Information

11 Nov

S3 Ep108: You hid THREE BILLION dollars in a popcorn tin?

Information

by Paul Ducklin THREE BILLION DOLLARS IN A POPCORN TIN? Radio waves so mysterious they’re known only as X-Rays. Were there six 0-days or only four? The cops who found $3 billion in a popcorn tin. Blue badge confusion. When URL scanning goes wrong. Tracking down every last unpatched file. Why even unlikely exploits can earn “high” severity levels. Click-and-drag on the soundwaves below to skip to any point. You can also listen directly on…

Read More
11 Nov

GitHub Introduces Private Vulnerability Reporting for Public Repositories

Information, News

Microsoft-owned code hosting platform GitHub has announced the introduction of a direct channel for security researchers to report vulnerabilities in public repositories that allow it. The new private vulnerability reporting capability enables repository maintainers to allow security researchers to report to them any vulnerabilities identified in their code. Some repositories may contain specific instructions on how the maintainers can be contacted for vulnerability reporting, but for those that do not, researchers often report issues publicly.…

Read More
11 Nov

Chinese Spyware Targets Uyghurs Through Apps: Report

Information, News

Cybersecurity researchers said they have found evidence of Chinese spyware in Uyghur-language apps that can track the location and harvest the data of Uyghurs living in China and abroad. Uyghurs are a Turkic Muslim minority predominantly in China’s northwestern region of Xinjiang, where a recent UN report said Beijing may have committed crimes against humanity. The United States and lawmakers in other Western countries say China’s treatment of the Uyghurs amounts to genocide. A Thursday…

Read More
11 Nov

LiteSpeed Vulnerabilities Can Lead to Complete Web Server Takeover

Information, News

LiteSpeed Web Server vulnerabilities discovered by researchers at Palo Alto Networks can be exploited to take complete control of a targeted server. The security holes were discovered during an audit of OpenLiteSpeed, the open source version of the LiteSpeed performance-focused web server made by LiteSpeed Technologies. Both versions are impacted by the vulnerabilities and they have been patched with the release of OpenLiteSpeed 1.7.16.1 and LiteSpeed 6.0.12. LiteSpeed is a popular web server and an…

Read More
10 Nov

Lawsuit Seeks Food Benefits Stolen By Skimmers

Information, Insights

A nonprofit organization is suing the state of Massachusetts on behalf of thousands of low-income families who were collectively robbed of more than a $1 million in food assistance benefits by card skimming devices secretly installed at cash machines and grocery store checkout lanes across the state. Federal law bars states from replacing these benefits using federal funds, and a recent rash of skimming incidents nationwide has disproportionately affected those receiving food assistance via state-issued…

Read More
10 Nov

10 common security mistakes and how to avoid them

Information

Do you put yourself at greater risk for successful attacks by making one of these security mistakes? How much of your personal time do you spend online? The answer may be a lot more than you think. One recent study estimated that Brits spend five hours on average each day glued to their screens, not including work time. It found that those aged 16-24 spend over 2,500 hours per year on Instagram alone. In fact,…

Read More
10 Nov

Toward the cutting edge: SMBs contemplating enterprise security

Information

Survey finds SMBs, weary of security failures, curious about detection and response How a company sees its digital security preparedness is critical. Conservative companies might follow the crowd, implementing a necessary minimum to ensure nominal security, and perhaps that’s the right choice for their business. Margins could be tight, or growth might not call for an outsized security budget. Maybe digitization has spared their business segment or processes more than others. In contrast, perhaps growth…

Read More
10 Nov

Exchange 0-days fixed (at last) – plus 4 brand new Patch Tuesday 0-days!

Information

by Paul Ducklin Remember those Exchange zero-days that emerged in a blaze of publicity back in September 2022? Those flaws, and attacks based on them, were wittily but misleadingly dubbed ProxyNotShell because the vulnerabilities involved were reminiscent of the ProxyShell security flaw in Exchange that hit the news in August 2021. Fortunately, unlike ProxyShell, the new bugs weren’t directly exploitable by anyone with an internet connection and a misguided sense of cybersecurity adventure. This time,…

Read More
10 Nov

Emergency code execution patch from Apple – but not an 0-day

Information

by Paul Ducklin No sooner had we stopped to catch our breath after reviewing the latest 62 patches (or 64, depending on how you count) dropped by Microsoft on Patch Tuesday… …than Apple’s latest security bulletins landed in our inbox. This time there were just two reported fixes: for mobile devices running the latest iOS or iPadOS, and for Macs running the latest macOS incarnation, version 13, better known as Ventura. To summarise what are…

Read More
10 Nov

Analysis of Russian Cyberspy Attacks Leads to Discovery of Windows Vulnerability

Information, News

An analysis of the numerous LDAP queries that Russian cyberespionage group APT29 had made to the Active Directory system has led to the discovery of a vulnerability in Windows’ ‘credential roaming’ functionality. Also referred to as Cozy Bear, the Dukes, and Yttrium, APT29 is a Russian cyberespionage group likely sponsored by the Russian Foreign Intelligence Service (SVR). The group is believed to be responsible for multiple high-profile attacks, including the 2016 targeting of the Democratic…

Read More