FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Microsoft hit by Storm season – a tale of two semi-zero days

By Paul Ducklin
The first compromise didn't get the crooks as far as they wanted, so they found a second one that did...

Zimbra Collaboration Suite warning: Patch this 0-day right now (by hand)!

By Paul Ducklin
Zimbra didn't actually say, "Do not delay/Do it today," but they did say, "We kindly request your cooperation to apply the fix manually."

Microsoft patches four zero-days, finally takes action against crimeware kernel drivers

By Paul Ducklin
Here's a brief reminder to do two things. The first is to patch. The second is to read up why it's a good idea to patch...

Apple silently pulls its latest zero-day update – what now?

By Paul Ducklin
Previously, we said "do it today", but now we're forced back on: "Do not delay; do it as soon as Apple and your device will let you."

Urgent! Apple fixes critical zero-day hole in iPhones, iPads and Macs

By Paul Ducklin
Don't delay, do it today. This is a code-implantation bug in WebKit that attackers already know how to exploit.

Serious Security: Rowhammer returns to gaslight your computer

By Paul Ducklin
Gaslights produce a telltale flicker when nearby lamps are lit; DRAM values do something similar when nearby memory cells are accessed.

S3 Ep142: Putting the X in X-Ops

By Paul Ducklin
How to get all your corporate "Ops" teams working together, with cybersecurity correctness as a guiding light.

s3-ep100-js-1200

Firefox 115 is out, says farewell to users of older Windows and Mac versions

By Paul Ducklin
No zero-days this month, so you're patching to stay ahead, not merely to catch up!

Ghostscript bug could allow rogue documents to run system commands

By Paul Ducklin
Even if you've never heard of the venerable Ghostscript project, you may have it installed without knowing.

WordPress plugin lets users become admins – Patch early, patch often!

By Paul Ducklin
Ultimate Member plugin lets rogue users choose their own site capabilities, including becoming admins.

Interested in $10,000,000? Ready to turn in the Clop ransomware crew?

By Naked Security writer
Technically, it's "up to $10 million", but it's potentially a LOT of money, nevertheless...

UK hacker busted in Spain gets 5 years over Twitter hack and more

By Naked Security writer
Not just that infamous Twitter hack, but SIM-swapping, stalking and swatting too...

Aussie PM says, “Shut down your phone every 24 hours for 5 mins” – but that’s not enough on its own

By Paul Ducklin
Don't treat rebooting your phone once a day as a cybersecurity talisman... here are 8 additional tips for better mobile phone security.

“The Ransomware Documentary” – brand new video series from Sophos starting now!

By Sally Adam
Get the full 360-degree view of ransomware

Ransomware Documentary Graphic Theme_780x480 NS

ASUS warns router customers: Patch now, or block all inbound requests

By Paul Ducklin
"Do as we say, not as we do!" - The patches took ages to come out, but don't let that lure you into taking ages to install them.

Megaupload duo will go to prison at last, but Kim Dotcom fights on…

By Paul Ducklin
One, sadly, has died, and two are heading to prison, but for Kim Dotcom, the saga goes on...

MOVEit mayhem 3: “Disable HTTP and HTTPS traffic immediately”

By Paul Ducklin
Twice more unto the breach... third patch tested and released, shut down web access until you've applied it

mi-1200

Gozi banking malware “IT chief” finally jailed after more than 10 years

By Paul Ducklin
Gozi threesome from way back in the late 2000s and early 2010s now all charged, convicted and sentenced. The DOJ got there in the end...

History revisited: US DOJ unseals Mt. Gox cybercrime charges

By Naked Security writer
Though the mills of the Law grind slowly/Yet they grind exceeding small/Though with patience they stand waiting/With exactness grind they all...

Thoughts on scheduled password changes (don’t call them rotations!)

By Paul Ducklin
Does swapping your password regularly make it a better password?

S3 Ep138: I like to MOVEit, MOVEit

By Paul Ducklin
Backdoors, exploits, and Little Bobby Tables. Listen now! (Full transcript available...)

s3-ep138-1200

S3 Ep137: 16th century crypto skullduggery

By Paul Ducklin
Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

s3-ep137-feat-1200

Serious Security: That KeePass “master password crack”, and what we can learn from it

By Paul Ducklin
Here, in an admittedly discursive nutshell, is the fascinating story of CVE-2023-32784. (Short version: Don't panic.)

Serious Security: Verification is vital – examining an OAUTH login bug

By Paul Ducklin
What good is a popup asking for your approval if an attacker can bypass it simply by suppressing it?

Ransomware tales: The MitM attack that really had a Man in the Middle

By Paul Ducklin
Another traitorous sysadmin story, this one busted by system logs that gave his game away...

PyPI open-source code repository deals with manic malware maelstrom

By Paul Ducklin
Controlled outage used to keep malware marauders from gumming up the works. Learn what you can do to help in future...

Phone scamming kingpin gets 13 years for running “iSpoof” service

By Naked Security writer
Site marketing video promised total anonymity, but that was a lie. 170 arrested already. Potentially 1000s more to follow.

ispoof-1200

Apple’s secret is out: 3 zero-days fixed, so be sure to patch now!

By Paul Ducklin
All Apple users have zero-days that need patching, though some have more zero-days than others.

S3 Ep135: Sysadmin by day, extortionist by night

By Paul Ducklin
Laugh (sufficiently), learn (efficiently), and then let us know what you think in our comments (anonymously, if you wish)...

US offers $10m bounty for Russian ransomware suspect outed in indictment

By Naked Security writer
"Up to $10 million for information that leads to the arrest and/or conviction of this defendant."

Belkin Wemo Smart Plug V2 – the buffer overflow that won’t be patched

By Paul Ducklin
Yes, it's a buffer overflow bug. No, it's not going get fixed.

Bootkit zero-day fix – is this Microsoft’s most cautious patch ever?

By Paul Ducklin
When blocking buggy bootup modules, you have to be really careful not to lock your keys inside the car...

Low-level motherboard security keys leaked in MSI breach, claim researchers

By Paul Ducklin
What can you do if someone steals your keys but you can't change the lock? We explain the dilemma in plain English.

  • May 9th 2023 at 16:58
  • ↗

World Password Day: 2 + 2 = 4

By Paul Ducklin
We've kept it short and simple, with no sermons, no judgmentalism, no tubthumping... and no BUY NOW buttons. Have a nice day!

Apple delivers first-ever Rapid Security Response “cyberattack” patch – leaves some users confused

By Paul Ducklin
Just when we'd got used to three-numbered versions, such as "13.3.1", here comes an update suffix, bringing you "13.3.1 (a)"...

Mac malware-for-hire steals passwords and cryptocoins, sends “crime logs” via Telegram

By Paul Ducklin
These malware peddlers are specifically going after Mac users. The hint's in the name: "Atomic macOS Stealer", or AMOS for short.

Google wins court order to force ISPs to filter botnet traffic

By Naked Security writer
CryptBot criminals are alleged to have plundered browser passwords, illicitly-snapped screenshots, cryptocurrency account data, and more.

S3 Ep132: Proof-of-concept lets anyone hack at will

By Paul Ducklin
When Doug says, "Happy Remote Code Execution Day, Duck"... it's irony. For the avoidance of all doubt :-)

Google leaking 2FA secrets – researchers advise against new “account sync” feature for now

By Paul Ducklin
You waited 13 years for this feature in Google Authenticator. Now researchers are advising you to wait a while longer, just in case...

❌