FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

S3 Ep148: Remembering crypto heroes

By Paul Ducklin
Celebrating the true crypto bros. Listen now (full transcript available).

“Grab hold and give it a wiggle” – ATM card skimming is still a thing

By Paul Ducklin
The rise of tap-to-pay and chip-and-PIN hasn't rid the world of ATM card skimming criminals...

S3 Ep142: Putting the X in X-Ops

By Paul Ducklin
How to get all your corporate "Ops" teams working together, with cybersecurity correctness as a guiding light.

s3-ep100-js-1200

Ghostscript bug could allow rogue documents to run system commands

By Paul Ducklin
Even if you've never heard of the venerable Ghostscript project, you may have it installed without knowing.

UK hacker busted in Spain gets 5 years over Twitter hack and more

By Naked Security writer
Not just that infamous Twitter hack, but SIM-swapping, stalking and swatting too...

ASUS warns router customers: Patch now, or block all inbound requests

By Paul Ducklin
"Do as we say, not as we do!" - The patches took ages to come out, but don't let that lure you into taking ages to install them.

S3 Ep137: 16th century crypto skullduggery

By Paul Ducklin
Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

s3-ep137-feat-1200

Mac malware-for-hire steals passwords and cryptocoins, sends “crime logs” via Telegram

By Paul Ducklin
These malware peddlers are specifically going after Mac users. The hint's in the name: "Atomic macOS Stealer", or AMOS for short.

S3 Ep132: Proof-of-concept lets anyone hack at will

By Paul Ducklin
When Doug says, "Happy Remote Code Execution Day, Duck"... it's irony. For the avoidance of all doubt :-)

PaperCut security vulnerabilities under active attack – vendor urges customers to patch

By Paul Ducklin
If you have the product, but you haven't patched - well, the crooks have now landed, so please don't delay. Do it today...

S3 Ep130: Open the garage bay doors, HAL [Audio + Text]

By Paul Ducklin
I'm sorry, Dave. I'm afraid I can't... errr, no, hang on a minute, I can do that easily! Worldwide! Right now!

Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads

By Paul Ducklin
That double-whammy Apple browser-to-kernel spyware bug combo we wrote up last week? Turns out it applies to all supported Macs and iDevices - patch now!

Popular server-side JavaScript security sandbox “vm2” patches remote execution hole

By Paul Ducklin
The security error was in the error handling system that was supposed to catch potential security errors...

vm2-1200

WooCommerce Payments plugin for WordPress has an admin-level hole – patch now!

By Paul Ducklin
Admin-level holes in websites are always a bad thing... and for "bad", read "worse" if it's an e-commerce site.

woo-1200

Bitcoin ATM customers hacked by video upload that was actually an app

By Paul Ducklin
As the misquote goes, "Once is misfortune..." This is the second time, and you know what Lady Bracknell had to say about that...

Dangerous Android phone 0-day bugs revealed – patch or work around them now!

By Paul Ducklin
Despite its usually inflexible 0-day disclosure policy, Google is keeping four mobile modem bugs semi-secret due to likely ease of exploitation.

S3 Ep 126: The price of fast fashion (and feature creep) [Audio + Text]

By Paul Ducklin
Worried about rogue apps? Unsure about the new Outlook zero-day? Clear advice in plain English... just like old times, with Duck and Chet!

DoppelPaymer ransomware supsects arrested in Germany and Ukraine

By Naked Security writer
Devices seized, suspects interrogated and arrested, allegedly connected to devastating cyberattack on University Hospital in Düsseldorf.

S3 Ep124: When so-called security apps go rogue [Audio + Text]

By Paul Ducklin
Rogue software packages. Rogue "sysadmins". Rogue keyloggers. Rogue authenticators. Rogue ROGUES!

s3-ep124-auth--1200

Tracers in the Dark: The Global Hunt for the Crime Lords of Crypto

By Paul Ducklin
Hear renowned cybersecurity author Andy Greenberg's thoughtful commentary about the "war on crypto" as we talk to him about his new book...

S3 Ep118: Guess your password? No need if it’s stolen already! [Audio + Text]

By Paul Ducklin
As always: entertaining, informative and educational... and not bogged down with jargon! Listen (or read) now...

Popular JWT cloud security library patches “remote” code execution hole

By Paul Ducklin
It's remotely triggerable, but attackers would already have pretty deep network access if they could "prime" your server for compromise.

CircleCI – code-building service suffers total credential compromise

By Paul Ducklin
They're saying "rotate secrets"... in plain English, they mean "change your credentials". The company has a tool to help you find them all.

S3 Ep116: Last straw for LastPass? Is crypto doomed? [Audio + Text]

By Paul Ducklin
Lots of big issues this week: breaches, encryption, supply chains and patching problems. Listen now! (Full transcript inside.)

Inside a scammers’ lair: Ukraine busts 40 in fake bank call-centre raid

By Naked Security writer
When someone calls you up to warn you that your bank account is under attack - it's true, because THAT VERY PERSON is the one attacking you!

PyTorch: Machine Learning toolkit pwned from Christmas to New Year

By Paul Ducklin
The bad news: the crooks have your SSH private keys. The good news: only users of the "nightly" build were affected.

S3 Ep114: Preventing cyberthreats – stop them before they stop you! [Audio + Text]

By Paul Ducklin
Join world-renowned expert Fraser Howard, Director of Research at SophosLabs, for this fascinating episode on how to fight cybercrime.

Credit card skimming – the long and winding road of supply chain failure

By Paul Ducklin
Don't keep calling home to a JavaScript server that closed its doors eight years ago!

SIM swapper sent to prison for 2FA cryptocurrency heist of over $20m

By Naked Security writer
Guilty party got 18 months, also has to pay back $20m he probably hasn't got, which could land him in more hot water.

S3 Ep100: Browser-in-the-Browser – how to spot an attack [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Cosmic rockets, zero-days, spotting cybercrooks, and unlocking the DEADBOLT...

s3-ep100-js-1200

Slack admits to leaking hashed passwords for five years

By Paul Ducklin
"When those invitations went out... somehow, your password hash went out with them."

Traffic Light Protocol for cybersecurity responders gets a revamp

By Paul Ducklin
Traffic lights make a handy global metaphor for denoting the sensitivity of cybersecurity threat data - three colours that everyone knows.

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

He sold cracked passwords for a living – now he’s serving 4 years in prison

By Paul Ducklin
Crooks don't need a password for every user on your network to break in and wreak havoc. One could be enough...

S3 Ep82: Bugs, bugs, bugs (and Colonial Pipeline again) [Podcast]

By Paul Ducklin
Latest episode - lots to learn - plain English - fun with a serious side - listen now!

❌