FreshRSS

πŸ”’
❌ About FreshRSS
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Mom’s Meals issues β€œNotice of Data Event”: What to know and what to do

By Paul Ducklin
It took six months for notifications to start, and we still don't know exactly what went down... but here's our advice on what to do.

β€œGrab hold and give it a wiggle” – ATM card skimming is still a thing

By Paul Ducklin
The rise of tap-to-pay and chip-and-PIN hasn't rid the world of ATM card skimming criminals...

Serious Security: Why learning to touch-type could protect you from audio snooping

By Paul Ducklin
Fast, quiet, smooth, consistent and low impact... why true hacker-grade touch-typing might keep you more secure.

S3 Ep146: Tell us about that breach! (If you want to.)

By Paul Ducklin
Serious security stories explained clearly in plain English - listen now. (Full transcript available.)

Performance and security clash yet again in β€œCollide+Power” attack

By Paul Ducklin
It's a real vulnerability, but the data leakage rate can be as low as... let's just say that an IMAX-quality copy of the new "Oppenheimer" movie could take you 4 billion years to exfiltrate.

SEC demands four-day disclosure limit for cybersecurity breaches

By Paul Ducklin
When is a ransomware attack a reportable matter? And how long have you got to decide?

S3 Ep145: Bugs With Impressive Names!

By Paul Ducklin
Fascinating fun (with a serious and educational side) - listen now! Full transcript available inside.

Zenbleed: How the quest for CPU performance could put your passwords at risk

By Paul Ducklin
You need to turn on a special setting to stop (the code you wrote to stop [the code you wrote to improve performance] from reducing performance) from reducing security.

Microsoft hit by Storm season – a tale of two semi-zero days

By Paul Ducklin
The first compromise didn't get the crooks as far as they wanted, so they found a second one that did...

Zimbra Collaboration Suite warning: Patch this 0-day right now (by hand)!

By Paul Ducklin
Zimbra didn't actually say, "Do not delay/Do it today," but they did say, "We kindly request your cooperation to apply the fix manually."

Serious Security: Rowhammer returns to gaslight your computer

By Paul Ducklin
Gaslights produce a telltale flicker when nearby lamps are lit; DRAM values do something similar when nearby memory cells are accessed.

Interested in $10,000,000? Ready to turn in the Clop ransomware crew?

By Naked Security writer
Technically, it's "up to $10 million", but it's potentially a LOT of money, nevertheless...

Gozi banking malware β€œIT chief” finally jailed after more than 10 years

By Paul Ducklin
Gozi threesome from way back in the late 2000s and early 2010s now all charged, convicted and sentenced. The DOJ got there in the end...

S3 Ep137: 16th century crypto skullduggery

By Paul Ducklin
Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

s3-ep137-feat-1200

Serious Security: Verification is vital – examining an OAUTH login bug

By Paul Ducklin
What good is a popup asking for your approval if an attacker can bypass it simply by suppressing it?

Phone scamming kingpin gets 13 years for running β€œiSpoof” service

By Naked Security writer
Site marketing video promised total anonymity, but that was a lie. 170 arrested already. Potentially 1000s more to follow.

ispoof-1200

S3 Ep131: Can you really have fun with FORTRAN?

By Paul Ducklin
Loop-the-loop in this week's episode. Entertaining, educational and all in plain English. Transcript inside.

Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security

By Paul Ducklin
Did the sentence fit the crime? Read the backstory, and then have your say in our comments! (You may post anonymously.)

FBI and FCC warn about β€œJuicejacking” – but just how useful is their advice?

By Paul Ducklin
USB charging stations - can you trust them? What are the real risks, and how can you keep your data safe on the road?

Attention gamers! Motherboard maker MSI admits to breach, issues β€œrogue firmware” alert

By Paul Ducklin
Stealing private keys is like getting hold of a medieval monarch's personal signet ring... you get to put an official seal on treasonous material.

S3 Ep129: When spyware arrives from someone you trust

By Paul Ducklin
Scanning tools, supply-chain malware, Wi-Fi hacking, and why there should be TWO World Backup Days... listen now!

Researchers claim they can bypass Wi-Fi encryption (briefly, at least)

By Paul Ducklin
They can't read much of your data, but even a few stray network packets could tell them something they're not supposed to know.

Microsoft assigns CVE to Snipping Tool bug, pushes patch to Store

By Paul Ducklin
Microsoft says "successful exploitation requires uncommon user interaction", but it's the innocent and accidental leakage of private data you should be concerned about.

WooCommerce Payments plugin for WordPress has an admin-level hole – patch now!

By Paul Ducklin
Admin-level holes in websites are always a bad thing... and for "bad", read "worse" if it's an e-commerce site.

woo-1200

Windows 11 also vulnerable to β€œaCropalypse” image data leakage

By Paul Ducklin
Turns out that the Windows 11 Snipping Tool has the same "aCropalypse" data leakage bug as Pixel phones. Here's how to work around the problem...

Google Pixel phones had a serious data leakage bug – here’s what to do!

By Paul Ducklin
What if the "safe" images you shared after carefully cropping them... had some or all of the "unsafe" pixels left behind anyway?

Bitcoin ATM customers hacked by video upload that was actually an app

By Paul Ducklin
As the misquote goes, "Once is misfortune..." This is the second time, and you know what Lady Bracknell had to say about that...

S3 Ep 126: The price of fast fashion (and feature creep) [Audio + Text]

By Paul Ducklin
Worried about rogue apps? Unsure about the new Outlook zero-day? Clear advice in plain English... just like old times, with Duck and Chet!

SHEIN shopping app goes rogue, grabs price and URL data from your clipboard

By Paul Ducklin
It's not exactly data theft, but it's worryingly close to "unintentional treachery" - apparently because it's great for marketing purposes

Feds warn about right Royal ransomware rampage that runs the gamut of TTPs

By Paul Ducklin
Wondering which cybercrime tools, techniques and procedures to focus on? How about any and all of them?

S3 Ep124: When so-called security apps go rogue [Audio + Text]

By Paul Ducklin
Rogue software packages. Rogue "sysadmins". Rogue keyloggers. Rogue authenticators. Rogue ROGUES!

s3-ep124-auth--1200

LastPass: Keylogger on home PC led to cracked corporate password vault

By Paul Ducklin
Seems the crooks implanted a keylogger via a vulnerable media app (LastPass politely didn't say which one!) on a developer's home computer.

Dutch police arrest three cyberextortion suspects who allegedly earned millions

By Naked Security writer
Ever paid hush money to crooks who broke into your network? Wondered how much you can trust them?

Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!

By Paul Ducklin
Even in Apple's and Google's "walled gardens", there are plenty of 2FA apps that are either dangerously incompetent, or unrepentantly malicious. (Or perhaps both.)

NPM JavaScript packages abused to create scambait links in bulk

By Paul Ducklin
Free spins? Bonus game points? Cheap social media followers? What harm could it possibly do if you just take a tiny little look?!

Coinbase breached by social engineers, employee data stolen

By Paul Ducklin
Another day, another "sophisticated" attack. This time, the company has handily included some useful advice along with its mea culpa...

GoDaddy admits: Crooks hit us with malware, poisoned customer websites

By Paul Ducklin
New report admits that attackers were detected in the network about three months ago, and may have been attacking for about three years.

Reddit admits it was hacked and data stolen, says β€œDon’t panic”

By Paul Ducklin
Reddit is suggesting three tips as a follow-up to this breach. We agree with two of them but not with the third...

Finnish psychotherapy extortion suspect arrested in France

By Naked Security writer
Company transcribed ultra-personal conversations, didn't secure them. Criminal stole them, then extorted thousands of vulnerable patients.

Password-stealing β€œvulnerability” reported in KeePass – bug or feature?

By Paul Ducklin
Is it a vulnerability if someone with control over your account can mess with files that your account is allowed to access anyway?

Dutch suspect locked up for alleged personal data megathefts

By Paul Ducklin
Undercover Austrian "controlled data buy" leads to Amsterdam arrest and ongoing investigation. Suspect is said to steal and sell all sorts of data, including medical records.

GoTo admits: Customer cloud backups stolen together with decryption key

By Paul Ducklin
We were going to write, "Once more unto the breach, dear friends, once more"... but it seems to go without saying these days.

S3 Ep118: Guess your password? No need if it’s stolen already! [Audio + Text]

By Paul Ducklin
As always: entertaining, informative and educational... and not bogged down with jargon! Listen (or read) now...

CircleCI – code-building service suffers total credential compromise

By Paul Ducklin
They're saying "rotate secrets"... in plain English, they mean "change your credentials". The company has a tool to help you find them all.

❌