FreshRSS

🔒
△ 🔃
☐ ☆ ✇ Naked Security

Psychotherapy extortion suspect: arrest warrant issued

By Paul Ducklin — October 31st 2022 at 19:59
Wanted! Not only the extortionist who abused the data, but also the CEO who let it happen.

☐ ☆ ✇ Naked Security

Chrome issues urgent zero-day fix – update now!

By Paul Ducklin — October 29th 2022 at 15:08
We've said it before/And we'll say it again/It's not *if* you should patch/It's a matter of *when*. (Hint: now!)

☐ ☆ ✇ Naked Security

Updates to Apple’s zero-day update story – iPhone and iPad users read this!

By Paul Ducklin — October 28th 2022 at 18:04
Turns out that Tuesday's zero-day for iOS 16 is Friday's zero-day for iOS 15...

☐ ☆ ✇ Naked Security

S3 Ep106: Facial recognition without consent – should it be banned?

By Paul Ducklin — October 27th 2022 at 16:59
Latest episode - listen (or read) now. Teachable moments for X-Ops professionals!

☐ ☆ ✇ Naked Security

Online ticketing company “See” pwned for 2.5 years by attackers

By Paul Ducklin — October 26th 2022 at 19:58
Don't be a cybersecurity slowcoach - you need to spot possible attacks as soon as you can.

☐ ☆ ✇ Naked Security

Clearview AI image-scraping face recognition service hit with €20m fine in France

By Paul Ducklin — October 26th 2022 at 00:50
"We told you to stop but you ignored us," said the French regulator, "so now we're coming after you again."

☐ ☆ ✇ Naked Security

Apple megaupdate: Ventura out, iOS and iPad kernel zero-day – act now!

By Paul Ducklin — October 25th 2022 at 18:03
Ventura hits the market with 112 patches, Catalina's gone missing, and iPhones and iPads get a critical kernel-level zero-day patch...

☐ ☆ ✇ Naked Security

Serious Security: How randomly (or not) can you shuffle cards?

By Paul Ducklin — October 24th 2022 at 18:57
What if you could guess the next card correctly twice as often as you should?

card-fan-1200

☐ ☆ ✇ Naked Security

When cops hack back: Dutch police fleece DEADBOLT criminals (legally!)

By Paul Ducklin — October 21st 2022 at 18:25
Crooks: Show us the money! Cops: How about you show us the decryption keys first?

☐ ☆ ✇ Naked Security

S3 Ep105: WONTFIX! The MS Office cryptofail that “isn’t a security flaw” [Audio + Text]

By Paul Ducklin — October 20th 2022 at 18:54
The coolest video game ever! And lots of solid cybersecurity advice - listen now!

pic-1200

☐ ☆ ✇ Naked Security

Women in Cryptology – USPS celebrates WW2 codebreakers

By Paul Ducklin — October 19th 2022 at 16:58
What did you do in the war, Mom? Oh, y'know, a bit of this and that...

☐ ☆ ✇ Naked Security

Zoom for Mac patches sneaky “spy-on-me” bug – update now!

By Paul Ducklin — October 18th 2022 at 18:01
Hey! That back door isn't supposed to be there at all, let alone propped open...

☐ ☆ ✇ Naked Security

Dangerous hole in Apache Commons Text – like Log4Shell all over again

By Paul Ducklin — October 18th 2022 at 17:26
Third time unlucky. Time to put your patching boots on again...

act-1200

☐ ☆ ✇ Naked Security

Fashion brand SHEIN fined $1.9m for lying about data breach

By Naked Security writer — October 17th 2022 at 18:50
Is "pay a small fine and keep on trading" a sufficient penalty for letting a breach happen, impeding an investigation, and hiding the truth?

☐ ☆ ✇ Naked Security

Serious Security: Microsoft Office 365 attacked over feeble encryption

By Paul Ducklin — October 14th 2022 at 16:59
How 2022 is your encryption?

☐ ☆ ✇ Naked Security

S3 Ep104: Should hospital ransomware attackers be locked up for life? [Audio + Text]

By Paul Ducklin — October 13th 2022 at 16:37
Have your say on three deep questions posed by this week's podcast. Read or listen as suits you best...

☐ ☆ ✇ Naked Security

Patch Tuesday in brief – one 0-day fixed, but no patches for Exchange!

By Paul Ducklin — October 12th 2022 at 16:58
There's a zero-day patch, but it's not for the zero-day you thought.

☐ ☆ ✇ Naked Security

Move over Patch Tuesday – it’s Ada Lovelace Day!

By Paul Ducklin — October 11th 2022 at 15:22
Hacking on actual computers is one thing, but hacking purposefully on imaginary computers is, these days, something we can only imagine.

☐ ☆ ✇ Naked Security

Mystery iPhone update patches against iOS 16 mail crash-attack

By Paul Ducklin — October 11th 2022 at 00:28
The problem with crashy messaging apps is that *other people* get to choose if and when to send you messages...

☐ ☆ ✇ Naked Security

Serious Security: OAuth 2 and why Microsoft is finally forcing you into it

By Paul Ducklin — October 10th 2022 at 18:02
Microsoft calls it "Modern Auth", though it's a decade old, and is finally forcing Exchange Online customers to switch to it.

☐ ☆ ✇ Naked Security

WhatsApp goes after Chinese password scammers via US court

By Paul Ducklin — October 7th 2022 at 18:14
If you can't beat 'em, sue 'em!

☐ ☆ ✇ Naked Security

S3 Ep103: Scammers in the Slammer (and other stories) [Audio + Text]

By Paul Ducklin — October 6th 2022 at 14:43
Latest episode - listen and learn now (or read and revise, if the written word is your thing)...

☐ ☆ ✇ Naked Security

Former Uber CSO convicted of covering up megabreach back in 2016

By Naked Security writer — October 6th 2022 at 01:04
Obstructed FTC proceedings, and concealed a crime, said the jury.

☐ ☆ ✇ Naked Security

NetWalker ransomware affiliate sentenced to 20 years by Florida court

By Naked Security writer — October 5th 2022 at 18:55
Judge tells the accused that if he hadn't pleaded guilty, "I would have given you life."

☐ ☆ ✇ Naked Security

BEC fraudster and romance scammer sent to prison for 25 years

By Paul Ducklin — October 4th 2022 at 19:12
Two years of scamming + $10 million leeched = 25 years in prison. Just in time for #Cybermonth.

rs-1200

☐ ☆ ✇ Naked Security

Scammers and rogue callers – can anything ever stop them?

By Paul Ducklin — October 4th 2022 at 00:06
Some thoughts for Cybersecurity Awareness Month: Is is worth reporting nuisance calls? Is it even worth reporting outright scams?

☐ ☆ ✇ Naked Security

S3 Ep102.5: “ProxyNotShell” Exchange bugs – an expert speaks [Audio + Text]

By Paul Ducklin — October 1st 2022 at 14:05
Who's affected, what you can do while waiting for Microsoft's patches, and how to plan your threat hunting...

☐ ☆ ✇ Naked Security

URGENT! Microsoft Exchange double zero-day – “like ProxyShell, only different”

By Paul Ducklin — September 30th 2022 at 18:25
Double-play 0-day in Exchange - what you need to know, and what you can do

☐ ☆ ✇ Naked Security

S3 Ep102: How to avoid a data breach [Audio + Transcript]

By Paul Ducklin — September 29th 2022 at 18:45
Latest episode - listen now! Tell fact from fiction in hyped-up cybersecurity news...

☐ ☆ ✇ Naked Security

Optus breach – Aussie telco told it will have to pay to replace IDs

By Paul Ducklin — September 28th 2022 at 13:55
Licence compromised? Passport number burned? Need a new one? Who's going to pay?

☐ ☆ ✇ Naked Security

WhatsApp “zero-day exploit” news scare – what you need to know

By Paul Ducklin — September 27th 2022 at 18:51
Is WhatsApp currently under active attack by cybercriminals? Is this a clear and current danger? How worried should WhatsApp users be?

☐ ☆ ✇ Naked Security

Uber and Rockstar – has a LAPSUS$ linchpin just been busted (again)?

By Paul Ducklin — September 24th 2022 at 22:57
Is this the same suspect as before? Is he part of LAPSUS$? Is this the man who hacked Uber and Rockstar? And, if so, who else?

☐ ☆ ✇ Naked Security

Morgan Stanley fined millions for selling off devices full of customer PII

By Paul Ducklin — September 23rd 2022 at 18:07
Critical data on old disks always seems inaccessible if you really need it. But when you DON''T want it back, guess what happens...

☐ ☆ ✇ Naked Security

S3 Ep101: Uber and LastPass breaches – is 2FA all it’s cracked up to be? [Audio + Text]

By Paul Ducklin — September 22nd 2022 at 18:42
Latest episode - listen now! Learn why adopting 2FA isn't a reason to relax your other security precautions...

☐ ☆ ✇ Naked Security

Interested in cybersecurity? Join us for Security SOS Week 2022!

By Paul Ducklin — September 21st 2022 at 14:24
Four one-on-one interviews with experts who are passionate about sharing their expertise with the community.

☐ ☆ ✇ Naked Security

LastPass source code breach – incident response report released

By Paul Ducklin — September 19th 2022 at 18:59
Wondering how you'd handle a data breach report if the worst happened to you? Here's a useful example.

☐ ☆ ✇ Naked Security

S3 Ep100.5: Uber breach – an expert speaks [Audio + Text]

By Paul Ducklin — September 17th 2022 at 20:57
Chester Wisniewski on what we can learn from Uber: "Just because a big company didn't have the security they should doesn't mean you can't."

☐ ☆ ✇ Naked Security

UBER HAS BEEN HACKED, boasts hacker – how to stop it happening to you

By Paul Ducklin — September 16th 2022 at 18:43
Uber is all over the news for a widely-publicised data breach. We help you answer the question, "How do I stop this happening to me?"

☐ ☆ ✇ Naked Security

S3 Ep100: Browser-in-the-Browser – how to spot an attack [Audio + Text]

By Paul Ducklin — September 15th 2022 at 18:50
Latest episode - listen now! Cosmic rockets, zero-days, spotting cybercrooks, and unlocking the DEADBOLT...

s3-ep100-js-1200

☐ ☆ ✇ Naked Security

Serious Security: Browser-in-the-browser attacks – watch out for windows that aren’t!

By Paul Ducklin — September 13th 2022 at 20:52
Simple but super-sneaky - use a picture of a browser, and convince people it's real...

pipe-light-not-1200

☐ ☆ ✇ Naked Security

Apple patches zero-day holes – even in the brand new iOS 16

By Paul Ducklin — September 12th 2022 at 21:25
Five updates, one upgrade, plus two zero-days. Patch your Macs, iPhones and iPads as soon as you can (again)...

apple-plus-16-1200

☐ ☆ ✇ Naked Security

How to deal with dates and times without any timezone tantrums…

By Paul Ducklin — September 9th 2022 at 18:59
Heartfelt encouragement to embrace RFC 3339 - find out why!

☐ ☆ ✇ Naked Security

S3 Ep99: TikTok “attack” – was there a data breach, or not? [Audio + Text]

By Paul Ducklin — September 8th 2022 at 13:21
Latest episode - listen now! (Or read if you prefer - full transcript inside.)

☐ ☆ ✇ Naked Security

DEADBOLT ransomware rears its head again, attacks QNAP devices

By Paul Ducklin — September 7th 2022 at 16:57
NAS devices make it easy for anyone to add high-capacity file servers to their network. Guess why cybercrooks love NAS devices too...

☐ ☆ ✇ Naked Security

Chrome and Edge fix zero-day security hole – update now!

By Paul Ducklin — September 5th 2022 at 15:12
This time, the crooks got there first - only 1 security hole patched, but it's a zero-day.

☐ ☆ ✇ Naked Security

Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43

By Paul Ducklin — September 4th 2022 at 00:50
This site, like millions of others, has a certificate from Let's Encrypt. Farewell, Peter Eckersley, PhD, who helped make it all possible.

☐ ☆ ✇ Naked Security

S3 Ep98: The LastPass saga – should we stop using password managers? [Audio + Text]

By Paul Ducklin — September 1st 2022 at 16:55
Latest episode - listen now!

☐ ☆ ✇ Naked Security

URGENT! Apple slips out zero-day update for older iPhones and iPads

By Paul Ducklin — August 31st 2022 at 18:42
Patch as soon as you can - that recent WebKit zero-day affecting new iPhones and iPads is apparently being used against older models, too.

☐ ☆ ✇ Naked Security

Chrome patches 24 security holes, enables “Sanitizer” safety system

By Paul Ducklin — August 31st 2022 at 11:48
24 existing bugs fixed. And, we hope, numerous potential future bugs prevented.

☐ ☆ ✇ Naked Security

JavaScript bugs aplenty in Node.js ecosystem – found automatically

By Paul Ducklin — August 30th 2022 at 16:59
How to get the better of bugs in all the possible packages in your supply chain?

☐ ☆ ✇ Naked Security

LastPass source code breach – do we still recommend password managers?

By Paul Ducklin — August 29th 2022 at 16:59
What does the recent LastPass breach mean for password managers? Just a bump in the road, or a reason to ditch them entirely?

☐ ☆ ✇ Naked Security

Firefox 104 is out – no critical bugs, but update anyway

By Paul Ducklin — August 26th 2022 at 16:27
Two trust-spoofing bugs were the main culprits this month - but neither one was a zero-day.

☐ ☆ ✇ Naked Security

S3 Ep97: Did your iPhone get pwned? How would you know? [Audio + Text]

By Paul Ducklin — August 25th 2022 at 15:37
Latest episode - listen now! (Or read the transcript if you prefer the text version.)

☐ ☆ ✇ Naked Security

Breaching airgap security: using your phone’s gyroscope as a microphone

By Paul Ducklin — August 24th 2022 at 18:59
One bit per second makes the Voyager probe data rate seem blindingly fast. But it's enough to break your security assumptions...

☐ ☆ ✇ Naked Security

Bitcoin ATMs leeched by attackers who created fake admin accounts

By Paul Ducklin — August 23rd 2022 at 18:35
The criminals didn't implant any malware. The attack was orchestrated via malevolent configuration changes.

☐ ☆ ✇ Naked Security

Laptop denial-of-service via music: the 1980s R&B song with a CVE!

By Paul Ducklin — August 22nd 2022 at 16:03
We haven't validated this vuln ourselves... but the source of the story is impeccable. (Impeccably dressed, at least.)

☐ ☆ ✇ Naked Security

S3 Ep96: Zoom 0-day, AEPIC leak, Conti reward, healthcare security [Audio + Text]

By Paul Ducklin — August 18th 2022 at 18:38
Latest episode - listen now (or read if you prefer!)

☐ ☆ ✇ Naked Security

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin — August 17th 2022 at 23:33
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

☐ ☆ ✇ Naked Security

Chrome browser gets 11 security fixes with 1 zero-day – update now!

By Paul Ducklin — August 17th 2022 at 13:16
Don't delay - patch today.

☐ ☆ ✇ Naked Security

US offers reward “up to $10 million” for information about the Conti gang

By Naked Security writer — August 16th 2022 at 16:57
Wanted - Reward Offered - Five unknown individuals (plus a man with a weird hat)

❌