FreshRSS

🔒
△ 🔃
☐ ☆ ✇ Naked Security

Microsoft hit by Storm season – a tale of two semi-zero days

By Paul Ducklin — July 18th 2023 at 20:59
The first compromise didn't get the crooks as far as they wanted, so they found a second one that did...

☐ ☆ ✇ Naked Security

Zimbra Collaboration Suite warning: Patch this 0-day right now (by hand)!

By Paul Ducklin — July 14th 2023 at 19:58
Zimbra didn't actually say, "Do not delay/Do it today," but they did say, "We kindly request your cooperation to apply the fix manually."

☐ ☆ ✇ Naked Security

S3 Ep141: What was Steve Jobs’s first job?

By Paul Ducklin — June 29th 2023 at 16:58
Latest episode - listen now! (Full transcript inside.)

☐ ☆ ✇ Naked Security

Interested in $10,000,000? Ready to turn in the Clop ransomware crew?

By Naked Security writer — June 28th 2023 at 18:59
Technically, it's "up to $10 million", but it's potentially a LOT of money, nevertheless...

☐ ☆ ✇ Naked Security

Aussie PM says, “Shut down your phone every 24 hours for 5 mins” – but that’s not enough on its own

By Paul Ducklin — June 23rd 2023 at 16:10
Don't treat rebooting your phone once a day as a cybersecurity talisman... here are 8 additional tips for better mobile phone security.

☐ ☆ ✇ Naked Security

Gozi banking malware “IT chief” finally jailed after more than 10 years

By Paul Ducklin — June 13th 2023 at 18:43
Gozi threesome from way back in the late 2000s and early 2010s now all charged, convicted and sentenced. The DOJ got there in the end...

☐ ☆ ✇ Naked Security

More MOVEit mitigations: new patches published for further protection

By Paul Ducklin — June 9th 2023 at 21:54
Good news... more patches, this time available proactively

☐ ☆ ✇ Naked Security

MOVEit zero-day exploit used by data breach gangs: The how, the why, and what to do…

By Paul Ducklin — June 5th 2023 at 19:59
Little Bobby Tables is back!

mi-1200

☐ ☆ ✇ Naked Security

S3 Ep137: 16th century crypto skullduggery

By Paul Ducklin — June 1st 2023 at 16:45
Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

s3-ep137-feat-1200

☐ ☆ ✇ Naked Security

Serious Security: That KeePass “master password crack”, and what we can learn from it

By Paul Ducklin — May 31st 2023 at 19:39
Here, in an admittedly discursive nutshell, is the fascinating story of CVE-2023-32784. (Short version: Don't panic.)

☐ ☆ ✇ Naked Security

Serious Security: Verification is vital – examining an OAUTH login bug

By Paul Ducklin — May 30th 2023 at 16:59
What good is a popup asking for your approval if an attacker can bypass it simply by suppressing it?

☐ ☆ ✇ Naked Security

Phone scamming kingpin gets 13 years for running “iSpoof” service

By Naked Security writer — May 22nd 2023 at 16:58
Site marketing video promised total anonymity, but that was a lie. 170 arrested already. Potentially 1000s more to follow.

ispoof-1200

☐ ☆ ✇ Naked Security

Whodunnit? Cybercrook gets 6 years for ransoming his own employer

By Naked Security writer — May 12th 2023 at 16:15
Not just an active adversary, but a two-faced one, too.

☐ ☆ ✇ Naked Security

Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security

By Paul Ducklin — April 18th 2023 at 16:56
Did the sentence fit the crime? Read the backstory, and then have your say in our comments! (You may post anonymously.)

☐ ☆ ✇ Naked Security

FBI and FCC warn about “Juicejacking” – but just how useful is their advice?

By Paul Ducklin — April 17th 2023 at 18:17
USB charging stations - can you trust them? What are the real risks, and how can you keep your data safe on the road?

☐ ☆ ✇ Naked Security

S3 Ep129: When spyware arrives from someone you trust

By Paul Ducklin — April 6th 2023 at 14:57
Scanning tools, supply-chain malware, Wi-Fi hacking, and why there should be TWO World Backup Days... listen now!

☐ ☆ ✇ Naked Security

Researchers claim they can bypass Wi-Fi encryption (briefly, at least)

By Paul Ducklin — April 3rd 2023 at 16:59
They can't read much of your data, but even a few stray network packets could tell them something they're not supposed to know.

☐ ☆ ✇ Naked Security

Microsoft assigns CVE to Snipping Tool bug, pushes patch to Store

By Paul Ducklin — March 27th 2023 at 19:59
Microsoft says "successful exploitation requires uncommon user interaction", but it's the innocent and accidental leakage of private data you should be concerned about.

☐ ☆ ✇ Naked Security

WooCommerce Payments plugin for WordPress has an admin-level hole – patch now!

By Paul Ducklin — March 24th 2023 at 19:48
Admin-level holes in websites are always a bad thing... and for "bad", read "worse" if it's an e-commerce site.

woo-1200

☐ ☆ ✇ Naked Security

S3 Ep127: When you chop someone out of a photo, but there they are anyway…

By Paul Ducklin — March 23rd 2023 at 17:59
Listen now - latest episode. Full transcript inside.

☐ ☆ ✇ Naked Security

Windows 11 also vulnerable to “aCropalypse” image data leakage

By Paul Ducklin — March 22nd 2023 at 17:59
Turns out that the Windows 11 Snipping Tool has the same "aCropalypse" data leakage bug as Pixel phones. Here's how to work around the problem...

☐ ☆ ✇ Naked Security

Google Pixel phones had a serious data leakage bug – here’s what to do!

By Paul Ducklin — March 21st 2023 at 17:58
What if the "safe" images you shared after carefully cropping them... had some or all of the "unsafe" pixels left behind anyway?

☐ ☆ ✇ Naked Security

Bitcoin ATM customers hacked by video upload that was actually an app

By Paul Ducklin — March 20th 2023 at 19:50
As the misquote goes, "Once is misfortune..." This is the second time, and you know what Lady Bracknell had to say about that...

☐ ☆ ✇ Naked Security

S3 Ep 126: The price of fast fashion (and feature creep) [Audio + Text]

By Paul Ducklin — March 16th 2023 at 17:56
Worried about rogue apps? Unsure about the new Outlook zero-day? Clear advice in plain English... just like old times, with Duck and Chet!

☐ ☆ ✇ Naked Security

SHEIN shopping app goes rogue, grabs price and URL data from your clipboard

By Paul Ducklin — March 10th 2023 at 19:58
It's not exactly data theft, but it's worryingly close to "unintentional treachery" - apparently because it's great for marketing purposes

☐ ☆ ✇ Naked Security

Feds warn about right Royal ransomware rampage that runs the gamut of TTPs

By Paul Ducklin — March 3rd 2023 at 19:56
Wondering which cybercrime tools, techniques and procedures to focus on? How about any and all of them?

☐ ☆ ✇ Naked Security

S3 Ep124: When so-called security apps go rogue [Audio + Text]

By Paul Ducklin — March 2nd 2023 at 19:40
Rogue software packages. Rogue "sysadmins". Rogue keyloggers. Rogue authenticators. Rogue ROGUES!

s3-ep124-auth--1200

☐ ☆ ✇ Naked Security

LastPass: Keylogger on home PC led to cracked corporate password vault

By Paul Ducklin — February 28th 2023 at 02:23
Seems the crooks implanted a keylogger via a vulnerable media app (LastPass politely didn't say which one!) on a developer's home computer.

☐ ☆ ✇ Naked Security

Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!

By Paul Ducklin — February 27th 2023 at 02:10
Even in Apple's and Google's "walled gardens", there are plenty of 2FA apps that are either dangerously incompetent, or unrepentantly malicious. (Or perhaps both.)

☐ ☆ ✇ Naked Security

S3 Ep123: Crypto company compromise kerfuffle [Audio + Text]

By Paul Ducklin — February 23rd 2023 at 19:58
Latest episode - listen now! Top-notch advice for cybersecurity, both at work and at home.

☐ ☆ ✇ Naked Security

NPM JavaScript packages abused to create scambait links in bulk

By Paul Ducklin — February 22nd 2023 at 20:59
Free spins? Bonus game points? Cheap social media followers? What harm could it possibly do if you just take a tiny little look?!

☐ ☆ ✇ Naked Security

Coinbase breached by social engineers, employee data stolen

By Paul Ducklin — February 21st 2023 at 17:58
Another day, another "sophisticated" attack. This time, the company has handily included some useful advice along with its mea culpa...

☐ ☆ ✇ Naked Security

GoDaddy admits: Crooks hit us with malware, poisoned customer websites

By Paul Ducklin — February 20th 2023 at 01:36
New report admits that attackers were detected in the network about three months ago, and may have been attacking for about three years.

☐ ☆ ✇ Naked Security

Reddit admits it was hacked and data stolen, says “Don’t panic”

By Paul Ducklin — February 10th 2023 at 19:59
Reddit is suggesting three tips as a follow-up to this breach. We agree with two of them but not with the third...

☐ ☆ ✇ Naked Security

Finnish psychotherapy extortion suspect arrested in France

By Naked Security writer — February 6th 2023 at 19:13
Company transcribed ultra-personal conversations, didn't secure them. Criminal stole them, then extorted thousands of vulnerable patients.

☐ ☆ ✇ Naked Security

Password-stealing “vulnerability” reported in KeePass – bug or feature?

By Paul Ducklin — February 1st 2023 at 19:58
Is it a vulnerability if someone with control over your account can mess with files that your account is allowed to access anyway?

☐ ☆ ✇ Naked Security

GitHub code-signing certificates stolen (but will be revoked this week)

By Paul Ducklin — January 31st 2023 at 11:35
There was a breach, so the bad news isn't great, but the good news isn't too bad...

☐ ☆ ✇ Naked Security

S3 Ep119: Breaches, patches, leaks and tweaks! [Audio + Text]

By Paul Ducklin — January 26th 2023 at 19:57
Lastest episode - listen now! (Or read the transcript.)

☐ ☆ ✇ Naked Security

GoTo admits: Customer cloud backups stolen together with decryption key

By Paul Ducklin — January 25th 2023 at 01:37
We were going to write, "Once more unto the breach, dear friends, once more"... but it seems to go without saying these days.

☐ ☆ ✇ Naked Security

T-Mobile admits to 37,000,000 customer records stolen by “bad actor”

By Paul Ducklin — January 20th 2023 at 17:59
Once more, it's time for Shakespeare's words: Once more unto the breach...

☐ ☆ ✇ Naked Security

CircleCI – code-building service suffers total credential compromise

By Paul Ducklin — January 9th 2023 at 14:52
They're saying "rotate secrets"... in plain English, they mean "change your credentials". The company has a tool to help you find them all.

☐ ☆ ✇ Naked Security

Serious Security: How to improve cryptography, resist supply chain attacks, and handle data breaches

By Paul Ducklin — January 4th 2023 at 19:50
Lessons for us all: improve cryptography, fight cybercrime, own your supply chain... and don't steal my data and then pretend you're sorry.

☐ ☆ ✇ Naked Security

Inside a scammers’ lair: Ukraine busts 40 in fake bank call-centre raid

By Naked Security writer — January 3rd 2023 at 17:03
When someone calls you up to warn you that your bank account is under attack - it's true, because THAT VERY PERSON is the one attacking you!

☐ ☆ ✇ Naked Security

S3 Ep115: True crime stories – A day in the life of a cybercrime fighter [Audio + Text]

By Paul Ducklin — December 29th 2022 at 09:20
Listen now - you'll be alarmed, amused and educated, all in equal measure. (Full transcript in article.)

☐ ☆ ✇ Naked Security

Twitter data of “+400 million unique users” up for sale – what to do?

By Paul Ducklin — December 28th 2022 at 19:59
If the crooks have connected up your phone number and your Twitter handle... what could go wrong?

☐ ☆ ✇ Naked Security

LastPass finally admits: Those crooks who got in? They did steal your password vaults, after all…

By Paul Ducklin — December 23rd 2022 at 19:58
The crooks now know who you are, where you live, which computers are yours, where you go online... and they got those password vaults, too.

☐ ☆ ✇ Naked Security

S3 Ep113: Pwning the Windows kernel – the crooks who hoodwinked Microsoft [Audio + Text]

By Paul Ducklin — December 15th 2022 at 17:10
Return o' the rookit, super-sneaky wireless spyware, credit card skimming, and patches galore. Listen and learn!

☐ ☆ ✇ Naked Security

COVID-bit: the wireless spyware trick with an unfortunate name

By Paul Ducklin — December 13th 2022 at 19:58
It's not the switching that's the problem, it's the switching of the switching!

ind-1200

☐ ☆ ✇ Naked Security

Credit card skimming – the long and winding road of supply chain failure

By Paul Ducklin — December 8th 2022 at 19:58
Don't keep calling home to a JavaScript server that closed its doors eight years ago!

☐ ☆ ✇ Naked Security

LastPass admits to customer data breach caused by previous breach

By Paul Ducklin — December 2nd 2022 at 01:10
Seems that the developer account that the crooks breached last time gave indirect access to customer data this time round.

☐ ☆ ✇ Naked Security

Black Friday and retail season – watch out for PayPal “money request” scams

By Paul Ducklin — November 17th 2022 at 12:45
Don't let a keen eye for bargains lead you into risky online behaviour...

☐ ☆ ✇ Naked Security

S3 Ep107: Eight months to kick out the crooks and you think that’s GOOD? [Audio + Text]

By Paul Ducklin — November 3rd 2022 at 17:51
Listen now - latest episode - audio plus full transcript

☐ ☆ ✇ Naked Security

S3 Ep106: Facial recognition without consent – should it be banned?

By Paul Ducklin — October 27th 2022 at 16:59
Latest episode - listen (or read) now. Teachable moments for X-Ops professionals!

☐ ☆ ✇ Naked Security

Online ticketing company “See” pwned for 2.5 years by attackers

By Paul Ducklin — October 26th 2022 at 19:58
Don't be a cybersecurity slowcoach - you need to spot possible attacks as soon as you can.

☐ ☆ ✇ Naked Security

S3 Ep105: WONTFIX! The MS Office cryptofail that “isn’t a security flaw” [Audio + Text]

By Paul Ducklin — October 20th 2022 at 18:54
The coolest video game ever! And lots of solid cybersecurity advice - listen now!

pic-1200

☐ ☆ ✇ Naked Security

Fashion brand SHEIN fined $1.9m for lying about data breach

By Naked Security writer — October 17th 2022 at 18:50
Is "pay a small fine and keep on trading" a sufficient penalty for letting a breach happen, impeding an investigation, and hiding the truth?

☐ ☆ ✇ Naked Security

Former Uber CSO convicted of covering up megabreach back in 2016

By Naked Security writer — October 6th 2022 at 01:04
Obstructed FTC proceedings, and concealed a crime, said the jury.

☐ ☆ ✇ Naked Security

Optus breach – Aussie telco told it will have to pay to replace IDs

By Paul Ducklin — September 28th 2022 at 13:55
Licence compromised? Passport number burned? Need a new one? Who's going to pay?

☐ ☆ ✇ Naked Security

Morgan Stanley fined millions for selling off devices full of customer PII

By Paul Ducklin — September 23rd 2022 at 18:07
Critical data on old disks always seems inaccessible if you really need it. But when you DON''T want it back, guess what happens...

☐ ☆ ✇ Naked Security

S3 Ep101: Uber and LastPass breaches – is 2FA all it’s cracked up to be? [Audio + Text]

By Paul Ducklin — September 22nd 2022 at 18:42
Latest episode - listen now! Learn why adopting 2FA isn't a reason to relax your other security precautions...

❌