FreshRSS

🔒
☐ ☆ ✇ Naked Security

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin — August 1st 2022 at 16:55
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

☐ ☆ ✇ The Hacker News

CISA Warns of Atlassian Confluence Hard-Coded Credential Bug Exploited in Attacks

By Ravie Lakshmanan — July 30th 2022 at 03:54
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added the recently disclosed Atlassian security flaw to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. The vulnerability, tracked as CVE-2022-26138, concerns the use of hard-coded credentials when the Questions For Confluence app is enabled in Confluence Server and Data Center
☐ ☆ ✇ The Hacker News

Latest Critical Atlassian Confluence Vulnerability Under Active Exploitation

By Ravie Lakshmanan — July 29th 2022 at 03:19
A week after Atlassian rolled out patches to contain a critical flaw in its Questions For Confluence app for Confluence Server and Confluence Data Center, the shortcoming has now come under active exploitation in the wild. The bug in question is CVE-2022-26138, which concerns the use of a hard-coded password in the app that could be exploited by a remote, unauthenticated attacker to gain
☐ ☆ ✇ Naked Security

S3 Ep93: Office security, breach costs, and leisurely patches [Audio + Text]

By Paul Ducklin — July 28th 2022 at 15:47
Latest episode - listen now!

☐ ☆ ✇ The Hacker News

Microsoft Uncovers Austrian Company Exploiting Windows and Adobe Zero-Day Exploits

By Ravie Lakshmanan — July 28th 2022 at 11:18
A cyber mercenary that "ostensibly sells general security and information analysis services to commercial customers" used several Windows and Adobe zero-day exploits in limited and highly-targeted attacks against European and Central American entities. The company, which Microsoft describes as a private-sector offensive actor (PSOA), is an Austria-based outfit called DSIRF that's linked to the
☐ ☆ ✇ Naked Security

Critical Samba bug could let anyone become Domain Admin – patch now!

By Paul Ducklin — July 27th 2022 at 21:15
It's a serious bug... but there's a fix for it, so you know exactly what to do!

☐ ☆ ✇ The Hacker News

Taking the Risk-Based Approach to Vulnerability Patching

By The Hacker News — July 27th 2022 at 09:21
Software vulnerabilities are a major threat to organizations today. The cost of these threats is significant, both financially and in terms of reputation.Vulnerability management and patching can easily get out of hand when the number of vulnerabilities in your organization is in the hundreds of thousands of vulnerabilities and tracked in inefficient ways, such as using Excel spreadsheets or
☐ ☆ ✇ Naked Security

Mild monthly security update from Firefox – but update anyway

By Paul Ducklin — July 27th 2022 at 00:41
You're probably thinking we're going to say, "Don't delay/Do it today"... and that's exactly what we are saying!

☐ ☆ ✇ The Hacker News

Microsoft Adds Default Protection Against RDP Brute-Force Attacks in Windows 11

By Ravie Lakshmanan — July 25th 2022 at 15:43
Microsoft is now taking steps to prevent Remote Desktop Protocol (RDP) brute-force attacks as part of the latest builds for the Windows 11 operating system in an attempt to raise the security baseline to meet the evolving threat landscape. To that end, the default policy for Windows 11 builds – particularly, Insider Preview builds 22528.1000 and newer – will automatically lock accounts for 10
☐ ☆ ✇ The Hacker News

SonicWall Issues Patch for Critical Bug Affecting its Analytics and GMS Products

By Ravie Lakshmanan — July 22nd 2022 at 18:35
Network security company SonicWall on Friday rolled out fixes to mitigate a critical SQL injection (SQLi) vulnerability affecting its Analytics On-Prem and Global Management System (GMS) products. The vulnerability, tracked as CVE-2022-22280, is rated 9.4 for severity on the CVSS scoring system and stems from what the company describes is an "improper neutralization of special elements" used in
☐ ☆ ✇ Naked Security

Apple patches “0-day” browser bug fixed 2 weeks ago in Chrome, Edge

By Paul Ducklin — July 21st 2022 at 12:38
One vendor's zero-day is another vendor's routine patch...

☐ ☆ ✇ Naked Security

8 months on, US says Log4Shell will be around for “a decade or longer”

By Paul Ducklin — July 18th 2022 at 16:57
When it comes to cybersecurity, ask not what everyone else can do for you...

☐ ☆ ✇ Naked Security

Apache “Commons Configuration” patches Log4Shell-style bug – what you need to know

By Paul Ducklin — July 8th 2022 at 00:59
It's a bit like Log4J, but for configuration files, not for logging.

☐ ☆ ✇ Naked Security

S3 Ep90: Chrome 0-day again, True Cybercrime, and a 2FA bypass [Podcast + Transcript]

By Paul Ducklin — July 7th 2022 at 18:46
Listen now! Or read if you prefer...

☐ ☆ ✇ Naked Security

OpenSSL fixes two “one-liner” crypto bugs – what you need to know

By Paul Ducklin — July 6th 2022 at 16:52
"As bad as Heartbleed"? We heard that concern a week ago, but we think it's less ungood than that...

☐ ☆ ✇ Naked Security

Google patches “in-the-wild” Chrome zero-day – update now!

By Paul Ducklin — July 5th 2022 at 15:55
Running Chrome? Do the "Help-About-Update" dance move right now, just to be sure...

☐ ☆ ✇ Naked Security

S3 Ep89: Sextortion, blockchain blunder, and an OpenSSL bugfix [Podcast + Transcript]

By Paul Ducklin — June 30th 2022 at 12:57
Latest episode - listen and read now! Use our advice to advise your own friends and family... let's all do our bit to stand up to scammers!

☐ ☆ ✇ Naked Security

Firefox 102 fixes address bar spoofing security hole (and helps with Follina!)

By Paul Ducklin — June 29th 2022 at 16:11
Firefox squashes a bug that helped phishers, and brings its own helping hand to Microsoft's "Follina" saga.

☐ ☆ ✇ Naked Security

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin — June 24th 2022 at 15:32
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

☐ ☆ ✇ Naked Security

S3 Ep87: Follina, AirTags, ID theft and the Law of Big Numbers [Podcast]

By Paul Ducklin — June 16th 2022 at 16:52
Lastest epsiode - listen now!

☐ ☆ ✇ Naked Security

Follina gets fixed – but it’s not listed in the Patch Tuesday patches!

By Paul Ducklin — June 15th 2022 at 01:20
We tried it out to make sure, so you don't have to.

☐ ☆ ✇ Naked Security

You’re invited! Join us for a live walkthrough of the “Follina” story…

By Paul Ducklin — June 13th 2022 at 16:28
Live demo, plain English, no sales pitch, just a chance to watch an attack dissected in safety. Join us if you can!

☐ ☆ ✇ Naked Security

S3 Ep86: The crooks were in our network for HOW long?! [Podcast + Transcript]

By Paul Ducklin — June 9th 2022 at 13:07
Latest episode - listen (or read) now!

☐ ☆ ✇ Naked Security

Know your enemy! Learn how cybercrime adversaries get in…

By Paul Ducklin — June 7th 2022 at 15:49
Here's how 144 recent attacks actually went down in real life. Don't let this happen to you!

☐ ☆ ✇ Naked Security

Atlassian announces 0-day hole in Confluence Server – update now!

By Paul Ducklin — June 3rd 2022 at 18:59
Zero-day announced - here's what you need to know

☐ ☆ ✇ Naked Security

Yet another zero-day (sort of) in Windows “search URL” handling

By Paul Ducklin — June 2nd 2022 at 19:39
More trouble with special-purpose URLs on Windows.

☐ ☆ ✇ Naked Security

S3 Ep85: Now THAT’S what I call a Microsoft Office exploit! [Podcast]

By Paul Ducklin — June 2nd 2022 at 18:37
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Firefox 101 is out, this time with no 0-day scares (but update anyway!)

By Paul Ducklin — June 1st 2022 at 14:31
After an intriguing month of Firefox releases, here's one with a bit less drama, probably to the collective relief of Mozilla's coders.

☐ ☆ ✇ Naked Security

Mysterious “Follina” zero-day hole in Office – here’s what to do!

By Paul Ducklin — May 30th 2022 at 23:01
News has emerged of a "feature" in Office that has been abused as a zero-day bug to run evil code. Turning off macros doesn't help!

☐ ☆ ✇ McAfee Blogs

How Secure Is Video Conferencing?

By McAfee — May 27th 2022 at 14:20

As millions of people around the world practice social distancing and work their office jobs from home, video conferencing has quickly become the new norm. Whether you’re attending regular work meetings, partaking in a virtual happy hour with friends, or catching up with extended family across the globe, video conferencing is a convenient alternative to many of the activities we can no longer do in real life. But as the rapid adoption of video conferencing tools and apps occurs, is security falling by the wayside?

Avoid Virtual Party Crashers

One security vulnerability that has recently made headlines is the ability for uninvited attendees to bombard users’ virtual meetings. How? According to Forbes, many users have posted their meeting invite links on social media sites like Twitter. An attacker can simply click on one of these links and interrupt an important conference call or meeting with inappropriate content.  

Ensure Data is in the Right Hands

Online conferencing tools allow users to hold virtual meetings and share files via chat. But according to Security Boulevard, communicating confidential business information quickly and privately can be challenging with these tools. For example, users are not always immediately available, even when working from home. In fact, many parents are simultaneously doubling as working parents and teachers with the recent closure of schools and childcare providers. If a user needs to share private information with a coworker but they are unable to connect by video or phone, they might revert to using a messaging platform that lacks end-to-end encryptiona feature that prevents third-party recipients from seeing private messages. This could lead to leaks or unintended sharing of confidential data, whether personal or corporate. What’s more, the lack of using a secure messaging platform could present a hacker with an opportunity to breach a victim’s data or deviceDepending on the severity of this type of breach, a victim could be at risk of identity theft 

Pay Attention to Privacy Policies

With the recent surge of new video conferencing users, privacy policies have been placed under a microscope. According to WIRED, some online conferencing tools have had to update their policies to reflect the collection of user information and meeting content used for advertising or other marketing efforts. Another privacy concern was brought to light by a video conferencing tool’s attention-tracking feature. This alerts the virtual meeting host when an attendee hasn’t had the meeting window in their device foreground for 30 seconds, resulting in users feeling that their privacy has been compromised.  

How to Secure Video Conferences

As users become accustomed to working from home, video conferencing tools will continue to become a necessary avenue for virtual communication. But how can users do so while putting their online security first? Follow these tips to help ensure that your virtual meetings are safeguarded:  

Do your research

There are plenty of video conferencing tools available online. Before downloading the first one you see, do your research and check for possible security vulnerabilities around the tools. Does the video conferencing tool you’re considering use end-to-end encryption? This ensures that only meeting participants have the ability to decrypt secure meeting content. Additionally, be sure to read the privacy policies listed by the video conferencing programs to find the one that is the most secure and fits your needs.  

Make your meetings password protected

To ensure that only invited attendees can access your meeting, make sure they are password protected. For maximum safety, activate passwords for new meetings, instant meetings, personal meetings, and people joining by phone. 

Block users from taking control of the screen

To keep users (either welcome or unwelcome) from taking control of your screen while you’re video conferencing, select the option to block everyone except the host (you) from screen sharing.  

Turn on automatic updates

By turning on automatic updates, you are guaranteed to have all the latest security patches and enhancements for your video conferencing tool as soon as they become available.  

The post How Secure Is Video Conferencing? appeared first on McAfee Blog.

☐ ☆ ✇ Naked Security

S3 Ep84: Government demand, Mozilla velocity, and Clearview fine [Podcast]

By Paul Ducklin — May 27th 2022 at 11:17
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin — May 24th 2022 at 23:04
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

☐ ☆ ✇ Naked Security

Mozilla patches Wednesday’s Pwn2Own double-exploit… on Friday!

By Paul Ducklin — May 20th 2022 at 23:47
That was quick! 48 hours from exploit report to published patch.

☐ ☆ ✇ Naked Security

Microsoft patches the Patch Tuesday patch that broke authentication

By Paul Ducklin — May 20th 2022 at 22:35
Remember the good old days when security patches rarely needed patches? Because security patches themlelves were rare enough anyway?

☐ ☆ ✇ Naked Security

US Government says: Patch VMware right now, or get off our network

By Paul Ducklin — May 20th 2022 at 14:03
Find and patch. Right now. If you can't patch, get it off the network. Right now! Oh, and show us what you did to comply.

☐ ☆ ✇ Naked Security

S3 Ep83: Cracking passwords, patching Firefox, and Apple vulns [Podcast]

By Paul Ducklin — May 19th 2022 at 13:56
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin — May 18th 2022 at 13:04
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

☐ ☆ ✇ Naked Security

Apple patches zero-day kernel hole and much more – update now!

By Paul Ducklin — May 17th 2022 at 09:30
You'll find fixes for numerous kernel-level code execution holes, including an 0-day vulnerability in many (though not all) versions.

☐ ☆ ✇ Naked Security

Serious Security: Learning from curl’s latest bug update

By Paul Ducklin — May 12th 2022 at 15:08
Learn how to write plain-speaking and purposeful security advisories from one of the most widely-used open source tools in the world.

☐ ☆ ✇ Naked Security

RubyGems supply chain rip-and-replace bug fixed – check your logs!

By Paul Ducklin — May 9th 2022 at 15:41
Imagine if you could assume the identity of, say, Franklin Delano Roosevelt simply by showing up and calling yourself "Frank".

ruby-1200

☐ ☆ ✇ Naked Security

You didn’t leave enough space between ROSE and AND, and AND and CROWN

By Paul Ducklin — May 6th 2022 at 16:59
What weird Google Docs bug connects the words THEREFORE, AND, SECONDLY, WHY, BUT and BESIDES?

☐ ☆ ✇ Naked Security

Android monthly updates are out – critical bugs found in critical places!

By Paul Ducklin — May 4th 2022 at 15:54
Android May 2022 updates are out - with some critical fixes in some critical places. Learn more...

☐ ☆ ✇ Naked Security

Firefox hits 100*, fixes bugs… but no new zero-days this month

By Paul Ducklin — May 3rd 2022 at 16:42
Despite concerns that some websites might break when Chromium and then Firefox reached version 100, the web still seems to be intact.

☐ ☆ ✇ Naked Security

QNAP warns of new bugs in its Network Attached Storage devices

By Paul Ducklin — April 22nd 2022 at 15:15
Here's what you need to know - plus some sensible advice for all the devices on your home or small biz network!

nas-1200

☐ ☆ ✇ Naked Security

Critical cryptographic Java security blunder patched – update now!

By Paul Ducklin — April 20th 2022 at 16:43
Either know the private key and use it scrupulously in your digital signature calculation.... or just send a bunch of zeros instead.

☐ ☆ ✇ Naked Security

Beanstalk cryptocurrency heist: scammer votes himself all the money

By Paul Ducklin — April 19th 2022 at 16:00
Voting safeguards based on commuity collateral don't work if one person can use a momentary loan to "become" 75% of the community.

☐ ☆ ✇ Naked Security

Yet another Chrome zero-day emergency update – patch now!

By Paul Ducklin — April 16th 2022 at 00:33
The third emergency Chrome 0-day in three months - the first one was exploited by North Korea, so you might as well get this one ASAP.

☐ ☆ ✇ Naked Security

S3 Ep78: Darkweb hydra, Ruby, quantum computing, and a robot revolution [Podcast]

By Paul Ducklin — April 14th 2022 at 13:39
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Hospital robot system gets five critical security holes patched

By Paul Ducklin — April 12th 2022 at 18:58
Fortunately, we're not talking about a robot revolution, or about hospital AI run amuck. But these bugs could lead to ransomware, or worse...

☐ ☆ ✇ Naked Security

Popular Ruby Asciidoc toolkit patched against critical vuln – get the update now!

By Paul Ducklin — April 8th 2022 at 15:38
A rogue line-continuation character can trick the code into validating just the second half of the line, but executing all of it.

ruby-1200

☐ ☆ ✇ Naked Security

S3 Ep77: Bugs, busts and old-school PDP-11 hacking [Podcast]

By Paul Ducklin — April 7th 2022 at 12:24
Latest episode - listen now! Cybersecurity news and advice in plain English.

☐ ☆ ✇ Naked Security

Firefox 99 is out – no major bugs, but update anyway!

By Paul Ducklin — April 5th 2022 at 16:21
Firefox's four-weekly updates just dropped - here's what you need to know.

☐ ☆ ✇ Naked Security

Google’s monthly Android updates patch numerous “get root” holes

By Paul Ducklin — April 5th 2022 at 14:44
Get the update now... if it's available for your phone. Here's how to check.

android-1200

☐ ☆ ✇ Naked Security

Apple pushes out two emergency 0-day updates – get ’em now!

By Paul Ducklin — March 31st 2022 at 23:38
More Apple zero-days - mobile devices, laptops and desktops affected. Update now!

apple-1200

☐ ☆ ✇ Naked Security

S3 Ep76: Deadbolt, LAPSUS$, Zlib, and a Chrome 0-day [Podcast]

By Paul Ducklin — March 31st 2022 at 13:38
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Zlib data compressor fixes 17-year-old security bug – patch, errrm, now

By Paul Ducklin — March 29th 2022 at 16:37
This code is venerable! Surely all the bugs must be out by now?

☐ ☆ ✇ Naked Security

S3 Ep75: Okta hack, CryptoRom, OpenSSL, and CafePress [Podcast]

By Paul Ducklin — March 24th 2022 at 13:49
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Serious Security: DEADBOLT – the ransomware that goes straight for your backups

By Paul Ducklin — March 23rd 2022 at 19:58
Some tips on how to keep your network safe - even (or perhaps especially!) if you think you're safe already.

☐ ☆ ✇ Naked Security

OpenSSL patches infinite-loop DoS bug in certificate verification

By Paul Ducklin — March 18th 2022 at 17:59
When it comes to writing loops in your code... never sit on the fence!

☐ ☆ ✇ Naked Security

S3 Ep74: Cybercrime busts, Apple patches, Pi Day, and disconnect effects [Podcast]

By Paul Ducklin — March 17th 2022 at 13:32
Latest episode - listen now!

❌