S3 Ep105: WONTFIX! The MS Office cryptofail that “isn’t a security flaw” [Audio + Text]

The coolest video game ever! And lots of solid cybersecurity advice - listen now!

Women in Cryptology – USPS celebrates WW2 codebreakers

What did you do in the war, Mom? Oh, y'know, a bit of this and that...

Zoom for Mac patches sneaky “spy-on-me” bug – update now!

Hey! That back door isn't supposed to be there at all, let alone propped open...

Dangerous hole in Apache Commons Text – like Log4Shell all over again

Third time unlucky. Time to put your patching boots on again...

Fashion brand SHEIN fined $1.9m for lying about data breach

Is "pay a small fine and keep on trading" a sufficient penalty for letting a breach happen, impeding an investigation, and hiding the truth?

Serious Security: Microsoft Office 365 attacked over feeble encryption

How 2022 is your encryption?

S3 Ep104: Should hospital ransomware attackers be locked up for life? [Audio + Text]

Have your say on three deep questions posed by this week's podcast. Read or listen as suits you best...

Patch Tuesday in brief – one 0-day fixed, but no patches for Exchange!

There's a zero-day patch, but it's not for the zero-day you thought.

Move over Patch Tuesday – it’s Ada Lovelace Day!

Hacking on actual computers is one thing, but hacking purposefully on imaginary computers is, these days, something we can only imagine.

Mystery iPhone update patches against iOS 16 mail crash-attack

The problem with crashy messaging apps is that *other people* get to choose if and when to send you messages...

Serious Security: OAuth 2 and why Microsoft is finally forcing you into it

Microsoft calls it "Modern Auth", though it's a decade old, and is finally forcing Exchange Online customers to switch to it.

WhatsApp goes after Chinese password scammers via US court

If you can't beat 'em, sue 'em!

S3 Ep103: Scammers in the Slammer (and other stories) [Audio + Text]

Latest episode - listen and learn now (or read and revise, if the written word is your thing)...

Former Uber CSO convicted of covering up megabreach back in 2016

Obstructed FTC proceedings, and concealed a crime, said the jury.

NetWalker ransomware affiliate sentenced to 20 years by Florida court

Judge tells the accused that if he hadn't pleaded guilty, "I would have given you life."

BEC fraudster and romance scammer sent to prison for 25 years

Two years of scamming + $10 million leeched = 25 years in prison. Just in time for #Cybermonth.

Scammers and rogue callers – can anything ever stop them?

Some thoughts for Cybersecurity Awareness Month: Is is worth reporting nuisance calls? Is it even worth reporting outright scams?

S3 Ep102.5: “ProxyNotShell” Exchange bugs – an expert speaks [Audio + Text]

Who's affected, what you can do while waiting for Microsoft's patches, and how to plan your threat hunting...

URGENT! Microsoft Exchange double zero-day – “like ProxyShell, only different”

Double-play 0-day in Exchange - what you need to know, and what you can do

S3 Ep102: How to avoid a data breach [Audio + Transcript]

Latest episode - listen now! Tell fact from fiction in hyped-up cybersecurity news...

Optus breach – Aussie telco told it will have to pay to replace IDs

Licence compromised? Passport number burned? Need a new one? Who's going to pay?

WhatsApp “zero-day exploit” news scare – what you need to know

Is WhatsApp currently under active attack by cybercriminals? Is this a clear and current danger? How worried should WhatsApp users be?

Uber and Rockstar – has a LAPSUS$ linchpin just been busted (again)?

Is this the same suspect as before? Is he part of LAPSUS$? Is this the man who hacked Uber and Rockstar? And, if so, who else?

Morgan Stanley fined millions for selling off devices full of customer PII

Critical data on old disks always seems inaccessible if you really need it. But when you DON''T want it back, guess what happens...

S3 Ep101: Uber and LastPass breaches – is 2FA all it’s cracked up to be? [Audio + Text]

Latest episode - listen now! Learn why adopting 2FA isn't a reason to relax your other security precautions...

Interested in cybersecurity? Join us for Security SOS Week 2022!

Four one-on-one interviews with experts who are passionate about sharing their expertise with the community.

LastPass source code breach – incident response report released

Wondering how you'd handle a data breach report if the worst happened to you? Here's a useful example.

S3 Ep100.5: Uber breach – an expert speaks [Audio + Text]

Chester Wisniewski on what we can learn from Uber: "Just because a big company didn't have the security they should doesn't mean you can't."

UBER HAS BEEN HACKED, boasts hacker – how to stop it happening to you

Uber is all over the news for a widely-publicised data breach. We help you answer the question, "How do I stop this happening to me?"

S3 Ep100: Browser-in-the-Browser – how to spot an attack [Audio + Text]

Latest episode - listen now! Cosmic rockets, zero-days, spotting cybercrooks, and unlocking the DEADBOLT...

Serious Security: Browser-in-the-browser attacks – watch out for windows that aren’t!

Simple but super-sneaky - use a picture of a browser, and convince people it's real...

Apple patches zero-day holes – even in the brand new iOS 16

Five updates, one upgrade, plus two zero-days. Patch your Macs, iPhones and iPads as soon as you can (again)...

How to deal with dates and times without any timezone tantrums…

Heartfelt encouragement to embrace RFC 3339 - find out why!

S3 Ep99: TikTok “attack” – was there a data breach, or not? [Audio + Text]

Latest episode - listen now! (Or read if you prefer - full transcript inside.)

DEADBOLT ransomware rears its head again, attacks QNAP devices

NAS devices make it easy for anyone to add high-capacity file servers to their network. Guess why cybercrooks love NAS devices too...

Chrome and Edge fix zero-day security hole – update now!

This time, the crooks got there first - only 1 security hole patched, but it's a zero-day.

Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43

This site, like millions of others, has a certificate from Let's Encrypt. Farewell, Peter Eckersley, PhD, who helped make it all possible.

S3 Ep98: The LastPass saga – should we stop using password managers? [Audio + Text]

Latest episode - listen now!

URGENT! Apple slips out zero-day update for older iPhones and iPads

Patch as soon as you can - that recent WebKit zero-day affecting new iPhones and iPads is apparently being used against older models, too.

Chrome patches 24 security holes, enables “Sanitizer” safety system

24 existing bugs fixed. And, we hope, numerous potential future bugs prevented.

JavaScript bugs aplenty in Node.js ecosystem – found automatically

How to get the better of bugs in all the possible packages in your supply chain?

LastPass source code breach – do we still recommend password managers?

What does the recent LastPass breach mean for password managers? Just a bump in the road, or a reason to ditch them entirely?

Firefox 104 is out – no critical bugs, but update anyway

Two trust-spoofing bugs were the main culprits this month - but neither one was a zero-day.

S3 Ep97: Did your iPhone get pwned? How would you know? [Audio + Text]

Latest episode - listen now! (Or read the transcript if you prefer the text version.)

Breaching airgap security: using your phone’s gyroscope as a microphone

One bit per second makes the Voyager probe data rate seem blindingly fast. But it's enough to break your security assumptions...

Bitcoin ATMs leeched by attackers who created fake admin accounts

The criminals didn't implant any malware. The attack was orchestrated via malevolent configuration changes.

Laptop denial-of-service via music: the 1980s R&B song with a CVE!

We haven't validated this vuln ourselves... but the source of the story is impeccable. (Impeccably dressed, at least.)

S3 Ep96: Zoom 0-day, AEPIC leak, Conti reward, healthcare security [Audio + Text]

Latest episode - listen now (or read if you prefer!)

Apple patches double zero-day in browser and kernel – update now!

Double 0-day exploits - one in WebKit (to break in) and the other in the kernel (to take over). Patch now!

Chrome browser gets 11 security fixes with 1 zero-day – update now!

Don't delay - patch today.

US offers reward “up to $10 million” for information about the Conti gang

Wanted - Reward Offered - Five unknown individuals (plus a man with a weird hat)

Zoom for Mac patches critical bug – update now!

There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...

S3 Ep95: Slack leak, Github onslaught, and post-quantum crypto [Audio + Text]

Latest episode - listen now! (Or read the transcript if you prefer.)

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

If you've ever written code that left stuff lying around in memory when you didn't need it any more... we bet you've regretted it!

Slack admits to leaking hashed passwords for five years

"When those invitations went out... somehow, your password hash went out with them."

Traffic Light Protocol for cybersecurity responders gets a revamp

Traffic lights make a handy global metaphor for denoting the sensitivity of cybersecurity threat data - three colours that everyone knows.

S3 Ep94: This sort of crypto (graphy), and the other sort of crypto (currency!) [Audio + Text]

Latest episode - listen now! (Or read if that's what you prefer.)

GitHub blighted by “researcher” who created thousands of malicious projects

If you spew projects laced with hidden malware into an open source repository, don't waste your time telling us "no harm done" afterwards.

Post-quantum cryptography – new algorithm “gone in 60 minutes”

And THIS is why you don't knit your own home-made encryption algorithms and hope no one looks at them.

Cryptocoin “token swapper” Nomad loses $200 million in coding blunder

Transactions were only approved, it seems, if they were initiated by... errrrr, by anyone.