FreshRSS

πŸ”’
❌ Secure Planet Training Courses Updated For 2019 - Click Here
There are new available articles, click to refresh the page.
Before yesterdayThe Register - Security

So the FBI 'persistently' abused its snoop powers. What's to worry about?

When is warrantless surveillance warranted?

Register Kettle If there's one thing that's more all the rage these days than this AI hype, it's warrantless spying by the Feds.…

Facial recog system used by Met Police shows racial bias at low thresholds

Tech used at King's Coronation employs higher thresholds on once-only watch-lists, Met tells MPs

The UK Parliament has heard that a facial recognition system used by the Metropolitan police during the King’s Coronation can exhibit racial bias at certain thresholds.…

Five Eyes and Microsoft accuse China of attacking US infrastructure again

Defeating Volt Typhoon will be hard, because the attacks look like legit Windows admin activity

China has attacked critical infrastructure organizations in the US using a "living off the land" attack that hides offensive action among everyday Windows admin activity.…

This legit Android app turned into mic-snooping malware – and Google missed it

File-stealing nasty in my Play store? Preposterous!!1

Google Play has been caught with its cybersecurity pants down yet again after a once-legit Android screen-and-audio recorder app was updated to include malicious code that listened in on device microphones.…

Philly Inquirer says Cuba ransomware gang's data leak claims are fake news

Now that's a Rocky relationship

The Philadelphia Inquirer has punched back at the Cuba ransomware gang after the criminals leaked what they said were files stolen from the newspaper.…

IT security analyst admits hijacking cyber attack to pocket ransom payments

Ashley Liles altered blackmail emails in bid to make off with Β£300,000 in Bitcoin

A former IT security analyst at Oxford Biomedica has admitted, five years after the fact, to turning to the dark side – by hijacking a cyber attack against his own company in an attempt to divert any ransom payments to himself.…

US bans North Korean outsourcer and its feisty freelancers

They do your work – usually from Russia and China – then send their wages home to pay for missiles

When businesses go shopping for IT services, North Korea-controlled companies probably struggle to make it into many lists.…

Apria Healthcare says potentially 2M people caught up in IT security breach

Took two years to tell us 'small number of emails' accessed

Personal and financial data describing almost 1.9 million Apria Healthcare patients and employees may have been accessed by crooks who breached the company's networks over a series of months in 2019 and 2021.…

Dish confirms 300,000 people's data was exposed in February's attack

But don't worry – we know it was deleted. Hmm. How would you know that?

Dish Network has admitted that a February cybersecurity incident and associated multi-day outage led to the extraction of data on nearly 300,000 people, while also appearing to indirectly admit it may have paid cybercriminals to delete said data.…

TikTok to let Oracle view source code, algorithm, and content moderation

It's all in the name of national security as Trump-era collab continues in Project Texas

TikTok, the social video platform used by around 150 million people in the US, is set to hand access to its source code, algorithm and content moderation material to Oracle in a bid to allay data protection and national security concerns stateside.…

Ads for lucrative jobs in Asia fail to mention chance of slavery as crypto-scammer

FBI warns jobseekers to be very skeptical of working holidays in Cambodia

The FBI has issued a warning about fake job ads that recruit workers into forced labor operations in Southeast Asia – some of which enslave visitors and force them to participate in cryptocurrency scams.…

China hasn't told Micron why it failed security review, or what its ban means

US memory-maker forecasts single-digit revenue impact, and ongoing gloom in PC and smartmobe markets

US memory-maker Micron has no idea why Chinese authorities have decided its products represent a security risk, or which customers it's not allowed to sell to.…

Uncle Sam strangles criminals' cashflow by reining in money mules

Tech support scammer among those targeted by recent crackdowns

Uncle Sam announced its commenced over 4,000 legal actions in three months β€” mostly harshly worded letters β€” to rein in "money mules" involved in romance scams, business email compromise, and other fraudulent schemes.…

Google settles location tracking lawsuit for only $39.9M

Also, more OEM Android malware, Google's bug reports (mostly) ditch CVEs, and this week's critical vulns

in brief Google has settled another location tracking lawsuit, yet again being fined a relative pittance.…

More UK councils caught by Capita's open AWS bucket blunder

As for March megabreach? M&S and Guinness maker Diageo warn pension members about data risks

The bad news train keeps rolling for Capita, with more local British councils surfacing to say their data was put on the line by an unsecured AWS bucket, and, separately, pension clients warning of possible data theft in March's mega breach.…

Fighting the five

Hear SANS cyber security experts share advice on how to defend your organization against the latest threats

Sponsored Post Cyber criminals never stop learning so nor should you. Fresh security hacks are being concocted and deployed every week, so it's a good idea for cyber security professionals to pool their knowledge when working out how best to defend against them.…

Rigorous dev courageously lied about exec's NSFW printouts – and survived long enough to quit with dignity

Log files don't lie and in this case one nasty incident spoke to a far deeper malaise

Who, Me? Wait? What? Is it Monday already? Not to fear, gentle readerfolk, for Uncle Reg is here with another instalment of Who, Me? – tales of readers having a much worse day than you. Enjoy the schadenfreude.…

Teen in court after '$600K swiped from DraftKings gamblers'

Bet he didn't expect these computer hacking charges

An 18-year-old Wisconsin man has been charged with allegedly playing a central role in the theft of $600,000 from DraftKings customer accounts.…

Russian IT guy sent to labor camp for DDoSing Kremlin websites

Pro-Ukraine techie gets hard time

A Russian IT worker accused of participating in pro-Ukraine denial of service attacks against Russian government websites has been sentenced to three years in a penal colony and ordered to pay 800,000 rubles (about $10,000). …

UK's GDPR replacement could wipe out oversight of live facial recognition

Question not whether UK police should use facial recog, but how, says surveillance chief

Biometrics and surveillance camera commissioner Professor Fraser Sampson has warned that independent oversight of facial recognition is at risk just as the policing minister plans to "embed" it into the force.…

Apple warns of three WebKit vulns under active exploitation, dozens more CVEs across its range

High school student and Amnesty International named among bug-finders

Apple has issued a bushel of security updates and warned that three of the flaws it's fixed are under active attack.…

Cisco squashes critical bugs in small biz switches

You'll want to patch these as proof-of-concept exploit code is out there already

Cisco rolled out patches for four critical security vulnerabilities in several of its network switches for small businesses that can be exploited to remotely hijack the equipment.…

Microsoft decides it will be the one to choose which secure login method you use

Certificate-based authentication comes first and phones last

Microsoft wants to take the decision of which multi-factor authentication (MFA) method to use out of the users' hands and into its own.…

Six million patients' data feared stolen from PharMerica

Cue the inevitable class action lawsuit

PharMerica, one of the largest pharmacy service providers in the US, has revealed its IT systems were breached – and it's feared the intruders stole personal and healthcare data belonging to more than 5.8 million past customers…

'Strictly limit' remote desktop – unless you like catching BianLian ransomware

Do it or don't. We're not cops. But the FBI are, and they have this to say

The FBI and friends have warned organizations to "strictly limit the use of RDP and other remote desktop services" to avoid BianLian infections and the ransomware gang's extortion attempts that follow the data encryption.…

Another security calamity for Capita: An unsecured AWS bucket

Colchester City Council says it and others caught up in new incident, reckons benefits data of local citizens exposed

Capita is facing criticism about its security hygiene on a new front after an Amazon cloud bucket containing benefits data on residents in a south east England city council was left exposed to the public web.…

Don't panic. Google offering scary .zip and .mov domains is not the end of the world

Did we forget about .pl, .sh and oh yeah, .com ?

Comment In early May, Google Domains added support for eight new top-level domains, two of which – .zip, and .mov – raised the hackles of the security community.…

Upstart encryption app walks back privacy claims, pulls from stores after probe

Try not leaving a database full of user info, chats, keys exposed, eh?

A new-ish messaging service that claimed to put privacy first has pulled its end-to-end encryption claims from its website and its app from both the Apple and Google software stores after being called out online.…

Ransomware-as-a-service groups rain money on their affiliates

Qilin gang crims can earn up to 85 percent of extortion cash, or jail

Business is very good for affiliates of the Qilin ransomware-as-a-service (RaaS) group, which is very bad for the rest of us.…

Feds offer $10m reward for info on alleged Russian ransomware crim

Infecting cops' computers is one way to put a target on your back

The Feds have sanctioned a Russian national accused of using LockBit, Babuk, and Hive ransomware to extort a law enforcement agency and nonprofit healthcare organization in New Jersey, and the Metropolitan Police Department in Washington DC, among "numerous" other victim organizations in the US and globally.…

US Dept of Transport security breach exposes info on a quarter-million people

Not the first time Uncle Sam has had the wheels come off its IT systems

A US Department of Transportation computer system used to reimburse federal government employees for commuting costs somehow suffered a security breach that exposed the personal info for 237,000 current and former workers.…

Compliance automation to confound cyber criminals

How you can streamline the auditing process while improving compliance and security

Sponsored Post Eminent US businessman Norman Ralph Augustine - who served as United States Under Secretary of the Army, as well as chairman and CEO of the Lockheed Martin Corporation - pointed to the importance of audit and compliance when he famously commented: "Two-thirds of the Earth's surface is covered with water. The other third is covered with auditors from headquarters."…

Cops crack gang that used bots to book and resell immigration appointments

Keeping files that mention 'robot rental' may not have been the best way to cover their tracks

Police have arrested 69 people alleged to have used bots to book up nearly all of Spain's available appointments with immigration officials, and then sold those meeting slots for between €30 and €200 ($33 to $218) to aspiring migrants.…

FTC sues VoIP provider over 'billions of illegal robocalls'

XCast knew it was breaking the law and didn't hold back, watchdog says

A VoIP provider was at the heart of billions of robocalls made over the past five years that broke a slew of US regulations, from enabling telemarketing scams to calling numbers on the National Do Not Call Registry, it is claimed.…

Intel says Friday's mystery 'security update' microcode isn't really a security update

We're all for encouraging people to squash bugs but this is an odd way to do it

False alarm: despite a patch notes suggesting otherwise, that mysterious blob of microcode released for many Intel microprocessors last week was not a security update, the x86 giant says.…

Extra! Extra! Don’t quite read all about it: Cyber attack hits Philadelphia Inquirer

Breaking news, literally

A cyber "incident" stopped The Philadelphia Inquirer's presses over the weekend, halting the Sunday edition's print edition and shutting down the newspaper's offices to staff until at least Tuesday.…

Some potential: How bad software updates could over-volt, brick remote servers

PMFault – from the eggheads who brought you Plundervolt and Voltpillager

Video Presenting at Black Hat Asia 2023, two infosec researchers detailed how remote updates can be exploited to modify voltage on a Supermicro motherboard and remotely brick machines.…

No more macros? No problem, say miscreants, we'll adapt

Microsoft blocking 'net scripts sparked 'monumental shift' in attacks

Microsoft's decision to block internet-sourced macros by default last year is forcing attackers to find new and creative ways to compromise systems and deliver malware, according to threat researchers at Proofpoint.…

An important system on project [REDACTED] was all [REDACTED] up

Luckily, [REDACTED] was there to save the day

Who Me? Welcome once again to the horrors of Monday, dear reader. But fear not – The Register is here to cushion the blow of the working week's resumption with a instalment of Who, Me?, our reader-contributed stories of tech gone awry.…

Ransomware corrupts data, so backups can be faster and cheaper than paying up

Smash and grab raids don’t leave time for careful encryption

Ransomware actors aim to spend the shortest amount of time possible inside your systems, and that means the encryption they employ is shoddy and often corrupts your data. That in turn means restoration after paying ransoms is often a more expensive chore than just deciding not to pay and working from our own backups.…

Arm acknowledges side-channel attack but denies Cortex-M is crocked

Spectre-esque exploit figures out when interesting info might be in memory

Black Hat Asia Arm issued a statement last Friday declaring that a successful side attack on its TrustZone-enabled Cortex-M based systems was "not a failure of the protection offered by the architecture."…

Toyota's bungling of customer privacy is becoming a pattern

Also: 3D printing gun mods = jail time; France fines Clearview AI for ignoring fine; this week's critical vulns, and more

in brief Japanese automaker Toyota has admitted yet again to mishandling customer data – this time saying it exposed information on more than two million Japanese customers for the past decade, thanks to a misconfigured cloud environment. …

'Top three Balkans drug kingpins' arrested after cops crack their Sky ECC chats

Maybe try carrier pigeons instead

European police arrested three people in Belgrade described as "the biggest" drug lords in the Balkans in what cops are chalking up to another win in dismantling Sky ECC's encrypted messaging app last year.…

Why Microsoft just patched a patch that squashed an under-attack Outlook bug

Let's take a quick dive into Windows API

Microsoft in March fixed an interesting security hole in Outlook that was exploited by miscreants to leak victims' Windows credentials. This week the IT giant fixed that fix as part of its monthly Patch Tuesday update.…

Ex-Ubiquiti dev jailed for 6 years after stealing internal corp data, extorting bosses

Momentary lapse in VPN led to stretch in the cooler, $1.6m bill

Nickolas Sharp has been sentenced to six years in prison and ordered to pay almost $1.6 million to his now-former employer Ubiquiti – after stealing gigabytes of corporate data from the biz and then trying to extort almost $2 million from his bosses while posing as an anonymous hacker.…

Britain's largest private pension scheme reveals scale of Capita break-in

USS says burgled biz reckons data on 470,000 'active, deferred and retired' members may have been accessed

Universities Superannuation Scheme, the UK’s largest private pension provider, says Capita has warned that details of almost half a million members were held on servers accessed during the recent breach.…

Activists gatecrash Capita's AGM to protest GPS tracking contract

Outsourcer asked to take 'principled stance'

We hear Privacy International and a few other campaign groups set up camp outside Capita's AGM in London yesterday protesting Capita's involvement as an outsourcer in a UK government GPS tracking contract.…

UK cops score legal win in EncroChat snooping op

But tribunal punts on whether data was intercepted in transit

The UK's National Crime Agency has partially won an important legal battle in a case that challenged the warrants used to obtain messages from cyber crook hangout EncroChat.…

India to send official whassup to WhatsApp after massive spamstorm

In a weird way, we can blame this on AI being a better bet than blockchain

India's IT minister Rajeev Chandrasekhar will ask WhatsApp to explain what's up, after the Meta-owned messaging service experienced a dramatic increase in spam calls.…

Let white-hat hackers stick a probe in those voting machines, say senators

HAVA go at breaking electronic ballot box security

US voting machines would undergo deeper examination for computer security holes under proposed bipartisan legislation.…

Millions of mobile phones come pre-infected with malware, say researchers

The threat is coming from inside the supply chain

Black Hat Asia Miscreants have infected millions of Androids worldwide with malicious firmware before the devices even shipped from their factories, according to Trend Micro researchers at Black Hat Asia.…

ENISA leans into EU-based clouds with draft cybersecurity label

Time for AWS and pals to start thinking about JVs?

Cloud services providers that aren't based in Europe β€”Β like the Big Three β€” may have to team up with a cloud that is operated and maintained from the EU if they want ENISA's stamp of approval for handling sensitive data.…

Sonatype axes 14 percent of staff, reminds them not to talk to the press

Workers slam 'horrendous' handling of layoffs that left even 'engineering managers in the dark'

Exclusive Software supply chain management biz Sonatype has laid off 14 percent of its global workforce, according to internal documents seen by The Register.…

Twitter adds new DM features, and Musk claims encryption is here, starting today

We'll believe our DMs are secure when someone provides proof, thanks

Updated Twitter has rolled out some quality of life updates for direct messages on the platform, and CEO Elon Musk reckons the site is to start encrypting DMs, beginning today, without providing proof that's the case.…

What should protection for your 365 data really look like?

Don't let the cyber-criminals spread through your enterprise

Sponsored Microsoft 365 has worked its way into so many facets of our organizations that it can be hard to imagine what life would be like without it.…

23-year-old Brit linked to 2020 Twitter attack and SIM-swap scheme pleads guilty

Admits to cyberstalking, wire fraud charges as Feds take $700k off him

A 23-year-old British citizen has confessed to "multiple schemes" involving computer crimes, including playing a part in the July 2020 Twitter attack that saw the accounts of Amazon CEO Jeff Bezos, Kanye West, and former President Barack Obama hijacked by an unidentified crew.…

Capita looking at a bill of Β£20M over breach clean-up costs

Analyst says expense 'no small drop in ocean' but reputational damage could be 'far greater'

Britain's leaky outsourcing behemoth Capita is warning investors that the clean-up bill for its recent digital break-in will cost up to Β£20 million ($25.24 million).…

Japan's ubiquitous convenience stores now serving up privacy breaches

Fujitsu in the frame for foul up with government document dispersal app

Japan's minister for digital transformation and digital reform, Taro Kono, has apologized after a government app breached citizens' privacy.…

Two Microsoft Windows bugs under attack, one in Secure Boot with a manual fix

On the plus side, this month's update batch is a bit smaller than usual

Patch Tuesday May's Patch Tuesday brings some good and some bad news, and if you're a glass-half-full type, you'd lead off with Microsoft's relatively low number of security fixes: a mere 38.…

FBI-led Op Medusa slays NATO-bothering Russian military malware network

Perseus to the rescue as Snake eats itself

The FBI has cut off a network of Kremlin-controlled computers used to spread the Snake malware which, according to the Feds, has been used by Russia's FSB to steal sensitive documents from NATO members for almost two decades.…

❌