FreshRSS

🔒
△ 🔃
☐ ☆ ✇ Naked Security

Aussie PM says, “Shut down your phone every 24 hours for 5 mins” – but that’s not enough on its own

By Paul Ducklin — June 23rd 2023 at 16:10
Don't treat rebooting your phone once a day as a cybersecurity talisman... here are 8 additional tips for better mobile phone security.

☐ ☆ ✇ Naked Security

S3 Ep140: So you think you know ransomware?

By Paul Ducklin — June 22nd 2023 at 16:48
Lots to learn this week - listen now! (Full transcript inside.)

☐ ☆ ✇ Naked Security

Apple patch fixes zero-day kernel hole reported by Kaspersky – update now!

By Paul Ducklin — June 22nd 2023 at 00:36
Apple didn't use the words "Triangulation Trojan", but you probably will.

☐ ☆ ✇ Naked Security

Beware bad passwords as attackers co-opt Linux servers into cybercrime

By Paul Ducklin — June 21st 2023 at 19:50
Did you prevent password-only logins on your SSH servers? On ALL of them? Are you sure about that?

☐ ☆ ✇ Naked Security

“The Ransomware Documentary” – brand new video series from Sophos starting now!

By Sally Adam — June 21st 2023 at 18:00
Get the full 360-degree view of ransomware

Ransomware Documentary Graphic Theme_780x480 NS

☐ ☆ ✇ Naked Security

ASUS warns router customers: Patch now, or block all inbound requests

By Paul Ducklin — June 20th 2023 at 18:14
"Do as we say, not as we do!" - The patches took ages to come out, but don't let that lure you into taking ages to install them.

☐ ☆ ✇ Naked Security

Megaupload duo will go to prison at last, but Kim Dotcom fights on…

By Paul Ducklin — June 19th 2023 at 18:59
One, sadly, has died, and two are heading to prison, but for Kim Dotcom, the saga goes on...

☐ ☆ ✇ Naked Security

MOVEit mayhem 3: “Disable HTTP and HTTPS traffic immediately”

By Paul Ducklin — June 15th 2023 at 22:10
Twice more unto the breach... third patch tested and released, shut down web access until you've applied it

mi-1200

☐ ☆ ✇ Naked Security

S3 Ep139: Are password rules like running through rain?

By Paul Ducklin — June 15th 2023 at 18:43
Latest episode - listen now! (Full transcript inside.)

☐ ☆ ✇ Naked Security

Patch Tuesday fixes 4 critical RCE bugs, and a bunch of Office holes

By Paul Ducklin — June 13th 2023 at 23:32
No zero-days this month, if you ignore the Edge RCE hole patched last week

☐ ☆ ✇ Naked Security

Gozi banking malware “IT chief” finally jailed after more than 10 years

By Paul Ducklin — June 13th 2023 at 18:43
Gozi threesome from way back in the late 2000s and early 2010s now all charged, convicted and sentenced. The DOJ got there in the end...

☐ ☆ ✇ Naked Security

History revisited: US DOJ unseals Mt. Gox cybercrime charges

By Naked Security writer — June 12th 2023 at 16:58
Though the mills of the Law grind slowly/Yet they grind exceeding small/Though with patience they stand waiting/With exactness grind they all...

☐ ☆ ✇ Naked Security

More MOVEit mitigations: new patches published for further protection

By Paul Ducklin — June 9th 2023 at 21:54
Good news... more patches, this time available proactively

☐ ☆ ✇ Naked Security

Thoughts on scheduled password changes (don’t call them rotations!)

By Paul Ducklin — June 9th 2023 at 18:58
Does swapping your password regularly make it a better password?

☐ ☆ ✇ Naked Security

S3 Ep138: I like to MOVEit, MOVEit

By Paul Ducklin — June 8th 2023 at 16:56
Backdoors, exploits, and Little Bobby Tables. Listen now! (Full transcript available...)

s3-ep138-1200

☐ ☆ ✇ Naked Security

Firefox 114 is out: No 0-days, but one fascinating “teachable moment” bug

By Paul Ducklin — June 7th 2023 at 19:59
With the right (or wrong, if you're on the right side of the fence) timing...

☐ ☆ ✇ Naked Security

Chrome and Edge zero-day: “This exploit is in the wild”, so check your versions now

By Paul Ducklin — June 6th 2023 at 18:28
Chrome and Edge 0-days patched.

☐ ☆ ✇ Naked Security

MOVEit zero-day exploit used by data breach gangs: The how, the why, and what to do…

By Paul Ducklin — June 5th 2023 at 19:59
Little Bobby Tables is back!

mi-1200

☐ ☆ ✇ Naked Security

Researchers claim Windows “backdoor” affects hundreds of Gigabyte motherboards

By Paul Ducklin — June 2nd 2023 at 18:56
It's a backdoor, Jim, but not as we know it... here's a sober look at this issue.

☐ ☆ ✇ Naked Security

S3 Ep137: 16th century crypto skullduggery

By Paul Ducklin — June 1st 2023 at 16:45
Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

s3-ep137-feat-1200

☐ ☆ ✇ Naked Security

Serious Security: That KeePass “master password crack”, and what we can learn from it

By Paul Ducklin — May 31st 2023 at 19:39
Here, in an admittedly discursive nutshell, is the fascinating story of CVE-2023-32784. (Short version: Don't panic.)

☐ ☆ ✇ Naked Security

Serious Security: Verification is vital – examining an OAUTH login bug

By Paul Ducklin — May 30th 2023 at 16:59
What good is a popup asking for your approval if an attacker can bypass it simply by suppressing it?

☐ ☆ ✇ Naked Security

S3 Ep136: Navigating a manic malware maelstrom

By Paul Ducklin — May 25th 2023 at 16:50
Latest episode - listen now. Full transcript inside...

☐ ☆ ✇ Naked Security

Ransomware tales: The MitM attack that really had a Man in the Middle

By Paul Ducklin — May 24th 2023 at 17:59
Another traitorous sysadmin story, this one busted by system logs that gave his game away...

☐ ☆ ✇ Naked Security

PyPI open-source code repository deals with manic malware maelstrom

By Paul Ducklin — May 23rd 2023 at 18:45
Controlled outage used to keep malware marauders from gumming up the works. Learn what you can do to help in future...

☐ ☆ ✇ Naked Security

Phone scamming kingpin gets 13 years for running “iSpoof” service

By Naked Security writer — May 22nd 2023 at 16:58
Site marketing video promised total anonymity, but that was a lie. 170 arrested already. Potentially 1000s more to follow.

ispoof-1200

☐ ☆ ✇ Naked Security

Apple’s secret is out: 3 zero-days fixed, so be sure to patch now!

By Paul Ducklin — May 19th 2023 at 01:02
All Apple users have zero-days that need patching, though some have more zero-days than others.

☐ ☆ ✇ Naked Security

S3 Ep135: Sysadmin by day, extortionist by night

By Paul Ducklin — May 18th 2023 at 18:48
Laugh (sufficiently), learn (efficiently), and then let us know what you think in our comments (anonymously, if you wish)...

☐ ☆ ✇ Naked Security

US offers $10m bounty for Russian ransomware suspect outed in indictment

By Naked Security writer — May 17th 2023 at 18:40
"Up to $10 million for information that leads to the arrest and/or conviction of this defendant."

☐ ☆ ✇ Naked Security

Belkin Wemo Smart Plug V2 – the buffer overflow that won’t be patched

By Paul Ducklin — May 16th 2023 at 17:59
Yes, it's a buffer overflow bug. No, it's not going get fixed.

☐ ☆ ✇ Naked Security

Zut alors! Raclage crapuleux! Clearview AI in 20% more trouble in France

By Paul Ducklin — May 15th 2023 at 16:36
We asked you once, we told you twice, now we're ordering you for the third time...

☐ ☆ ✇ Naked Security

Whodunnit? Cybercrook gets 6 years for ransoming his own employer

By Naked Security writer — May 12th 2023 at 16:15
Not just an active adversary, but a two-faced one, too.

☐ ☆ ✇ Naked Security

S3 Ep134: It’s a PRIVATE key – the hint is in the name!

By Paul Ducklin — May 11th 2023 at 14:54
Latest episode - listen now! (Full transcript inside.)

☐ ☆ ✇ Naked Security

Bootkit zero-day fix – is this Microsoft’s most cautious patch ever?

By Paul Ducklin — May 10th 2023 at 11:50
When blocking buggy bootup modules, you have to be really careful not to lock your keys inside the car...

☐ ☆ ✇ Naked Security

Low-level motherboard security keys leaked in MSI breach, claim researchers

By Paul Ducklin — May 9th 2023 at 16:58
What can you do if someone steals your keys but you can't change the lock? We explain the dilemma in plain English.

☐ ☆ ✇ Naked Security

PHP Packagist supply chain poisoned by hacker “looking for a job”

By Paul Ducklin — May 5th 2023 at 16:59
I pwned you! Gizza job! You know it makes sense!

☐ ☆ ✇ Naked Security

S3 Ep133: Apple takes “tight-lipped” to a whole new level

By Paul Ducklin — May 4th 2023 at 20:59
Entertaining, educational, and all in plain English 🎧📖

☐ ☆ ✇ Naked Security

World Password Day: 2 + 2 = 4

By Paul Ducklin — May 4th 2023 at 13:12
We've kept it short and simple, with no sermons, no judgmentalism, no tubthumping... and no BUY NOW buttons. Have a nice day!

☐ ☆ ✇ Naked Security

Tracked by hidden tags? Apple and Google unite to propose safety and security standards…

By Paul Ducklin — May 3rd 2023 at 19:58
To bleat, or not to bleat, that is the question.

☐ ☆ ✇ Naked Security

Apple delivers first-ever Rapid Security Response “cyberattack” patch – leaves some users confused

By Paul Ducklin — May 1st 2023 at 20:46
Just when we'd got used to three-numbered versions, such as "13.3.1", here comes an update suffix, bringing you "13.3.1 (a)"...

☐ ☆ ✇ Naked Security

Mac malware-for-hire steals passwords and cryptocoins, sends “crime logs” via Telegram

By Paul Ducklin — April 30th 2023 at 01:23
These malware peddlers are specifically going after Mac users. The hint's in the name: "Atomic macOS Stealer", or AMOS for short.

☐ ☆ ✇ Naked Security

Google wins court order to force ISPs to filter botnet traffic

By Naked Security writer — April 28th 2023 at 19:59
CryptBot criminals are alleged to have plundered browser passwords, illicitly-snapped screenshots, cryptocurrency account data, and more.

☐ ☆ ✇ Naked Security

S3 Ep132: Proof-of-concept lets anyone hack at will

By Paul Ducklin — April 27th 2023 at 16:55
When Doug says, "Happy Remote Code Execution Day, Duck"... it's irony. For the avoidance of all doubt :-)

☐ ☆ ✇ Naked Security

Google leaking 2FA secrets – researchers advise against new “account sync” feature for now

By Paul Ducklin — April 26th 2023 at 17:59
You waited 13 years for this feature in Google Authenticator. Now researchers are advising you to wait a while longer, just in case...

☐ ☆ ✇ Naked Security

PaperCut security vulnerabilities under active attack – vendor urges customers to patch

By Paul Ducklin — April 25th 2023 at 17:53
If you have the product, but you haven't patched - well, the crooks have now landed, so please don't delay. Do it today...

☐ ☆ ✇ Naked Security

Double zero-day in Chrome and Edge – check your versions now!

By Paul Ducklin — April 24th 2023 at 19:59
Wouldn't it be handy if there were a single version number to check for in every Chromium-based browser, on every supported platform?

☐ ☆ ✇ Naked Security

VMware patches break-and-enter hole in logging tools: update now!

By Paul Ducklin — April 21st 2023 at 17:58
You know jolly well/What we're going to say/And that's "Do not delay/Simply do it today."

☐ ☆ ✇ Naked Security

S3 Ep131: Can you really have fun with FORTRAN?

By Paul Ducklin — April 20th 2023 at 17:55
Loop-the-loop in this week's episode. Entertaining, educational and all in plain English. Transcript inside.

☐ ☆ ✇ Naked Security

Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security

By Paul Ducklin — April 18th 2023 at 16:56
Did the sentence fit the crime? Read the backstory, and then have your say in our comments! (You may post anonymously.)

☐ ☆ ✇ Naked Security

FBI and FCC warn about “Juicejacking” – but just how useful is their advice?

By Paul Ducklin — April 17th 2023 at 18:17
USB charging stations - can you trust them? What are the real risks, and how can you keep your data safe on the road?

☐ ☆ ✇ Naked Security

S3 Ep130: Open the garage bay doors, HAL [Audio + Text]

By Paul Ducklin — April 13th 2023 at 16:54
I'm sorry, Dave. I'm afraid I can't... errr, no, hang on a minute, I can do that easily! Worldwide! Right now!

☐ ☆ ✇ Naked Security

Patch Tuesday: Microsoft fixes a zero-day, and two curious bugs that take the Secure out of Secure Boot

By Paul Ducklin — April 12th 2023 at 18:57
Is Secure Boot without the Secure just "Boot"?

☐ ☆ ✇ Naked Security

Attention gamers! Motherboard maker MSI admits to breach, issues “rogue firmware” alert

By Paul Ducklin — April 11th 2023 at 18:58
Stealing private keys is like getting hold of a medieval monarch's personal signet ring... you get to put an official seal on treasonous material.

☐ ☆ ✇ Naked Security

Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads

By Paul Ducklin — April 10th 2023 at 20:20
That double-whammy Apple browser-to-kernel spyware bug combo we wrote up last week? Turns out it applies to all supported Macs and iDevices - patch now!

☐ ☆ ✇ Naked Security

Popular server-side JavaScript security sandbox “vm2” patches remote execution hole

By Paul Ducklin — April 9th 2023 at 00:28
The security error was in the error handling system that was supposed to catch potential security errors...

vm2-1200

☐ ☆ ✇ Naked Security

Apple issues emergency patches for spyware-style 0-day exploits – update now!

By Paul Ducklin — April 8th 2023 at 01:20
A bug to hack your browser, then a bug to pwn the kernel... reported from the wild by Amnesty International.

☐ ☆ ✇ Naked Security

S3 Ep129: When spyware arrives from someone you trust

By Paul Ducklin — April 6th 2023 at 14:57
Scanning tools, supply-chain malware, Wi-Fi hacking, and why there should be TWO World Backup Days... listen now!

☐ ☆ ✇ Naked Security

Hack and enter! The “secure” garage doors that anyone can open from anywhere – what you need to know

By Paul Ducklin — April 5th 2023 at 18:49
Grab a message/Play it back/You've just performed/A big phat hack...

☐ ☆ ✇ Naked Security

Einstein tilings – the amazing “Hat” shape that never repeats!

By Paul Ducklin — April 4th 2023 at 18:59
Imagine tiling a whole football field using a single shape... yet not being able to produce a repeating pattern, even if you wanted to.

☐ ☆ ✇ Naked Security

Researchers claim they can bypass Wi-Fi encryption (briefly, at least)

By Paul Ducklin — April 3rd 2023 at 16:59
They can't read much of your data, but even a few stray network packets could tell them something they're not supposed to know.

❌