FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Performance and security clash yet again in “Collide+Power” attack

By Paul Ducklin
It's a real vulnerability, but the data leakage rate can be as low as... let's just say that an IMAX-quality copy of the new "Oppenheimer" movie could take you 4 billion years to exfiltrate.

Microsoft patches four zero-days, finally takes action against crimeware kernel drivers

By Paul Ducklin
Here's a brief reminder to do two things. The first is to patch. The second is to read up why it's a good idea to patch...

Belkin Wemo Smart Plug V2 – the buffer overflow that won’t be patched

By Paul Ducklin
Yes, it's a buffer overflow bug. No, it's not going get fixed.

Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads

By Paul Ducklin
That double-whammy Apple browser-to-kernel spyware bug combo we wrote up last week? Turns out it applies to all supported Macs and iDevices - patch now!

Supply chain blunder puts 3CX telephone app users at risk

By Paul Ducklin
Booby-trapped app, apparently signed and shipped by 3CX itself after its source code repository was broken into.

In Memoriam – Gordon Moore, who put the more in “Moore’s Law”

By Paul Ducklin
His prediction was called a "Law", though it was an exhortation to engineering excellence as much it was an estimate.

gm-rip-1200

Google Pixel phones had a serious data leakage bug – here’s what to do!

By Paul Ducklin
What if the "safe" images you shared after carefully cropping them... had some or all of the "unsafe" pixels left behind anyway?

DoppelPaymer ransomware supsects arrested in Germany and Ukraine

By Naked Security writer
Devices seized, suspects interrogated and arrested, allegedly connected to devastating cyberattack on University Hospital in Düsseldorf.

Serious Security: Unravelling the LifeLock “hacked passwords” story

By Paul Ducklin
Four straight-talking tips to improve your online security, whether you're a LifeLock customer or not.

PyTorch: Machine Learning toolkit pwned from Christmas to New Year

By Paul Ducklin
The bad news: the crooks have your SSH private keys. The good news: only users of the "nightly" build were affected.

How to hack an unpatched Exchange server with rogue PowerShell code

By Paul Ducklin
Review your servers, your patches and your authentication policies - there's a proof-of-concept out

Move over Patch Tuesday – it’s Ada Lovelace Day!

By Paul Ducklin
Hacking on actual computers is one thing, but hacking purposefully on imaginary computers is, these days, something we can only imagine.

7 cybersecurity tips for your summer vacation!

By Paul Ducklin
Here you go - seven thoughtful cybersecurity tips to help you travel safely...

Colonial Pipeline facing $1,000,000 fine for poor recovery plans

By Paul Ducklin
How good is your cybersecurity? Are you making the same mistakes as lots of other people? Here's some real-life advice...

“Dirty Pipe” Linux kernel bug lets anyone write to any file

By Paul Ducklin
Even read-only files can be written to, leading to a dangerously general purpose elevation-of-privilege attack.

pipe-1200

At last! Office macros from the internet to be blocked by default

By Paul Ducklin
It's been a long time coming, and we're not there yet, but at least Microsoft Office will be a bit safer against macro malware...

FTC threatens “legal action” over unpatched Log4j and other vulns

By Paul Ducklin
Remember the Equifax breach? Remember the $700m penalty? In case you'd forgotten, here's the FTC to refresh your memory!

Log4Shell vulnerability Number Four: “Much ado about something”

By Paul Ducklin
It's a Log4j bug, and you ought to patch it. But we don't think it's a critical crisis like the last one.

S3 Ep63: Log4Shell (what else?) and Apple kernel bugs [Podcast+Transcript]

By Paul Ducklin
Latest episode - listen now! (Yes, there are plenty of critical things to go along with Log4Shell.)

Log4Shell explained – how it works, why you need to know, and how to fix it

By Paul Ducklin
Find out how to deal with the Log4Shell vulnerability right across your estate. Yes, you need to patch, but that helps everyone else along with you!

“Log4Shell” Java vulnerability – how to safeguard your servers

By Paul Ducklin
Just when you thought it was safe to relax for the weekend... a critical bug showed up in Apache's Log4j product

Apple’s Mail Privacy Protection feature – watch out if you have a Watch!

By Paul Ducklin
Apple's "Protect Mail Activity" is a handy privacy enhancement for your messaging habits. As long as you know its limitations...

LANtenna hack spies on your data from across the room! (Sort of)

By Paul Ducklin
Are your network cables acting as undercover wireless transmitters? What can you do if they are?

❌