Information

The real cost of a free lunch – Week in security with Tony Anscombe

Don’t download software from non-reputable websites and sketchy links – you might be in for more than you bargained for Chances are good that you have, at some point, searched for free stuff online, including software, movies, TV shows, or live streams of sports matches. But the truth is that this search for “free” may ultimately come at a high cost, especially if it involves the promise of effortlessly downloading a free version of what’s…

Read More

US Teenager Indicted for Credential Stuffing Attack on Fantasy Sports Website

A Wisconsin teenager has been charged with accessing tens of thousands of user accounts at a fantasy sports and betting website after launching a credential stuffing attack on the site. According to a six-count criminal complaint (PDF), the teenager, Joseph Garrison, of Wisconsin, launched the attack on the betting website on November 18, 2022, accessing roughly 60,000 accounts without authorization. In some cases, the defendant and others added a new payment method to the compromised…

Read More

Pimcore Platform Flaws Exposed Users to Code Execution

Security researchers are warning that vulnerabilities patched in the open-source Pimcore platform could have led to the execution of arbitrary code when clicking on a link. A digital experience platform, Pimcore provides data and user experience management capabilities to over 100,000 organizations worldwide. In March 2023, version 10.5.19 of the Pimcore platform resolved two issues that could have been used together to achieve arbitrary code execution, open source software security company Sonar Source says. The…

Read More

What TikTok knows about you – and what you should know about TikTok

As TikTok CEO attempts to placate U.S. lawmakers, it’s time for us all to think about the wealth of personal information that TikTok and other social media giants collect about us TikTok CEO Shou Zi Chew has appeared before the U.S. Congress to give his take on the app’s data security and privacy practices and possible links to the Chinese government amid a nationwide discussion about a blanket ban on TikTok in the US. The…

Read More

5 useful search engines for internet‑connected devices and services

A roundup of some of the handiest tools that security professionals can use to search for and monitor devices that are accessible from the internet Internet security is a constant concern for technology and cybersecurity professionals. With the ever-increasing number of online devices and services, it is important to have a clear and accurate view of the online presence of these devices and services in order to protect them and data against online threats. Some…

Read More

S3 Ep135: Sysadmin by day, extortionist by night

by Paul Ducklin AN INSIDER ATTACK (WHERE THE PERP GOT CAUGHT) No audio player below? Listen directly on Soundcloud. With Doug Aamoth and Paul Ducklin. Intro and outro music by Edith Mudge. You can listen to us on Soundcloud, Apple Podcasts, Google Podcasts, Spotify, Stitcher and anywhere that good podcasts are found. Or just drop the URL of our RSS feed into your favourite podcatcher. READ THE TRANSCRIPT DOUG.  Inside jobs, facial recognition, and the “S”…

Read More

Apple’s secret is out: 3 zero-days fixed, so be sure to patch now!

by Paul Ducklin Remember that zipped-lipped but super-fast update that Apple pushed out three weeks ago, on 2023-05-01? That update was the very first in Apple’s newfangled Rapid Security Response process, whereby the company can push out critical patches for key system components without going through a full-size operating system update that takes you to a new version number. As we pondered in the Naked Securirty podcast that week: Apple have just introduced “Rapid Security…

Read More

Investors Make $6M Bet on Manifest for SBOM Management Technology

Manifest, an early stage startup building technology to help businesses generate, collect, and operationalize software bill of materials (SBOMs), has banked $6 million in venture capital funding as investors race to find value in software supply chain security companies. The $6 million seed round was led by First Round Capital and closes alongside news that Manifest secured two new contracts from the U.S. government to help federal agencies and the military understand what’s in the…

Read More

Highlights from TikTok CEO’s Congress grilling – Week in security with Tony Anscombe

Here are some of the key moments from the five hours of Shou Zi Chew’s testimony and other interesting news on the data privacy front As the controversy surrounding TikTok continues, the app’s CEO Shou Zi Chew appeared before the U.S. Congress to explain the app’s data privacy and security practices. Here are some of the key moments from the five hours of the testimony. In other (but related) news, a school district in San…

Read More

Staying safe on OnlyFans: The naked truth

How content creators and subscribers can embrace the social media platform without (overly) exposing themselves to the potentially toxic brew of NSFW content and privacy threats By now you’ve most probably heard of, or possibly even use, OnlyFans. Launched in 2016, this subscription service for content creators gained momentum over the course of the pandemic and now boasts a user base of more than 170 million people, 2.1 million of which are registered content creators.…

Read More