FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Smart light bulbs could give away your password secrets

By Paul Ducklin
Cryptography isn't just about secrecy. You need to take care of authenticity (no imposters!) and integrity (no tampering!) as well.

S3 Ep145: Bugs With Impressive Names!

By Paul Ducklin
Fascinating fun (with a serious and educational side) - listen now! Full transcript available inside.

Microsoft hit by Storm season – a tale of two semi-zero days

By Paul Ducklin
The first compromise didn't get the crooks as far as they wanted, so they found a second one that did...

UK hacker busted in Spain gets 5 years over Twitter hack and more

By Naked Security writer
Not just that infamous Twitter hack, but SIM-swapping, stalking and swatting too...

History revisited: US DOJ unseals Mt. Gox cybercrime charges

By Naked Security writer
Though the mills of the Law grind slowly/Yet they grind exceeding small/Though with patience they stand waiting/With exactness grind they all...

S3 Ep137: 16th century crypto skullduggery

By Paul Ducklin
Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

s3-ep137-feat-1200

Google leaking 2FA secrets – researchers advise against new “account sync” feature for now

By Paul Ducklin
You waited 13 years for this feature in Google Authenticator. Now researchers are advising you to wait a while longer, just in case...

Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security

By Paul Ducklin
Did the sentence fit the crime? Read the backstory, and then have your say in our comments! (You may post anonymously.)

Attention gamers! Motherboard maker MSI admits to breach, issues “rogue firmware” alert

By Paul Ducklin
Stealing private keys is like getting hold of a medieval monarch's personal signet ring... you get to put an official seal on treasonous material.

Windows 11 also vulnerable to “aCropalypse” image data leakage

By Paul Ducklin
Turns out that the Windows 11 Snipping Tool has the same "aCropalypse" data leakage bug as Pixel phones. Here's how to work around the problem...

Bitcoin ATM customers hacked by video upload that was actually an app

By Paul Ducklin
As the misquote goes, "Once is misfortune..." This is the second time, and you know what Lady Bracknell had to say about that...

Serious Security: TPM 2.0 vulns – is your super-secure data at risk?

By Paul Ducklin
Security bugs in the very code you've been told you must have to improve the security of your computer...

DoppelPaymer ransomware supsects arrested in Germany and Ukraine

By Naked Security writer
Devices seized, suspects interrogated and arrested, allegedly connected to devastating cyberattack on University Hospital in Düsseldorf.

S3 Ep124: When so-called security apps go rogue [Audio + Text]

By Paul Ducklin
Rogue software packages. Rogue "sysadmins". Rogue keyloggers. Rogue authenticators. Rogue ROGUES!

s3-ep124-auth--1200

Dutch police arrest three cyberextortion suspects who allegedly earned millions

By Naked Security writer
Ever paid hush money to crooks who broke into your network? Wondered how much you can trust them?

Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!

By Paul Ducklin
Even in Apple's and Google's "walled gardens", there are plenty of 2FA apps that are either dangerously incompetent, or unrepentantly malicious. (Or perhaps both.)

Coinbase breached by social engineers, employee data stolen

By Paul Ducklin
Another day, another "sophisticated" attack. This time, the company has handily included some useful advice along with its mea culpa...

Twitter tells users: Pay up if you want to keep using insecure 2FA

By Paul Ducklin
Ironically, Twitter Blue users will be allowed to keep using the very 2FA process that's not considered secure enough for everyone else.

Serious Security: GnuTLS follows OpenSSL, fixes timing attack bug

By Paul Ducklin
Conditional code considered cryptographically counterproductive.

OpenSSL fixes High Severity data-stealing bug – patch now!

By Paul Ducklin
7 memory mismanagements and a timing attack. We explain all the jargon bug terminology in plain English...

Tracers in the Dark: The Global Hunt for the Crime Lords of Crypto

By Paul Ducklin
Hear renowned cybersecurity author Andy Greenberg's thoughtful commentary about the "war on crypto" as we talk to him about his new book...

Finnish psychotherapy extortion suspect arrested in France

By Naked Security writer
Company transcribed ultra-personal conversations, didn't secure them. Criminal stole them, then extorted thousands of vulnerable patients.

Password-stealing “vulnerability” reported in KeePass – bug or feature?

By Paul Ducklin
Is it a vulnerability if someone with control over your account can mess with files that your account is allowed to access anyway?

Serious Security: The Samba logon bug caused by outdated crypto

By Paul Ducklin
Enjoy our Serious Security deep dive into this real-world example of why cryptographic agility is important!

GoTo admits: Customer cloud backups stolen together with decryption key

By Paul Ducklin
We were going to write, "Once more unto the breach, dear friends, once more"... but it seems to go without saying these days.

S3 Ep118: Guess your password? No need if it’s stolen already! [Audio + Text]

By Paul Ducklin
As always: entertaining, informative and educational... and not bogged down with jargon! Listen (or read) now...

Serious Security: Unravelling the LifeLock “hacked passwords” story

By Paul Ducklin
Four straight-talking tips to improve your online security, whether you're a LifeLock customer or not.

Multi-million investment scammers busted in four-country Europol raid

By Paul Ducklin
216 questioned, 15 arrested, 4 fake call centres searched, millions seized...

Popular JWT cloud security library patches “remote” code execution hole

By Paul Ducklin
It's remotely triggerable, but attackers would already have pretty deep network access if they could "prime" your server for compromise.

RSA crypto cracked? Or perhaps not!

By Paul Ducklin
Stand down from blue alert, it seems... but why not plan your cryptographic agility anyway?

S3 Ep116: Last straw for LastPass? Is crypto doomed? [Audio + Text]

By Paul Ducklin
Lots of big issues this week: breaches, encryption, supply chains and patching problems. Listen now! (Full transcript inside.)

Inside a scammers’ lair: Ukraine busts 40 in fake bank call-centre raid

By Naked Security writer
When someone calls you up to warn you that your bank account is under attack - it's true, because THAT VERY PERSON is the one attacking you!

PyTorch: Machine Learning toolkit pwned from Christmas to New Year

By Paul Ducklin
The bad news: the crooks have your SSH private keys. The good news: only users of the "nightly" build were affected.

US passes the Quantum Computing Cybersecurity Preparedness Act – and why not?

By Paul Ducklin
Cryptographic agility: the ability and the willingness to change quickly when needed.

sc-daa-1200

Twitter data of “+400 million unique users” up for sale – what to do?

By Paul Ducklin
If the crooks have connected up your phone number and your Twitter handle... what could go wrong?

OneCoin scammer Sebastian Greenwood pleads guilty, “Cryptoqueen” still missing

By Paul Ducklin
The Cryptoqueen herself is still missing, but her co-conspirator, who is said to have pocketed over $20m a month, has been convicted.

SIM swapper sent to prison for 2FA cryptocurrency heist of over $20m

By Naked Security writer
Guilty party got 18 months, also has to pay back $20m he probably hasn't got, which could land him in more hot water.

Serious Security: MD5 considered harmful – to the tune of $600,000

By Paul Ducklin
It's not just the hashing, by the way. It's the salting and the stretching, too!

TikTok “Invisible Challenge” porn malware puts us all at risk

By Paul Ducklin
An injury to one is an injury to all. Especially if the other people are part of your social network.

Multimillion dollar CryptoRom scam sites seized, suspects arrested in US

By Paul Ducklin
Five tips to keep yourself, and your friends and family, out of the clutches of "chopping block" scammers...

cryptorom-1200

S3 Ep108: You hid THREE BILLION dollars in a popcorn tin?

By Paul Ducklin
Patches, busts, leaks and why even low-likelihood exploits can be high-severity risks - listen now!

Silk Road drugs market hacker pleads guilty, faces 20 years inside

By Paul Ducklin
Jurisprudence isn't like arithmetic... two negatives never make a positive!

The OpenSSL security update story – how can you tell what needs fixing?

By Paul Ducklin
How to Hack! Finding OpenSSL library files and accurately identifying their version numbers...

ossl-code-1200

❌