FreshRSS

πŸ”’
☐ β˜† βœ‡ The Register - Security

Google sues CryptBot slingers, gets court order to shut down malware domains

April 27th 2023 at 23:04

Hands off those Chrome users, they're ours!

Google said it obtained a court order to shut down domains used to distribute CryptBot after suing the distributors of the info-stealing malware.…

☐ β˜† βœ‡ The Register - Security

Microsoft is busy rewriting core Windows code in memory-safe Rust

April 27th 2023 at 20:45

Now that's a C change we can back

Microsoft is rewriting core Windows libraries in the Rust programming language, and the more memory-safe code is already reaching developers.…

☐ β˜† βœ‡ The Register - Security

Microsoft probes complaints of Edge leaking URLs to Bing

April 26th 2023 at 21:08

Remember next time Redmond begs you not to install another browser

You might want to think twice before typing anything into Microsoft's Edge browser, as an apparent bug in a recent release of Redmond's Chromium clone appears to be funneling URLs you visit back to the Bing API.…

☐ β˜† βœ‡ The Register - Security

DoJ, Treasury accuses 3 men of laundering crypto for North Korea

April 26th 2023 at 18:44

If the DPRK is named, you know it somehow involves Lazarus Group

The US government is aggressively pursuing three men accused of wide-ranging and complex conspiracies of laundering stolen and illicit cryptocurrency that the North Korean regime used to finance its massive weapons programs.…

☐ β˜† βœ‡ The Register - Security

The good, the bad and the generative AI

April 26th 2023 at 08:32

ChatGPT is just the beginning: CISOs need to prepare for the next wave of AI-powered attacks

Sponsored Feature Change in the tech industry is usually evolutionary, but perhaps more interesting are the exceptions to this rule – the microprocessor in 1968, the IBM PC in 1981, the web in 1989, the smartphone in 2007. These are the technologies whose appearance began new eras that completely reshaped the industry around them.…

☐ β˜† βœ‡ The Register - Security

Apache Superset: A story of insecure default keys, thousands of vulnerable systems, few paying attention

April 25th 2023 at 22:35

Two out of three public-facing app instances open to hijacking

Apache Superset until earlier this year shipped with an insecure default configuration that miscreants could exploit to login and take over the data visualization application, steal data, and execute malicious code.…

☐ β˜† βœ‡ The Register - Security

Menaced by miscreants, critical infrastructure needs a good ETHOS. Ah, here's one

April 25th 2023 at 20:10

OT firms construct handy early-warning info-sharing system

RSA Conference A group of some of the largest operational technology companies are using this year's RSA Conference as an opportunity to launch an open source early-threat-warning system designed for OT and industrial control systems (ICS) environments. …

☐ β˜† βœ‡ The Register - Security

How fiends abuse an out-of-date Microsoft Windows driver to infect victims

April 24th 2023 at 11:30

It's like those TV movies where a spy cuts a wire and the whole building's security goes out

Ransomware spreaders have built a handy tool that abuses an out-of-date Microsoft Windows driver to disable security defenses before dropping malware into the targeted systems.…

☐ β˜† βœ‡ The Register - Security

That 3CX supply chain attack keeps getting worse: Other vendors hit

April 24th 2023 at 03:27

Also, Finland sentences CEO of breach company to prison (kind of), and this week's laundry list of critical vulns

In Brief We thought it was probably the case when the news came out, but now it's been confirmed: The X_Trader supply chain attack behind the 3CX compromise last month wasn't confined to the telco developer.…

☐ β˜† βœ‡ The Register - Security

Chinese scientists calculate the Milky Way's mass as 805 billion times that of our Sun

April 24th 2023 at 00:29

ALSO: Australia says offensive hacking is working; DJI hit with $279m patent suit; Philippines Police leak data; and more

Asia In Brief Chinese scientists have estimated the mass of the Milky Way.…

☐ β˜† βœ‡ The Register - Security

European air traffic control confirms website 'under attack' by pro-Russia hackers

April 22nd 2023 at 07:09

Another cyber nuisance in support of Putin's war, nothing too serious

Europe's air-traffic agency appears to be the latest target in pro-Russian miscreants' attempts to disrupt air travel.…

☐ β˜† βœ‡ The Register - Security

Microsoft pushes for more women in cybersecurity

April 21st 2023 at 22:03

Redmond tops industry average, still got a way to go

Microsoft has partnered with organizations around the globe to bring more women into infosec roles, though the devil is in the details.…

☐ β˜† βœ‡ The Register - Security

International cops urge Meta not to implement secure encryption for all

April 21st 2023 at 10:28

Why? Well, think of the children, of course

An international group of law enforcement agencies are urging Meta not to standardize end-to-end encryption on Facebook Messenger and Instagram, which they say will harm their ability to fight child sexual abuse material (CSAM) online.…

☐ β˜† βœ‡ The Register - Security

Healthcare organisations urged to improve system security

April 21st 2023 at 08:35

Patient data covering sensitive areas has long been a high-value target for cybercriminals

Sponsored Post Digital patient medical records now cover a whole gamut of sensitive details such as clinical diagnoses/treatments, prescriptions, personal finances and insurance policies. Which makes keeping them safe more important than ever.…

☐ β˜† βœ‡ The Register - Security

Thanks for fixing the computer lab. Now tell us why we shouldn’t expel you?

April 21st 2023 at 06:32

Guessing the admin password is cool. Using it, even for good, is dangerous

On Call It’s always twelve o’clock somewhere, the saying goes, but Friday comes around but once a week and only this day does The Register offer a fresh instalment of On Call, our reader-contributed tales of tech support torture and turmoil.…

☐ β˜† βœ‡ The Register - Security

Capita has 'evidence' customer data was stolen in digital burglary

April 20th 2023 at 13:29

Admits criminals accessed 4% of servers from March 22 until it spotted them at month-end

Business process outsourcing and tech services player Capita says there is proof that some customer data was scooped up by cyber baddies that broke into its systems late last month.…

☐ β˜† βœ‡ The Register - Security

An earlier supply chain attack led to the 3CX supply chain attack, Mandiant says

April 20th 2023 at 12:00

Threat hunters traced it back to malware-laced Trading Technologies' software

The supply-chain attack against 3CX last month was caused by an earlier supply-chain compromise of a different software firm β€” Trading Technologies β€” according to Mandiant, whose consulting crew was hired by 3CX to help the VoIP biz investigate the intrusion.…

☐ β˜† βœ‡ The Register - Security

AI defenders ready to foil AI-armed attackers

April 20th 2023 at 08:34

Operational AI cybersecurity systems have been gaining valuable experience that will enable them to defend against AI-armed opponents.

Sponsored Feature For some time now, alerts concerning the utilisation of AI by cybercriminals have been sounded in specialist and mainstream media alike – with the set-to between AI-armed attackers and AI-protected defenders envisaged in vivid gladiatorial terms.…

☐ β˜† βœ‡ The Register - Security

Protect the Industrial Control Systems (ICS)

April 20th 2023 at 08:08

ICS security is fast becoming a frontline defense against hackers intent on causing mayhem

Sponsored Post Some of the most famous cyber attacks in history have been directed against Industrial Control Systems (ICS).…

☐ β˜† βœ‡ The Register - Security

Medusa ransomware crew brags about spreading Bing, Cortana source code

April 19th 2023 at 23:12

'Does have a somewhat Lapsus$ish feel' we're told

The Medusa ransomware gang has put online what it claims is a massive leak of internal Microsoft materials, including Bing and Cortana source code.…

☐ β˜† βœ‡ The Register - Security

Appeals court spares Google from $20m patent payout over Chrome

April 19th 2023 at 22:28

Chocolate Factory can afford some staples now, or?

Six years after a jury decided otherwise, Google has convinced an appeals court to reverse a $20 million patent judgment against the web giant.…

☐ β˜† βœ‡ The Register - Security

Spyware slinger QuaDream’s reported demise may be the canary in the coal mine

April 19th 2023 at 20:20

NSO and others are still out there, but pariahs find it hard to do business

Analysis Israeli spyware shop QuaDream is reportedly shutting down due to financial troubles.…

☐ β˜† βœ‡ The Register - Security

GitHub debuts pedigree check for npm packages via Actions

April 19th 2023 at 16:00

Publishing provenance possibly prevents problems

Developers who use GitHub Actions to build software packages for the npm registry can now add a command flag that will publish details about the code's origin.…

☐ β˜† βœ‡ The Register - Security

Prioritize what matters most

April 19th 2023 at 09:34

How to manage your cloud and container vulnerabilities at scale

Webinar There's nothing complicated about the statistics released in Sysdig's latest report. They're alarming and should keep many an IT team up at night.…

☐ β˜† βœ‡ The Register - Security

US citizens charged with pushing pro-Kremlin disinfo, election interference

April 18th 2023 at 23:35

Also a bunch of Russians plus someone giving free trips to the Motherland

Four US citizens have been accused of working on behalf of the Russian government to push pro-Kremlin propaganda and unduly influence elections in Florida.…

☐ β˜† βœ‡ The Register - Security

Russian snoops just love invading unpatched Cisco gear, America and UK warn

April 18th 2023 at 20:45

Spying on foreign targets? That's our job!

The UK and US governments have sounded the alarm on Russian intelligence targeting unpatched Cisco routers to deploy malware and carry out surveillance.…

☐ β˜† βœ‡ The Register - Security

Microsoft opens up Defender threat intel library with file hash, URL search

April 18th 2023 at 19:30

Surprised there's no ChatGPT angle and that it's not called MalwareTotal

Security researchers and analysts can now search Microsoft's Threat Intelligence Defender database using file hashes and URLs when pulling together information for network intrusion investigations and whatnot.…

☐ β˜† βœ‡ The Register - Security

Payments firm accused of aiding 'contact Microsoft about a virus' scammers must cough $650k

April 18th 2023 at 18:34

'My computer locked up and a siren went off,' one mark tells Better Business Bureau

Updated Two execs and a multinational payment processing company must pay $650k to the US government, says the FTC, which accuses them of knowingly processing credit card payments for Microsoft-themed support scammers.…

☐ β˜† βœ‡ The Register - Security

Brit cops rapped over app that recorded 200k phone calls

April 18th 2023 at 13:38

Officers didn't know software was saving personal data and neither did people on other end

Several police forces in Britain are being put on the naughty step by the UK's data watchdog for using a calling app that recorded hundreds of thousands of phone conversations and illegally retained that data.…

☐ β˜† βœ‡ The Register - Security

Wrong time to weaken encryption, UK IT chartered institute tells government

April 18th 2023 at 11:27

Plus: Signal, WhatsApp, and Viber also write online protest over Online Safety Bill back door

The UK’s chartered institute for IT has slammed proposed legislation that could see the government open a β€œback door” to encrypted messaging.…

☐ β˜† βœ‡ The Register - Security

Capita IT breach gets worse as Black Basta claims it's now selling off stolen data

April 18th 2023 at 07:25

No worries, outsourcer only handles government tech contracts worth billions

Black Basta, the extortionists who claimed they were the ones who lately broke into Capita, have reportedly put up for sale sensitive details, including bank account information, addresses, and passport photos, stolen from the IT outsourcing giant.…

☐ β˜† βœ‡ The Register - Security

US alleges China created troll army that tried to have dissidents booted from Zoom

April 18th 2023 at 04:37

Charges laid against 44, including officers of China’s Cyberspace Administration

The United States Department of Justice has charged 44 people over schemes prosecutors allege were run by China’s National Police to silence opponents of the Communist Party of China.…

☐ β˜† βœ‡ The Register - Security

Military helicopter crash blamed on failure to apply software patch

April 18th 2023 at 03:30

A rather nice beach in Australia now briefly hosted an unusual feature

An Australian military helicopter crash was reportedly caused by failure to apply a software patch, with a hefty side serving of pilot error.…

☐ β˜† βœ‡ The Register - Security

LockBit crew cooks up half-baked Mac ransomware

April 17th 2023 at 21:30

Please, no need to fix these problems

LockBit has developed ransomware that can encrypt files on Arm-powered Macs, said to be a first for the prolific cybercrime crew. …

☐ β˜† βœ‡ The Register - Security

Marketing biz sent 107 million spam emails... to just 437k people

April 17th 2023 at 12:45

Recruitment company fined Β£130,000 by data regulator for breaking PECR

A recruitment business that sent out an eye watering 107 million spam emails is now nursing a Β£130,000 ($161,000) fine from Britain’s data watchdog.…

☐ β˜† βœ‡ The Register - Security

Firmware is on shaky ground – let's see what it's made of

April 17th 2023 at 09:41

Old architectures just don't stack up

Opinion Most data theft does clear harm to the victim, and often to its customers. But while embarrassing, the cyberattack against MSI in which source code was said to be stolen is harder to diagnose. It looks like a valuable company asset that's cost a lot to develop. That its theft may be no loss is a weird idea. But then, firmware is weirder than we give it credit for. It's even hard to say exactly what it is.…

☐ β˜† βœ‡ The Register - Security

Student requested access to research data. And waited. And waited. And then hacked to get root

April 17th 2023 at 07:29

The punishment – Windows 98 administration chores – was far worse than the crime

Who, Me? Welcome once more to Who Me? The Register’s confessional column in which readers admit to being the source of SNAFUs.…

☐ β˜† βœ‡ The Register - Security

Update now: Google emits emergency fix for zero-day Chrome vulnerability

April 17th 2023 at 01:15

Also: Tech players spin up white hat protection, this week's critical bugs, and more

In brief Google on Friday released an emergency update for Chrome to address a zero-day security flaw.…

☐ β˜† βœ‡ The Register - Security

Russia-pushed UN Cybercrime Treaty may rewrite global law. It's ... not great

April 14th 2023 at 23:46

Let's go through all the proposed problematic powers, starting with surveillance and censorship

Special report United Nations negotiators convened this week in Vienna, Austria, to formulate a draft cybercrime treaty, and civil society groups are worried.…

☐ β˜† βœ‡ The Register - Security

US extradites Nigerian charged over $6m email fraud scam

April 14th 2023 at 21:20

Maybe our prince has come at last

A suspected Nigerian fraudster is scheduled to appear in court Friday for his alleged role in a $6 million plot to scam businesses via email.…

☐ β˜† βœ‡ The Register - Security

Compatibility mess breaks not one but two Windows password tools

April 14th 2023 at 17:50

Windows LAPS and legacy LAPS don't play nicely under certain conditions, Microsoft says

Integrating the Local Administrator Password Solution (LAPS) into Windows and Windows Server that came with updates earlier this week is causing interoperability problems with what's called legacy LAPS, Microsoft says.…

☐ β˜† βœ‡ The Register - Security

While Twitter wants to sell its verification, Microsoft will do it for free on LinkedIn

April 14th 2023 at 10:14

Redmond expands a digital ID process for its platform as Musk seeks cash for blue check marks

As Elon Musk tears at Twitter's credibility by demanding businesses and individuals pay for their blue verification checks, Microsoft is pushing its own free digital ID tech to companies and their employees on LinkedIn.…

☐ β˜† βœ‡ The Register - Security

Linux kernel logic allowed Spectre attack on 'major cloud provider'

April 14th 2023 at 06:27

Kernel 6.2 ditched a useful defense against ghostly chip design flaw

The Spectre vulnerability that has haunted hardware and software makers since 2018 continues to defy efforts to bury it.…

☐ β˜† βœ‡ The Register - Security

To improve security, consider how the aviation world stopped blaming pilots

April 14th 2023 at 04:29

When admitting to an error isn't seen as a failure, improvement easy to achieve, says pilot-turned-CISO

To improve security, the cybersecurity industry needs to follow the aviation industry's shift from a blame culture to a "just" culture, according to ISACA director Serge Christiaans.…

☐ β˜† βœ‡ The Register - Security

Pentagon super-leak suspect cuffed: 21-year-old Air National Guardsman

April 13th 2023 at 19:52

When bragging about your job on Discord gets just a little out of hand?

The FBI has detained a 21-year-old Air National Guardsman suspected of leaking a trove of classified Pentagon documents on Discord.…

☐ β˜† βœ‡ The Register - Security

How insecure is America's FirstNet emergency response system? Seriously, anyone know?

April 12th 2023 at 23:58

Senator Wyden warns full probe needed into vital comms network

AT&T is "concealing vital cybersecurity reporting" about its FirstNet phone network for first responders and the US military, according to US Senator Ron Wyden (D-OR), who said the network had been dubbed unsafe by CISA.…

☐ β˜† βœ‡ The Register - Security

FBI: How fake Xi cops prey on Chinese nationals in the US

April 12th 2023 at 23:26

δ½ ε₯½ [insert name], ζˆ‘εœ¨ Ministry of Public Security ε·₯作 [insert shakedown]

Criminals posing as law enforcement agents of the Chinese government are shaking down Chinese nationals living the United States by accusing them of financial crimes and threatening to arrest or hurt them if they don't pay, according to the FBI.…

☐ β˜† βœ‡ The Register - Security

Mission possible

April 12th 2023 at 09:21

Tamping down risk in cloud management

Webinar There's nothing like reading a report based on real world data to give IT teams an fresh sense of priority.…

☐ β˜† βœ‡ The Register - Security

3CX teases security-focused client update, plus password hashing

April 12th 2023 at 04:35

As Mandiant finds more evidence it was North Korea wot done it

The CEO of VoIP software provider 3CX has teased the imminent release of a security-focused upgrade to the company’s progressive web application client.…

☐ β˜† βœ‡ The Register - Security

US cyber chiefs warn AI will help crooks, China develop nastier cyberattacks faster

April 12th 2023 at 01:50

It's not all doom and gloom because ML also amplifies defensive efforts, probably

Bots like ChatGPT may not be able to pull off the next big Microsoft server worm or Colonial Pipeline ransomware super-infection but they may help criminal gangs and nation-state hackers develop some attacks against IT, according to Rob Joyce, director of the NSA's Cybersecurity Directorate.…

☐ β˜† βœ‡ The Register - Security

Another zero-click Apple spyware maker just popped up on the radar again

April 12th 2023 at 00:42

Pegasus, pssh, you so 2000-and-late

Malware reportedly developed by a little-known Israeli commercial spyware maker has been found on devices of journalists, politicians, and an NGO worker in multiple countries, say researchers. …

☐ β˜† βœ‡ The Register - Security

April Patch Tuesday: Ransomware gangs already exploiting this Windows bug

April 11th 2023 at 23:04

Plus Google, SAP, Adobe and Cisco emit fixes

Microsoft patched 97 security flaws today for April's Patch Tuesday including one that has already been found and exploited by miscreants attempting to deploy Nokoyawa ransomware.…

☐ β˜† βœ‡ The Register - Security

Azure admins warned to disable shared key access as backdoor attack detailed

April 11th 2023 at 13:00

The default is that sharing is caring as Redmond admits: 'These permissions could be abused'

A design flaw in Microsoft Azure – that shared key authorization is enabled by default when creating storage accounts – could give attackers full access to your environment, according to Orca Security researchers.…

☐ β˜† βœ‡ The Register - Security

40% of IT security pros say they've been told not to report a data leak

April 11th 2023 at 09:37

Plus: KFC, Pizza Hut owner spills more beans on ransomware hit... latest critical flaws... and more

In Brief More than 40 percent of surveyed IT security professionals say they've been told to keep network breaches under wraps despite laws and common decency requiring disclosure.…

☐ β˜† βœ‡ The Register - Security

How much to infect Android phones via Google Play store? How about $20k

April 10th 2023 at 23:01

Or whatever you managed to haggle with these miscreants

If you want to sneak malware onto people's Android devices via the official Google Play store, it may cost you about $20,000 to do so, Kaspersky suggests.…

☐ β˜† βœ‡ The Register - Security

Inside FTX: Jokes about misplaced funds, diabolical IT, poor oversight, and worse

April 10th 2023 at 21:43

How's the saying go? $50m here, $50m there, pretty soon you're talking real money

The liquidators picking over the remains of FTX have released their first formal report into Sam Bankman-Fried's imploded empire – and it somehow appears things are worse than feared.…

☐ β˜† βœ‡ The Register - Security

Apple squashes iOS, macOS zero-day bugs already exploited by snoops

April 10th 2023 at 21:01

Keep calm and install patches before abuse becomes widespread

Apple rolled out patches on Good Friday to its iOS, iPadOS, and macOS operating systems and the Safari web browser to address vulnerabilities found by Google and Amnesty International that were exploited in the wild.…

☐ β˜† βœ‡ The Register - Security

Google to kill Dropcam, Nest Secure hardware next year

April 10th 2023 at 18:58

Great, more company for Stadia, Duo and pals in the graveyard

Owners of Dropcam security cameras and Nest Secure systems have been given an unwelcome deadline from Google: their smart home products will be shut off April 8 next year.…

☐ β˜† βœ‡ The Register - Security

Microsoft, Fortra are this fed up with cyber-gangs abusing Cobalt Strike

April 10th 2023 at 16:29

Oh, sure, let's play a game of legal and technical whack-a-mole

Microsoft and Fortra are taking legal and technical actions to thwart cyber-criminals from using the latter company's Cobalt Strike software to distribute malware.…

☐ β˜† βœ‡ The Register - Security

When it comes to technology, securing your future means securing your present

April 10th 2023 at 13:58

How to build cyber resiliency in the face of complexity

Sponsored Feature Most economies and business sectors are dealing with extreme volatility and economic uncertainty. Even as the dislocation caused by the pandemic three years ago looked to be settling down, business leaders have had to contend with geopolitical concerns, rising interest rates, and surging inflation.…

❌