeLock customer or not.

Multi-million investment scammers busted in four-country Europol raid

By Paul Ducklin
216 questioned, 15 arrested, 4 fake call centres searched, millions seized...

Popular JWT cloud security library patches “remote” code execution hole

By Paul Ducklin
It's remotely triggerable, but attackers would already have pretty deep network access if they could "prime" your server for compromise.

RSA crypto cracked? Or perhaps not!

By Paul Ducklin
Stand down from blue alert, it seems... but why not plan your cryptographic agility anyway?

S3 Ep116: Last straw for LastPass? Is crypto doomed? [Audio + Text]

By Paul Ducklin
Lots of big issues this week: breaches, encryption, supply chains and patching problems. Listen now! (Full transcript inside.)

Inside a scammers’ lair: Ukraine busts 40 in fake bank call-centre raid

By Naked Security writer
When someone calls you up to warn you that your bank account is under attack - it's true, because THAT VERY PERSON is the one attacking you!

PyTorch: Machine Learning toolkit pwned from Christmas to New Year

By Paul Ducklin
The bad news: the crooks have your SSH private keys. The good news: only users of the "nightly" build were affected.

US passes the Quantum Computing Cybersecurity Preparedness Act – and why not?

By Paul Ducklin
Cryptographic agility: the ability and the willingness to change quickly when needed.

sc-daa-1200

Twitter data of “+400 million unique users” up for sale – what to do?

By Paul Ducklin
If the crooks have connected up your phone number and your Twitter handle... what could go wrong?

OneCoin scammer Sebastian Greenwood pleads guilty, “Cryptoqueen” still missing

By Paul Ducklin
The Cryptoqueen herself is still missing, but her co-conspirator, who is said to have pocketed over $20m a month, has been convicted.

SIM swapper sent to prison for 2FA cryptocurrency heist of over $20m

By Naked Security writer
Guilty party got 18 months, also has to pay back $20m he probably hasn't got, which could land him in more hot water.

Serious Security: MD5 considered harmful – to the tune of $600,000

By Paul Ducklin
It's not just the hashing, by the way. It's the salting and the stretching, too!

TikTok “Invisible Challenge” porn malware puts us all at risk

By Paul Ducklin
An injury to one is an injury to all. Especially if the other people are part of your social network.

Multimillion dollar CryptoRom scam sites seized, suspects arrested in US

By Paul Ducklin
Five tips to keep yourself, and your friends and family, out of the clutches of "chopping block" scammers...

cryptorom-1200

S3 Ep108: You hid THREE BILLION dollars in a popcorn tin?

By Paul Ducklin
Patches, busts, leaks and why even low-likelihood exploits can be high-severity risks - listen now!

Silk Road drugs market hacker pleads guilty, faces 20 years inside

By Paul Ducklin
Jurisprudence isn't like arithmetic... two negatives never make a positive!

The OpenSSL security update story – how can you tell what needs fixing?

By Paul Ducklin
How to Hack! Finding OpenSSL library files and accurately identifying their version numbers...

ossl-code-1200

OpenSSL patches are out – CRITICAL bug downgraded to HIGH, but patch anyway!

By Paul Ducklin
That bated-breath OpenSSL update is out! It's no longer rated CRITICAL, but we advise you to patch ASAP anyway. Here's why...

SHA-3 code execution bug patched in PHP – check your version!

By Paul Ducklin
As everyone waits for news of a bug in OpenSSL, here's a reminder that other cryptographic code in your life may also need patching!

Psychotherapy extortion suspect: arrest warrant issued

By Paul Ducklin
Wanted! Not only the extortionist who abused the data, but also the CEO who let it happen.

Clearview AI image-scraping face recognition service hit with €20m fine in France

By Paul Ducklin
"We told you to stop but you ignored us," said the French regulator, "so now we're coming after you again."

Serious Security: How randomly (or not) can you shuffle cards?

By Paul Ducklin
What if you could guess the next card correctly twice as often as you should?

card-fan-1200

Women in Cryptology – USPS celebrates WW2 codebreakers

By Paul Ducklin
What did you do in the war, Mom? Oh, y'know, a bit of this and that...

Fashion brand SHEIN fined $1.9m for lying about data breach

By Naked Security writer
Is "pay a small fine and keep on trading" a sufficient penalty for letting a breach happen, impeding an investigation, and hiding the truth?

Serious Security: OAuth 2 and why Microsoft is finally forcing you into it

By Paul Ducklin
Microsoft calls it "Modern Auth", though it's a decade old, and is finally forcing Exchange Online customers to switch to it.

Bitcoin ATMs leeched by attackers who created fake admin accounts

By Paul Ducklin
The criminals didn't implant any malware. The attack was orchestrated via malevolent configuration changes.

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

By Paul Ducklin
If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

Slack admits to leaking hashed passwords for five years

By Paul Ducklin
"When those invitations went out... somehow, your password hash went out with them."

Post-quantum cryptography – new algorithm “gone in 60 minutes”

By Paul Ducklin
And THIS is why you don't knit your own home-made encryption algorithms and hope no one looks at them.

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

S3 Ep91: CodeRed, OpenSSL, Java bugs, Office macros [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Great discussion, technical content, solid advice... all covered in plain English.

Paying ransomware crooks won’t reduce your legal risk, warns regulator

By Paul Ducklin
"We paid the crooks to keep things under control and make a bad thing better"... isn't a valid excuse. Who knew?

OpenSSL fixes two “one-liner” crypto bugs – what you need to know

By Paul Ducklin
"As bad as Heartbleed"? We heard that concern a week ago, but we think it's less ungood than that...

“Missing Cryptoqueen” hits the FBI’s Ten Most Wanted list

By Paul Ducklin
The "Missing Cryptoqueen" makes the American Top Ten... but not in a good way.

❌