FreshRSS

🔒
△ 🔃
☐ ☆ ✇ Naked Security

URGENT! Microsoft Exchange double zero-day – “like ProxyShell, only different”

By Paul Ducklin — September 30th 2022 at 18:25
Double-play 0-day in Exchange - what you need to know, and what you can do

☐ ☆ ✇ Naked Security

S3 Ep102: How to avoid a data breach [Audio + Transcript]

By Paul Ducklin — September 29th 2022 at 18:45
Latest episode - listen now! Tell fact from fiction in hyped-up cybersecurity news...

☐ ☆ ✇ Naked Security

WhatsApp “zero-day exploit” news scare – what you need to know

By Paul Ducklin — September 27th 2022 at 18:51
Is WhatsApp currently under active attack by cybercriminals? Is this a clear and current danger? How worried should WhatsApp users be?

☐ ☆ ✇ Naked Security

S3 Ep101: Uber and LastPass breaches – is 2FA all it’s cracked up to be? [Audio + Text]

By Paul Ducklin — September 22nd 2022 at 18:42
Latest episode - listen now! Learn why adopting 2FA isn't a reason to relax your other security precautions...

☐ ☆ ✇ Naked Security

Interested in cybersecurity? Join us for Security SOS Week 2022!

By Paul Ducklin — September 21st 2022 at 14:24
Four one-on-one interviews with experts who are passionate about sharing their expertise with the community.

☐ ☆ ✇ Naked Security

S3 Ep100.5: Uber breach – an expert speaks [Audio + Text]

By Paul Ducklin — September 17th 2022 at 20:57
Chester Wisniewski on what we can learn from Uber: "Just because a big company didn't have the security they should doesn't mean you can't."

☐ ☆ ✇ Naked Security

S3 Ep100: Browser-in-the-Browser – how to spot an attack [Audio + Text]

By Paul Ducklin — September 15th 2022 at 18:50
Latest episode - listen now! Cosmic rockets, zero-days, spotting cybercrooks, and unlocking the DEADBOLT...

s3-ep100-js-1200

☐ ☆ ✇ Naked Security

Serious Security: Browser-in-the-browser attacks – watch out for windows that aren’t!

By Paul Ducklin — September 13th 2022 at 20:52
Simple but super-sneaky - use a picture of a browser, and convince people it's real...

pipe-light-not-1200

☐ ☆ ✇ Naked Security

Apple patches zero-day holes – even in the brand new iOS 16

By Paul Ducklin — September 12th 2022 at 21:25
Five updates, one upgrade, plus two zero-days. Patch your Macs, iPhones and iPads as soon as you can (again)...

apple-plus-16-1200

☐ ☆ ✇ Naked Security

How to deal with dates and times without any timezone tantrums…

By Paul Ducklin — September 9th 2022 at 18:59
Heartfelt encouragement to embrace RFC 3339 - find out why!

☐ ☆ ✇ Naked Security

S3 Ep99: TikTok “attack” – was there a data breach, or not? [Audio + Text]

By Paul Ducklin — September 8th 2022 at 13:21
Latest episode - listen now! (Or read if you prefer - full transcript inside.)

☐ ☆ ✇ Naked Security

Chrome and Edge fix zero-day security hole – update now!

By Paul Ducklin — September 5th 2022 at 15:12
This time, the crooks got there first - only 1 security hole patched, but it's a zero-day.

☐ ☆ ✇ Naked Security

Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43

By Paul Ducklin — September 4th 2022 at 00:50
This site, like millions of others, has a certificate from Let's Encrypt. Farewell, Peter Eckersley, PhD, who helped make it all possible.

☐ ☆ ✇ Naked Security

S3 Ep98: The LastPass saga – should we stop using password managers? [Audio + Text]

By Paul Ducklin — September 1st 2022 at 16:55
Latest episode - listen now!

☐ ☆ ✇ Naked Security

URGENT! Apple slips out zero-day update for older iPhones and iPads

By Paul Ducklin — August 31st 2022 at 18:42
Patch as soon as you can - that recent WebKit zero-day affecting new iPhones and iPads is apparently being used against older models, too.

☐ ☆ ✇ Naked Security

Chrome patches 24 security holes, enables “Sanitizer” safety system

By Paul Ducklin — August 31st 2022 at 11:48
24 existing bugs fixed. And, we hope, numerous potential future bugs prevented.

☐ ☆ ✇ Naked Security

JavaScript bugs aplenty in Node.js ecosystem – found automatically

By Paul Ducklin — August 30th 2022 at 16:59
How to get the better of bugs in all the possible packages in your supply chain?

☐ ☆ ✇ Naked Security

Firefox 104 is out – no critical bugs, but update anyway

By Paul Ducklin — August 26th 2022 at 16:27
Two trust-spoofing bugs were the main culprits this month - but neither one was a zero-day.

☐ ☆ ✇ Naked Security

S3 Ep97: Did your iPhone get pwned? How would you know? [Audio + Text]

By Paul Ducklin — August 25th 2022 at 15:37
Latest episode - listen now! (Or read the transcript if you prefer the text version.)

☐ ☆ ✇ Naked Security

Breaching airgap security: using your phone’s gyroscope as a microphone

By Paul Ducklin — August 24th 2022 at 18:59
One bit per second makes the Voyager probe data rate seem blindingly fast. But it's enough to break your security assumptions...

☐ ☆ ✇ Naked Security

Bitcoin ATMs leeched by attackers who created fake admin accounts

By Paul Ducklin — August 23rd 2022 at 18:35
The criminals didn't implant any malware. The attack was orchestrated via malevolent configuration changes.

☐ ☆ ✇ Naked Security

Laptop denial-of-service via music: the 1980s R&B song with a CVE!

By Paul Ducklin — August 22nd 2022 at 16:03
We haven't validated this vuln ourselves... but the source of the story is impeccable. (Impeccably dressed, at least.)

☐ ☆ ✇ Naked Security

S3 Ep96: Zoom 0-day, AEPIC leak, Conti reward, healthcare security [Audio + Text]

By Paul Ducklin — August 18th 2022 at 18:38
Latest episode - listen now (or read if you prefer!)

☐ ☆ ✇ Naked Security

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin — August 17th 2022 at 23:33
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

☐ ☆ ✇ Naked Security

Chrome browser gets 11 security fixes with 1 zero-day – update now!

By Paul Ducklin — August 17th 2022 at 13:16
Don't delay - patch today.

☐ ☆ ✇ Naked Security

Zoom for Mac patches critical bug – update now!

By Paul Ducklin — August 15th 2022 at 18:26
There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...

☐ ☆ ✇ Naked Security

S3 Ep95: Slack leak, Github onslaught, and post-quantum crypto [Audio + Text]

By Paul Ducklin — August 11th 2022 at 14:34
Latest episode - listen now! (Or read the transcript if you prefer.)

☐ ☆ ✇ Naked Security

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

By Paul Ducklin — August 10th 2022 at 16:59
If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

☐ ☆ ✇ Naked Security

Traffic Light Protocol for cybersecurity responders gets a revamp

By Paul Ducklin — August 5th 2022 at 18:57
Traffic lights make a handy global metaphor for denoting the sensitivity of cybersecurity threat data - three colours that everyone knows.

☐ ☆ ✇ Naked Security

S3 Ep94: This sort of crypto (graphy), and the other sort of crypto (currency!) [Audio + Text]

By Paul Ducklin — August 4th 2022 at 17:52
Latest episode - listen now! (Or read if that's what you prefer.)

☐ ☆ ✇ Naked Security

GitHub blighted by “researcher” who created thousands of malicious projects

By Paul Ducklin — August 3rd 2022 at 23:06
If you spew projects laced with hidden malware into an open source repository, don't waste your time telling us "no harm done" afterwards.

☐ ☆ ✇ Naked Security

Cryptocoin “token swapper” Nomad loses $200 million in coding blunder

By Paul Ducklin — August 2nd 2022 at 16:12
Transactions were only approved, it seems, if they were initiated by... errrrr, by anyone.

☐ ☆ ✇ Naked Security

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin — August 1st 2022 at 16:55
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

☐ ☆ ✇ Naked Security

How to celebrate SysAdmin Day!

By Paul Ducklin — July 29th 2022 at 15:37
I've just popped in to wish you all/The best SysAdmin Day!

☐ ☆ ✇ Naked Security

S3 Ep93: Office security, breach costs, and leisurely patches [Audio + Text]

By Paul Ducklin — July 28th 2022 at 15:47
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Critical Samba bug could let anyone become Domain Admin – patch now!

By Paul Ducklin — July 27th 2022 at 21:15
It's a serious bug... but there's a fix for it, so you know exactly what to do!

☐ ☆ ✇ Naked Security

Mild monthly security update from Firefox – but update anyway

By Paul Ducklin — July 27th 2022 at 00:41
You're probably thinking we're going to say, "Don't delay/Do it today"... and that's exactly what we are saying!

☐ ☆ ✇ Naked Security

S3 Ep92: Log4Shell4Ever, travel tips, and scamminess [Audio + Text]

By Paul Ducklin — July 21st 2022 at 16:25
Latest episode - listen, read or both!

☐ ☆ ✇ Naked Security

Apple patches “0-day” browser bug fixed 2 weeks ago in Chrome, Edge

By Paul Ducklin — July 21st 2022 at 12:38
One vendor's zero-day is another vendor's routine patch...

☐ ☆ ✇ Naked Security

8 months on, US says Log4Shell will be around for “a decade or longer”

By Paul Ducklin — July 18th 2022 at 16:57
When it comes to cybersecurity, ask not what everyone else can do for you...

☐ ☆ ✇ Naked Security

S3 Ep91: CodeRed, OpenSSL, Java bugs, Office macros [Audio + Text]

By Paul Ducklin — July 14th 2022 at 18:47
Latest episode - listen now! Great discussion, technical content, solid advice... all covered in plain English.

☐ ☆ ✇ Naked Security

Apache “Commons Configuration” patches Log4Shell-style bug – what you need to know

By Paul Ducklin — July 8th 2022 at 00:59
It's a bit like Log4J, but for configuration files, not for logging.

☐ ☆ ✇ Naked Security

S3 Ep90: Chrome 0-day again, True Cybercrime, and a 2FA bypass [Podcast + Transcript]

By Paul Ducklin — July 7th 2022 at 18:46
Listen now! Or read if you prefer...

☐ ☆ ✇ Naked Security

OpenSSL fixes two “one-liner” crypto bugs – what you need to know

By Paul Ducklin — July 6th 2022 at 16:52
"As bad as Heartbleed"? We heard that concern a week ago, but we think it's less ungood than that...

☐ ☆ ✇ Naked Security

Google patches “in-the-wild” Chrome zero-day – update now!

By Paul Ducklin — July 5th 2022 at 15:55
Running Chrome? Do the "Help-About-Update" dance move right now, just to be sure...

☐ ☆ ✇ Naked Security

Canadian cybercriminal pleads guilty to “NetWalker” attacks in US

By Paul Ducklin — July 4th 2022 at 14:09
Bust in Canada, now bust in the USA as well.

☐ ☆ ✇ Naked Security

S3 Ep89: Sextortion, blockchain blunder, and an OpenSSL bugfix [Podcast + Transcript]

By Paul Ducklin — June 30th 2022 at 12:57
Latest episode - listen and read now! Use our advice to advise your own friends and family... let's all do our bit to stand up to scammers!

☐ ☆ ✇ Naked Security

Firefox 102 fixes address bar spoofing security hole (and helps with Follina!)

By Paul Ducklin — June 29th 2022 at 16:11
Firefox squashes a bug that helped phishers, and brings its own helping hand to Microsoft's "Follina" saga.

☐ ☆ ✇ Naked Security

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin — June 24th 2022 at 15:32
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

☐ ☆ ✇ Naked Security

S3 Ep88: Phone scammers, hacking bust, and data breach fines [Podcast + Transcript]

By Paul Ducklin — June 23rd 2022 at 11:08
Latest epsiode - listen (or read) now!

☐ ☆ ✇ Naked Security

Capital One identity theft hacker finally gets convicted

By Paul Ducklin — June 21st 2022 at 15:24
It took three years, but the Capital One cracker was convicted in the end. Don't get caught out in a data breach of your own!

☐ ☆ ✇ Naked Security

S3 Ep87: Follina, AirTags, ID theft and the Law of Big Numbers [Podcast]

By Paul Ducklin — June 16th 2022 at 16:52
Lastest epsiode - listen now!

☐ ☆ ✇ Naked Security

Follina gets fixed – but it’s not listed in the Patch Tuesday patches!

By Paul Ducklin — June 15th 2022 at 01:20
We tried it out to make sure, so you don't have to.

☐ ☆ ✇ Naked Security

You’re invited! Join us for a live walkthrough of the “Follina” story…

By Paul Ducklin — June 13th 2022 at 16:28
Live demo, plain English, no sales pitch, just a chance to watch an attack dissected in safety. Join us if you can!

☐ ☆ ✇ Naked Security

S3 Ep86: The crooks were in our network for HOW long?! [Podcast + Transcript]

By Paul Ducklin — June 9th 2022 at 13:07
Latest episode - listen (or read) now!

☐ ☆ ✇ Naked Security

SSNDOB Market domains seized, identity theft “brokerage” shut down

By Paul Ducklin — June 8th 2022 at 14:53
The online identity "brokerage" SSNDOB Market didn't want people to be in any doubt what it was selling.

☐ ☆ ✇ Naked Security

Know your enemy! Learn how cybercrime adversaries get in…

By Paul Ducklin — June 7th 2022 at 15:49
Here's how 144 recent attacks actually went down in real life. Don't let this happen to you!

☐ ☆ ✇ Naked Security

Atlassian announces 0-day hole in Confluence Server – update now!

By Paul Ducklin — June 3rd 2022 at 18:59
Zero-day announced - here's what you need to know

☐ ☆ ✇ Naked Security

Yet another zero-day (sort of) in Windows “search URL” handling

By Paul Ducklin — June 2nd 2022 at 19:39
More trouble with special-purpose URLs on Windows.

☐ ☆ ✇ Naked Security

S3 Ep85: Now THAT’S what I call a Microsoft Office exploit! [Podcast]

By Paul Ducklin — June 2nd 2022 at 18:37
Latest episode - listen now!

❌