FreshRSS

🔒
❌ Secure Planet Training Courses Updated For 2019 - Click Here
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

WooCommerce Payments plugin for WordPress has an admin-level hole – patch now!

By: Paul Ducklin
Admin-level holes in websites are always a bad thing... and for "bad", read "worse" if it's an e-commerce site.

woo-1200

Windows 11 also vulnerable to “aCropalypse” image data leakage

By: Paul Ducklin
Turns out that the Windows 11 Snipping Tool has the same "aCropalypse" data leakage bug as Pixel phones. Here's how to work around the problem...

Google Pixel phones had a serious data leakage bug – here’s what to do!

By: Paul Ducklin
What if the "safe" images you shared after carefully cropping them... had some or all of the "unsafe" pixels left behind anyway?

Bitcoin ATM customers hacked by video upload that was actually an app

By: Paul Ducklin
As the misquote goes, "Once is misfortune..." This is the second time, and you know what Lady Bracknell had to say about that...

Dangerous Android phone 0-day bugs revealed – patch or work around them now!

By: Paul Ducklin
Despite its usually inflexible 0-day disclosure policy, Google is keeping four mobile modem bugs semi-secret due to likely ease of exploitation.

Firefox 111 patches 11 holes, but not 1 zero-day among them…

By: Paul Ducklin
In the game of cricket, 111 is an inauspicious number, but for Firefox, there doesn't seem to be much to worry about this month.

Linux gets double-quick double-update to fix kernel Oops!

By: Paul Ducklin
Linux doesn't BSoD. It has oopses and panics instead. (We show you how to make a kernel module to explore further.)

SHEIN shopping app goes rogue, grabs price and URL data from your clipboard

By: Paul Ducklin
It's not exactly data theft, but it's worryingly close to "unintentional treachery" - apparently because it's great for marketing purposes

Serious Security: TPM 2.0 vulns – is your super-secure data at risk?

By: Paul Ducklin
Security bugs in the very code you've been told you must have to improve the security of your computer...

DoppelPaymer ransomware supsects arrested in Germany and Ukraine

By: Naked Security writer
Devices seized, suspects interrogated and arrested, allegedly connected to devastating cyberattack on University Hospital in Düsseldorf.

Feds warn about right Royal ransomware rampage that runs the gamut of TTPs

By: Paul Ducklin
Wondering which cybercrime tools, techniques and procedures to focus on? How about any and all of them?

LastPass: Keylogger on home PC led to cracked corporate password vault

By: Paul Ducklin
Seems the crooks implanted a keylogger via a vulnerable media app (LastPass politely didn't say which one!) on a developer's home computer.

Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!

By: Paul Ducklin
Even in Apple's and Google's "walled gardens", there are plenty of 2FA apps that are either dangerously incompetent, or unrepentantly malicious. (Or perhaps both.)

NPM JavaScript packages abused to create scambait links in bulk

By: Paul Ducklin
Free spins? Bonus game points? Cheap social media followers? What harm could it possibly do if you just take a tiny little look?!

Coinbase breached by social engineers, employee data stolen

By: Paul Ducklin
Another day, another "sophisticated" attack. This time, the company has handily included some useful advice along with its mea culpa...

Twitter tells users: Pay up if you want to keep using insecure 2FA

By: Paul Ducklin
Ironically, Twitter Blue users will be allowed to keep using the very 2FA process that's not considered secure enough for everyone else.

GoDaddy admits: Crooks hit us with malware, poisoned customer websites

By: Paul Ducklin
New report admits that attackers were detected in the network about three months ago, and may have been attacking for about three years.

Microsoft Patch Tuesday: 36 RCE bugs, 3 zero-days, 75 CVEs

By: Paul Ducklin
Lots of lovely patches for your Valentine's Day delight. Get 'em as soon as you can...

Apple fixes zero-day spyware implant bug – patch now!

By: Paul Ducklin
Everyone update now! Except for those who don't need to! Or who need to but will only get updates later on, though Apple isn't saying yet!

Reddit admits it was hacked and data stolen, says “Don’t panic”

By: Paul Ducklin
Reddit is suggesting three tips as a follow-up to this breach. We agree with two of them but not with the third...

OpenSSL fixes High Severity data-stealing bug – patch now!

By: Paul Ducklin
7 memory mismanagements and a timing attack. We explain all the jargon bug terminology in plain English...

VMWare user? Worried about “ESXi ransomware”? Check your patches now!

By: Paul Ducklin
To borrow from HHGttG, please DON'T PANIC. But if you are two years out of date with patches, please do ACT NOW!

Tracers in the Dark: The Global Hunt for the Crime Lords of Crypto

By: Paul Ducklin
Hear renowned cybersecurity author Andy Greenberg's thoughtful commentary about the "war on crypto" as we talk to him about his new book...

Finnish psychotherapy extortion suspect arrested in France

By: Naked Security writer
Company transcribed ultra-personal conversations, didn't secure them. Criminal stole them, then extorted thousands of vulnerable patients.

OpenSSH fixes double-free memory bug that’s pokable over the network

By: Paul Ducklin
It's a bug fix for a bug fix. A memory leak was turned into a double-free that has now been turned into correct code...

Password-stealing “vulnerability” reported in KeePass – bug or feature?

By: Paul Ducklin
Is it a vulnerability if someone with control over your account can mess with files that your account is allowed to access anyway?

Serious Security: The Samba logon bug caused by outdated crypto

By: Paul Ducklin
Enjoy our Serious Security deep dive into this real-world example of why cryptographic agility is important!

Hive ransomware servers shut down at last, says FBI

By: Naked Security writer
Unfortunately, you've probably already heard the cliche that "cybercrime abhors a vacuum"...

Dutch suspect locked up for alleged personal data megathefts

By: Paul Ducklin
Undercover Austrian "controlled data buy" leads to Amsterdam arrest and ongoing investigation. Suspect is said to steal and sell all sorts of data, including medical records.

GoTo admits: Customer cloud backups stolen together with decryption key

By: Paul Ducklin
We were going to write, "Once more unto the breach, dear friends, once more"... but it seems to go without saying these days.

Serious Security: How dEliBeRaTe tYpOs might imProVe DNS security

By: Paul Ducklin
It's a really cool and super-simple trick. The question is, "Will it help?"

Serious Security: Unravelling the LifeLock “hacked passwords” story

By: Paul Ducklin
Four straight-talking tips to improve your online security, whether you're a LifeLock customer or not.

Popular JWT cloud security library patches “remote” code execution hole

By: Paul Ducklin
It's remotely triggerable, but attackers would already have pretty deep network access if they could "prime" your server for compromise.

CircleCI – code-building service suffers total credential compromise

By: Paul Ducklin
They're saying "rotate secrets"... in plain English, they mean "change your credentials". The company has a tool to help you find them all.

RSA crypto cracked? Or perhaps not!

By: Paul Ducklin
Stand down from blue alert, it seems... but why not plan your cryptographic agility anyway?

S3 Ep116: Last straw for LastPass? Is crypto doomed? [Audio + Text]

By: Paul Ducklin
Lots of big issues this week: breaches, encryption, supply chains and patching problems. Listen now! (Full transcript inside.)

Inside a scammers’ lair: Ukraine busts 40 in fake bank call-centre raid

By: Naked Security writer
When someone calls you up to warn you that your bank account is under attack - it's true, because THAT VERY PERSON is the one attacking you!

❌