FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Performance and security clash yet again in “Collide+Power” attack

By Paul Ducklin
It's a real vulnerability, but the data leakage rate can be as low as... let's just say that an IMAX-quality copy of the new "Oppenheimer" movie could take you 4 billion years to exfiltrate.

S3 Ep142: Putting the X in X-Ops

By Paul Ducklin
How to get all your corporate "Ops" teams working together, with cybersecurity correctness as a guiding light.

s3-ep100-js-1200

Ghostscript bug could allow rogue documents to run system commands

By Paul Ducklin
Even if you've never heard of the venerable Ghostscript project, you may have it installed without knowing.

Megaupload duo will go to prison at last, but Kim Dotcom fights on…

By Paul Ducklin
One, sadly, has died, and two are heading to prison, but for Kim Dotcom, the saga goes on...

History revisited: US DOJ unseals Mt. Gox cybercrime charges

By Naked Security writer
Though the mills of the Law grind slowly/Yet they grind exceeding small/Though with patience they stand waiting/With exactness grind they all...

World Backup Day is here again – 5 tips to keep your precious data safe

By Paul Ducklin
The only backup you will ever regret is the one you didn't make...

Apple patches everything, including a zero-day fix for iOS 15 users

By Paul Ducklin
Got an older iPhone that can't run iOS 16? You've got a zero-day to deal with! That super-cool Studio Display monitor needs patching, too.

WooCommerce Payments plugin for WordPress has an admin-level hole – patch now!

By Paul Ducklin
Admin-level holes in websites are always a bad thing... and for "bad", read "worse" if it's an e-commerce site.

woo-1200

Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!

By Paul Ducklin
Even in Apple's and Google's "walled gardens", there are plenty of 2FA apps that are either dangerously incompetent, or unrepentantly malicious. (Or perhaps both.)

Coinbase breached by social engineers, employee data stolen

By Paul Ducklin
Another day, another "sophisticated" attack. This time, the company has handily included some useful advice along with its mea culpa...

Serious Security: The Samba logon bug caused by outdated crypto

By Paul Ducklin
Enjoy our Serious Security deep dive into this real-world example of why cryptographic agility is important!

Apple patches are out – old iPhones get an old zero-day fix at last!

By Paul Ducklin
Don't delay, especially if you're still running an iOS 12 device... please do it today!

US passes the Quantum Computing Cybersecurity Preparedness Act – and why not?

By Paul Ducklin
Cryptographic agility: the ability and the willingness to change quickly when needed.

sc-daa-1200

Microsoft dishes the dirt on Apple’s “Achilles heel” shortly after fixing similar Windows bug

By Paul Ducklin
It happens to the best of us: Microsoft highlights a security bypass bug on Macs that is curiously similar to a recent Windows 0-day.

OneCoin scammer Sebastian Greenwood pleads guilty, “Cryptoqueen” still missing

By Paul Ducklin
The Cryptoqueen herself is still missing, but her co-conspirator, who is said to have pocketed over $20m a month, has been convicted.

Credit card skimming – the long and winding road of supply chain failure

By Paul Ducklin
Don't keep calling home to a JavaScript server that closed its doors eight years ago!

“Gucci Master” business email scammer Hushpuppi gets 11 years

By Naked Security writer
Learn how to protect yourself from big-money tricksters like the Hushpuppis of the world...

puppi-car-1200

Silk Road drugs market hacker pleads guilty, faces 20 years inside

By Paul Ducklin
Jurisprudence isn't like arithmetic... two negatives never make a positive!

Psychotherapy extortion suspect: arrest warrant issued

By Paul Ducklin
Wanted! Not only the extortionist who abused the data, but also the CEO who let it happen.

Clearview AI image-scraping face recognition service hit with €20m fine in France

By Paul Ducklin
"We told you to stop but you ignored us," said the French regulator, "so now we're coming after you again."

Serious Security: How randomly (or not) can you shuffle cards?

By Paul Ducklin
What if you could guess the next card correctly twice as often as you should?

card-fan-1200

Fashion brand SHEIN fined $1.9m for lying about data breach

By Naked Security writer
Is "pay a small fine and keep on trading" a sufficient penalty for letting a breach happen, impeding an investigation, and hiding the truth?

Move over Patch Tuesday – it’s Ada Lovelace Day!

By Paul Ducklin
Hacking on actual computers is one thing, but hacking purposefully on imaginary computers is, these days, something we can only imagine.

Former Uber CSO convicted of covering up megabreach back in 2016

By Naked Security writer
Obstructed FTC proceedings, and concealed a crime, said the jury.

Scammers and rogue callers – can anything ever stop them?

By Paul Ducklin
Some thoughts for Cybersecurity Awareness Month: Is is worth reporting nuisance calls? Is it even worth reporting outright scams?

Morgan Stanley fined millions for selling off devices full of customer PII

By Paul Ducklin
Critical data on old disks always seems inaccessible if you really need it. But when you DON''T want it back, guess what happens...

Breaching airgap security: using your phone’s gyroscope as a microphone

By Paul Ducklin
One bit per second makes the Voyager probe data rate seem blindingly fast. But it's enough to break your security assumptions...

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

US offers reward “up to $10 million” for information about the Conti gang

By Naked Security writer
Wanted - Reward Offered - Five unknown individuals (plus a man with a weird hat)

Zoom for Mac patches critical bug – update now!

By Paul Ducklin
There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...

Post-quantum cryptography – new algorithm “gone in 60 minutes”

By Paul Ducklin
And THIS is why you don't knit your own home-made encryption algorithms and hope no one looks at them.

Paying ransomware crooks won’t reduce your legal risk, warns regulator

By Paul Ducklin
"We paid the crooks to keep things under control and make a bad thing better"... isn't a valid excuse. Who knew?

“Missing Cryptoqueen” hits the FBI’s Ten Most Wanted list

By Paul Ducklin
The "Missing Cryptoqueen" makes the American Top Ten... but not in a good way.

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

Clearview AI face-matching service fined a lot less than expected

By Paul Ducklin
The fine has finally gone through... but it's less than 45% of what was originally proposed.

eleceye-1200

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

Colonial Pipeline facing $1,000,000 fine for poor recovery plans

By Paul Ducklin
How good is your cybersecurity? Are you making the same mistakes as lots of other people? Here's some real-life advice...

Beanstalk cryptocurrency heist: scammer votes himself all the money

By Paul Ducklin
Voting safeguards based on commuity collateral don't work if one person can use a momentary loan to "become" 75% of the community.

Yet another Chrome zero-day emergency update – patch now!

By Paul Ducklin
The third emergency Chrome 0-day in three months - the first one was exploited by North Korea, so you might as well get this one ASAP.

OpenSSH goes Post-Quantum, switches to qubit-busting crypto by default

By Paul Ducklin
Useful quantum computers might not actually be possible. But what if they are? And what if they arrive, say, tomorrow?

cat-1200

Web vendor CafePress fined $500,000 for giving cybersecurity a low value

By Paul Ducklin
Just because you're the victim of a cybercrime doesn't let you off your cybersecurity obligations

❌