FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Mom’s Meals issues “Notice of Data Event”: What to know and what to do

By Paul Ducklin
It took six months for notifications to start, and we still don't know exactly what went down... but here's our advice on what to do.

“Grab hold and give it a wiggle” – ATM card skimming is still a thing

By Paul Ducklin
The rise of tap-to-pay and chip-and-PIN hasn't rid the world of ATM card skimming criminals...

Microsoft Patch Tuesday: 74 CVEs plus 2 “Exploit Detected” advisories

By Paul Ducklin
74 CVEs, and two "Exploitation Detected" advisories, which are nearly but not quite the same as 0-days. Also, two potential Teams treacheries that you really want to fix.

Serious Security: Why learning to touch-type could protect you from audio snooping

By Paul Ducklin
Fast, quiet, smooth, consistent and low impact... why true hacker-grade touch-typing might keep you more secure.

Performance and security clash yet again in “Collide+Power” attack

By Paul Ducklin
It's a real vulnerability, but the data leakage rate can be as low as... let's just say that an IMAX-quality copy of the new "Oppenheimer" movie could take you 4 billion years to exfiltrate.

SEC demands four-day disclosure limit for cybersecurity breaches

By Paul Ducklin
When is a ransomware attack a reportable matter? And how long have you got to decide?

S3 Ep145: Bugs With Impressive Names!

By Paul Ducklin
Fascinating fun (with a serious and educational side) - listen now! Full transcript available inside.

Zenbleed: How the quest for CPU performance could put your passwords at risk

By Paul Ducklin
You need to turn on a special setting to stop (the code you wrote to stop [the code you wrote to improve performance] from reducing performance) from reducing security.

Microsoft hit by Storm season – a tale of two semi-zero days

By Paul Ducklin
The first compromise didn't get the crooks as far as they wanted, so they found a second one that did...

Zimbra Collaboration Suite warning: Patch this 0-day right now (by hand)!

By Paul Ducklin
Zimbra didn't actually say, "Do not delay/Do it today," but they did say, "We kindly request your cooperation to apply the fix manually."

Microsoft patches four zero-days, finally takes action against crimeware kernel drivers

By Paul Ducklin
Here's a brief reminder to do two things. The first is to patch. The second is to read up why it's a good idea to patch...

Apple silently pulls its latest zero-day update – what now?

By Paul Ducklin
Previously, we said "do it today", but now we're forced back on: "Do not delay; do it as soon as Apple and your device will let you."

Urgent! Apple fixes critical zero-day hole in iPhones, iPads and Macs

By Paul Ducklin
Don't delay, do it today. This is a code-implantation bug in WebKit that attackers already know how to exploit.

Ghostscript bug could allow rogue documents to run system commands

By Paul Ducklin
Even if you've never heard of the venerable Ghostscript project, you may have it installed without knowing.

Interested in $10,000,000? Ready to turn in the Clop ransomware crew?

By Naked Security writer
Technically, it's "up to $10 million", but it's potentially a LOT of money, nevertheless...

Aussie PM says, “Shut down your phone every 24 hours for 5 mins” – but that’s not enough on its own

By Paul Ducklin
Don't treat rebooting your phone once a day as a cybersecurity talisman... here are 8 additional tips for better mobile phone security.

Gozi banking malware “IT chief” finally jailed after more than 10 years

By Paul Ducklin
Gozi threesome from way back in the late 2000s and early 2010s now all charged, convicted and sentenced. The DOJ got there in the end...

S3 Ep138: I like to MOVEit, MOVEit

By Paul Ducklin
Backdoors, exploits, and Little Bobby Tables. Listen now! (Full transcript available...)

s3-ep138-1200

S3 Ep137: 16th century crypto skullduggery

By Paul Ducklin
Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

s3-ep137-feat-1200

Serious Security: That KeePass “master password crack”, and what we can learn from it

By Paul Ducklin
Here, in an admittedly discursive nutshell, is the fascinating story of CVE-2023-32784. (Short version: Don't panic.)

Serious Security: Verification is vital – examining an OAUTH login bug

By Paul Ducklin
What good is a popup asking for your approval if an attacker can bypass it simply by suppressing it?

Phone scamming kingpin gets 13 years for running “iSpoof” service

By Naked Security writer
Site marketing video promised total anonymity, but that was a lie. 170 arrested already. Potentially 1000s more to follow.

ispoof-1200

Mac malware-for-hire steals passwords and cryptocoins, sends “crime logs” via Telegram

By Paul Ducklin
These malware peddlers are specifically going after Mac users. The hint's in the name: "Atomic macOS Stealer", or AMOS for short.

S3 Ep132: Proof-of-concept lets anyone hack at will

By Paul Ducklin
When Doug says, "Happy Remote Code Execution Day, Duck"... it's irony. For the avoidance of all doubt :-)

Double zero-day in Chrome and Edge – check your versions now!

By Paul Ducklin
Wouldn't it be handy if there were a single version number to check for in every Chromium-based browser, on every supported platform?

Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security

By Paul Ducklin
Did the sentence fit the crime? Read the backstory, and then have your say in our comments! (You may post anonymously.)

FBI and FCC warn about “Juicejacking” – but just how useful is their advice?

By Paul Ducklin
USB charging stations - can you trust them? What are the real risks, and how can you keep your data safe on the road?

S3 Ep130: Open the garage bay doors, HAL [Audio + Text]

By Paul Ducklin
I'm sorry, Dave. I'm afraid I can't... errr, no, hang on a minute, I can do that easily! Worldwide! Right now!

Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads

By Paul Ducklin
That double-whammy Apple browser-to-kernel spyware bug combo we wrote up last week? Turns out it applies to all supported Macs and iDevices - patch now!

Apple issues emergency patches for spyware-style 0-day exploits – update now!

By Paul Ducklin
A bug to hack your browser, then a bug to pwn the kernel... reported from the wild by Amnesty International.

S3 Ep129: When spyware arrives from someone you trust

By Paul Ducklin
Scanning tools, supply-chain malware, Wi-Fi hacking, and why there should be TWO World Backup Days... listen now!

Researchers claim they can bypass Wi-Fi encryption (briefly, at least)

By Paul Ducklin
They can't read much of your data, but even a few stray network packets could tell them something they're not supposed to know.

Cops use fake DDoS services to take aim at wannabe cybercriminals

By Naked Security writer
Thinking of trying a bit of DDoSsing to get a feel for life at the fringes of the Dark Side? Don't do it!

Apple patches everything, including a zero-day fix for iOS 15 users

By Paul Ducklin
Got an older iPhone that can't run iOS 16? You've got a zero-day to deal with! That super-cool Studio Display monitor needs patching, too.

Microsoft assigns CVE to Snipping Tool bug, pushes patch to Store

By Paul Ducklin
Microsoft says "successful exploitation requires uncommon user interaction", but it's the innocent and accidental leakage of private data you should be concerned about.

WooCommerce Payments plugin for WordPress has an admin-level hole – patch now!

By Paul Ducklin
Admin-level holes in websites are always a bad thing... and for "bad", read "worse" if it's an e-commerce site.

woo-1200

Windows 11 also vulnerable to “aCropalypse” image data leakage

By Paul Ducklin
Turns out that the Windows 11 Snipping Tool has the same "aCropalypse" data leakage bug as Pixel phones. Here's how to work around the problem...

Google Pixel phones had a serious data leakage bug – here’s what to do!

By Paul Ducklin
What if the "safe" images you shared after carefully cropping them... had some or all of the "unsafe" pixels left behind anyway?

Bitcoin ATM customers hacked by video upload that was actually an app

By Paul Ducklin
As the misquote goes, "Once is misfortune..." This is the second time, and you know what Lady Bracknell had to say about that...

S3 Ep 126: The price of fast fashion (and feature creep) [Audio + Text]

By Paul Ducklin
Worried about rogue apps? Unsure about the new Outlook zero-day? Clear advice in plain English... just like old times, with Duck and Chet!

❌