Supply chain blunder puts 3CX telephone app users at risk

By: Paul Ducklin — March 30^th 2023 at 17:36

Booby-trapped app, apparently signed and shipped by 3CX itself after its source code repository was broken into.

GitHub code-signing certificates stolen (but will be revoked this week)

By: Paul Ducklin — January 31^st 2023 at 11:35

There was a breach, so the bad news isn't great, but the good news isn't too bad...

By: Paul Ducklin — November 29^th 2022 at 17:58

An injury to one is an injury to all. Especially if the other people are part of your social network.

By: Paul Ducklin — August 11^th 2022 at 14:34

Latest episode - listen now! (Or read the transcript if you prefer.)

By: Paul Ducklin — August 3^rd 2022 at 23:06

If you spew projects laced with hidden malware into an open source repository, don't waste your time telling us "no harm done" afterwards.

By: Paul Ducklin — May 5^th 2022 at 14:16

Latest episode - listen now!

By: Paul Ducklin — April 29^th 2022 at 16:15

Learn how to find out which apps you've given access rights to, and how to revoke those rights immediately in an emergency.

By: Paul Ducklin — April 20^th 2022 at 16:43

Either know the private key and use it scrupulously in your digital signature calculation.... or just send a bunch of zeros instead.

By: Paul Ducklin — March 7^th 2022 at 12:47

Training data stashed in GitHub by mistake... unfortunately, it was *real* data