FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

S3 Ep142: Putting the X in X-Ops

By Paul Ducklin
How to get all your corporate "Ops" teams working together, with cybersecurity correctness as a guiding light.

s3-ep100-js-1200

Aussie PM says, “Shut down your phone every 24 hours for 5 mins” – but that’s not enough on its own

By Paul Ducklin
Don't treat rebooting your phone once a day as a cybersecurity talisman... here are 8 additional tips for better mobile phone security.

Gozi banking malware “IT chief” finally jailed after more than 10 years

By Paul Ducklin
Gozi threesome from way back in the late 2000s and early 2010s now all charged, convicted and sentenced. The DOJ got there in the end...

PyPI open-source code repository deals with manic malware maelstrom

By Paul Ducklin
Controlled outage used to keep malware marauders from gumming up the works. Learn what you can do to help in future...

Mac malware-for-hire steals passwords and cryptocoins, sends “crime logs” via Telegram

By Paul Ducklin
These malware peddlers are specifically going after Mac users. The hint's in the name: "Atomic macOS Stealer", or AMOS for short.

Attention gamers! Motherboard maker MSI admits to breach, issues “rogue firmware” alert

By Paul Ducklin
Stealing private keys is like getting hold of a medieval monarch's personal signet ring... you get to put an official seal on treasonous material.

S3 Ep129: When spyware arrives from someone you trust

By Paul Ducklin
Scanning tools, supply-chain malware, Wi-Fi hacking, and why there should be TWO World Backup Days... listen now!

Supply chain blunder puts 3CX telephone app users at risk

By Paul Ducklin
Booby-trapped app, apparently signed and shipped by 3CX itself after its source code repository was broken into.

LastPass: Keylogger on home PC led to cracked corporate password vault

By Paul Ducklin
Seems the crooks implanted a keylogger via a vulnerable media app (LastPass politely didn't say which one!) on a developer's home computer.

Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!

By Paul Ducklin
Even in Apple's and Google's "walled gardens", there are plenty of 2FA apps that are either dangerously incompetent, or unrepentantly malicious. (Or perhaps both.)

GoDaddy admits: Crooks hit us with malware, poisoned customer websites

By Paul Ducklin
New report admits that attackers were detected in the network about three months ago, and may have been attacking for about three years.

Microsoft Patch Tuesday: One 0-day; Win 7 and 8.1 get last-ever patches

By Paul Ducklin
Get 'em while they're hot. And get 'em for the very last time, if you still have Windows 7 or 8.1...

PyTorch: Machine Learning toolkit pwned from Christmas to New Year

By Paul Ducklin
The bad news: the crooks have your SSH private keys. The good news: only users of the "nightly" build were affected.

S3 Ep114: Preventing cyberthreats – stop them before they stop you! [Audio + Text]

By Paul Ducklin
Join world-renowned expert Fraser Howard, Director of Research at SophosLabs, for this fascinating episode on how to fight cybercrime.

Credit card skimming – the long and winding road of supply chain failure

By Paul Ducklin
Don't keep calling home to a JavaScript server that closed its doors eight years ago!

The CHRISTMA EXEC network worm – 35 years and counting!

By Paul Ducklin
"Uh-oh, this viruses-and-worms scene could turn out quite troublesome." If only we'd been wrong...

xmas-1200-35-wide

TikTok “Invisible Challenge” porn malware puts us all at risk

By Paul Ducklin
An injury to one is an injury to all. Especially if the other people are part of your social network.

Multimillion dollar CryptoRom scam sites seized, suspects arrested in US

By Paul Ducklin
Five tips to keep yourself, and your friends and family, out of the clutches of "chopping block" scammers...

cryptorom-1200

Online ticketing company “See” pwned for 2.5 years by attackers

By Paul Ducklin
Don't be a cybersecurity slowcoach - you need to spot possible attacks as soon as you can.

Interested in cybersecurity? Join us for Security SOS Week 2022!

By Paul Ducklin
Four one-on-one interviews with experts who are passionate about sharing their expertise with the community.

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

GitHub blighted by “researcher” who created thousands of malicious projects

By Paul Ducklin
If you spew projects laced with hidden malware into an open source repository, don't waste your time telling us "no harm done" afterwards.

Office macro security: on-again-off-again feature now BACK ON AGAIN!

By Paul Ducklin
20 years to turn it on, then 20 weeks to turn it off, then just 2 weeks to turn it back on again. That's progress!

Last member of Gozi malware troika arrives in US for criminal trial

By Paul Ducklin
His co-conspirators went into and got out of prison years ago, while he remained free. Now the tables have turned...

S3 Ep91: CodeRed, OpenSSL, Java bugs, Office macros [Audio + Text]

By Paul Ducklin
Latest episode - listen now! Great discussion, technical content, solid advice... all covered in plain English.

That didn’t last! Microsoft turns off the Office security it just turned on

By Paul Ducklin
An Office anti-malware setting that took more than 20 years to arrive... and fewer than 20 weeks to vanish again.

Capital One identity theft hacker finally gets convicted

By Paul Ducklin
It took three years, but the Capital One cracker was convicted in the end. Don't get caught out in a data breach of your own!

You’re invited! Join us for a live walkthrough of the “Follina” story…

By Paul Ducklin
Live demo, plain English, no sales pitch, just a chance to watch an attack dissected in safety. Join us if you can!

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

Beware bogus Betas – cryptocoin scammers abuse Apple’s TestFlight system

By Paul Ducklin
"Install this moneymaking app" - this one is so special that it isn't available on Google Play or the App Store!

At last! Office macros from the internet to be blocked by default

By Paul Ducklin
It's been a long time coming, and we're not there yet, but at least Microsoft Office will be a bit safer against macro malware...

Microsoft blocks web installation of its own App Installer files

By Paul Ducklin
It's a big deal when a vendor decides to block one of its own "features" for security reasons. Here's why we think it's a good idea.

Firefox update brings a whole new sort of security sandbox

By Paul Ducklin
Firefox 95.0 is out, with the usual security fixes... plus some funky new ones.

Black Friday and Cyber Monday – here’s what you REALLY need to do!

By Paul Ducklin
The world fills up with cybersecurity tips every year when Black Friday comes round. But what about the rest of the year?

Emotet malware: “The report of my death was an exaggeration”

By Paul Ducklin
"Old malware rarely dies." The best way to predict the future is to look at the past... if it worked before, it will probably work again.

Sophos 2022 Threat Report: Malware, Mobile, Machine learning and more!

By Paul Ducklin
The crooks have shown that they're willing to learn and adapt their attacks, so we need to make sure we learn and adapt, too.

S3 Ep56: Cryptotrading rodent, ransomware hackback, and a Docusign phish [Podcast]

By Paul Ducklin
Latest episode - listen now! Serious security explained with personality in plain English.

ns-1200-logo-podcast-with-mic-and-rodent-emoji

Listen up 2 – CYBERSECURITY FIRST! How to protect yourself from supply chain attacks

By Paul Ducklin
Everyone remembers this year's big-news supply chain attacks on Kaseya and SolarWinds. Sophos expert Chester Wisniewski explains how to control the risk.

❌