FreshRSS

🔒
△ 🔃
☐ ☆ ✇ Naked Security

S3 Ep112: Data breaches can haunt you more than once! [Audio + Text]

By Paul Ducklin — December 9th 2022 at 16:46
Breaches, exploits, busts, buffer overflows and bug hunting - entertaining and educational in equal measure.

☐ ☆ ✇ Naked Security

Number Nine! Chrome fixes another 2022 zero-day, Edge patched too

By Paul Ducklin — December 5th 2022 at 20:58
Ninth more unto the breach, dear friends, ninth more.

☐ ☆ ✇ Naked Security

Ping of death! FreeBSD fixes crashtastic bug in network tool

By Paul Ducklin — December 5th 2022 at 19:59
It's a venerable program, and this version had a venerable bug in it.

☐ ☆ ✇ Naked Security

Chrome fixes 8th zero-day of 2022 – check your version now (Edge too!)

By Paul Ducklin — November 28th 2022 at 19:42
There isn't a rhyme to remind you which months have browser zero-days... you just have to keep your eyes and ears open!

☐ ☆ ✇ Naked Security

How to hack an unpatched Exchange server with rogue PowerShell code

By Paul Ducklin — November 22nd 2022 at 19:54
Review your servers, your patches and your authentication policies - there's a proof-of-concept out

☐ ☆ ✇ Naked Security

S3 Ep109: How one leaked email password could drain your business [Audio + Transcript]

By Paul Ducklin — November 17th 2022 at 17:52
Latest episode - listen now! Cybersecurity news plus loads of great advice...

☐ ☆ ✇ Naked Security

Firefox fixes fullscreen fakery flaw – get the update now!

By Paul Ducklin — November 16th 2022 at 19:51
What's so bad about a web page going fullscreen without warning you first?

☐ ☆ ✇ Naked Security

Log4Shell-like code execution hole in popular Backstage dev tool

By Paul Ducklin — November 15th 2022 at 17:49
Good old "string templating", also known as "string interpolation", in the spotlight again...

bs-1200

☐ ☆ ✇ Naked Security

S3 Ep108: You hid THREE BILLION dollars in a popcorn tin?

By Paul Ducklin — November 10th 2022 at 17:26
Patches, busts, leaks and why even low-likelihood exploits can be high-severity risks - listen now!

☐ ☆ ✇ Naked Security

Emergency code execution patch from Apple – but not an 0-day

By Paul Ducklin — November 10th 2022 at 01:49
Not a zero-day, but important enough for a quick-fire patch to one system library...

☐ ☆ ✇ Naked Security

Exchange 0-days fixed (at last) – plus 4 brand new Patch Tuesday 0-days!

By Paul Ducklin — November 9th 2022 at 19:58
In all the excitement, we kind of lost track ourselves. Were there six 0-days, or only four?

☐ ☆ ✇ Naked Security

S3 Ep107: Eight months to kick out the crooks and you think that’s GOOD? [Audio + Text]

By Paul Ducklin — November 3rd 2022 at 17:51
Listen now - latest episode - audio plus full transcript

☐ ☆ ✇ Naked Security

The OpenSSL security update story – how can you tell what needs fixing?

By Paul Ducklin — November 3rd 2022 at 00:44
How to Hack! Finding OpenSSL library files and accurately identifying their version numbers...

ossl-code-1200

☐ ☆ ✇ Naked Security

OpenSSL patches are out – CRITICAL bug downgraded to HIGH, but patch anyway!

By Paul Ducklin — November 1st 2022 at 17:24
That bated-breath OpenSSL update is out! It's no longer rated CRITICAL, but we advise you to patch ASAP anyway. Here's why...

☐ ☆ ✇ Naked Security

SHA-3 code execution bug patched in PHP – check your version!

By Paul Ducklin — November 1st 2022 at 14:09
As everyone waits for news of a bug in OpenSSL, here's a reminder that other cryptographic code in your life may also need patching!

☐ ☆ ✇ Naked Security

Chrome issues urgent zero-day fix – update now!

By Paul Ducklin — October 29th 2022 at 15:08
We've said it before/And we'll say it again/It's not *if* you should patch/It's a matter of *when*. (Hint: now!)

☐ ☆ ✇ Naked Security

Updates to Apple’s zero-day update story – iPhone and iPad users read this!

By Paul Ducklin — October 28th 2022 at 18:04
Turns out that Tuesday's zero-day for iOS 16 is Friday's zero-day for iOS 15...

☐ ☆ ✇ Naked Security

Apple megaupdate: Ventura out, iOS and iPad kernel zero-day – act now!

By Paul Ducklin — October 25th 2022 at 18:03
Ventura hits the market with 112 patches, Catalina's gone missing, and iPhones and iPads get a critical kernel-level zero-day patch...

☐ ☆ ✇ Naked Security

Dangerous hole in Apache Commons Text – like Log4Shell all over again

By Paul Ducklin — October 18th 2022 at 17:26
Third time unlucky. Time to put your patching boots on again...

act-1200

☐ ☆ ✇ Naked Security

Patch Tuesday in brief – one 0-day fixed, but no patches for Exchange!

By Paul Ducklin — October 12th 2022 at 16:58
There's a zero-day patch, but it's not for the zero-day you thought.

☐ ☆ ✇ Naked Security

Mystery iPhone update patches against iOS 16 mail crash-attack

By Paul Ducklin — October 11th 2022 at 00:28
The problem with crashy messaging apps is that *other people* get to choose if and when to send you messages...

☐ ☆ ✇ Naked Security

S3 Ep103: Scammers in the Slammer (and other stories) [Audio + Text]

By Paul Ducklin — October 6th 2022 at 14:43
Latest episode - listen and learn now (or read and revise, if the written word is your thing)...

☐ ☆ ✇ Naked Security

S3 Ep102.5: “ProxyNotShell” Exchange bugs – an expert speaks [Audio + Text]

By Paul Ducklin — October 1st 2022 at 14:05
Who's affected, what you can do while waiting for Microsoft's patches, and how to plan your threat hunting...

☐ ☆ ✇ Naked Security

URGENT! Microsoft Exchange double zero-day – “like ProxyShell, only different”

By Paul Ducklin — September 30th 2022 at 18:25
Double-play 0-day in Exchange - what you need to know, and what you can do

☐ ☆ ✇ Naked Security

WhatsApp “zero-day exploit” news scare – what you need to know

By Paul Ducklin — September 27th 2022 at 18:51
Is WhatsApp currently under active attack by cybercriminals? Is this a clear and current danger? How worried should WhatsApp users be?

☐ ☆ ✇ Naked Security

Apple patches zero-day holes – even in the brand new iOS 16

By Paul Ducklin — September 12th 2022 at 21:25
Five updates, one upgrade, plus two zero-days. Patch your Macs, iPhones and iPads as soon as you can (again)...

apple-plus-16-1200

☐ ☆ ✇ Naked Security

Chrome and Edge fix zero-day security hole – update now!

By Paul Ducklin — September 5th 2022 at 15:12
This time, the crooks got there first - only 1 security hole patched, but it's a zero-day.

☐ ☆ ✇ Naked Security

S3 Ep98: The LastPass saga – should we stop using password managers? [Audio + Text]

By Paul Ducklin — September 1st 2022 at 16:55
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Chrome patches 24 security holes, enables “Sanitizer” safety system

By Paul Ducklin — August 31st 2022 at 11:48
24 existing bugs fixed. And, we hope, numerous potential future bugs prevented.

☐ ☆ ✇ Naked Security

JavaScript bugs aplenty in Node.js ecosystem – found automatically

By Paul Ducklin — August 30th 2022 at 16:59
How to get the better of bugs in all the possible packages in your supply chain?

☐ ☆ ✇ Naked Security

Firefox 104 is out – no critical bugs, but update anyway

By Paul Ducklin — August 26th 2022 at 16:27
Two trust-spoofing bugs were the main culprits this month - but neither one was a zero-day.

☐ ☆ ✇ Naked Security

S3 Ep97: Did your iPhone get pwned? How would you know? [Audio + Text]

By Paul Ducklin — August 25th 2022 at 15:37
Latest episode - listen now! (Or read the transcript if you prefer the text version.)

☐ ☆ ✇ Naked Security

Breaching airgap security: using your phone’s gyroscope as a microphone

By Paul Ducklin — August 24th 2022 at 18:59
One bit per second makes the Voyager probe data rate seem blindingly fast. But it's enough to break your security assumptions...

☐ ☆ ✇ Naked Security

Bitcoin ATMs leeched by attackers who created fake admin accounts

By Paul Ducklin — August 23rd 2022 at 18:35
The criminals didn't implant any malware. The attack was orchestrated via malevolent configuration changes.

☐ ☆ ✇ Naked Security

Laptop denial-of-service via music: the 1980s R&B song with a CVE!

By Paul Ducklin — August 22nd 2022 at 16:03
We haven't validated this vuln ourselves... but the source of the story is impeccable. (Impeccably dressed, at least.)

☐ ☆ ✇ Naked Security

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin — August 17th 2022 at 23:33
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

☐ ☆ ✇ Naked Security

Chrome browser gets 11 security fixes with 1 zero-day – update now!

By Paul Ducklin — August 17th 2022 at 13:16
Don't delay - patch today.

☐ ☆ ✇ Naked Security

Zoom for Mac patches critical bug – update now!

By Paul Ducklin — August 15th 2022 at 18:26
There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...

☐ ☆ ✇ Naked Security

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

By Paul Ducklin — August 10th 2022 at 16:59
If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

☐ ☆ ✇ Naked Security

S3 Ep94: This sort of crypto (graphy), and the other sort of crypto (currency!) [Audio + Text]

By Paul Ducklin — August 4th 2022 at 17:52
Latest episode - listen now! (Or read if that's what you prefer.)

☐ ☆ ✇ Naked Security

Cryptocoin “token swapper” Nomad loses $200 million in coding blunder

By Paul Ducklin — August 2nd 2022 at 16:12
Transactions were only approved, it seems, if they were initiated by... errrrr, by anyone.

☐ ☆ ✇ Naked Security

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin — August 1st 2022 at 16:55
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

☐ ☆ ✇ Naked Security

S3 Ep93: Office security, breach costs, and leisurely patches [Audio + Text]

By Paul Ducklin — July 28th 2022 at 15:47
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Critical Samba bug could let anyone become Domain Admin – patch now!

By Paul Ducklin — July 27th 2022 at 21:15
It's a serious bug... but there's a fix for it, so you know exactly what to do!

☐ ☆ ✇ Naked Security

Mild monthly security update from Firefox – but update anyway

By Paul Ducklin — July 27th 2022 at 00:41
You're probably thinking we're going to say, "Don't delay/Do it today"... and that's exactly what we are saying!

☐ ☆ ✇ Naked Security

Apple patches “0-day” browser bug fixed 2 weeks ago in Chrome, Edge

By Paul Ducklin — July 21st 2022 at 12:38
One vendor's zero-day is another vendor's routine patch...

☐ ☆ ✇ Naked Security

8 months on, US says Log4Shell will be around for “a decade or longer”

By Paul Ducklin — July 18th 2022 at 16:57
When it comes to cybersecurity, ask not what everyone else can do for you...

☐ ☆ ✇ Naked Security

Apache “Commons Configuration” patches Log4Shell-style bug – what you need to know

By Paul Ducklin — July 8th 2022 at 00:59
It's a bit like Log4J, but for configuration files, not for logging.

☐ ☆ ✇ Naked Security

S3 Ep90: Chrome 0-day again, True Cybercrime, and a 2FA bypass [Podcast + Transcript]

By Paul Ducklin — July 7th 2022 at 18:46
Listen now! Or read if you prefer...

☐ ☆ ✇ Naked Security

OpenSSL fixes two “one-liner” crypto bugs – what you need to know

By Paul Ducklin — July 6th 2022 at 16:52
"As bad as Heartbleed"? We heard that concern a week ago, but we think it's less ungood than that...

☐ ☆ ✇ Naked Security

Google patches “in-the-wild” Chrome zero-day – update now!

By Paul Ducklin — July 5th 2022 at 15:55
Running Chrome? Do the "Help-About-Update" dance move right now, just to be sure...

☐ ☆ ✇ Naked Security

S3 Ep89: Sextortion, blockchain blunder, and an OpenSSL bugfix [Podcast + Transcript]

By Paul Ducklin — June 30th 2022 at 12:57
Latest episode - listen and read now! Use our advice to advise your own friends and family... let's all do our bit to stand up to scammers!

☐ ☆ ✇ Naked Security

Firefox 102 fixes address bar spoofing security hole (and helps with Follina!)

By Paul Ducklin — June 29th 2022 at 16:11
Firefox squashes a bug that helped phishers, and brings its own helping hand to Microsoft's "Follina" saga.

☐ ☆ ✇ Naked Security

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin — June 24th 2022 at 15:32
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

☐ ☆ ✇ Naked Security

S3 Ep87: Follina, AirTags, ID theft and the Law of Big Numbers [Podcast]

By Paul Ducklin — June 16th 2022 at 16:52
Lastest epsiode - listen now!

☐ ☆ ✇ Naked Security

Follina gets fixed – but it’s not listed in the Patch Tuesday patches!

By Paul Ducklin — June 15th 2022 at 01:20
We tried it out to make sure, so you don't have to.

☐ ☆ ✇ Naked Security

You’re invited! Join us for a live walkthrough of the “Follina” story…

By Paul Ducklin — June 13th 2022 at 16:28
Live demo, plain English, no sales pitch, just a chance to watch an attack dissected in safety. Join us if you can!

☐ ☆ ✇ Naked Security

S3 Ep86: The crooks were in our network for HOW long?! [Podcast + Transcript]

By Paul Ducklin — June 9th 2022 at 13:07
Latest episode - listen (or read) now!

☐ ☆ ✇ Naked Security

Know your enemy! Learn how cybercrime adversaries get in…

By Paul Ducklin — June 7th 2022 at 15:49
Here's how 144 recent attacks actually went down in real life. Don't let this happen to you!

☐ ☆ ✇ Naked Security

Atlassian announces 0-day hole in Confluence Server – update now!

By Paul Ducklin — June 3rd 2022 at 18:59
Zero-day announced - here's what you need to know

❌