FreshRSS

🔒
△ 🔃
☐ ☆ ✇ Naked Security

“Snakes in airplane mode” – what if your phone says it’s offline but isn’t?

By Paul Ducklin — August 21st 2023 at 17:45
WYSIWYG is short for "what you see is what you get". Except when it isn't...

☐ ☆ ✇ Naked Security

SEC demands four-day disclosure limit for cybersecurity breaches

By Paul Ducklin — July 31st 2023 at 18:57
When is a ransomware attack a reportable matter? And how long have you got to decide?

☐ ☆ ✇ Naked Security

S3 Ep145: Bugs With Impressive Names!

By Paul Ducklin — July 27th 2023 at 18:47
Fascinating fun (with a serious and educational side) - listen now! Full transcript available inside.

☐ ☆ ✇ Naked Security

Zenbleed: How the quest for CPU performance could put your passwords at risk

By Paul Ducklin — July 26th 2023 at 19:01
You need to turn on a special setting to stop (the code you wrote to stop [the code you wrote to improve performance] from reducing performance) from reducing security.

☐ ☆ ✇ Naked Security

Apple ships that recent “Rapid Response” spyware patch to everyone, fixes a second zero-day

By Paul Ducklin — July 24th 2023 at 23:18
Another month, another patch for in-the-wild iPhone malware (and a whole lot more).

☐ ☆ ✇ Naked Security

Microsoft hit by Storm season – a tale of two semi-zero days

By Paul Ducklin — July 18th 2023 at 20:59
The first compromise didn't get the crooks as far as they wanted, so they found a second one that did...

☐ ☆ ✇ Naked Security

Microsoft patches four zero-days, finally takes action against crimeware kernel drivers

By Paul Ducklin — July 12th 2023 at 18:57
Here's a brief reminder to do two things. The first is to patch. The second is to read up why it's a good idea to patch...

☐ ☆ ✇ Naked Security

Apple silently pulls its latest zero-day update – what now?

By Paul Ducklin — July 11th 2023 at 15:21
Previously, we said "do it today", but now we're forced back on: "Do not delay; do it as soon as Apple and your device will let you."

☐ ☆ ✇ Naked Security

Ghostscript bug could allow rogue documents to run system commands

By Paul Ducklin — July 4th 2023 at 17:57
Even if you've never heard of the venerable Ghostscript project, you may have it installed without knowing.

☐ ☆ ✇ Naked Security

S3 Ep141: What was Steve Jobs’s first job?

By Paul Ducklin — June 29th 2023 at 16:58
Latest episode - listen now! (Full transcript inside.)

☐ ☆ ✇ Naked Security

Aussie PM says, “Shut down your phone every 24 hours for 5 mins” – but that’s not enough on its own

By Paul Ducklin — June 23rd 2023 at 16:10
Don't treat rebooting your phone once a day as a cybersecurity talisman... here are 8 additional tips for better mobile phone security.

☐ ☆ ✇ Naked Security

MOVEit mayhem 3: “Disable HTTP and HTTPS traffic immediately”

By Paul Ducklin — June 15th 2023 at 22:10
Twice more unto the breach... third patch tested and released, shut down web access until you've applied it

mi-1200

☐ ☆ ✇ Naked Security

Chrome and Edge zero-day: “This exploit is in the wild”, so check your versions now

By Paul Ducklin — June 6th 2023 at 18:28
Chrome and Edge 0-days patched.

☐ ☆ ✇ Naked Security

PyPI open-source code repository deals with manic malware maelstrom

By Paul Ducklin — May 23rd 2023 at 18:45
Controlled outage used to keep malware marauders from gumming up the works. Learn what you can do to help in future...

☐ ☆ ✇ Naked Security

Apple’s secret is out: 3 zero-days fixed, so be sure to patch now!

By Paul Ducklin — May 19th 2023 at 01:02
All Apple users have zero-days that need patching, though some have more zero-days than others.

☐ ☆ ✇ Naked Security

Zut alors! Raclage crapuleux! Clearview AI in 20% more trouble in France

By Paul Ducklin — May 15th 2023 at 16:36
We asked you once, we told you twice, now we're ordering you for the third time...

☐ ☆ ✇ Naked Security

Apple delivers first-ever Rapid Security Response “cyberattack” patch – leaves some users confused

By Paul Ducklin — May 1st 2023 at 20:46
Just when we'd got used to three-numbered versions, such as "13.3.1", here comes an update suffix, bringing you "13.3.1 (a)"...

☐ ☆ ✇ Naked Security

Google leaking 2FA secrets – researchers advise against new “account sync” feature for now

By Paul Ducklin — April 26th 2023 at 17:59
You waited 13 years for this feature in Google Authenticator. Now researchers are advising you to wait a while longer, just in case...

☐ ☆ ✇ Naked Security

Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security

By Paul Ducklin — April 18th 2023 at 16:56
Did the sentence fit the crime? Read the backstory, and then have your say in our comments! (You may post anonymously.)

☐ ☆ ✇ Naked Security

Attention gamers! Motherboard maker MSI admits to breach, issues “rogue firmware” alert

By Paul Ducklin — April 11th 2023 at 18:58
Stealing private keys is like getting hold of a medieval monarch's personal signet ring... you get to put an official seal on treasonous material.

☐ ☆ ✇ Naked Security

Apple issues emergency patches for spyware-style 0-day exploits – update now!

By Paul Ducklin — April 8th 2023 at 01:20
A bug to hack your browser, then a bug to pwn the kernel... reported from the wild by Amnesty International.

☐ ☆ ✇ Naked Security

Hack and enter! The “secure” garage doors that anyone can open from anywhere – what you need to know

By Paul Ducklin — April 5th 2023 at 18:49
Grab a message/Play it back/You've just performed/A big phat hack...

☐ ☆ ✇ Naked Security

Supply chain blunder puts 3CX telephone app users at risk

By Paul Ducklin — March 30th 2023 at 20:36
Booby-trapped app, apparently signed and shipped by 3CX itself after its source code repository was broken into.

☐ ☆ ✇ Naked Security

Apple patches everything, including a zero-day fix for iOS 15 users

By Paul Ducklin — March 28th 2023 at 00:23
Got an older iPhone that can't run iOS 16? You've got a zero-day to deal with! That super-cool Studio Display monitor needs patching, too.

☐ ☆ ✇ Naked Security

In Memoriam – Gordon Moore, who put the more in “Moore’s Law”

By Paul Ducklin — March 27th 2023 at 00:05
His prediction was called a "Law", though it was an exhortation to engineering excellence as much it was an estimate.

gm-rip-1200

☐ ☆ ✇ Naked Security

S3 Ep124: When so-called security apps go rogue [Audio + Text]

By Paul Ducklin — March 2nd 2023 at 19:40
Rogue software packages. Rogue "sysadmins". Rogue keyloggers. Rogue authenticators. Rogue ROGUES!

s3-ep124-auth--1200

☐ ☆ ✇ Naked Security

Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!

By Paul Ducklin — February 27th 2023 at 02:10
Even in Apple's and Google's "walled gardens", there are plenty of 2FA apps that are either dangerously incompetent, or unrepentantly malicious. (Or perhaps both.)

☐ ☆ ✇ Naked Security

Twitter tells users: Pay up if you want to keep using insecure 2FA

By Paul Ducklin — February 20th 2023 at 17:58
Ironically, Twitter Blue users will be allowed to keep using the very 2FA process that's not considered secure enough for everyone else.

☐ ☆ ✇ Naked Security

Finnish psychotherapy extortion suspect arrested in France

By Naked Security writer — February 6th 2023 at 19:13
Company transcribed ultra-personal conversations, didn't secure them. Criminal stole them, then extorted thousands of vulnerable patients.

☐ ☆ ✇ Naked Security

S3 Ep120: When dud crypto simply won’t let go [Audio + Text]

By Paul Ducklin — February 2nd 2023 at 17:50
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Serious Security: The Samba logon bug caused by outdated crypto

By Paul Ducklin — January 30th 2023 at 19:59
Enjoy our Serious Security deep dive into this real-world example of why cryptographic agility is important!

☐ ☆ ✇ Naked Security

Dutch suspect locked up for alleged personal data megathefts

By Paul Ducklin — January 26th 2023 at 22:02
Undercover Austrian "controlled data buy" leads to Amsterdam arrest and ongoing investigation. Suspect is said to steal and sell all sorts of data, including medical records.

☐ ☆ ✇ Naked Security

Serious Security: Unravelling the LifeLock “hacked passwords” story

By Paul Ducklin — January 17th 2023 at 17:59
Four straight-talking tips to improve your online security, whether you're a LifeLock customer or not.

☐ ☆ ✇ Naked Security

Popular JWT cloud security library patches “remote” code execution hole

By Paul Ducklin — January 10th 2023 at 19:59
It's remotely triggerable, but attackers would already have pretty deep network access if they could "prime" your server for compromise.

☐ ☆ ✇ Naked Security

PyTorch: Machine Learning toolkit pwned from Christmas to New Year

By Paul Ducklin — January 1st 2023 at 21:36
The bad news: the crooks have your SSH private keys. The good news: only users of the "nightly" build were affected.

☐ ☆ ✇ Naked Security

US passes the Quantum Computing Cybersecurity Preparedness Act – and why not?

By Paul Ducklin — December 29th 2022 at 20:45
Cryptographic agility: the ability and the willingness to change quickly when needed.

sc-daa-1200

☐ ☆ ✇ Naked Security

Twitter data of “+400 million unique users” up for sale – what to do?

By Paul Ducklin — December 28th 2022 at 19:59
If the crooks have connected up your phone number and your Twitter handle... what could go wrong?

☐ ☆ ✇ Naked Security

S3 Ep114: Preventing cyberthreats – stop them before they stop you! [Audio + Text]

By Paul Ducklin — December 22nd 2022 at 19:56
Join world-renowned expert Fraser Howard, Director of Research at SophosLabs, for this fascinating episode on how to fight cybercrime.

☐ ☆ ✇ Naked Security

“Suspicious login” scammers up their game – take care at Christmas

By Paul Ducklin — December 21st 2022 at 17:59
A picture is worth 1024 words - we clicked through so you don't have to.

☐ ☆ ✇ Naked Security

OneCoin scammer Sebastian Greenwood pleads guilty, “Cryptoqueen” still missing

By Paul Ducklin — December 19th 2022 at 19:50
The Cryptoqueen herself is still missing, but her co-conspirator, who is said to have pocketed over $20m a month, has been convicted.

☐ ☆ ✇ Naked Security

S3 Ep113: Pwning the Windows kernel – the crooks who hoodwinked Microsoft [Audio + Text]

By Paul Ducklin — December 15th 2022 at 17:10
Return o' the rookit, super-sneaky wireless spyware, credit card skimming, and patches galore. Listen and learn!

☐ ☆ ✇ Naked Security

COVID-bit: the wireless spyware trick with an unfortunate name

By Paul Ducklin — December 13th 2022 at 19:58
It's not the switching that's the problem, it's the switching of the switching!

ind-1200

☐ ☆ ✇ Naked Security

Credit card skimming – the long and winding road of supply chain failure

By Paul Ducklin — December 8th 2022 at 19:58
Don't keep calling home to a JavaScript server that closed its doors eight years ago!

☐ ☆ ✇ Naked Security

Apple pushes out iOS security update that’s more tight-lipped than ever

By Paul Ducklin — December 2nd 2022 at 21:02
We grabbed the update, based on no information at all, just in case we came across a reason to advise you not to. So far, so good...

☐ ☆ ✇ Naked Security

Silk Road drugs market hacker pleads guilty, faces 20 years inside

By Paul Ducklin — November 8th 2022 at 19:58
Jurisprudence isn't like arithmetic... two negatives never make a positive!

☐ ☆ ✇ Naked Security

Twitter Blue Badge email scams – Don’t fall for them!

By Naked Security writer — November 4th 2022 at 17:59
That was the week that was...

☐ ☆ ✇ Naked Security

S3 Ep107: Eight months to kick out the crooks and you think that’s GOOD? [Audio + Text]

By Paul Ducklin — November 3rd 2022 at 17:51
Listen now - latest episode - audio plus full transcript

☐ ☆ ✇ Naked Security

Psychotherapy extortion suspect: arrest warrant issued

By Paul Ducklin — October 31st 2022 at 19:59
Wanted! Not only the extortionist who abused the data, but also the CEO who let it happen.

☐ ☆ ✇ Naked Security

Updates to Apple’s zero-day update story – iPhone and iPad users read this!

By Paul Ducklin — October 28th 2022 at 18:04
Turns out that Tuesday's zero-day for iOS 16 is Friday's zero-day for iOS 15...

☐ ☆ ✇ Naked Security

Clearview AI image-scraping face recognition service hit with €20m fine in France

By Paul Ducklin — October 26th 2022 at 00:50
"We told you to stop but you ignored us," said the French regulator, "so now we're coming after you again."

☐ ☆ ✇ Naked Security

Apple megaupdate: Ventura out, iOS and iPad kernel zero-day – act now!

By Paul Ducklin — October 25th 2022 at 18:03
Ventura hits the market with 112 patches, Catalina's gone missing, and iPhones and iPads get a critical kernel-level zero-day patch...

☐ ☆ ✇ Naked Security

Serious Security: How randomly (or not) can you shuffle cards?

By Paul Ducklin — October 24th 2022 at 18:57
What if you could guess the next card correctly twice as often as you should?

card-fan-1200

☐ ☆ ✇ Naked Security

Dangerous hole in Apache Commons Text – like Log4Shell all over again

By Paul Ducklin — October 18th 2022 at 17:26
Third time unlucky. Time to put your patching boots on again...

act-1200

☐ ☆ ✇ Naked Security

S3 Ep104: Should hospital ransomware attackers be locked up for life? [Audio + Text]

By Paul Ducklin — October 13th 2022 at 16:37
Have your say on three deep questions posed by this week's podcast. Read or listen as suits you best...

☐ ☆ ✇ Naked Security

BEC fraudster and romance scammer sent to prison for 25 years

By Paul Ducklin — October 4th 2022 at 19:12
Two years of scamming + $10 million leeched = 25 years in prison. Just in time for #Cybermonth.

rs-1200

☐ ☆ ✇ Naked Security

Morgan Stanley fined millions for selling off devices full of customer PII

By Paul Ducklin — September 23rd 2022 at 18:07
Critical data on old disks always seems inaccessible if you really need it. But when you DON''T want it back, guess what happens...

☐ ☆ ✇ Naked Security

LastPass source code breach – incident response report released

By Paul Ducklin — September 19th 2022 at 18:59
Wondering how you'd handle a data breach report if the worst happened to you? Here's a useful example.

☐ ☆ ✇ Naked Security

How to deal with dates and times without any timezone tantrums…

By Paul Ducklin — September 9th 2022 at 18:59
Heartfelt encouragement to embrace RFC 3339 - find out why!

☐ ☆ ✇ Naked Security

S3 Ep97: Did your iPhone get pwned? How would you know? [Audio + Text]

By Paul Ducklin — August 25th 2022 at 15:37
Latest episode - listen now! (Or read the transcript if you prefer the text version.)

☐ ☆ ✇ Naked Security

Breaching airgap security: using your phone’s gyroscope as a microphone

By Paul Ducklin — August 24th 2022 at 18:59
One bit per second makes the Voyager probe data rate seem blindingly fast. But it's enough to break your security assumptions...

❌