FreshRSS

🔒
△ 🔃
☐ ☆ ✇ Naked Security

Twitter tells users: Pay up if you want to keep using insecure 2FA

By Paul Ducklin — February 20th 2023 at 17:58
Ironically, Twitter Blue users will be allowed to keep using the very 2FA process that's not considered secure enough for everyone else.

☐ ☆ ✇ Naked Security

Apple fixes zero-day spyware implant bug – patch now!

By Paul Ducklin — February 14th 2023 at 19:08
Everyone update now! Except for those who don't need to! Or who need to but will only get updates later on, though Apple isn't saying yet!

☐ ☆ ✇ Naked Security

Password-stealing “vulnerability” reported in KeePass – bug or feature?

By Paul Ducklin — February 1st 2023 at 19:58
Is it a vulnerability if someone with control over your account can mess with files that your account is allowed to access anyway?

☐ ☆ ✇ Naked Security

Serious Security: The Samba logon bug caused by outdated crypto

By Paul Ducklin — January 30th 2023 at 19:59
Enjoy our Serious Security deep dive into this real-world example of why cryptographic agility is important!

☐ ☆ ✇ Naked Security

Apple patches are out – old iPhones get an old zero-day fix at last!

By Paul Ducklin — January 24th 2023 at 01:24
Don't delay, especially if you're still running an iOS 12 device... please do it today!

☐ ☆ ✇ Naked Security

Microsoft dishes the dirt on Apple’s “Achilles heel” shortly after fixing similar Windows bug

By Paul Ducklin — December 20th 2022 at 17:59
It happens to the best of us: Microsoft highlights a security bypass bug on Macs that is curiously similar to a recent Windows 0-day.

☐ ☆ ✇ Naked Security

Apple patches everything, finally reveals mystery of iOS 16.1.2

By Paul Ducklin — December 14th 2022 at 02:11
There's an update for everything this time, not just for iOS.

☐ ☆ ✇ Naked Security

Pwn2Own Toronto: 54 hacks, 63 new bugs, $1 million in bounties

By Paul Ducklin — December 12th 2022 at 19:58
That's a mean average of $15,710 per bug... and 63 fewer bugs out there for crooks and rogues to find.

☐ ☆ ✇ Naked Security

SIM swapper sent to prison for 2FA cryptocurrency heist of over $20m

By Naked Security writer — December 6th 2022 at 17:56
Guilty party got 18 months, also has to pay back $20m he probably hasn't got, which could land him in more hot water.

☐ ☆ ✇ Naked Security

Number Nine! Chrome fixes another 2022 zero-day, Edge patched too

By Paul Ducklin — December 5th 2022 at 20:58
Ninth more unto the breach, dear friends, ninth more.

☐ ☆ ✇ Naked Security

The CHRISTMA EXEC network worm – 35 years and counting!

By Paul Ducklin — December 1st 2022 at 20:35
"Uh-oh, this viruses-and-worms scene could turn out quite troublesome." If only we'd been wrong...

xmas-1200-35-wide

☐ ☆ ✇ Naked Security

Serious Security: MD5 considered harmful – to the tune of $600,000

By Paul Ducklin — November 30th 2022 at 17:58
It's not just the hashing, by the way. It's the salting and the stretching, too!

☐ ☆ ✇ Naked Security

How to hack an unpatched Exchange server with rogue PowerShell code

By Paul Ducklin — November 22nd 2022 at 19:54
Review your servers, your patches and your authentication policies - there's a proof-of-concept out

☐ ☆ ✇ Naked Security

Log4Shell-like code execution hole in popular Backstage dev tool

By Paul Ducklin — November 15th 2022 at 17:49
Good old "string templating", also known as "string interpolation", in the spotlight again...

bs-1200

☐ ☆ ✇ Naked Security

Dangerous SIM-swap lockscreen bypass – update Android now!

By Paul Ducklin — November 11th 2022 at 19:59
A bit like leaving the front door keys under the doormat...

☐ ☆ ✇ Naked Security

Emergency code execution patch from Apple – but not an 0-day

By Paul Ducklin — November 10th 2022 at 01:49
Not a zero-day, but important enough for a quick-fire patch to one system library...

☐ ☆ ✇ Naked Security

Twitter Blue Badge email scams – Don’t fall for them!

By Naked Security writer — November 4th 2022 at 17:59
That was the week that was...

☐ ☆ ✇ Naked Security

The OpenSSL security update story – how can you tell what needs fixing?

By Paul Ducklin — November 3rd 2022 at 00:44
How to Hack! Finding OpenSSL library files and accurately identifying their version numbers...

ossl-code-1200

☐ ☆ ✇ Naked Security

OpenSSL patches are out – CRITICAL bug downgraded to HIGH, but patch anyway!

By Paul Ducklin — November 1st 2022 at 17:24
That bated-breath OpenSSL update is out! It's no longer rated CRITICAL, but we advise you to patch ASAP anyway. Here's why...

☐ ☆ ✇ Naked Security

SHA-3 code execution bug patched in PHP – check your version!

By Paul Ducklin — November 1st 2022 at 14:09
As everyone waits for news of a bug in OpenSSL, here's a reminder that other cryptographic code in your life may also need patching!

☐ ☆ ✇ Naked Security

Chrome issues urgent zero-day fix – update now!

By Paul Ducklin — October 29th 2022 at 15:08
We've said it before/And we'll say it again/It's not *if* you should patch/It's a matter of *when*. (Hint: now!)

☐ ☆ ✇ Naked Security

Updates to Apple’s zero-day update story – iPhone and iPad users read this!

By Paul Ducklin — October 28th 2022 at 18:04
Turns out that Tuesday's zero-day for iOS 16 is Friday's zero-day for iOS 15...

☐ ☆ ✇ Naked Security

Apple megaupdate: Ventura out, iOS and iPad kernel zero-day – act now!

By Paul Ducklin — October 25th 2022 at 18:03
Ventura hits the market with 112 patches, Catalina's gone missing, and iPhones and iPads get a critical kernel-level zero-day patch...

☐ ☆ ✇ Naked Security

Zoom for Mac patches sneaky “spy-on-me” bug – update now!

By Paul Ducklin — October 18th 2022 at 18:01
Hey! That back door isn't supposed to be there at all, let alone propped open...

☐ ☆ ✇ Naked Security

Dangerous hole in Apache Commons Text – like Log4Shell all over again

By Paul Ducklin — October 18th 2022 at 17:26
Third time unlucky. Time to put your patching boots on again...

act-1200

☐ ☆ ✇ Naked Security

Mystery iPhone update patches against iOS 16 mail crash-attack

By Paul Ducklin — October 11th 2022 at 00:28
The problem with crashy messaging apps is that *other people* get to choose if and when to send you messages...

☐ ☆ ✇ Naked Security

S3 Ep102.5: “ProxyNotShell” Exchange bugs – an expert speaks [Audio + Text]

By Paul Ducklin — October 1st 2022 at 14:05
Who's affected, what you can do while waiting for Microsoft's patches, and how to plan your threat hunting...

☐ ☆ ✇ Naked Security

URGENT! Microsoft Exchange double zero-day – “like ProxyShell, only different”

By Paul Ducklin — September 30th 2022 at 18:25
Double-play 0-day in Exchange - what you need to know, and what you can do

☐ ☆ ✇ Naked Security

Uber and Rockstar – has a LAPSUS$ linchpin just been busted (again)?

By Paul Ducklin — September 24th 2022 at 22:57
Is this the same suspect as before? Is he part of LAPSUS$? Is this the man who hacked Uber and Rockstar? And, if so, who else?

☐ ☆ ✇ Naked Security

S3 Ep101: Uber and LastPass breaches – is 2FA all it’s cracked up to be? [Audio + Text]

By Paul Ducklin — September 22nd 2022 at 18:42
Latest episode - listen now! Learn why adopting 2FA isn't a reason to relax your other security precautions...

☐ ☆ ✇ Naked Security

Chrome and Edge fix zero-day security hole – update now!

By Paul Ducklin — September 5th 2022 at 15:12
This time, the crooks got there first - only 1 security hole patched, but it's a zero-day.

☐ ☆ ✇ Naked Security

URGENT! Apple slips out zero-day update for older iPhones and iPads

By Paul Ducklin — August 31st 2022 at 18:42
Patch as soon as you can - that recent WebKit zero-day affecting new iPhones and iPads is apparently being used against older models, too.

☐ ☆ ✇ Naked Security

Laptop denial-of-service via music: the 1980s R&B song with a CVE!

By Paul Ducklin — August 22nd 2022 at 16:03
We haven't validated this vuln ourselves... but the source of the story is impeccable. (Impeccably dressed, at least.)

☐ ☆ ✇ Naked Security

Apple patches double zero-day in browser and kernel – update now!

By Paul Ducklin — August 17th 2022 at 23:33
Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

☐ ☆ ✇ Naked Security

Zoom for Mac patches critical bug – update now!

By Paul Ducklin — August 15th 2022 at 18:26
There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...

☐ ☆ ✇ Naked Security

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

By Paul Ducklin — August 10th 2022 at 16:59
If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

☐ ☆ ✇ Naked Security

GnuTLS patches memory mismanagement bug – update now!

By Paul Ducklin — August 1st 2022 at 16:55
GnuTLS may well be the most widespread cryptographic toolkit you've never heard of. Learn more...

☐ ☆ ✇ Naked Security

Critical Samba bug could let anyone become Domain Admin – patch now!

By Paul Ducklin — July 27th 2022 at 21:15
It's a serious bug... but there's a fix for it, so you know exactly what to do!

☐ ☆ ✇ Naked Security

Facebook 2FA scammers return – this time in just 21 minutes

By Paul Ducklin — July 13th 2022 at 16:46
Last time they arrived 28 minutes after lighting up their fake domain... this time it was just 21 minutes

☐ ☆ ✇ Naked Security

Apache “Commons Configuration” patches Log4Shell-style bug – what you need to know

By Paul Ducklin — July 8th 2022 at 00:59
It's a bit like Log4J, but for configuration files, not for logging.

☐ ☆ ✇ Naked Security

S3 Ep90: Chrome 0-day again, True Cybercrime, and a 2FA bypass [Podcast + Transcript]

By Paul Ducklin — July 7th 2022 at 18:46
Listen now! Or read if you prefer...

☐ ☆ ✇ Naked Security

Google patches “in-the-wild” Chrome zero-day – update now!

By Paul Ducklin — July 5th 2022 at 15:55
Running Chrome? Do the "Help-About-Update" dance move right now, just to be sure...

☐ ☆ ✇ Naked Security

Facebook 2FA phish arrives just 28 minutes after scam domain created

By Paul Ducklin — July 1st 2022 at 20:01
The crooks hit us up with this phishing email less than half an hour after they activated their new scam domain.

☐ ☆ ✇ Naked Security

S3 Ep87: Follina, AirTags, ID theft and the Law of Big Numbers [Podcast]

By Paul Ducklin — June 16th 2022 at 16:52
Lastest epsiode - listen now!

☐ ☆ ✇ Naked Security

Follina gets fixed – but it’s not listed in the Patch Tuesday patches!

By Paul Ducklin — June 15th 2022 at 01:20
We tried it out to make sure, so you don't have to.

☐ ☆ ✇ Naked Security

You’re invited! Join us for a live walkthrough of the “Follina” story…

By Paul Ducklin — June 13th 2022 at 16:28
Live demo, plain English, no sales pitch, just a chance to watch an attack dissected in safety. Join us if you can!

☐ ☆ ✇ Naked Security

Atlassian announces 0-day hole in Confluence Server – update now!

By Paul Ducklin — June 3rd 2022 at 18:59
Zero-day announced - here's what you need to know

☐ ☆ ✇ Naked Security

S3 Ep85: Now THAT’S what I call a Microsoft Office exploit! [Podcast]

By Paul Ducklin — June 2nd 2022 at 18:37
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Mysterious “Follina” zero-day hole in Office – here’s what to do!

By Paul Ducklin — May 30th 2022 at 23:01
News has emerged of a "feature" in Office that has been abused as a zero-day bug to run evil code. Turning off macros doesn't help!

☐ ☆ ✇ Naked Security

Mozilla patches Wednesday’s Pwn2Own double-exploit… on Friday!

By Paul Ducklin — May 20th 2022 at 23:47
That was quick! 48 hours from exploit report to published patch.

☐ ☆ ✇ Naked Security

US Government says: Patch VMware right now, or get off our network

By Paul Ducklin — May 20th 2022 at 14:03
Find and patch. Right now. If you can't patch, get it off the network. Right now! Oh, and show us what you did to comply.

☐ ☆ ✇ Naked Security

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin — May 18th 2022 at 13:04
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

☐ ☆ ✇ Naked Security

Firefox out-of-band update to 100.0.1 – just in time for Pwn2Own?

By Paul Ducklin — May 15th 2022 at 21:53
A new point-release of Firefox. Not unusual, but the timing of this one is interesting, with Pwn2Own coming up in a few days.

☐ ☆ ✇ Naked Security

RubyGems supply chain rip-and-replace bug fixed – check your logs!

By Paul Ducklin — May 9th 2022 at 15:41
Imagine if you could assume the identity of, say, Franklin Delano Roosevelt simply by showing up and calling yourself "Frank".

ruby-1200

☐ ☆ ✇ Naked Security

Critical cryptographic Java security blunder patched – update now!

By Paul Ducklin — April 20th 2022 at 16:43
Either know the private key and use it scrupulously in your digital signature calculation.... or just send a bunch of zeros instead.

☐ ☆ ✇ Naked Security

Yet another Chrome zero-day emergency update – patch now!

By Paul Ducklin — April 16th 2022 at 00:33
The third emergency Chrome 0-day in three months - the first one was exploited by North Korea, so you might as well get this one ASAP.

☐ ☆ ✇ Naked Security

Two different “VMware Spring” bugs at large – we cut through the confusion

By Paul Ducklin — March 31st 2022 at 16:59
Whoever came up with the name "Spring4Shell" didn't help at all... we cut through the Spring Bug confusion

☐ ☆ ✇ Naked Security

“VMware Spring Cloud Function” Java bug gives instant remote code execution – update now!

By Paul Ducklin — March 30th 2022 at 20:38
Easy unauthenticated remote code execution - PoC code already out

☐ ☆ ✇ Naked Security

Zlib data compressor fixes 17-year-old security bug – patch, errrm, now

By Paul Ducklin — March 29th 2022 at 16:37
This code is venerable! Surely all the bugs must be out by now?

☐ ☆ ✇ Naked Security

Google Chrome patches mysterious new zero-day bug – update now

By Paul Ducklin — March 28th 2022 at 14:18
CVE-2022-1096 - another mystery in-the-wild 0-day in Chrome... check your version now!

❌