Naked Security
Mom’s Meals issues “Notice of Data Event”: What to know and what to do
August 29^th 2023 at 16:51

Mom’s Meals issues “Notice of Data Event”: What to know and what to do

By: Paul Ducklin

It took six months for notifications to start, and we still don't know exactly what went down... but here's our advice on what to do.

Naked Security
S3 Ep149: How many cryptographers does it take to change a light bulb?
August 24^th 2023 at 18:50

S3 Ep149: How many cryptographers does it take to change a light bulb?

By: Paul Ducklin

Latest episode - listen now! Full transcript inside...

Naked Security
“Snakes in airplane mode” – what if your phone says it’s offline but isn’t?
August 21^st 2023 at 17:45

“Snakes in airplane mode” – what if your phone says it’s offline but isn’t?

By: Paul Ducklin

WYSIWYG is short for "what you see is what you get". Except when it isn't...

Naked Security
“Grab hold and give it a wiggle” – ATM card skimming is still a thing
August 14^th 2023 at 23:18

“Grab hold and give it a wiggle” – ATM card skimming is still a thing

By: Paul Ducklin

The rise of tap-to-pay and chip-and-PIN hasn't rid the world of ATM card skimming criminals...

🏷️ My labels
- ❌
Article tags
August 14^th 2023 at 23:18

Naked Security
S3 Ep147: What if you type in your password during a meeting?
August 10^th 2023 at 13:34

S3 Ep147: What if you type in your password during a meeting?

By: Paul Ducklin

Latest episode - listen now! (Full transcript inside.)

Naked Security
Microsoft Patch Tuesday: 74 CVEs plus 2 “Exploit Detected” advisories
August 9^th 2023 at 18:34

Microsoft Patch Tuesday: 74 CVEs plus 2 “Exploit Detected” advisories

By: Paul Ducklin

74 CVEs, and two "Exploitation Detected" advisories, which are nearly but not quite the same as 0-days. Also, two potential Teams treacheries that you really want to fix.

Naked Security
Serious Security: Why learning to touch-type could protect you from audio snooping
August 8^th 2023 at 18:51

Serious Security: Why learning to touch-type could protect you from audio snooping

By: Paul Ducklin

Fast, quiet, smooth, consistent and low impact... why true hacker-grade touch-typing might keep you more secure.

Naked Security
Performance and security clash yet again in “Collide+Power” attack
August 2^nd 2023 at 23:36

Performance and security clash yet again in “Collide+Power” attack

By: Paul Ducklin

It's a real vulnerability, but the data leakage rate can be as low as... let's just say that an IMAX-quality copy of the new "Oppenheimer" movie could take you 4 billion years to exfiltrate.

Naked Security
SEC demands four-day disclosure limit for cybersecurity breaches
July 31^st 2023 at 16:57

SEC demands four-day disclosure limit for cybersecurity breaches

By: Paul Ducklin

When is a ransomware attack a reportable matter? And how long have you got to decide?

S3 Ep145: Bugs With Impressive Names!

By: Paul Ducklin

Fascinating fun (with a serious and educational side) - listen now! Full transcript available inside.

Naked Security
Zenbleed: How the quest for CPU performance could put your passwords at risk
July 26^th 2023 at 19:01

Zenbleed: How the quest for CPU performance could put your passwords at risk

By: Paul Ducklin

You need to turn on a special setting to stop (the code you wrote to stop [the code you wrote to improve performance] from reducing performance) from reducing security.

Naked Security
S3 Ep144: When threat hunting goes down a rabbit hole
July 20^th 2023 at 14:58

S3 Ep144: When threat hunting goes down a rabbit hole

By: Paul Ducklin

Latest episode - check it out now!

Naked Security
Google Virus Total leaks list of spooky email addresses
July 18^th 2023 at 23:16

Google Virus Total leaks list of spooky email addresses

By: Paul Ducklin

Careful with that file, Eugene!

🏷️ My labels
- ❌
Article tags
July 18^th 2023 at 23:16

Naked Security
Microsoft hit by Storm season – a tale of two semi-zero days
July 18^th 2023 at 16:59

Microsoft hit by Storm season – a tale of two semi-zero days

By: Paul Ducklin

The first compromise didn't get the crooks as far as they wanted, so they found a second one that did...

Naked Security
Zimbra Collaboration Suite warning: Patch this 0-day right now (by hand)!
July 14^th 2023 at 16:58

Zimbra Collaboration Suite warning: Patch this 0-day right now (by hand)!

By: Paul Ducklin

Zimbra didn't actually say, "Do not delay/Do it today," but they did say, "We kindly request your cooperation to apply the fix manually."

Naked Security
S3 Ep143: Supercookie surveillance shenanigans
July 13^th 2023 at 16:48

S3 Ep143: Supercookie surveillance shenanigans

By: Paul Ducklin

Latest episode - listen now! (Full transcript inside.)

Naked Security
Microsoft patches four zero-days, finally takes action against crimeware kernel drivers
July 12^th 2023 at 18:57

Microsoft patches four zero-days, finally takes action against crimeware kernel drivers

By: Paul Ducklin

Here's a brief reminder to do two things. The first is to patch. The second is to read up why it's a good idea to patch...

Naked Security
Apple silently pulls its latest zero-day update – what now?
July 11^th 2023 at 15:21

Apple silently pulls its latest zero-day update – what now?

By: Paul Ducklin

Previously, we said "do it today", but now we're forced back on: "Do not delay; do it as soon as Apple and your device will let you."

Naked Security
Urgent! Apple fixes critical zero-day hole in iPhones, iPads and Macs
July 10^th 2023 at 23:12

Urgent! Apple fixes critical zero-day hole in iPhones, iPads and Macs

By: Paul Ducklin

Don't delay, do it today. This is a code-implantation bug in WebKit that attackers already know how to exploit.

Naked Security
Ghostscript bug could allow rogue documents to run system commands
July 4^th 2023 at 17:57

Ghostscript bug could allow rogue documents to run system commands

By: Paul Ducklin

Even if you've never heard of the venerable Ghostscript project, you may have it installed without knowing.

Naked Security
S3 Ep141: What was Steve Jobs’s first job?
June 29^th 2023 at 16:58

S3 Ep141: What was Steve Jobs’s first job?

By: Paul Ducklin

Latest episode - listen now! (Full transcript inside.)

Naked Security
Interested in $10,000,000? Ready to turn in the Clop ransomware crew?
June 28^th 2023 at 16:59

Interested in $10,000,000? Ready to turn in the Clop ransomware crew?

By: Naked Security writer

Technically, it's "up to $10 million", but it's potentially a LOT of money, nevertheless...

Naked Security
Aussie PM says, “Shut down your phone every 24 hours for 5 mins” – but that’s not enough on its own
June 23^rd 2023 at 16:10

Aussie PM says, “Shut down your phone every 24 hours for 5 mins” – but that’s not enough on its own

By: Paul Ducklin

Don't treat rebooting your phone once a day as a cybersecurity talisman... here are 8 additional tips for better mobile phone security.

Naked Security
Apple patch fixes zero-day kernel hole reported by Kaspersky – update now!
June 22^nd 2023 at 00:36

Apple patch fixes zero-day kernel hole reported by Kaspersky – update now!

By: Paul Ducklin

Apple didn't use the words "Triangulation Trojan", but you probably will.

Naked Security
Beware bad passwords as attackers co-opt Linux servers into cybercrime
June 21^st 2023 at 17:50

Beware bad passwords as attackers co-opt Linux servers into cybercrime

By: Paul Ducklin

Did you prevent password-only logins on your SSH servers? On ALL of them? Are you sure about that?

Naked Security
S3 Ep139: Are password rules like running through rain?
June 15^th 2023 at 16:43

S3 Ep139: Are password rules like running through rain?

By: Paul Ducklin

Latest episode - listen now! (Full transcript inside.)

Naked Security
Patch Tuesday fixes 4 critical RCE bugs, and a bunch of Office holes
June 13^th 2023 at 23:32

Patch Tuesday fixes 4 critical RCE bugs, and a bunch of Office holes

By: Paul Ducklin

No zero-days this month, if you ignore the Edge RCE hole patched last week

Naked Security
Gozi banking malware “IT chief” finally jailed after more than 10 years
June 13^th 2023 at 16:43

Gozi banking malware “IT chief” finally jailed after more than 10 years

By: Paul Ducklin

Gozi threesome from way back in the late 2000s and early 2010s now all charged, convicted and sentenced. The DOJ got there in the end...

Naked Security
More MOVEit mitigations: new patches published for further protection
June 9^th 2023 at 21:54

More MOVEit mitigations: new patches published for further protection

By: Paul Ducklin

Good news... more patches, this time available proactively

S3 Ep138: I like to MOVEit, MOVEit

By: Paul Ducklin

Backdoors, exploits, and Little Bobby Tables. Listen now! (Full transcript available...)

s3-ep138-1200

Naked Security
Chrome and Edge zero-day: “This exploit is in the wild”, so check your versions now
June 6^th 2023 at 18:28

Chrome and Edge zero-day: “This exploit is in the wild”, so check your versions now

By: Paul Ducklin

Chrome and Edge 0-days patched.

Naked Security
MOVEit zero-day exploit used by data breach gangs: The how, the why, and what to do…
June 5^th 2023 at 17:59

MOVEit zero-day exploit used by data breach gangs: The how, the why, and what to do…

By: Paul Ducklin

Little Bobby Tables is back!

mi-1200

Naked Security
S3 Ep137: 16th century crypto skullduggery
June 1^st 2023 at 16:45

S3 Ep137: 16th century crypto skullduggery

By: Paul Ducklin

Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

s3-ep137-feat-1200

Naked Security
Serious Security: That KeePass “master password crack”, and what we can learn from it
May 31^st 2023 at 17:39

Serious Security: That KeePass “master password crack”, and what we can learn from it

By: Paul Ducklin

Here, in an admittedly discursive nutshell, is the fascinating story of CVE-2023-32784. (Short version: Don't panic.)

Naked Security
Serious Security: Verification is vital – examining an OAUTH login bug
May 30^th 2023 at 16:59

Serious Security: Verification is vital – examining an OAUTH login bug

By: Paul Ducklin

What good is a popup asking for your approval if an attacker can bypass it simply by suppressing it?

Naked Security
Phone scamming kingpin gets 13 years for running “iSpoof” service
May 22^nd 2023 at 16:58

Phone scamming kingpin gets 13 years for running “iSpoof” service

By: Naked Security writer

Site marketing video promised total anonymity, but that was a lie. 170 arrested already. Potentially 1000s more to follow.

ispoof-1200

🏷️ My labels
- ❌
Article tags
May 22^nd 2023 at 16:58

Naked Security
Whodunnit? Cybercrook gets 6 years for ransoming his own employer
May 12^th 2023 at 16:15

Whodunnit? Cybercrook gets 6 years for ransoming his own employer

By: Naked Security writer

Not just an active adversary, but a two-faced one, too.

Naked Security
S3 Ep133: Apple takes “tight-lipped” to a whole new level
May 4^th 2023 at 20:59

S3 Ep133: Apple takes “tight-lipped” to a whole new level

By: Paul Ducklin

Entertaining, educational, and all in plain English 🎧📖

Naked Security
Mac malware-for-hire steals passwords and cryptocoins, sends “crime logs” via Telegram
April 30^th 2023 at 01:23

Mac malware-for-hire steals passwords and cryptocoins, sends “crime logs” via Telegram

By: Paul Ducklin

These malware peddlers are specifically going after Mac users. The hint's in the name: "Atomic macOS Stealer", or AMOS for short.

Naked Security
S3 Ep132: Proof-of-concept lets anyone hack at will
April 27^th 2023 at 16:55

S3 Ep132: Proof-of-concept lets anyone hack at will

By: Paul Ducklin

When Doug says, "Happy Remote Code Execution Day, Duck"... it's irony. For the avoidance of all doubt :-)

Naked Security
Double zero-day in Chrome and Edge – check your versions now!
April 24^th 2023 at 16:59

Double zero-day in Chrome and Edge – check your versions now!

By: Paul Ducklin

Wouldn't it be handy if there were a single version number to check for in every Chromium-based browser, on every supported platform?

Naked Security
Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security
April 18^th 2023 at 16:56

Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security

By: Paul Ducklin

Did the sentence fit the crime? Read the backstory, and then have your say in our comments! (You may post anonymously.)

Naked Security
FBI and FCC warn about “Juicejacking” – but just how useful is their advice?
April 17^th 2023 at 14:17

FBI and FCC warn about “Juicejacking” – but just how useful is their advice?

By: Paul Ducklin

USB charging stations - can you trust them? What are the real risks, and how can you keep your data safe on the road?

Naked Security
S3 Ep130: Open the garage bay doors, HAL [Audio + Text]
April 13^th 2023 at 16:54

S3 Ep130: Open the garage bay doors, HAL [Audio + Text]

By: Paul Ducklin

I'm sorry, Dave. I'm afraid I can't... errr, no, hang on a minute, I can do that easily! Worldwide! Right now!

Naked Security
Patch Tuesday: Microsoft fixes a zero-day, and two curious bugs that take the Secure out of Secure Boot
April 12^th 2023 at 18:57

Patch Tuesday: Microsoft fixes a zero-day, and two curious bugs that take the Secure out of Secure Boot

By: Paul Ducklin

Is Secure Boot without the Secure just "Boot"?

Naked Security
Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads
April 10^th 2023 at 20:20

Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads

By: Paul Ducklin

That double-whammy Apple browser-to-kernel spyware bug combo we wrote up last week? Turns out it applies to all supported Macs and iDevices - patch now!

Naked Security
Apple issues emergency patches for spyware-style 0-day exploits – update now!
April 8^th 2023 at 01:20

Apple issues emergency patches for spyware-style 0-day exploits – update now!

By: Paul Ducklin

A bug to hack your browser, then a bug to pwn the kernel... reported from the wild by Amnesty International.

Naked Security
S3 Ep129: When spyware arrives from someone you trust
April 6^th 2023 at 14:57

S3 Ep129: When spyware arrives from someone you trust

By: Paul Ducklin

Scanning tools, supply-chain malware, Wi-Fi hacking, and why there should be TWO World Backup Days... listen now!

Naked Security
Hack and enter! The “secure” garage doors that anyone can open from anywhere – what you need to know
April 5^th 2023 at 18:49

Hack and enter! The “secure” garage doors that anyone can open from anywhere – what you need to know

By: Paul Ducklin

Grab a message/Play it back/You've just performed/A big phat hack...

Naked Security
Researchers claim they can bypass Wi-Fi encryption (briefly, at least)
April 3^rd 2023 at 16:59

Researchers claim they can bypass Wi-Fi encryption (briefly, at least)

By: Paul Ducklin

They can't read much of your data, but even a few stray network packets could tell them something they're not supposed to know.

🏷️ My labels
- ❌
Article tags
April 3^rd 2023 at 16:59

Naked Security
S3 Ep128: So you want to be a cybercriminal? [Audio + Text]
March 30^th 2023 at 14:43

S3 Ep128: So you want to be a cybercriminal? [Audio + Text]

By: Paul Ducklin

Latest episode - listen now!

Naked Security
Cops use fake DDoS services to take aim at wannabe cybercriminals
March 28^th 2023 at 16:58

Cops use fake DDoS services to take aim at wannabe cybercriminals

By: Naked Security writer

Thinking of trying a bit of DDoSsing to get a feel for life at the fringes of the Dark Side? Don't do it!

🏷️ My labels
- ❌
Article tags
March 28^th 2023 at 16:58

Naked Security
Apple patches everything, including a zero-day fix for iOS 15 users
March 28^th 2023 at 00:23

Apple patches everything, including a zero-day fix for iOS 15 users

By: Paul Ducklin

Got an older iPhone that can't run iOS 16? You've got a zero-day to deal with! That super-cool Studio Display monitor needs patching, too.

Naked Security
Microsoft assigns CVE to Snipping Tool bug, pushes patch to Store
March 27^th 2023 at 16:59

Microsoft assigns CVE to Snipping Tool bug, pushes patch to Store

By: Paul Ducklin

Microsoft says "successful exploitation requires uncommon user interaction", but it's the innocent and accidental leakage of private data you should be concerned about.