FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

S3 Ep146: Tell us about that breach! (If you want to.)

By Paul Ducklin
Serious security stories explained clearly in plain English - listen now. (Full transcript available.)

S3 Ep145: Bugs With Impressive Names!

By Paul Ducklin
Fascinating fun (with a serious and educational side) - listen now! Full transcript available inside.

PyPI open-source code repository deals with manic malware maelstrom

By Paul Ducklin
Controlled outage used to keep malware marauders from gumming up the works. Learn what you can do to help in future...

Attention gamers! Motherboard maker MSI admits to breach, issues “rogue firmware” alert

By Paul Ducklin
Stealing private keys is like getting hold of a medieval monarch's personal signet ring... you get to put an official seal on treasonous material.

S3 Ep129: When spyware arrives from someone you trust

By Paul Ducklin
Scanning tools, supply-chain malware, Wi-Fi hacking, and why there should be TWO World Backup Days... listen now!

Supply chain blunder puts 3CX telephone app users at risk

By Paul Ducklin
Booby-trapped app, apparently signed and shipped by 3CX itself after its source code repository was broken into.

NPM JavaScript packages abused to create scambait links in bulk

By Paul Ducklin
Free spins? Bonus game points? Cheap social media followers? What harm could it possibly do if you just take a tiny little look?!

PyTorch: Machine Learning toolkit pwned from Christmas to New Year

By Paul Ducklin
The bad news: the crooks have your SSH private keys. The good news: only users of the "nightly" build were affected.

COVID-bit: the wireless spyware trick with an unfortunate name

By Paul Ducklin
It's not the switching that's the problem, it's the switching of the switching!

ind-1200

TikTok “Invisible Challenge” porn malware puts us all at risk

By Paul Ducklin
An injury to one is an injury to all. Especially if the other people are part of your social network.

“Gucci Master” business email scammer Hushpuppi gets 11 years

By Naked Security writer
Learn how to protect yourself from big-money tricksters like the Hushpuppis of the world...

puppi-car-1200

Clearview AI image-scraping face recognition service hit with €20m fine in France

By Paul Ducklin
"We told you to stop but you ignored us," said the French regulator, "so now we're coming after you again."

Breaching airgap security: using your phone’s gyroscope as a microphone

By Paul Ducklin
One bit per second makes the Voyager probe data rate seem blindingly fast. But it's enough to break your security assumptions...

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

GitHub blighted by “researcher” who created thousands of malicious projects

By Paul Ducklin
If you spew projects laced with hidden malware into an open source repository, don't waste your time telling us "no harm done" afterwards.

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

Clearview AI face-matching service fined a lot less than expected

By Paul Ducklin
The fine has finally gone through... but it's less than 45% of what was originally proposed.

eleceye-1200

RubyGems supply chain rip-and-replace bug fixed – check your logs!

By Paul Ducklin
Imagine if you could assume the identity of, say, Franklin Delano Roosevelt simply by showing up and calling yourself "Frank".

ruby-1200

GitHub issues final report on supply-chain source code intrusions

By Paul Ducklin
Learn how to find out which apps you've given access rights to, and how to revoke those rights immediately in an emergency.

Beanstalk cryptocurrency heist: scammer votes himself all the money

By Paul Ducklin
Voting safeguards based on commuity collateral don't work if one person can use a momentary loan to "become" 75% of the community.

Apple AirTag anti-stalking protection bypassed by researchers

By Paul Ducklin
Problems with Apple's Tracker Detect system, which warns you of likely stalking attempts using hidden AirTags.

Wormhole cryptotrading company turns over $340,000,000 to criminals

By Paul Ducklin
It was the best of blockchains, it was the worst of blockchains... as Charles Dickens might have said.

JavaScript developer destroys own projects in supply chain “lesson”

By Paul Ducklin
Two popular open source JavaScript packages recently got "hacked" in a symbolic gesture by the original project creator.

S3 Ep63: Log4Shell (what else?) and Apple kernel bugs [Podcast+Transcript]

By Paul Ducklin
Latest episode - listen now! (Yes, there are plenty of critical things to go along with Log4Shell.)

Clearview AI face-matching service set to be fined over $20m

By Paul Ducklin
Scraping data for a facial recognition service? "That's unlawful", concluded both the British and the Australians.

Samba update patches plaintext password plundering problem

By Paul Ducklin
When Microsoft itself says STOP USING X, where X is one of its own protocols... we think you should listen.

Sophos 2022 Threat Report: Malware, Mobile, Machine learning and more!

By Paul Ducklin
The crooks have shown that they're willing to learn and adapt their attacks, so we need to make sure we learn and adapt, too.

Listen up 2 – CYBERSECURITY FIRST! How to protect yourself from supply chain attacks

By Paul Ducklin
Everyone remembers this year's big-news supply chain attacks on Kaseya and SolarWinds. Sophos expert Chester Wisniewski explains how to control the risk.

❌