FreshRSS

🔒
△ 🔃
☐ ☆ ✇ Naked Security

S3 Ep144: When threat hunting goes down a rabbit hole

By Paul Ducklin — July 20th 2023 at 14:58
Latest episode - check it out now!

☐ ☆ ✇ Naked Security

Google Virus Total leaks list of spooky email addresses

By Paul Ducklin — July 18th 2023 at 23:16
Careful with that file, Eugene!

☐ ☆ ✇ Naked Security

Microsoft hit by Storm season – a tale of two semi-zero days

By Paul Ducklin — July 18th 2023 at 20:59
The first compromise didn't get the crooks as far as they wanted, so they found a second one that did...

☐ ☆ ✇ Naked Security

Zimbra Collaboration Suite warning: Patch this 0-day right now (by hand)!

By Paul Ducklin — July 14th 2023 at 19:58
Zimbra didn't actually say, "Do not delay/Do it today," but they did say, "We kindly request your cooperation to apply the fix manually."

☐ ☆ ✇ Naked Security

S3 Ep143: Supercookie surveillance shenanigans

By Paul Ducklin — July 13th 2023 at 16:48
Latest episode - listen now! (Full transcript inside.)

☐ ☆ ✇ Naked Security

Microsoft patches four zero-days, finally takes action against crimeware kernel drivers

By Paul Ducklin — July 12th 2023 at 18:57
Here's a brief reminder to do two things. The first is to patch. The second is to read up why it's a good idea to patch...

☐ ☆ ✇ Naked Security

Apple silently pulls its latest zero-day update – what now?

By Paul Ducklin — July 11th 2023 at 15:21
Previously, we said "do it today", but now we're forced back on: "Do not delay; do it as soon as Apple and your device will let you."

☐ ☆ ✇ Naked Security

Urgent! Apple fixes critical zero-day hole in iPhones, iPads and Macs

By Paul Ducklin — July 10th 2023 at 23:12
Don't delay, do it today. This is a code-implantation bug in WebKit that attackers already know how to exploit.

☐ ☆ ✇ Naked Security

Serious Security: Rowhammer returns to gaslight your computer

By Paul Ducklin — July 10th 2023 at 21:22
Gaslights produce a telltale flicker when nearby lamps are lit; DRAM values do something similar when nearby memory cells are accessed.

☐ ☆ ✇ Naked Security

S3 Ep142: Putting the X in X-Ops

By Paul Ducklin — July 6th 2023 at 19:58
How to get all your corporate "Ops" teams working together, with cybersecurity correctness as a guiding light.

s3-ep100-js-1200

☐ ☆ ✇ Naked Security

Firefox 115 is out, says farewell to users of older Windows and Mac versions

By Paul Ducklin — July 5th 2023 at 18:58
No zero-days this month, so you're patching to stay ahead, not merely to catch up!

☐ ☆ ✇ Naked Security

Ghostscript bug could allow rogue documents to run system commands

By Paul Ducklin — July 4th 2023 at 17:57
Even if you've never heard of the venerable Ghostscript project, you may have it installed without knowing.

☐ ☆ ✇ Naked Security

WordPress plugin lets users become admins – Patch early, patch often!

By Paul Ducklin — July 3rd 2023 at 16:48
Ultimate Member plugin lets rogue users choose their own site capabilities, including becoming admins.

☐ ☆ ✇ Naked Security

S3 Ep141: What was Steve Jobs’s first job?

By Paul Ducklin — June 29th 2023 at 16:58
Latest episode - listen now! (Full transcript inside.)

☐ ☆ ✇ Naked Security

Interested in $10,000,000? Ready to turn in the Clop ransomware crew?

By Naked Security writer — June 28th 2023 at 18:59
Technically, it's "up to $10 million", but it's potentially a LOT of money, nevertheless...

☐ ☆ ✇ Naked Security

UK hacker busted in Spain gets 5 years over Twitter hack and more

By Naked Security writer — June 26th 2023 at 18:35
Not just that infamous Twitter hack, but SIM-swapping, stalking and swatting too...

☐ ☆ ✇ Naked Security

Aussie PM says, “Shut down your phone every 24 hours for 5 mins” – but that’s not enough on its own

By Paul Ducklin — June 23rd 2023 at 16:10
Don't treat rebooting your phone once a day as a cybersecurity talisman... here are 8 additional tips for better mobile phone security.

☐ ☆ ✇ Naked Security

S3 Ep140: So you think you know ransomware?

By Paul Ducklin — June 22nd 2023 at 16:48
Lots to learn this week - listen now! (Full transcript inside.)

☐ ☆ ✇ Naked Security

Apple patch fixes zero-day kernel hole reported by Kaspersky – update now!

By Paul Ducklin — June 22nd 2023 at 00:36
Apple didn't use the words "Triangulation Trojan", but you probably will.

☐ ☆ ✇ Naked Security

Beware bad passwords as attackers co-opt Linux servers into cybercrime

By Paul Ducklin — June 21st 2023 at 19:50
Did you prevent password-only logins on your SSH servers? On ALL of them? Are you sure about that?

☐ ☆ ✇ Naked Security

“The Ransomware Documentary” – brand new video series from Sophos starting now!

By Sally Adam — June 21st 2023 at 18:00
Get the full 360-degree view of ransomware

Ransomware Documentary Graphic Theme_780x480 NS

☐ ☆ ✇ Naked Security

ASUS warns router customers: Patch now, or block all inbound requests

By Paul Ducklin — June 20th 2023 at 18:14
"Do as we say, not as we do!" - The patches took ages to come out, but don't let that lure you into taking ages to install them.

☐ ☆ ✇ Naked Security

Megaupload duo will go to prison at last, but Kim Dotcom fights on…

By Paul Ducklin — June 19th 2023 at 18:59
One, sadly, has died, and two are heading to prison, but for Kim Dotcom, the saga goes on...

☐ ☆ ✇ Naked Security

MOVEit mayhem 3: “Disable HTTP and HTTPS traffic immediately”

By Paul Ducklin — June 15th 2023 at 22:10
Twice more unto the breach... third patch tested and released, shut down web access until you've applied it

mi-1200

☐ ☆ ✇ Naked Security

S3 Ep139: Are password rules like running through rain?

By Paul Ducklin — June 15th 2023 at 18:43
Latest episode - listen now! (Full transcript inside.)

☐ ☆ ✇ Naked Security

Patch Tuesday fixes 4 critical RCE bugs, and a bunch of Office holes

By Paul Ducklin — June 13th 2023 at 23:32
No zero-days this month, if you ignore the Edge RCE hole patched last week

☐ ☆ ✇ Naked Security

Gozi banking malware “IT chief” finally jailed after more than 10 years

By Paul Ducklin — June 13th 2023 at 18:43
Gozi threesome from way back in the late 2000s and early 2010s now all charged, convicted and sentenced. The DOJ got there in the end...

☐ ☆ ✇ Naked Security

History revisited: US DOJ unseals Mt. Gox cybercrime charges

By Naked Security writer — June 12th 2023 at 16:58
Though the mills of the Law grind slowly/Yet they grind exceeding small/Though with patience they stand waiting/With exactness grind they all...

☐ ☆ ✇ Naked Security

More MOVEit mitigations: new patches published for further protection

By Paul Ducklin — June 9th 2023 at 21:54
Good news... more patches, this time available proactively

☐ ☆ ✇ Naked Security

Thoughts on scheduled password changes (don’t call them rotations!)

By Paul Ducklin — June 9th 2023 at 18:58
Does swapping your password regularly make it a better password?

☐ ☆ ✇ Naked Security

S3 Ep138: I like to MOVEit, MOVEit

By Paul Ducklin — June 8th 2023 at 16:56
Backdoors, exploits, and Little Bobby Tables. Listen now! (Full transcript available...)

s3-ep138-1200

☐ ☆ ✇ Naked Security

Firefox 114 is out: No 0-days, but one fascinating “teachable moment” bug

By Paul Ducklin — June 7th 2023 at 19:59
With the right (or wrong, if you're on the right side of the fence) timing...

☐ ☆ ✇ Naked Security

Chrome and Edge zero-day: “This exploit is in the wild”, so check your versions now

By Paul Ducklin — June 6th 2023 at 18:28
Chrome and Edge 0-days patched.

☐ ☆ ✇ Naked Security

MOVEit zero-day exploit used by data breach gangs: The how, the why, and what to do…

By Paul Ducklin — June 5th 2023 at 19:59
Little Bobby Tables is back!

mi-1200

☐ ☆ ✇ Naked Security

Researchers claim Windows “backdoor” affects hundreds of Gigabyte motherboards

By Paul Ducklin — June 2nd 2023 at 18:56
It's a backdoor, Jim, but not as we know it... here's a sober look at this issue.

☐ ☆ ✇ Naked Security

S3 Ep137: 16th century crypto skullduggery

By Paul Ducklin — June 1st 2023 at 16:45
Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

s3-ep137-feat-1200

☐ ☆ ✇ Naked Security

Serious Security: That KeePass “master password crack”, and what we can learn from it

By Paul Ducklin — May 31st 2023 at 19:39
Here, in an admittedly discursive nutshell, is the fascinating story of CVE-2023-32784. (Short version: Don't panic.)

☐ ☆ ✇ Naked Security

Serious Security: Verification is vital – examining an OAUTH login bug

By Paul Ducklin — May 30th 2023 at 16:59
What good is a popup asking for your approval if an attacker can bypass it simply by suppressing it?

☐ ☆ ✇ Naked Security

S3 Ep136: Navigating a manic malware maelstrom

By Paul Ducklin — May 25th 2023 at 16:50
Latest episode - listen now. Full transcript inside...

☐ ☆ ✇ Naked Security

Ransomware tales: The MitM attack that really had a Man in the Middle

By Paul Ducklin — May 24th 2023 at 17:59
Another traitorous sysadmin story, this one busted by system logs that gave his game away...

☐ ☆ ✇ Naked Security

PyPI open-source code repository deals with manic malware maelstrom

By Paul Ducklin — May 23rd 2023 at 18:45
Controlled outage used to keep malware marauders from gumming up the works. Learn what you can do to help in future...

☐ ☆ ✇ Naked Security

Phone scamming kingpin gets 13 years for running “iSpoof” service

By Naked Security writer — May 22nd 2023 at 16:58
Site marketing video promised total anonymity, but that was a lie. 170 arrested already. Potentially 1000s more to follow.

ispoof-1200

☐ ☆ ✇ Naked Security

Apple’s secret is out: 3 zero-days fixed, so be sure to patch now!

By Paul Ducklin — May 19th 2023 at 01:02
All Apple users have zero-days that need patching, though some have more zero-days than others.

☐ ☆ ✇ Naked Security

S3 Ep135: Sysadmin by day, extortionist by night

By Paul Ducklin — May 18th 2023 at 18:48
Laugh (sufficiently), learn (efficiently), and then let us know what you think in our comments (anonymously, if you wish)...

☐ ☆ ✇ Naked Security

US offers $10m bounty for Russian ransomware suspect outed in indictment

By Naked Security writer — May 17th 2023 at 18:40
"Up to $10 million for information that leads to the arrest and/or conviction of this defendant."

☐ ☆ ✇ Naked Security

Belkin Wemo Smart Plug V2 – the buffer overflow that won’t be patched

By Paul Ducklin — May 16th 2023 at 17:59
Yes, it's a buffer overflow bug. No, it's not going get fixed.

☐ ☆ ✇ Naked Security

Zut alors! Raclage crapuleux! Clearview AI in 20% more trouble in France

By Paul Ducklin — May 15th 2023 at 16:36
We asked you once, we told you twice, now we're ordering you for the third time...

☐ ☆ ✇ Naked Security

Whodunnit? Cybercrook gets 6 years for ransoming his own employer

By Naked Security writer — May 12th 2023 at 16:15
Not just an active adversary, but a two-faced one, too.

☐ ☆ ✇ Naked Security

S3 Ep134: It’s a PRIVATE key – the hint is in the name!

By Paul Ducklin — May 11th 2023 at 14:54
Latest episode - listen now! (Full transcript inside.)

☐ ☆ ✇ Naked Security

Bootkit zero-day fix – is this Microsoft’s most cautious patch ever?

By Paul Ducklin — May 10th 2023 at 11:50
When blocking buggy bootup modules, you have to be really careful not to lock your keys inside the car...

☐ ☆ ✇ Naked Security

Low-level motherboard security keys leaked in MSI breach, claim researchers

By Paul Ducklin — May 9th 2023 at 16:58
What can you do if someone steals your keys but you can't change the lock? We explain the dilemma in plain English.

☐ ☆ ✇ Naked Security

PHP Packagist supply chain poisoned by hacker “looking for a job”

By Paul Ducklin — May 5th 2023 at 16:59
I pwned you! Gizza job! You know it makes sense!

☐ ☆ ✇ Naked Security

S3 Ep133: Apple takes “tight-lipped” to a whole new level

By Paul Ducklin — May 4th 2023 at 20:59
Entertaining, educational, and all in plain English 🎧📖

☐ ☆ ✇ Naked Security

World Password Day: 2 + 2 = 4

By Paul Ducklin — May 4th 2023 at 13:12
We've kept it short and simple, with no sermons, no judgmentalism, no tubthumping... and no BUY NOW buttons. Have a nice day!

☐ ☆ ✇ Naked Security

Tracked by hidden tags? Apple and Google unite to propose safety and security standards…

By Paul Ducklin — May 3rd 2023 at 19:58
To bleat, or not to bleat, that is the question.

☐ ☆ ✇ Naked Security

Apple delivers first-ever Rapid Security Response “cyberattack” patch – leaves some users confused

By Paul Ducklin — May 1st 2023 at 20:46
Just when we'd got used to three-numbered versions, such as "13.3.1", here comes an update suffix, bringing you "13.3.1 (a)"...

☐ ☆ ✇ Naked Security

Mac malware-for-hire steals passwords and cryptocoins, sends “crime logs” via Telegram

By Paul Ducklin — April 30th 2023 at 01:23
These malware peddlers are specifically going after Mac users. The hint's in the name: "Atomic macOS Stealer", or AMOS for short.

☐ ☆ ✇ Naked Security

Google wins court order to force ISPs to filter botnet traffic

By Naked Security writer — April 28th 2023 at 19:59
CryptBot criminals are alleged to have plundered browser passwords, illicitly-snapped screenshots, cryptocurrency account data, and more.

☐ ☆ ✇ Naked Security

S3 Ep132: Proof-of-concept lets anyone hack at will

By Paul Ducklin — April 27th 2023 at 16:55
When Doug says, "Happy Remote Code Execution Day, Duck"... it's irony. For the avoidance of all doubt :-)

☐ ☆ ✇ Naked Security

Google leaking 2FA secrets – researchers advise against new “account sync” feature for now

By Paul Ducklin — April 26th 2023 at 17:59
You waited 13 years for this feature in Google Authenticator. Now researchers are advising you to wait a while longer, just in case...

❌