Naked Security
S3 Ep133: Apple takes “tight-lipped” to a whole new level
May 4^th 2023 at 20:59

S3 Ep133: Apple takes “tight-lipped” to a whole new level

By: Paul Ducklin

Entertaining, educational, and all in plain English 🎧📖

World Password Day: 2 + 2 = 4

By: Paul Ducklin

We've kept it short and simple, with no sermons, no judgmentalism, no tubthumping... and no BUY NOW buttons. Have a nice day!

Naked Security
Tracked by hidden tags? Apple and Google unite to propose safety and security standards…
May 3^rd 2023 at 19:58

Tracked by hidden tags? Apple and Google unite to propose safety and security standards…

By: Paul Ducklin

To bleat, or not to bleat, that is the question.

🏷️ My labels
- ❌
Article tags
May 3^rd 2023 at 19:58

Naked Security
Apple delivers first-ever Rapid Security Response “cyberattack” patch – leaves some users confused
May 1^st 2023 at 20:46

Apple delivers first-ever Rapid Security Response “cyberattack” patch – leaves some users confused

By: Paul Ducklin

Just when we'd got used to three-numbered versions, such as "13.3.1", here comes an update suffix, bringing you "13.3.1 (a)"...

Naked Security
Mac malware-for-hire steals passwords and cryptocoins, sends “crime logs” via Telegram
April 30^th 2023 at 01:23

Mac malware-for-hire steals passwords and cryptocoins, sends “crime logs” via Telegram

By: Paul Ducklin

These malware peddlers are specifically going after Mac users. The hint's in the name: "Atomic macOS Stealer", or AMOS for short.

Naked Security
Google wins court order to force ISPs to filter botnet traffic
April 28^th 2023 at 19:59

Google wins court order to force ISPs to filter botnet traffic

By: Naked Security writer

CryptBot criminals are alleged to have plundered browser passwords, illicitly-snapped screenshots, cryptocurrency account data, and more.

Naked Security
S3 Ep132: Proof-of-concept lets anyone hack at will
April 27^th 2023 at 16:55

S3 Ep132: Proof-of-concept lets anyone hack at will

By: Paul Ducklin

When Doug says, "Happy Remote Code Execution Day, Duck"... it's irony. For the avoidance of all doubt :-)

Naked Security
Google leaking 2FA secrets – researchers advise against new “account sync” feature for now
April 26^th 2023 at 17:59

Google leaking 2FA secrets – researchers advise against new “account sync” feature for now

By: Paul Ducklin

You waited 13 years for this feature in Google Authenticator. Now researchers are advising you to wait a while longer, just in case...

🏷️ My labels
- ❌
Article tags
April 26^th 2023 at 17:59

Naked Security
PaperCut security vulnerabilities under active attack – vendor urges customers to patch
April 25^th 2023 at 17:53

PaperCut security vulnerabilities under active attack – vendor urges customers to patch

By: Paul Ducklin

If you have the product, but you haven't patched - well, the crooks have now landed, so please don't delay. Do it today...

Naked Security
Double zero-day in Chrome and Edge – check your versions now!
April 24^th 2023 at 16:59

Double zero-day in Chrome and Edge – check your versions now!

By: Paul Ducklin

Wouldn't it be handy if there were a single version number to check for in every Chromium-based browser, on every supported platform?

Naked Security
VMware patches break-and-enter hole in logging tools: update now!
April 21^st 2023 at 17:58

VMware patches break-and-enter hole in logging tools: update now!

By: Paul Ducklin

You know jolly well/What we're going to say/And that's "Do not delay/Simply do it today."

🏷️ My labels
- ❌
Article tags
April 21^st 2023 at 17:58

Naked Security
S3 Ep131: Can you really have fun with FORTRAN?
April 20^th 2023 at 17:55

S3 Ep131: Can you really have fun with FORTRAN?

By: Paul Ducklin

Loop-the-loop in this week's episode. Entertaining, educational and all in plain English. Transcript inside.

Naked Security
Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security
April 18^th 2023 at 16:56

Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security

By: Paul Ducklin

Did the sentence fit the crime? Read the backstory, and then have your say in our comments! (You may post anonymously.)

Naked Security
FBI and FCC warn about “Juicejacking” – but just how useful is their advice?
April 17^th 2023 at 14:17

FBI and FCC warn about “Juicejacking” – but just how useful is their advice?

By: Paul Ducklin

USB charging stations - can you trust them? What are the real risks, and how can you keep your data safe on the road?

Naked Security
S3 Ep130: Open the garage bay doors, HAL [Audio + Text]
April 13^th 2023 at 16:54

S3 Ep130: Open the garage bay doors, HAL [Audio + Text]

By: Paul Ducklin

I'm sorry, Dave. I'm afraid I can't... errr, no, hang on a minute, I can do that easily! Worldwide! Right now!

Naked Security
Patch Tuesday: Microsoft fixes a zero-day, and two curious bugs that take the Secure out of Secure Boot
April 12^th 2023 at 18:57

Patch Tuesday: Microsoft fixes a zero-day, and two curious bugs that take the Secure out of Secure Boot

By: Paul Ducklin

Is Secure Boot without the Secure just "Boot"?

Naked Security
Attention gamers! Motherboard maker MSI admits to breach, issues “rogue firmware” alert
April 11^th 2023 at 16:58

Attention gamers! Motherboard maker MSI admits to breach, issues “rogue firmware” alert

By: Paul Ducklin

Stealing private keys is like getting hold of a medieval monarch's personal signet ring... you get to put an official seal on treasonous material.

Naked Security
Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads
April 10^th 2023 at 20:20

Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads

By: Paul Ducklin

That double-whammy Apple browser-to-kernel spyware bug combo we wrote up last week? Turns out it applies to all supported Macs and iDevices - patch now!

Naked Security
Popular server-side JavaScript security sandbox “vm2” patches remote execution hole
April 9^th 2023 at 00:28

Popular server-side JavaScript security sandbox “vm2” patches remote execution hole

By: Paul Ducklin

The security error was in the error handling system that was supposed to catch potential security errors...

vm2-1200

🏷️ My labels
- ❌
Article tags
April 9^th 2023 at 00:28

Naked Security
Apple issues emergency patches for spyware-style 0-day exploits – update now!
April 8^th 2023 at 01:20

Apple issues emergency patches for spyware-style 0-day exploits – update now!

By: Paul Ducklin

A bug to hack your browser, then a bug to pwn the kernel... reported from the wild by Amnesty International.

Naked Security
S3 Ep129: When spyware arrives from someone you trust
April 6^th 2023 at 14:57

S3 Ep129: When spyware arrives from someone you trust

By: Paul Ducklin

Scanning tools, supply-chain malware, Wi-Fi hacking, and why there should be TWO World Backup Days... listen now!

Naked Security
Hack and enter! The “secure” garage doors that anyone can open from anywhere – what you need to know
April 5^th 2023 at 18:49

Hack and enter! The “secure” garage doors that anyone can open from anywhere – what you need to know

By: Paul Ducklin

Grab a message/Play it back/You've just performed/A big phat hack...

Naked Security
Einstein tilings – the amazing “Hat” shape that never repeats!
April 4^th 2023 at 16:59

Einstein tilings – the amazing “Hat” shape that never repeats!

By: Paul Ducklin

Imagine tiling a whole football field using a single shape... yet not being able to produce a repeating pattern, even if you wanted to.

🏷️ My labels
- ❌
Article tags
- ❌
- Uncategorized
April 4^th 2023 at 16:59

Naked Security
Researchers claim they can bypass Wi-Fi encryption (briefly, at least)
April 3^rd 2023 at 16:59

Researchers claim they can bypass Wi-Fi encryption (briefly, at least)

By: Paul Ducklin

They can't read much of your data, but even a few stray network packets could tell them something they're not supposed to know.

🏷️ My labels
- ❌
Article tags
April 3^rd 2023 at 16:59

Naked Security
World Backup Day is here again – 5 tips to keep your precious data safe
March 31^st 2023 at 01:14

World Backup Day is here again – 5 tips to keep your precious data safe

By: Paul Ducklin

The only backup you will ever regret is the one you didn't make...

🏷️ My labels
- ❌
Article tags
March 31^st 2023 at 01:14

Naked Security
Supply chain blunder puts 3CX telephone app users at risk
March 30^th 2023 at 17:36

Supply chain blunder puts 3CX telephone app users at risk

By: Paul Ducklin

Booby-trapped app, apparently signed and shipped by 3CX itself after its source code repository was broken into.

🏷️ My labels
- ❌
Article tags
March 30^th 2023 at 17:36

Naked Security
S3 Ep128: So you want to be a cybercriminal? [Audio + Text]
March 30^th 2023 at 14:43

S3 Ep128: So you want to be a cybercriminal? [Audio + Text]

By: Paul Ducklin

Latest episode - listen now!

Naked Security
Cops use fake DDoS services to take aim at wannabe cybercriminals
March 28^th 2023 at 16:58

Cops use fake DDoS services to take aim at wannabe cybercriminals

By: Naked Security writer

Thinking of trying a bit of DDoSsing to get a feel for life at the fringes of the Dark Side? Don't do it!

🏷️ My labels
- ❌
Article tags
March 28^th 2023 at 16:58

Naked Security
Apple patches everything, including a zero-day fix for iOS 15 users
March 28^th 2023 at 00:23

Apple patches everything, including a zero-day fix for iOS 15 users

By: Paul Ducklin

Got an older iPhone that can't run iOS 16? You've got a zero-day to deal with! That super-cool Studio Display monitor needs patching, too.

Naked Security
Microsoft assigns CVE to Snipping Tool bug, pushes patch to Store
March 27^th 2023 at 16:59

Microsoft assigns CVE to Snipping Tool bug, pushes patch to Store

By: Paul Ducklin

Microsoft says "successful exploitation requires uncommon user interaction", but it's the innocent and accidental leakage of private data you should be concerned about.

Naked Security
In Memoriam – Gordon Moore, who put the more in “Moore’s Law”
March 27^th 2023 at 00:05

In Memoriam – Gordon Moore, who put the more in “Moore’s Law”

By: Paul Ducklin

His prediction was called a "Law", though it was an exhortation to engineering excellence as much it was an estimate.

gm-rip-1200

Naked Security
WooCommerce Payments plugin for WordPress has an admin-level hole – patch now!
March 24^th 2023 at 17:48

WooCommerce Payments plugin for WordPress has an admin-level hole – patch now!

By: Paul Ducklin

Admin-level holes in websites are always a bad thing... and for "bad", read "worse" if it's an e-commerce site.

woo-1200

Naked Security
S3 Ep127: When you chop someone out of a photo, but there they are anyway…
March 23^rd 2023 at 17:59

S3 Ep127: When you chop someone out of a photo, but there they are anyway…

By: Paul Ducklin

Listen now - latest episode. Full transcript inside.

Naked Security
Windows 11 also vulnerable to “aCropalypse” image data leakage
March 22^nd 2023 at 17:59

Windows 11 also vulnerable to “aCropalypse” image data leakage

By: Paul Ducklin

Turns out that the Windows 11 Snipping Tool has the same "aCropalypse" data leakage bug as Pixel phones. Here's how to work around the problem...

Naked Security
Google Pixel phones had a serious data leakage bug – here’s what to do!
March 21^st 2023 at 17:58

Google Pixel phones had a serious data leakage bug – here’s what to do!

By: Paul Ducklin

What if the "safe" images you shared after carefully cropping them... had some or all of the "unsafe" pixels left behind anyway?

Naked Security
Bitcoin ATM customers hacked by video upload that was actually an app
March 20^th 2023 at 17:50

Bitcoin ATM customers hacked by video upload that was actually an app

By: Paul Ducklin

As the misquote goes, "Once is misfortune..." This is the second time, and you know what Lady Bracknell had to say about that...

Naked Security
Dangerous Android phone 0-day bugs revealed – patch or work around them now!
March 17^th 2023 at 17:56

Dangerous Android phone 0-day bugs revealed – patch or work around them now!

By: Paul Ducklin

Despite its usually inflexible 0-day disclosure policy, Google is keeping four mobile modem bugs semi-secret due to likely ease of exploitation.

Naked Security
S3 Ep 126: The price of fast fashion (and feature creep) [Audio + Text]
March 16^th 2023 at 17:56

S3 Ep 126: The price of fast fashion (and feature creep) [Audio + Text]

By: Paul Ducklin

Worried about rogue apps? Unsure about the new Outlook zero-day? Clear advice in plain English... just like old times, with Duck and Chet!

Naked Security
Microsoft fixes two 0-days on Patch Tuesday – update now!
March 15^th 2023 at 00:06

Microsoft fixes two 0-days on Patch Tuesday – update now!

By: Paul Ducklin

An email you haven't even looked at yet could be used to trick Outlook into helping crooks to logon as you.

Naked Security
Firefox 111 patches 11 holes, but not 1 zero-day among them…
March 14^th 2023 at 17:16

Firefox 111 patches 11 holes, but not 1 zero-day among them…

By: Paul Ducklin

In the game of cricket, 111 is an inauspicious number, but for Firefox, there doesn't seem to be much to worry about this month.

Naked Security
Linux gets double-quick double-update to fix kernel Oops!
March 13^th 2023 at 17:59

Linux gets double-quick double-update to fix kernel Oops!

By: Paul Ducklin

Linux doesn't BSoD. It has oopses and panics instead. (We show you how to make a kernel module to explore further.)

🏷️ My labels
- ❌
Article tags
- ❌
- BSOD
- Linux
- oops
- panic
March 13^th 2023 at 17:59

Naked Security
SHEIN shopping app goes rogue, grabs price and URL data from your clipboard
March 10^th 2023 at 17:58

SHEIN shopping app goes rogue, grabs price and URL data from your clipboard

By: Paul Ducklin

It's not exactly data theft, but it's worryingly close to "unintentional treachery" - apparently because it's great for marketing purposes

🏷️ My labels
- ❌
Article tags
March 10^th 2023 at 17:58

Naked Security
S3 Ep125: When security hardware has security holes [Audio + Text]
March 9^th 2023 at 18:58

S3 Ep125: When security hardware has security holes [Audio + Text]

By: Paul Ducklin

Lastest episode - listen now! (Full transcript inside.)

Naked Security
Serious Security: TPM 2.0 vulns – is your super-secure data at risk?
March 7^th 2023 at 17:59

Serious Security: TPM 2.0 vulns – is your super-secure data at risk?

By: Paul Ducklin

Security bugs in the very code you've been told you must have to improve the security of your computer...

Naked Security
DoppelPaymer ransomware supsects arrested in Germany and Ukraine
March 6^th 2023 at 16:16

DoppelPaymer ransomware supsects arrested in Germany and Ukraine

By: Naked Security writer

Devices seized, suspects interrogated and arrested, allegedly connected to devastating cyberattack on University Hospital in Düsseldorf.

Naked Security
Feds warn about right Royal ransomware rampage that runs the gamut of TTPs
March 3^rd 2023 at 17:56

Feds warn about right Royal ransomware rampage that runs the gamut of TTPs

By: Paul Ducklin

Wondering which cybercrime tools, techniques and procedures to focus on? How about any and all of them?

Naked Security
S3 Ep124: When so-called security apps go rogue [Audio + Text]
March 2^nd 2023 at 15:40

S3 Ep124: When so-called security apps go rogue [Audio + Text]

By: Paul Ducklin

Rogue software packages. Rogue "sysadmins". Rogue keyloggers. Rogue authenticators. Rogue ROGUES!

s3-ep124-auth--1200

Naked Security
LastPass: Keylogger on home PC led to cracked corporate password vault
February 28^th 2023 at 02:23

LastPass: Keylogger on home PC led to cracked corporate password vault

By: Paul Ducklin

Seems the crooks implanted a keylogger via a vulnerable media app (LastPass politely didn't say which one!) on a developer's home computer.

🏷️ My labels
- ❌
Article tags
February 28^th 2023 at 02:23

Naked Security
Dutch police arrest three cyberextortion suspects who allegedly earned millions
February 27^th 2023 at 17:33

Dutch police arrest three cyberextortion suspects who allegedly earned millions

By: Naked Security writer

Ever paid hush money to crooks who broke into your network? Wondered how much you can trust them?

Naked Security
Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!
February 27^th 2023 at 02:10

Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!

By: Paul Ducklin

Even in Apple's and Google's "walled gardens", there are plenty of 2FA apps that are either dangerously incompetent, or unrepentantly malicious. (Or perhaps both.)