FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

S3 Ep145: Bugs With Impressive Names!

By Paul Ducklin
Fascinating fun (with a serious and educational side) - listen now! Full transcript available inside.

Microsoft hit by Storm season – a tale of two semi-zero days

By Paul Ducklin
The first compromise didn't get the crooks as far as they wanted, so they found a second one that did...

S3 Ep137: 16th century crypto skullduggery

By Paul Ducklin
Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

s3-ep137-feat-1200

Serious Security: TPM 2.0 vulns – is your super-secure data at risk?

By Paul Ducklin
Security bugs in the very code you've been told you must have to improve the security of your computer...

DoppelPaymer ransomware supsects arrested in Germany and Ukraine

By Naked Security writer
Devices seized, suspects interrogated and arrested, allegedly connected to devastating cyberattack on University Hospital in Düsseldorf.

S3 Ep124: When so-called security apps go rogue [Audio + Text]

By Paul Ducklin
Rogue software packages. Rogue "sysadmins". Rogue keyloggers. Rogue authenticators. Rogue ROGUES!

s3-ep124-auth--1200

Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!

By Paul Ducklin
Even in Apple's and Google's "walled gardens", there are plenty of 2FA apps that are either dangerously incompetent, or unrepentantly malicious. (Or perhaps both.)

Serious Security: GnuTLS follows OpenSSL, fixes timing attack bug

By Paul Ducklin
Conditional code considered cryptographically counterproductive.

OpenSSL fixes High Severity data-stealing bug – patch now!

By Paul Ducklin
7 memory mismanagements and a timing attack. We explain all the jargon bug terminology in plain English...

Tracers in the Dark: The Global Hunt for the Crime Lords of Crypto

By Paul Ducklin
Hear renowned cybersecurity author Andy Greenberg's thoughtful commentary about the "war on crypto" as we talk to him about his new book...

Password-stealing “vulnerability” reported in KeePass – bug or feature?

By Paul Ducklin
Is it a vulnerability if someone with control over your account can mess with files that your account is allowed to access anyway?

Serious Security: The Samba logon bug caused by outdated crypto

By Paul Ducklin
Enjoy our Serious Security deep dive into this real-world example of why cryptographic agility is important!

GoTo admits: Customer cloud backups stolen together with decryption key

By Paul Ducklin
We were going to write, "Once more unto the breach, dear friends, once more"... but it seems to go without saying these days.

Serious Security: Unravelling the LifeLock “hacked passwords” story

By Paul Ducklin
Four straight-talking tips to improve your online security, whether you're a LifeLock customer or not.

Popular JWT cloud security library patches “remote” code execution hole

By Paul Ducklin
It's remotely triggerable, but attackers would already have pretty deep network access if they could "prime" your server for compromise.

RSA crypto cracked? Or perhaps not!

By Paul Ducklin
Stand down from blue alert, it seems... but why not plan your cryptographic agility anyway?

S3 Ep116: Last straw for LastPass? Is crypto doomed? [Audio + Text]

By Paul Ducklin
Lots of big issues this week: breaches, encryption, supply chains and patching problems. Listen now! (Full transcript inside.)

US passes the Quantum Computing Cybersecurity Preparedness Act – and why not?

By Paul Ducklin
Cryptographic agility: the ability and the willingness to change quickly when needed.

sc-daa-1200

Serious Security: MD5 considered harmful – to the tune of $600,000

By Paul Ducklin
It's not just the hashing, by the way. It's the salting and the stretching, too!

The OpenSSL security update story – how can you tell what needs fixing?

By Paul Ducklin
How to Hack! Finding OpenSSL library files and accurately identifying their version numbers...

ossl-code-1200

OpenSSL patches are out – CRITICAL bug downgraded to HIGH, but patch anyway!

By Paul Ducklin
That bated-breath OpenSSL update is out! It's no longer rated CRITICAL, but we advise you to patch ASAP anyway. Here's why...

SHA-3 code execution bug patched in PHP – check your version!

By Paul Ducklin
As everyone waits for news of a bug in OpenSSL, here's a reminder that other cryptographic code in your life may also need patching!

Serious Security: How randomly (or not) can you shuffle cards?

By Paul Ducklin
What if you could guess the next card correctly twice as often as you should?

card-fan-1200

Women in Cryptology – USPS celebrates WW2 codebreakers

By Paul Ducklin
What did you do in the war, Mom? Oh, y'know, a bit of this and that...

Serious Security: OAuth 2 and why Microsoft is finally forcing you into it

By Paul Ducklin
Microsoft calls it "Modern Auth", though it's a decade old, and is finally forcing Exchange Online customers to switch to it.

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

By Paul Ducklin
If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

Slack admits to leaking hashed passwords for five years

By Paul Ducklin
"When those invitations went out... somehow, your password hash went out with them."

Post-quantum cryptography – new algorithm “gone in 60 minutes”

By Paul Ducklin
And THIS is why you don't knit your own home-made encryption algorithms and hope no one looks at them.

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

S3 Ep91: CodeRed, OpenSSL, Java bugs, Office macros [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Great discussion, technical content, solid advice... all covered in plain English.

OpenSSL fixes two “one-liner” crypto bugs – what you need to know

By Paul Ducklin
"As bad as Heartbleed"? We heard that concern a week ago, but we think it's less ungood than that...

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

He sold cracked passwords for a living – now he’s serving 4 years in prison

By Paul Ducklin
Crooks don't need a password for every user on your network to break in and wreak havoc. One could be enough...

Critical cryptographic Java security blunder patched – update now!

By Paul Ducklin
Either know the private key and use it scrupulously in your digital signature calculation.... or just send a bunch of zeros instead.

OpenSSH goes Post-Quantum, switches to qubit-busting crypto by default

By Paul Ducklin
Useful quantum computers might not actually be possible. But what if they are? And what if they arrive, say, tomorrow?

cat-1200

Self-styled “Crocodile of Wall Street” arrested with husband over Bitcoin megaheist

By Naked Security writer
The cops say they've recovered 80% of a $72 million cryptocoin heist... but the recovered funds alone are now worth over $4 billion!

Serious Security: Linux full-disk encryption bug fixed – patch now!

By Paul Ducklin
Imagine if someone who didn't have your password could sneakily modify data that was encrypted with it.

Mozilla patches critical “BigSig” cryptographic bug: Here’s how to track it down and fix it

By Paul Ducklin
Mozilla's cryptographic code had a critical bug. Problem is that numerous apps are affected and may need patching individually.

Samba update patches plaintext password plundering problem

By Paul Ducklin
When Microsoft itself says STOP USING X, where X is one of its own protocols... we think you should listen.

❌