FreshRSS

🔒
❌ Secure Planet Training Courses Updated For 2019 - Click Here
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayNaked Security

Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads

By: Paul Ducklin
That double-whammy Apple browser-to-kernel spyware bug combo we wrote up last week? Turns out it applies to all supported Macs and iDevices - patch now!

Popular server-side JavaScript security sandbox “vm2” patches remote execution hole

By: Paul Ducklin
The security error was in the error handling system that was supposed to catch potential security errors...

vm2-1200

S3 Ep129: When spyware arrives from someone you trust

By: Paul Ducklin
Scanning tools, supply-chain malware, Wi-Fi hacking, and why there should be TWO World Backup Days... listen now!

Supply chain blunder puts 3CX telephone app users at risk

By: Paul Ducklin
Booby-trapped app, apparently signed and shipped by 3CX itself after its source code repository was broken into.

Apple patches everything, including a zero-day fix for iOS 15 users

By: Paul Ducklin
Got an older iPhone that can't run iOS 16? You've got a zero-day to deal with! That super-cool Studio Display monitor needs patching, too.

In Memoriam – Gordon Moore, who put the more in “Moore’s Law”

By: Paul Ducklin
His prediction was called a "Law", though it was an exhortation to engineering excellence as much it was an estimate.

gm-rip-1200

WooCommerce Payments plugin for WordPress has an admin-level hole – patch now!

By: Paul Ducklin
Admin-level holes in websites are always a bad thing... and for "bad", read "worse" if it's an e-commerce site.

woo-1200

Dangerous Android phone 0-day bugs revealed – patch or work around them now!

By: Paul Ducklin
Despite its usually inflexible 0-day disclosure policy, Google is keeping four mobile modem bugs semi-secret due to likely ease of exploitation.

Firefox 111 patches 11 holes, but not 1 zero-day among them…

By: Paul Ducklin
In the game of cricket, 111 is an inauspicious number, but for Firefox, there doesn't seem to be much to worry about this month.

Serious Security: TPM 2.0 vulns – is your super-secure data at risk?

By: Paul Ducklin
Security bugs in the very code you've been told you must have to improve the security of your computer...

Feds warn about right Royal ransomware rampage that runs the gamut of TTPs

By: Paul Ducklin
Wondering which cybercrime tools, techniques and procedures to focus on? How about any and all of them?

NPM JavaScript packages abused to create scambait links in bulk

By: Paul Ducklin
Free spins? Bonus game points? Cheap social media followers? What harm could it possibly do if you just take a tiny little look?!

Twitter tells users: Pay up if you want to keep using insecure 2FA

By: Paul Ducklin
Ironically, Twitter Blue users will be allowed to keep using the very 2FA process that's not considered secure enough for everyone else.

Apple fixes zero-day spyware implant bug – patch now!

By: Paul Ducklin
Everyone update now! Except for those who don't need to! Or who need to but will only get updates later on, though Apple isn't saying yet!

Reddit admits it was hacked and data stolen, says “Don’t panic”

By: Paul Ducklin
Reddit is suggesting three tips as a follow-up to this breach. We agree with two of them but not with the third...

OpenSSL fixes High Severity data-stealing bug – patch now!

By: Paul Ducklin
7 memory mismanagements and a timing attack. We explain all the jargon bug terminology in plain English...

VMWare user? Worried about “ESXi ransomware”? Check your patches now!

By: Paul Ducklin
To borrow from HHGttG, please DON'T PANIC. But if you are two years out of date with patches, please do ACT NOW!

OpenSSH fixes double-free memory bug that’s pokable over the network

By: Paul Ducklin
It's a bug fix for a bug fix. A memory leak was turned into a double-free that has now been turned into correct code...

Password-stealing “vulnerability” reported in KeePass – bug or feature?

By: Paul Ducklin
Is it a vulnerability if someone with control over your account can mess with files that your account is allowed to access anyway?

Serious Security: The Samba logon bug caused by outdated crypto

By: Paul Ducklin
Enjoy our Serious Security deep dive into this real-world example of why cryptographic agility is important!

Serious Security: How dEliBeRaTe tYpOs might imProVe DNS security

By: Paul Ducklin
It's a really cool and super-simple trick. The question is, "Will it help?"

Popular JWT cloud security library patches “remote” code execution hole

By: Paul Ducklin
It's remotely triggerable, but attackers would already have pretty deep network access if they could "prime" your server for compromise.

CircleCI – code-building service suffers total credential compromise

By: Paul Ducklin
They're saying "rotate secrets"... in plain English, they mean "change your credentials". The company has a tool to help you find them all.

S3 Ep116: Last straw for LastPass? Is crypto doomed? [Audio + Text]

By: Paul Ducklin
Lots of big issues this week: breaches, encryption, supply chains and patching problems. Listen now! (Full transcript inside.)

Twitter data of “+400 million unique users” up for sale – what to do?

By: Paul Ducklin
If the crooks have connected up your phone number and your Twitter handle... what could go wrong?

COVID-bit: the wireless spyware trick with an unfortunate name

By: Paul Ducklin
It's not the switching that's the problem, it's the switching of the switching!

ind-1200

Pwn2Own Toronto: 54 hacks, 63 new bugs, $1 million in bounties

By: Paul Ducklin
That's a mean average of $15,710 per bug... and 63 fewer bugs out there for crooks and rogues to find.

Ping of death! FreeBSD fixes crashtastic bug in network tool

By: Paul Ducklin
It's a venerable program, and this version had a venerable bug in it.

Apple pushes out iOS security update that’s more tight-lipped than ever

By: Paul Ducklin
We grabbed the update, based on no information at all, just in case we came across a reason to advise you not to. So far, so good...

❌