Information

22 Jun

S3 Ep140: So you think you know ransomware?

Information

by Paul Ducklin LISTEN AND LEARN Gee Whizz BASIC (probably). Think you know ransomware? Megaupload, 11 years on. ASUS warns of critical router bugs. MOVEit mayhem Part III. No audio player below? Listen directly on Soundcloud. With Doug Aamoth and Paul Ducklin. Intro and outro music by Edith Mudge. You can listen to us on Soundcloud, Apple Podcasts, Google Podcasts, Spotify, Stitcher and anywhere that good podcasts are found. Or just drop the URL of…

Read More
22 Jun

SMS Phishers Harvested Phone Numbers, Shipment Data from UPS Tracking Tool

Information, Insights

The United Parcel Service (UPS) says fraudsters have been harvesting phone numbers and other information from its online shipment tracking tool in Canada to send highly targeted SMS phishing (a.k.a. “smishing”) messages that spoofed UPS and other top brands. The missives addressed recipients by name, included details about recent orders, and warned that those orders wouldn’t be shipped unless the customer paid an added delivery fee. In a snail mail letter sent this month to…

Read More
22 Jun

Google Backs Creation of Cybersecurity Clinics With $20 Million Donation

Information, News

Free medical clinics and legal aid clinics, where college students and their instructors help their communities while also learning more about their professions, are now commonplace. Google hopes to add cybersecurity clinics to that list. Google CEO Sundar Pichai pledged $20 million in donations on Thursday to support and expand the Consortium of Cybersecurity Clinics to introduce thousands of students to potential careers in cybersecurity, while also helping defend small government offices, rural hospitals and…

Read More
21 Jun

Going on vacation soon? Stay one step ahead of travel scammers

Information

From bogus free trips to fake rental homes, here are some of the most common online threats you should look out for both before and during your travels As the mercury rises and we look forward to vacationing in sunnier climbs, it’s also time to keep one eye peeled for internet scams and cyberthreats. Travel fraud is one of the biggest money-makers for cybercriminals. In 2022 alone, over 62,400 victim reports were filed with the…

Read More
21 Jun

“The Ransomware Documentary” – brand new video series from Sophos starting now!

Information

by Matt Fairbanks Ransomware – as readers here know only too well – is one of the biggest cybercrime challenges we collectively face today. That’s why Sophos has recently visited cities around the globe to dive deep into the real story behind ransomware. We captured more than 100 hours of interviews with cybercriminals, cybersecurity experts, industry analysts, and policy makers to provide a full 360-degree perspective. The result is Think You Know Ransomware?, a three-part…

Read More
21 Jun

Beware bad passwords as attackers co-opt Linux servers into cybercrime

Information, Malware

by Paul Ducklin Researchers at Korean anti-malware business AhnLab are warning about an old-school attack that they say they’re seeing a lot of these days, where cybercriminals guess their way into Linux shell servers and use them as jumping-off points for further attacks, often against innocent third parties. The payloads unleashed by this crew of otherwise unsophisticated crooks could not only cost you money through unexpected electricity bills, but also tarnish your reputation by leaving…

Read More
21 Jun

Apple patch fixes zero-day kernel hole reported by Kaspersky – update now!

Information

by Paul Ducklin Right at the start of June 2023, well-known Russian cybersecurity outfit Kaspersky reported on a previously unknown strain of iPhone malware. Most notable about the original story was its strapline: Targeted attack on [Kaspersky] management with the Triangulation Trojan. Although the company ultimately said, “We’re confident that Kaspersky was not the main target of this cyberattack”, the threat hunting it was called upon to do wasn’t on customer devices, but on its…

Read More
21 Jun

Apple Patches iOS Flaws Used in Kaspersky ‘Operation Triangulation’ 

Information, News

Apple has rolled out a major security-themed iOS update to fix remote code execution vulnerabilities that have already been exploited in the wild. The patches address a pair of vulnerabilities reported by Russian anti-malware vendor Kaspersky and follow the public documentation of ‘Operation Triangulation,’ a digital spy campaign that used zero-click iMessage exploits. The patches – iOS 16.5.1, iPadOS 16.5.1, iOS 15.7.7 and iPadOS15.7.7 – cover security defects in kernel and WebKit and have been…

Read More
21 Jun

Why Malware Crypting Services Deserve More Scrutiny

Information, Insights

If you operate a cybercrime business that relies on disseminating malicious software, you probably also spend a good deal of time trying to disguise or “crypt” your malware so that it appears benign to antivirus and security products. In fact, the process of “crypting” malware is sufficiently complex and time-consuming that most serious cybercrooks will outsource this critical function to a handful of trusted third parties. This story explores the history and identity behind Cryptor[.]biz,…

Read More
20 Jun

Passwords out, passkeys in: are you ready to make the switch?

Information

With passkeys poised for prime time, passwords seem passé. What are the main benefits of ditching one in favor of the other? Chances are good that many of us have had enough of passwords. In a world where we have to manage access for scores of online accounts, passwords no longer seem fit for purpose. Many of us reuse the same, easy-to-remember login credentials across these apps and websites and commit other password-related mistakes, which…

Read More