Information

Cybersecurity Trends 2023: Securing our hybrid lives

ESET experts offer their reflections on what the continued blurring of boundaries between different spheres of life means for our human and social experience – and especially our cybersecurity and privacy The future isn’t what it used to be. This adage, if a little trite, has taken on a whole new meaning after our lives turned on a dime with the outbreak of the COVID-19 pandemic. And as the world was bouncing back from the…

Read More

Top tips for security‑ and privacy‑enhancing holiday gifts

Think outside the (gift) box. Here are a few ideas for security and privacy gifts to get for your relatives – or even for yourself. Some don’t cost a penny! Thanks to a decade or more of big-name data breaches, global privacy scandals and consumer rights legislation like the GDPR, we’re all more aware of cybersecurity and privacy issues today. And now that many of us are working more from home and our personal and…

Read More

COVID-bit: the wireless spyware trick with an unfortunate name

by Paul Ducklin If you’re a regular Naked Security reader, you can probably guess where on the planet we’re headed in this virtual journey…. …we’re off once more to the Department of Software and Information Systems Engineering at Ben-Gurion University of the Negev in Israel. Researchers in the department’s Cyber-Security Research Center regularly investigate security issues related to so-called airgapped networks. As the name suggests, an airgapped network is deliberately disconnected not only from the…

Read More

Patch Tuesday: 0-days, RCE bugs, and a curious tale of signed malware

by Paul Ducklin Another month, another Microsoft Patch Tuesday, another 48 patches, another two zero-days… …and an astonishing tale about a bunch of rogue actors who tricked Microsoft itself into giving their malicious code an official digital seal of approval. For a threat researcher’s view of the Patch Tuesday fixes for December 2002, please consult the Sophos X-Ops writeup on our sister site Sophos News: For a deep dive into the saga of the signed…

Read More

Apple patches everything, finally reveals mystery of iOS 16.1.2

by Paul Ducklin Apple has just published a wide range of security fixes for all its supported platforms, from the smallest watch to the biggest laptop. In other words, if you’ve got an Apple product, and it’s still officially supported, we urge you to do an update check now. Remember that even if you’ve set your iDevices to update entirely automatically, doing a manual check is still well worth it, because: It ensures that you…

Read More

High-Severity Memory Safety Bugs Patched With Latest Chrome 108 Update

Google this week announced a Chrome update that resolves eight vulnerabilities in the popular browser, including five reported by external researchers. All five security defects are use-after-free flaws, a type of memory safety bug that has been prevalent in Chrome over the past years, and which Google has long-battled to eliminate. According to Google’s advisory, four of these issues are high-severity bugs, impacting components such as Blink Media, Mojo IPC, Blink Frames, and Aura. The…

Read More

FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked

InfraGard, a program run by the U.S. Federal Bureau of Investigation (FBI) to build cyber and physical threat information sharing partnerships with the private sector, this week saw its database of contact information on more than 80,000 members go up for sale on an English-language cybercrime forum. Meanwhile, the hackers responsible are communicating directly with members through the InfraGard portal online — using a new account under the assumed identity of a financial industry CEO…

Read More

Pwn2Own Toronto: 54 hacks, 63 new bugs, $1 million in bounties

by Paul Ducklin You’ve probably heard of Pwn2Own, a hacking contest that started life alongside the annual CanSecWest cybersecurity event in Vancouver, Canada. Pwn2Own is now a multi-million “hackers’ brand” in its own right, having been bought up by anti-virus outfit Trend Micro and extended to cover many more types of bug than just browsers and desktop operating systems. The name, in case you’re wondering, is shorthand for “pwn it to own it”, where pwn…

Read More

New Python-Based Backdoor Targeting VMware ESXi Servers

Security researchers with Juniper Networks’ Threat Labs warn of a new Python-based backdoor targeting VMware ESXi virtualization servers. The targeted servers were impacted by known security defects (such as CVE-2019-5544 and CVE-2020-3992) that were likely used for initial compromise, but what caught the researchers’ attention was the simplicity, persistence, and capabilities of the deployed backdoor. As part of the attack, the threat actor modified a total of four files on the target, which the system…

Read More

Python, JavaScript Developers Targeted With Fake Packages Delivering Ransomware

Phylum security researchers warn of a new software supply chain attack relying on typosquatting to target Python and JavaScript developers. On Friday, the researchers warned that a threat actor was typosquatting popular PyPI packages to direct developers to malicious dependencies containing code to download payloads written in Golang (Go). The purpose of the attack is to infect victims with ransomware variants designed to update the desktop background with a message impersonating the CIA and instructing…

Read More