One of most important malware loaders to cybercrims who are jumping on vulnerabilities faster than ever Researchers suspect the criminals behind the Raspberry Robin malware are now buying exploits for speedier cyberattacks.… This article has been indexed from The Register…
Category: The Register – Security
Cybercrime duo accused of picking $2.5M from Apple’s orchard
Security researcher buddies allegedly tag team a four-month virtual gift card heist at Cupertino tech giant A cybersecurity researcher and his pal are facing charges in California after they allegedly defrauded an unnamed company, almost certainly Apple, out of $2.5…
Rust can help make software secure – but it’s no cure-all
Security is a process, not a product. Nor a language Memory-safety flaws represent the majority of high-severity problems for Google and Microsoft, but they’re not necessarily associated with the majority of vulnerabilities that actually get exploited.… This article has been…
IT suppliers hacked off with Uncle Sam’s demands in aftermath of cyberattacks
Plan says to hand over keys to networks – and report intrusions within eight hours of discovery Organizations that sell IT services to Uncle Sam are peeved at proposed changes to procurement rules that would require them to allow US…
Volt Typhoon not the only Chinese crew lurking in US energy, critical networks
Presumably American TLAs are all over Beijing’s infrastructure, too … right? Volt Typhoon isn’t the only Chinese spying crew infiltrating computer networks in America’s energy sector and other critical organizations with the aim of wrecking equipment and causing other headaches,…
Half of polled infosec pros say their degree was less than useful for real-world work
The other half paid attention in class? Half of infosec professionals polled by Kaspersky said any cybersecurity knowledge they picked up from their higher education is at best somewhat useful for doing their day jobs. On the other hand, half…
US says China’s Volt Typhoon is readying destructive cyberattacks
12 international govt agencies sound the alarm, critical infrastructure at the heart of threats The US government today confirmed that China’s Volt Typhoon crew comprised “multiple” critical infrastructure org’s IT networks, and warned that the state-sponored hackers are readying “disruptive…
Iran’s cyber operations in Israel a potential prelude to US election interference
Tactics are more sophisticated and supported in greater numbers Iran’s anti-Israel cyber operations are providing a window into the techniques the country may deploy in the run-up to the 2024 US Presidential elections, Microsoft says.… This article has been indexed…
Raspberry Pi Pico cracks BitLocker in under a minute
Windows encryption feature defeated by $10 and a YouTube tutorial We’re very familiar with the many projects in which Raspberry Pi hardware is used, from giving old computers a new lease of life through to running the animated displays so…
JetBrains urges swift patching of latest critical TeamCity flaw
Cloud version is safe, but no assurances offered about possible on-prem exploits JetBrains is encouraging all users of TeamCity (on-prem) to upgrade to the latest version following the disclosure of a critical vulnerability in the CI/CD tool.… This article has…
The spyware business is booming despite government crackdowns
‘Almost zero data being shared across the industry on this particular threat,’ we’re told The commercial spyware economy – despite government and big tech’s efforts to crack down – appears to be booming.… This article has been indexed from The…
DEF CON is canceled! No, really this time – but the show will go on
Longtime host Caesars ends relationship at short notice It’s an annual meme that DEF CON infosec conference has been canceled, but this time it actually happened.… This article has been indexed from The Register – Security Read the original article:…
Mozilla adds paid-for data-deletion tier to Monitor, its privacy-breach radar
Firefox maker promises to lean on personal info brokers to scrub records Mozilla on Tuesday expanded its free privacy-monitoring service with a paid-for tier called Mozilla Monitor Plus that will try to get data brokers to delete their copies of…
Verizon says 63K employees’ info fell into the wrong hands – an insider this time
Telco says it’s a private matter, data ‘not shared externally’ Verizon is notifying more than 63,000 people, mostly current employees, that an insider, accidentally or otherwise, had inappropriate access to their personal data.… This article has been indexed from The…
Verizon says 63K employees’ info fell into wrong hands – an insider in this case
Telco says it’s a private matter Verizon is notifying more than 63,000 people, mostly current employees, that an insider, accidentally or otherwise, had inappropriate access to their personal data.… This article has been indexed from The Register – Security Read…
Verizon alerts 63k employees their details were leaked by an insider
Telco says it’s a private matter Verizon is notifying more than 63,000 people, mostly current employees, that an insider leak exposed their personal data.… This article has been indexed from The Register – Security Read the original article: Verizon alerts…
Chinese Coathanger malware hung out to dry by Dutch defense department
Attack happened in 2023 using a bespoke backdoor, confirming year-old suspicions Dutch authorities are lifting the curtain on an attempted cyberattack last year at its Ministry of Defense (MoD), blaming Chinese state-sponsored attackers for the espionage-focused intrusion.… This article has…
EquiLend back in the saddle as ransom payment rumors swirl
Still no word on how the intruders broke in or the full extent of any possible data compromise Global securities finance tech company EquiLend’s systems are now back online after announcing a disruptive ransomware attack nearly two weeks ago.… This…
Double trouble for Fortinet customers as pair of critical vulns found in FortiSIEM
Admins should get a move on while info is scarce and exploits aren’t yet available Fortinet’s FortiSIEM product is vulnerable to two new maximum-severity security vulnerabilities that allow for remote code execution.… This article has been indexed from The Register…
New kids on the ransomware block in 2023: Akira and 8Base lead dozens of newbies
How good are your takedowns when fresh gangs are linked to previous ops, though? At least 25 new ransomware gangs emerged in 2023, with Akira and 8Base proving the most “successful,” research reveals.… This article has been indexed from The…
Google throws $1M at Rust Foundation to build C++ bridges
Chocolate Factory matches Microsoft money for memory safety Google on Monday donated $1 million to the Rust Foundation specifically to improve interoperability between the language and C++.… This article has been indexed from The Register – Security Read the original…
Google throws $1m at Rust Foundation to build C++ bridges
Chocolate Factory matches Microsoft money for memory safety Google on Monday donated $1 million to the Rust Foundation specifically to improve interoperability between the language and C++.… This article has been indexed from The Register – Security Read the original…
Ivanti devices hit by wave of exploits for latest security hole
At this point you might be better off just shutting the stuff down All manner of miscreants are exploiting the latest Ivanti flaw, a server-side request forgery (SSRF) vulnerability tracked as CVE-2024-21893 that can be used to hijack equipment.… This…
More mass exploits hit the same buggy Ivanti devices
At this point you might be better just shutting the stuff down All manner of miscreants are piling onto the latest Ivanti flaw, a server-side request forgery (SSRF) vulnerability tracked as CVE-2024-21893, according to threat hunters tracking the string of…
Ignore Uncle Sam’s ‘voluntary’ cybersecurity goals for hospitals at your peril
What is on HHS paper will most likely become law, Google security boss says Interview If you are responsible for infosec at a US hospital or other healthcare organization, and you treat the government’s new “voluntary” cybersecurity performance goals (CPGs)…
AnyDesk revokes signing certs, portal passwords after crooks sneak into systems
Horse, meet stable door AnyDesk has copped to an IT security “incident” in which criminals broke into the remote-desktop software maker’s production systems. The biz has told customers to expect disruption as it attempts to lock down its infrastructure.… This…
Lurie Children’s Hospital back to pen and paper after cyberattack
It’s the second Chicago hospital to disclose a major incident in the same week For the second time in one week, cybercriminals have targeted a Chicago children’s hospital, this time causing significant operational disruption.… This article has been indexed from…
SBF likely off the hook for misplaced FTX funds after cops bust SIM swap ring
PLUS: more glibc vulns discovered; DraftKings hacker sentenced; and a hefty dose of critical vulnerabilities Infosec In Brief The recent indictment of a massive SIM-swapping ring may mean convicted crypto conman Sam Bankman-Fried is innocent of at least one allegation…
Researchers remotely exploit devices used to manage safe aircraft landings and takeoffs
The closest thing we may ever get to a real-life Die Hard 2 scenario Criminals could remotely tamper with the data that apps used by airplane pilots rely on to inform safe takeoff and landing procedures, according to fresh research.……
Blackbaud settles with FTC after that IT breach exposed millions of people’s info
Cloud software slinger admits no guilt, promises better basic security hygiene Blackbaud, which had data on millions of people stolen from it by one or more crooks, has promised to shore up its IT defenses in a proposed deal with…
Critical vulnerability in Mastodon is pounced upon by fast-acting admins
Danger of remote account takeovers leaves lead devs scared of releasing many details Mastodon has called admins to action following the disclosure of a critical vulnerability affecting the decentralized social network favored by erstwhile Twitter lovers.… This article has been…
Interpol’s latest cybercrime intervention dismantles ransomware, banking malware servers
Efforts part of internationally coordinated operations carried out in recent months Interpol has arrested 31 people following a three-month operation to stamp out various types of cybercrime.… This article has been indexed from The Register – Security Read the original…
Wikileaks source and former CIA worker Joshua Schulte sentenced to 40 years jail
‘Vault 7’ leak detailed cyber-ops including forged digital certs Joshua Schulte, a former CIA employee and software engineer accused of sharing material with WikiLeaks, was sentenced to 40 years in prison by the US Southern District of New York on…
Managing the hidden risks of shadow APIs
How F5 Distributed Cloud Services seal security gaps in modern app development amid growing attack surface Partner Content Application programming interfaces (APIs) play a significant role in today’s digital economy, but at the same time they can also represent a…
Cloudflare sheds more light on Thanksgiving security breach in which tokens, source code accessed by suspected spies
Atlassian systen compromised via October Okta intrusion Cloudflare has just detailed how suspected government spies gained access to its internal Atlassian installation using credentials stolen via a security breach at Okta in October.… This article has been indexed from The…
Biden will veto attempts to kill off SEC’s security breach reporting rules
Senate, House can try but won’t make it past the Prez, says White House The Biden administration has expressed to congressional representatives its strong opposition to undoing the Securities and Exchange Commission’s (SEC) strict data breach reporting rule.… This article…
Rise of deepfake threats means biometric security measures won’t be enough
Defenses need a rethink in face of increasing sophistication Cyber attacks using AI-generated deepfakes to bypass facial biometrics security will lead a third of organizations to doubt the adequacy of identity verification and authentication tools as standalone protections.… This article…
Biden will veto attempts to rip up SEC breach reporting rule
Senate, House can try but won’t make it past the Prez, says White House The Biden administration has expressed to congressional representatives its strong opposition to undoing the Securities and Exchange Commission’s (SEC) strict data breach reporting rule.… This article…
LockBit shows no remorse for ransomware attack on children’s hospital
It even had the gall to set the ransom demand at $800K … for a nonprofit Ransomware gang LockBit is claiming responsibility for an attack on a Chicago children’s hospital in an apparent deviation from its previous policy of not…
Congress told how Chinese attackers plan to incite ‘societal chaos’ in the US
American public are way ahead of them Chinese attackers are preparing to “wreak havoc” on American infrastructure and “cause societal chaos” in the US, infosec, and law enforcement bosses told a US House committee on Wednesday.… This article has been…
Ransomware payment rates drop to new low – only 29% of victims are forking over cash
It’s almost like years of false assurances have made people realize payments are pointless Trusting a ransomware crew to honor a deal isn’t the greatest idea, and the world seems to be waking up to that. The number of victims…
FBI confirms it issued remote kill command to blow out Volt Typhoon’s botnet
Remotely disinfects Cisco and Netgear routers to block Chinese critters China’s Volt Typhoon attackers used “hundreds” of outdated Cisco and NetGear routers infected with malware in an attempt to break into US critical infrastructure facilities, according to the Justice Department.……
Nearly 4-year-old Cisco vuln linked to recent Akira ransomware attacks
Evidence mounts of an exploit gatekept within Russia’s borders Security researchers believe the Akira ransomware group could be exploiting a nearly four-year-old Cisco vulnerability and using it as an entry point into organizations’ systems.… This article has been indexed from…
We know nations are going after critical systems, but what happens when crims join in?
This isn’t going to end well Volt Typhoon, the Chinese government-backed cyberspies whose infrastructure was at least partially disrupted by Uncle Sam, has been honing in on other US energy, satellite and telecommunications systems, according to Robert Lee, CEO of…
Ivanti releases patches for VPN zero-days, discloses two more high-severity vulns
Many versions still without fixes while sophisticated attackers bypass mitigations Ivanti has finally released the first round of patches for vulnerability-stricken Connect Secure and Policy Secure gateways, but in doing so has also found two additional zero-days, one of which…
US shorts China’s Volt Typhoon crew targeting America’s criticals
Invaders inveigle infrastructure The US Justice Department and FBI may have scored a win over Chinese state-sponsored snoops trying to break into American critical infrastructure.… This article has been indexed from The Register – Security Read the original article: US…
Jenkins jitters as 45,000 servers still vulnerable to RCE attacks after patch released
Multiple publicly available exploits have since been published for the critical flaw The number of public-facing installs of Jenkins servers vulnerable to a recently disclosed critical vulnerability is in the tens of thousands.… This article has been indexed from The…
Reg story prompts fresh security bulletin, review of Juniper Networks’ CVE process
Vendor gets tangled in its own web of undisclosed vulnerabilities Juniper Networks has disclosed separate vulnerabilities it was previously accused of concealing, and apologized to customers for the error in communication.… This article has been indexed from The Register –…
UK biometrics boss bows out, bemoaning bureaucratic blunders
Questionable institutional change and myriad IT issues pervade the governance landscape The farewell report written by the UK’s biometrics and surveillance commissioner highlights a litany of failings in the Home Office’s approach to governing the technology.… This article has been…
SolarWinds slams SEC lawsuit against it as ‘unprecedented’ victim blaming
18,000 customers, including the Pentagon and Microsoft, may have other thoughts SolarWinds – whose network monitoring software was backdoored by Russian spies so that the biz’s customers could be spied upon – has accused America’s financial watchdog of seeking to…
Tesla hacks make big bank at Pwn2Own’s first automotive-focused event
ALSO: SEC admits to X account negligence; New macOS malware family appears; and some critical vulns Infosec in brief Trend Micro’s Zero Day Initiative (ZDI) held its first-ever automotive-focused Pwn2Own event in Tokyo last week, and awarded over $1.3 million…
750 million Indian mobile subscribers’ info for sale on dark web
ALSO: Samsung turns to Baidu for Galaxy AI in China; Terraform Labs files for bankruptcy; India’s supercomputing ambitions Asia In Brief Indian infosec firm CloudSEK last week claimed it found records describing 750 million Indian mobile network subscribers on the…
Microsoft sheds some light on Russian email heist – and how to learn from Redmond’s mistakes
Step one, actually turn on MFA Microsoft, a week after disclosing that Kremlin-backed spies broke into its network and stole internal emails and files from its executives and staff, has now confirmed the compromised corporate account used in the genesis…
Wait, security courses aren’t a requirement to graduate with a computer science degree?
And software makers seem to be OK with this, apparently There’s a line in the latest plea from CISA – the US government’s cybersecurity agency – to software developers to do a better job of writing secure code that may…
Guess the company: Takes your DNA, blames you when criminals steal it, can’t spot a cyberattack for 5 months
Breach filings show Reddit post led to the discovery rather than any sophisticated cyber defenses Biotech and DNA-collection biz 23andMe, the one that blamed its own customers for the October mega-breach, just admitted it failed to detect any malicious activity…
Akira ransomware gang says it stole passport scans from Lush in 110 GB data heist
Cosmetics brand goes from Jackson Pollocking your bathwater to cleaning up serious a digital mess The Akira ransomware gang is claiming responsiblity for the “cybersecurity incident” at British bath bomb merchant.… This article has been indexed from The Register –…
Trickbot malware scumbag gets five years for infecting hospitals, businesses
Rest of the crew still at large A former Trickbot developer has been sent down for five years and four months for his role in infecting American hospitals and businesses with ransomware and other malware, costing victims tens of millions…
EquiLend drags systems offline after admitting attacker broke in
Securities lender processes trillions of dollars worth of Wall Street transactions every day US securities lender EquiLend has pulled a number of its systems offline after a security “incident” in which an attacker gained “unauthorized access”.… This article has been…
HPE joins the ‘our executive email was hacked by Russia’ club
Cozy Bear may have had access to the green rectangular email and SharePoint cloud for six months HPE has become the latest tech giant to admit it has been compromised by Russian operatives.… This article has been indexed from The…
US judge rejects spyware developer NSO’s attempt to bin Apple’s spyware lawsuit
Judge says anti-hacking laws fits Pegasus case “to a T” A US court has rejected spyware vendor NSO Group’s motion to dismiss a lawsuit filed by Apple that alleges the developer violated computer fraud and other laws by infecting customers’…
Major IT outage at Europe’s largest caravan and RV club makes for not-so-happy campers
1 million members still searching for answers as IT issues floor primary digital services The UK’s Caravan and Motorhome Club (CAMC) is battling a suspected cyberattack with members reporting widespread IT outages for the past five days.… This article has…
Using GoAnywhere MFT for file transfers? Patch now – an exploit’s out for a critical bug
Ancient path traversal exploit offers remote attackers admin access Security experts are wasting no time in publishing working exploits for a critical vulnerability in Fortra GoAnywhere MFT, which was publicly disclosed just over a day ago.… This article has been…
What Microsoft’s latest email breach says about this IT security heavyweight
Senator Wyden tells The Reg this latest security lapse is ‘inexcusable’ Comment For most organizations – especially security vendors – disclosing a corporate email breach, in which executives’ internal messages and attachments were stolen, would noticeably ding their stock prices.……
COVID-19 test lab accused of exposing 1.3 million patient records to open internet
Now that’s a Dutch crunch A password-less database containing an estimated 1.3 million sets of Dutch COVID-19 testing records was left exposed to the open internet, and it’s not clear if anyone is taking responsibility.… This article has been indexed…
GCHQ’s NCSC warns of ‘realistic possibility’ AI will help state-backed malware evade detection
That means Brit spies want the ability to do exactly that, huh? The idea that AI could generate super-potent and undetectable malware has been bandied about for years – and also already debunked. However, an article published today by the…
CISA boss swatted: ‘While my own experience was certainly harrowing, it was unfortunately not unique’
Election officials, judges, politicians, and gamers are in swatters’ crosshairs CISA Director Jen Easterly has confirmed she was the subject of a swatting attempt on December 30 after a bogus report of a shooting at her home.… This article has…
Accused PII seller faces jail for running underground fraud op
More than 5,000 victims claimed over a 3-year period but filing reckons accused didn’t even use a VPN A Baltimore man faces a potential maximum 20-year prison sentence after being charged for his alleged role in running an online service…
UK water giant admits attackers broke into system as gang holds it to ransom
Comes mere months after Western intelligence agencies warned of attacks on water providers Southern Water confirmed this morning that criminals broke into its IT systems, making off with a “limited amount of data.”… This article has been indexed from The…
Australia imposes cyber sanctions on Russian it says ransomwared health insurer
‘Aleksandr Ermakov’ isn’t allowed down under after being linked to ten-million-record leak Australia’s government has used the “significant cyber incidents” sanctions regime it introduced in 2021 for the first time, against a Russian named Aleksandr Gennadievich Ermakov whom authorities have…
Atlassian Confluence Server RCE attacks underway from 600+ IPs
If you’re still running a vulnerable instance then ‘assume a breach’ More than 600 IP addresses are launching thousands of exploit attempts against CVE-2023-22527 – a critical bug in out–of-date versions of Atlassian Confluence Data Center and Server – according…
Slug slimes aerospace biz AerCap with ransomware, brags about 1TB theft
Loanbase admits massive loss of customer data to thieves, too AerCap, the world’s largest aircraft leasing company, has reported a ransomware infection that occurred earlier this month, but claims it hasn’t yet suffered any financial losses yet and all its…
EFF adds Street Surveillance Hub so Americans can check who’s checking on them
‘The federal government has almost entirely abdicated its responsibility’ For a country that prides itself on being free, America does seem to have an awful lot of spying going on, as the new Street Surveillance Hub from the Electronic Frontier…
Ivanti and Juniper Networks accused of bending the rules with CVE assignments
Critics claim now-fixed vulnerabilities weren’t disclosed, flag up grouping of multiple flaws under one CVE Critics are accusing major tech companies of not sticking to the rules when it comes to registering vulnerabilities with the appropriate authorities.… This article has…
Subway’s data torpedoed by LockBit, ransomware gang claims
Fast food chain could face a footlong recovery process if allegations are true The LockBit ransomware gang is claiming an attack on submarine sandwich slinger Subway, alleging it has made off with a platter of data.… This article has been…
ICO fines spam slinging financial services biz
It’s all very well offering ‘Free Debt Help,’ but recipients were unwilling, says watchdog… A financial services company that illegally dispatched tens of thousands of spam messages promising to help the recipients magically wipe away their debts is itself now…
Safeguarding against the global ransomware threat
How Object First’s Ootbi delivers ransomware-proof and immutable backup storage that can be up and running in minutes Sponsored Feature Ransomware is used by cybercriminals to steal and encrypt critical business data before demanding payment for its restoration. It represents…
BreachForums admin ‘Pompourin’ sentenced to 20 years of supervised release
ALSO: Another UEFI flaw found; Kaspersky discovers iOS log files actually work; and a few critical vulnerabilities in brief Conor Brian Fitzpatrick – aka “Pompourin,” a former administrator of notorious leak site BreachForums – has been sentenced to 20 years…
Russians invade Microsoft exec mail while China jabs at VMware vCenter Server
Plus: Uncle Sam says Ivanti exploits ‘consistent with PRC’ snoops A VMware security vulnerability has been exploited by Chinese cyberspies since late 2021, according to Mandiant, in what has been a busy week for nation-state espionage news.… This article has…
Five ripped off IT giant with $7M+ in bogus work expenses, prosecutors claim
Account manager and pals blew it on hotels, cruise, fancy meals and more allegedly Five people have been accused of pulling off a “brazen” scam that involved submitting more than $7 million in fake work expense claims to an IT…
Thieves steal 35.5M customers’ data from Vans sneakers maker
But what kind of info was actually compromised? None of your business VF Corporation, parent company of clothes and footwear brands including Vans and North Face, says 35.5 million customers were impacted in some way when criminals broke into their…
IT consultant fined for daring to expose shoddy security
Spotting a plaintext password and using it in research without authorization deemed a crime A security researcher in Germany has been fined €3,000 ($3,300, £2,600) for finding and reporting an e-commerce database vulnerability that was exposing almost 700,000 customer records.……
US agencies warn made-in-China drones might help Beijing snoop on the world
It’s a bird, it’s a plane… it’s a flying menace out to endanger national security Two US government agencies, the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI), warned on Wednesday that drones made in China…
JPMorgan exec claims bank repels 45 billion cyberattack attempts per day
Assets boss also reckons she has more engineers than Amazon The largest bank in the United States repels 45 billion – yes, with a B – cyberattack attempts per day, one of its leaders claimed at the World Economic Forum…
Future of America’s Cyber Safety Review Board hangs in balance amid calls for rethink
Politics-busting, uber-transparent incident reviews require independence, less internal conflict As the US mulls legislation that would see the Cyber Safety Review Board (CSRB) become a permanent fixture in the government’s cyber defense armory, experts are calling for substantial changes in…
Ransomware attacks hospitalizing security pros, as one admits suicidal feelings
Untold harms of holding the corporate perimeter revealed in extensive series of interviews Ransomware attacks are being linked to a litany of psychological and physical illnesses reported by infosec professionals, and in some cases blamed for hospitalizations.… This article has…
Two more Citrix NetScaler bugs exploited in the wild
Just when you thought you had recovered from Bleed Two vulnerabilities in NetScaler’s ADC and Gateway products have been fixed – but not before criminals found and exploited them, according to the vendor.… This article has been indexed from The…
Google TAG: Kremlin cyber spies move into malware with a custom backdoor
The threat hunters believe COLDRIVER has used SPICA since at least November 2022 Russian cyberspies linked to the Kremlin’s Federal Security Service (FSB) are moving beyond their usual credential phishing antics and have developed a custom backdoor that they started…
Vast botnet hijacks smart TVs for prime-time cybercrime
8-year-old op responsible for DDoS attacks and commandeering broadcasts to push war material Security researchers have pinned a DDoS botnet that’s infected potentially millions of smart TVs and set-top boxes to an eight-year-old cybercrime syndicate called Bigpanzi.… This article has…
Enter the era of platform-based cloud security
How an integrated platform can streamline the management overhead, improve cloud security and boost threat visibility Sponsored Post Reports suggest that forward-looking organisations are ditching legacy point-based cloud security offerings and replacing them with more efficient integrated platforms which slash…
Insurance website’s buggy API leaked Office 365 password and a giant email trove
Pen-tester accessed more than 650,000 sensitive messages, and still can, at Indian outfit using Toyota SaaS Toyota Tsusho Insurance Broker India (TTIBI), an Indo-Japanese joint insurance venture, operated a misconfigured server that exposed more than 650,000 Microsoft-hosted email messages to…
Apple, AMD, Qualcomm GPU security hole lets miscreants snoop on AI training and chats
So much for isolation A design flaw in GPU drivers made by Apple, Qualcomm, AMD, and likely Imagination can be exploited by miscreants on a shared system to snoop on fellow users.… This article has been indexed from The Register…
What’s worse than paying an extortion bot that auto-pwned your database?
Paying one that lied to you and only saved the first 20 rows of each table Publicly exposed PostgreSQL and MySQL databases with weak passwords are being autonomously wiped out by a malicious extortion bot – one that marks who…
Windows Server 2022 patch is breaking apps for some users
Uninstall the update or edit the Windows registry to restore order The latest Windows Server 2022 patch has broken the Chrome browser, and short of uninstalling the update, a registry hack is the only way to restore service for affected…
Home improvement marketers dial up trouble from regulator
ICO slaps penalties on two businesses that collectively made more than 3 million cold calls Another week and yet another couple of pesky cold callers face fines from the UK’s data privacy watchdog for “bombarding” unsuspecting households with marketing messages…
Combination of cheap .cloud domains and fake Shark Tank news fuel unhealthy wellness scams
.SBS gTLD once owned by Australian broadcaster is another source of strife Scammers are buying up cheap domain names to host sites that sell dodgy health products using fake articles, according to cybercrime disruption outfit Netcraft.… This article has been…
Nokia walks the walk about its RAN to play on Uncle Sam’s China fears
It pays not to be Huawei, and the US military can be lucrative, too Comment A vendor establishing a business unit dedicated to government sales is not new or unusual. But Finnish telecommunications giant Nokia’s decision to do so in…
FBI: Beware of thieves building Androxgh0st botnets using stolen creds
Infecting networks via years-old CVEs that should have been patched by now Crooks are exploiting years-old vulnerabilities to deploy Androxgh0st malware and build a cloud-credential stealing botnet, according to the FBI and the Cybersecurity and Infrastructure Security Agency (CISA).… This…
Locking down the edge
Watch this webinar to find out how Zero Trust fits into the edge security ecosystem Commissioned Edge security is a growing headache. The attack surface is expanding as more operational functions migrate out of centralized locations and into distributed sites…
Patch now: Critical VMware, Atlassian flaws found
You didn’t have anything else to do this Tuesday, right? VMware and Atlassian today disclosed critical vulnerabilities and, while neither appear to have been exploited by miscreants yet, admins should patch now to avoid disappointment.… This article has been indexed…
Double trouble for VMware and Atlassian admins – critical flaws to fix
You didn’t have anything else to do this Tuesday, right? VMware and Atlassian today disclosed critical vulnerabilities and, while neither appear to have been exploited by miscreants yet, admins should patch now to avoid disappointment.… This article has been indexed…