Sensitive documents dumped on leak site amid claims of 3 TB of data stolen in total NHS Scotland says it managed to contain a ransomware group’s malware to a regional branch, preventing the spread of infection across the entire institution.……
Category: The Register – Security
These 17,000 unpatched Microsoft Exchange servers are a ticking time bomb
One might say this is a wurst case scenario The German Federal Office for Information Security (BIS) has issued an urgent alert about the poor state of Microsoft Exchange Server patching in the country.… This article has been indexed from…
AI hallucinates software packages and devs download them – even if potentially poisoned with malware
Simply look out for libraries imagined by ML and make them real, with actual malicious code. No wait, don’t do that In-depth Several big businesses have published source code that incorporates a software package previously hallucinated by generative AI.… This…
Execs in Japan busted for winning dev bids then outsourcing to North Koreans
Government issues stern warning over despot money-making scheme Two executives were issued arrest warrants in Japan on Wednesday, reportedly for charges related to establishing a business that outsourced work to North Korean IT engineers.… This article has been indexed from…
China encouraged armed offensive against Myanmar government to protest proliferation of online scams
Report claims Beijing is most displaced by junta’s failure to address slave labor scam settlements The military junta controlling Myanmar has struggled to control all of its territory thanks in part to China backing rebel forces as a way of…
Apple fans deluged with phony password reset requests
Beware support calls offering a fix Apple device owners, consider yourselves warned: a targeted multi-factor authentication bombing campaign is under way, with the goal of exhausting iUsers into allowing an unwanted password reset.… This article has been indexed from The…
Apple fans flooded with phony password reset requests
Beware support calls offering a fix Apple device owners, consider yourselves warned: A targeted multi-factor authentication bombing campaign is going around with the goal of exhausting iUsers into accidentally allowing a password reset.… This article has been indexed from The…
Majority of Americans now use ad blockers
We’re dreaming of a white list, because we’re just like the ones you used to know More than half of Americans are using ad blocking software, and among advertising, programming, and security professionals that fraction is more like two-thirds to…
‘Thousands’ of businesses at mercy of miscreants thanks to unpatched Ray AI flaw
Anyscale claims issue is ‘long-standing design decision’ – as users are raided by intruders Thousands of companies remain vulnerable to a remote-code-execution bug in Ray, an open-source AI framework used by Amazon, OpenAI, and others, that is being abused by…
Meta accused of snarfing people’s Snapchat data via traffic decryption
I ain’t afraid of no ghosts, but in this case… To spy on rival Snapchat and get data on how the app was being used, Meta – when it was operating as Facebook – allegedly initiated a program called Project…
Google reveals zero-day exploits in enterprise tech surged 64% last year
Crooks know where the big bucks are Zero-day exploits targeting enterprise-specific software and appliances are now outpacing zero-day bugs overall, according to Google’s threat hunting teams.… This article has been indexed from The Register – Security Read the original article:…
Street newspaper appears to have Big Issue with Qilin ransomware gang
The days of cybercriminals having something of a moral compass are over The parent company of The Big Issue, a street newspaper and social enterprise for homeless people, is wrestling with a cybersecurity incident claimed by the Qilin ransomware gang.……
The easy road to pervasive DLP
How Forcepoint Data Security Everywhere does what it says on the tin Sponsored Post The coronavirus pandemic appears to have changed the employment landscape forever, with estimates suggesting that up to a quarter of staff still spend some of their…
Uncle Sam’s had it up to here with ‘unforgivable’ SQL injection flaws
Software slackers urged to up their game The US has clearly had enough of software vendors shipping products with “unforgivable” vulnerabilities, and is now urging them to launch formal code reviews to stamp out SQL injection flaws.… This article has…
Ransomware can mean life or death at hospitals, but DEF CON hackers have a plan
ARPA-H joins the challenge, adds $20M to cash rewards Interview As ransomware gangs target critical infrastructure – especially hospitals and other healthcare organizations – DARPA has added another government agency partner to its Artificial Intelligence Cyber Challenge (AIxCC).… This article…
FreeBSD Foundation hands out Beacon gongs for safer software
Multiple CHERI-related projects win money for important research that prizes safety over speed The inaugural Beacon Awards has handed three prizes to projects working on safer software for CHERI-enabled hardware running on the CheriBSD operating system.… This article has been…
UK elections are unaffected by China’s cyber-interference, says deputy PM
Sanctions galore for APT31, which has been blamed for two major attacks on democracy The UK’s deputy prime minister, Oliver Dowden, says China has been unsuccessful in its attempts to undermine UK elections.… This article has been indexed from The…
Row breaks out over true severity of two DNSSEC flaws
Some of us would be happy being rated 7.5 out of 10, just sayin’ Two DNSSEC vulnerabilities were disclosed last month with similar descriptions and the same severity score, but they are not the same issue.… This article has been…
New Zealand to world: China attacked us, too!
Reveals 2021 incident that saw parliamentary agencies briefly probed The government of South Pacific island nation New Zealand has revealed that it, too, has been attacked by China.… This article has been indexed from The Register – Security Read the…
US charges Chinese nationals with cyber-spying on pretty much everyone for Beijing
Plus: Alleged front sanctioned, UK blames PRC for Electoral Commission theft, and does America need a Cyber Force? The United States on Monday accused seven Chinese men of breaking into computer networks, email accounts, and cloud storage belonging to numerous…
Chinese nationals charged with cyber-spying on US biz and more for Beijing
Plus: Alleged front sanctioned, UK blames PRC for Electoral Commission theft, and does America need a Cyber Force? The United States on Monday accused seven Chinese men of breaking into computer networks, email accounts, and cloud storage belonging to numerous…
Over 170K users caught up in poisoned Python package ruse
Supply chain attack targeted GitHub community of Top.gg Discord server More than 170,000 users are said to have been affected by an attack using fake Python infrastructure with “successful exploitation of multiple victims.”… This article has been indexed from The…
Over 170K users hit by poisoned Python package ruse
Supply chain attack targeted GitHub community of Top.gg Discord server More than 170,000 users have been affected by an attack using fake Python infrastructure with “successful exploitation of multiple victims.”… This article has been indexed from The Register – Security…
Tech trade union confirms cyberattack behind IT, email outage
Systems have been pulled offline as a precaution Exclusive The Communications Workers Union (CWU), which represents hundreds of thousands of employees in sectors across the UK economy including tech and telecoms, is currently working to mitigate a cyberattack.… This article…
Mozilla fixes $100,000 Firefox zero-days following two-day hackathon
Users may have to upgrade twice to protect their browsers Mozilla has swiftly patched a pair of critical Firefox zero-days after a researcher debuted them at a Vancouver cybersec competition.… This article has been indexed from The Register – Security…
GoFetch security exploit can’t be disabled on M1 and M2 Apple chips
For now, cryptographic work should be run on slower Icestorm cores The GoFetch vulnerability found on Apple M-series and Intel Raptor Lake CPUs has been further unpacked by the researchers who first disclosed it.… This article has been indexed from…
Time to examine the anatomy of the British Library ransomware nightmare
Mistakes years in the making tell a universal story that must not be ignored Opinion Quiz time: name one thing you know about the Library of Alexandria. Points deducted for “it’s a library. In Alexandria.” Looking things up is cheating…
That Asian meal you eat on holidays could launder money for North Korea
United Nations finds IT contract and crypto scams are just two of DPRK’s illicit menu items If you dine out at an Asian restaurant on your next holiday, the United Nations thinks your meal could help North Korea to launder…
Microsoft confirms memory leak in March Windows Server security update
ALSO: Viasat hack wiper malware is back, users are the number one cause of data loss, and critical vulns Infosec in brief If your Windows domain controllers have been crashing since a security update was installed earlier this month, there’s…
Some 300,000 IPs vulnerable to this Loop DoS attack
Easy to exploit, not yet exploited, not widely patched – pick three As many as 300,000 servers or devices on the public internet are thought to be vulnerable right now to the recently disclosed Loop Denial-of-Service technique that works against…
Vans claims cyber crooks didn’t run off with its customers’ financial info
Just 35.5M names, addresses, emails, phone numbers … no biggie Clothing and footwear giant VF Corporation is letting 35.5 million of its customers know they may find themselves victims of identity theft following last year’s security breach.… This article has…
Russia’s Cozy Bear caught phishing German politicos with phony dinner invites
Forget the Riesling, bring on the WINELOADER The Kremlin’s cyberspies targeted German political parties in a phishing campaign that used emails disguised as dinner party invitations, according to Mandiant.… This article has been indexed from The Register – Security Read…
Chinese snoops use F5, ConnectWise bugs to sell access into top US, UK networks
Crew may well be working under contract for Beijing Chinese spies exploited a couple of critical-severity bugs in F5 and ConnectWise equipment earlier this year to sell access to compromised US defense organizations, UK government agencies, and hundreds of other…
Chinese snoops use F5, ConnectWise bugs to sell access to top US, UK networks
Crew may well be working under contract for Beijing Chinese spies exploited a couple of critical-severity bugs in F5 and ConnectWise equipment earlier this year to sell access to compromised US defense organizations, UK government agencies, and hundreds of other…
3 million doors open to uninvited guests in keycard exploit
As months go by without fixes, hotels take the scenic route to securing rooms Around 3 million doors protected by popular keycard locks are thought to be vulnerable to security flaws that allow miscreants to quickly slip into locked rooms.……
Hardware-level Apple Silicon vulnerability can leak cryptographic keys
Short of rearchitecting hardware, the fix will seriously degrade performance Apple is having its own Meltdown/Spectre moment with a new side-channel vulnerability found in the architecture of Apple Silicon processors that gives malicious apps the ability to extract cryptographic keys. ……
NVD slowdown leaves thousands of vulnerabilities without analysis data
Security world reacts as NIST does a lot less of oft criticized, ‘almost always thankless’ work Opinion The United States National Institute of Standards and Technology (NIST) has almost completely stopped adding analysis to Common Vulnerabilities and Exposures (CVEs) listed…
Truck-to-truck worm could infect – and disrupt – entire US commercial fleet
The device that makes it possible is required in all American big rigs, and has poor security Vulnerabilities in common Electronic Logging Devices (ELDs) required in US commercial trucks could be present in over 14 million medium- and heavy-duty rigs,…
FBI v the bots: Feds urge denial-of-service defense after critical infrastructure alert
You better watch out, you better not cry, better not pout, they’re telling you why The US government has recommended a series of steps that critical infrastructure operators should take to prevent distributed-denial-of-service (DDoS) attacks.… This article has been indexed…
Microsoft faces bipartisan criticism for alleged censorship on Bing in China
Redmond says it does what it’s told, but still thinks users are better off Microsoft is the subject of growing criticism in the US over allegations that its Bing search engine censors results for users in China that relate to…
Congress votes unanimously to ban brokers selling American data to enemies
At least we can all agree on something The US House of Representatives has passed a bill that would prohibit data brokers from selling Americans’ data to foreign adversaries with an unusual degree of bipartisan support: It passed without a…
Yacht dealer to the stars attacked by Rhysida ransomware gang
MarineMax may be in choppy waters after ‘stolen data’ given million-dollar price tag The Rhysida ransomware group claims it was responsible for the cyberattack at US luxury yacht dealer MarineMax earlier this month.… This article has been indexed from The…
UK council won’t say whether two-week ‘cyber incident’ impacted resident data
Security experts insist ransomware is involved but Leicester zips its lips Leicester City Council continues to battle a suspected ransomware attack while keeping schtum about the key details.… This article has been indexed from The Register – Security Read the…
Exposed: Chinese smartphone farms that run thousands of barebones mobes to do crime
Operators pack twenty phones into a chassis – then rack ’em and stack ’em ready to do evil Chinese upstarts are selling smartphone motherboards – and kit to run and manage them at scale – to operators of outfits that…
It’s 2024 and North Korea’s Kimsuky gang is exploiting Windows Help files
New infostealer may indicate a shift in tactics – and maybe targets too, beyond Asia North Korea’s notorious Kimsuky cyber crime gang has commenced a campaign using fresh tactics, according to infosec tools vendor Rapid7.… This article has been indexed…
It’s tax season, and scammers are a step ahead of filers, Microsoft says
Phishing season started early with crims intent on the hooking early filers As the digital wolves dress in sheep’s tax forms, Microsoft has thrown a spotlight on a crafty 2024 phishing expedition, unraveled in January, that preys on the unsuspecting…
US task force aims to plug security leaks in water sector
From a trickle to a flood, threats now seen as too great to ignore US government is urging state officials to band together to improve the cybersecurity of the country’s water sector amid growing threats from foreign adversaries.… This article…
London Clinic probes claim staffer tried to peek at Princess Kate’s records
First: not being able buy a meat pie with a credit card. Now this. The London Clinic where the Princess of Wales had surgery at the start of this year says it is investigating claims that an employee had tried…
Serial extortionist of medical facilities pleads guilty to cybercrime charges
Robert Purbeck even went as far as threatening a dentist with the sale of his child’s data A cyberattacker and extortionist of a medical center has pleaded guilty to federal computer fraud and abuse charges in the US.… This article…
Stalkerware usage surging, despite data privacy concerns
At least 31,031 people affected last year Stalkerware has reached “pandemic proportions,” according to Kaspersky, which documented a total of 31,031 people affected by the intrusive software in 2023 – up almost six percent on the prior year.… This article…
Five Eyes tell critical infra orgs: take these actions now to protect against China’s Volt Typhoon
Unless you want to be the next Change Healthcare, that is The Feds and friends yesterday issued yet another warning about China’s Volt Typhoon gang, this time urging critical infrastructure owners and operators to protect their facilities against destructive cyber…
Australian techie jailed for accessing museum’s accounting system and buying himself stuff
Also down under, researchers find security-cleared workers leaking details of their gigs An Australian IT contractor has been sentenced to 30 months jail for ripping off the National Maritime Museum.… This article has been indexed from The Register – Security…
Crypto scams more costly to the US than ransomware, Feds say
Latest figures paint grim picture of how viciously the elderly are targeted The FBI says investment fraud was the form of cybercrime that incurred the greatest financial loss for Americans last year.… This article has been indexed from The Register…
Beijing-backed cyberspies attacked 70+ orgs across 23 countries
Plus potential links to I-Soon, researchers say Chinese cyberspies have compromised at least 70 organizations, mostly government entities, and targeted more than 116 victims across the globe, according to security researchers.… This article has been indexed from The Register –…
Crypto scams more costly to the US than ransomware, feds say
Latest figures paint grim picture of how viciously the elderly are targeted The Federal Bureau of Investigations (FBI) says investment fraud was the form of cybercrime that incurred the greatest financial loss for Americans last year.… This article has been…
Crypto wallet providers urged to rethink security as criminals drain them of millions
Innovative Ethereum feature exploited as victims say goodbye to assets Infosec researchers are noting rising cryptocurrency attacks and have encouraged wallet security providers to up their collective game.… This article has been indexed from The Register – Security Read the…
Atos says Airbus flew off, no longer interested in infosec and big data biz
Ailing tech integrator takes a hard hit… share price down by up to 20% this morning Atos’ share price sank as much as 20 percent this morning on confirmation that Airbus is no longer interested in buying the big data…
Don’t be like these 900+ websites and expose millions of passwords via Firebase
Warning: Poorly configured Google Cloud databases spill billing info, plaintext credentials At least 900 websites built with Google’s Firebase, a cloud database, have been misconfigured, leaving credentials, personal info, and other sensitive data inadvertently exposed to the public internet, according…
Fujitsu reveals malware installed on internal systems, risk of customer data spill
Sneaky software slips past shields, spurring scramble Fujitsu has confirmed that miscreants have compromised some of its internal computers, deployed malware, and may have stolen some customer information.… This article has been indexed from The Register – Security Read the…
More than 133,000 Fortinet appliances still vulnerable to month-old critical bug
A huge attack surface for a vulnerability with various PoCs available The volume of Fortinet boxes exposed to the public internet and vulnerable to a month-old critical security flaw in FortiOS is still extremely high, despite a gradual increase in…
Cyber baddies leak 70M+ files online, claim they’re from AT&T
Telco reckons data is old, isn’t from its systems More than 70 million records, allegedly stolen from AT&T in 2021, were dumped on a cybercrime forum at the weekend.… This article has been indexed from The Register – Security Read…
Cyberattack gifts esports pros with cheats, forcing Apex Legends to postpone tournament
Virtual gunslingers forcibly became cheaters via mystery means Esports pros competing in the Apex Legends Global Series (ALGS) Pro League tournament were forced to abandon their match today due to a suspected cyberattack.… This article has been indexed from The…
Infosec teams must be allowed to fail, argues Gartner
But failing to recover from incidents is unforgivable because ‘adrenalin does not scale’ Zero tolerance of failure by information security professionals is unrealistic, and makes it harder for cyber security folk to do the essential part of their job: recovering…
Filipino police free hundreds of slaves toiling in romance scam operation
875 workers liberated after falling for promises of lucrative work, nine arrested Filipino police rescued 875 “workers” – including 504 foreigners – in a raid late last week on a firm that posed as an online gaming company but in…
Protecting distributed branch office environments from ransomware
As ransomware becomes more sophisticated, detection tools should be upgraded to cover every site and location Sponsored Feature Ransomware gangs that steal and encrypt vital business data before extorting payment for its decryption and restoration are ramping up global attacks…
ChatGPT side-channel attack has easy fix: token obfuscation
ALSO: Roblox-themed infostealer on the prowl, telco insider pleads guilty to swapping SIMs, and some crit vulns in brief Almost as quickly as a paper came out last week revealing an AI side-channel vulnerability, Cloudflare researchers have figured out how…
In the rush to build AI apps, please, please don’t leave security behind
Supply-chain attacks are definitely possible and could lead to data theft, system hijacking, and more Feature While in a rush to understand, build, and ship AI products, developers and data scientists are being urged to be mindful of security and…
As if working at Helldesk weren’t bad enough, IT helpers now targeted by cybercrims
Wave of Okta attacks mark what researchers are calling the biggest security trend of the year IT helpdesk workers are increasingly the target of cybercriminals – a trend researchers have described as “the most noteworthy” of the past year.… This…
Cop shop rapped for ‘completely avoidable’ web form blunder
Made public highly sensitive data on complaints about Metropolitan Police Service The London Mayor’s Office for Policing and Crime is being rapped by regulators for untidy tech practices that made public the personal data of hundreds of people who filed…
Forget TikTok – Chinese spies want to steal IP by backdooring digital locks
Uncle Sam can use this snooping tool, too, but that’s beside the point There’s another Chinese-manufactured product – joining the likes of TikTok, cars and semiconductors – that poses a national security risk to Americans: electronic locks, such as those…
FTC goes undercover to probe suspected antivirus scam, scores $26M settlement
On the internet, men are men, lonely single moms are men, and vulnerable PC users are federal agents A pair of tech support businesses accused of swindling marks out of their hard-earned cash have agreed to cough up a $26…
LockBit ransomware kingpin gets 4 years behind bars
Canadian said to have turned to a life of cybercrime during pandemic, now must pay the price – literally A LockBit ransomware kingpin has been sentenced to almost four years behind bars and ordered to pay more than CA$860,000 ($635,000,…
Google gooses Safe Browsing with real-time protection that doesn’t leak to ad giant
Rare occasion when you do want Big Tech to make a hash of it Google has enhanced its Safe Browsing service to enable real-time protection in Chrome for desktop, iOS, and soon Android against risky websites, without sending browsing history…
Record breach of French government exposes up to 43 million people’s data
Zut alors! Department for registering and helping unemployed people broken into A French government department – responsible for registering and assisting unemployed people – is the latest victim of a mega data breach that compromised the information of up to…
International effort to disrupt cybercrime moves into operational phase
Will the WEF experiment work? The Cybercrime Atlas, a massive undertaking that aims to disrupt cybercriminals across the globe, enters its operational phase in 2024, two years after organizers laid the groundwork at the RSA Conference.… This article has been…
US to probe Change Healthcare’s data protection standards as lawsuits mount
Services slowly coming back online but providers still struggling Change Healthcare is being investigated over the alleged 6 TB data theft by the ALPHV ransomware group as it continues recovery efforts.… This article has been indexed from The Register –…
US Congress goes bang, bang, on TikTok sale-or-ban plan
Bill proposes to do to China what China already does to the US – make life hard for foreign social networks The United States House of Representatives on Wednesday passed the Protecting Americans from Foreign Adversary Controlled Applications Act –…
Nissan to let 100,000 Aussies and Kiwis know their data was stolen in cyberattack
Akira ransomware crooks brag of swiping thousands of ID documents during break-in Over the next few weeks, Nissan Oceania will make contact with around 100,000 people in Australia and New Zealand whose data was pilfered in a December 2023 attack…
Nissan to alert 100,000 Aussies and Kiwis about data loss incident
Akira ransomware crooks brag of stealing thousands of ID documents during break-in Over the next few weeks, Nissan Oceania will make contact with around 100,000 people in Australia and New Zealand whose data was pilfered in a December 2023 attack…
Poking holes in Google tech bagged bug hunters $10M
A $2M drop from previous year. So … things are more secure? Google awarded $10 million to 632 bug hunters last year through its vulnerability reward programs.… This article has been indexed from The Register – Security Read the original…
Microsoft Copilot for Security prepares for April liftoff
Automated AI helper intended to make security more manageable Microsoft Copilot for Security, a subscription AI security service, will be generally available on April 1, 2024, the company announced on Wednesday.… This article has been indexed from The Register –…
Stanford University failed to detect ransomware intruders for 4 months
27,000 individuals had data stolen, which for some included names and social security numbers Stanford University says the cybersecurity incident it dealt with last year was indeed ransomware, which it failed to spot for more than four months.… This article…
Researchers jimmy OpenAI’s and Google’s closed models
Infosec folk aren’t thrilled that if you poke APIs enough, you learn AI’s secrets Boffins have managed to pry open closed AI services from OpenAI and Google with an attack that recovers an otherwise hidden portion of transformer models.… This…
Reducing the cloud security overhead
Why creating a layered defensive strategy that includes security by design can help address cloud challenges Sponsored Feature The world is filled with choices. Whether it’s the 20 different types of shampoo on offer at the grocery store, or the…
March Patch Tuesday sees Hyper-V join the guest-host escape club
Critical bugs galore among 61 Microsoft fixes, 56 from Adobe, a dozen from SAP, and a fistful from Fortinet Patch Tuesday Microsoft’s monthly patch drop has arrived, delivering a mere 61 CVE-tagged vulnerabilities – none listed as under active attack…
Meta sues ex infra VP for allegedly stealing top-secret datacenter blueprints
Exec accused of using own work PC to swipe confidential AI and staffing docs for stealth cloud startup An ex-Meta veep has been sued by his former bosses for “brazenly disloyal and dishonest conduct” – and by that, they mean…
Biden’s budget proposal boosts CISA funding to $3B
Plus almost $1.5b for health-care cybersecurity US President Joe Biden has asked Congress to approve an extra $103 million in funding for the Cybersecurity and Infrastructure Security Agency, bringing CISA’s total budget to $3 billion.… This article has been indexed…
Biden’s budget proposal boosts CISA funding to $3b
Plus almost $1.5b for health-care cybersecurity US President Joe Biden has asked Congress to approve an extra $103 million in funding for the Cybersecurity and Infrastructure Security Agency, bringing CISA’s total budget to $3 billion.… This article has been indexed…
JetBrains is still mad at Rapid7 for the ransomware attacks on its customers
War of words wages on between vendors divided Last week, we wrote about how security outfit Rapid7 threw JetBrains, the company behind the popular CI/CD platform TeamCity, under the bus over allegations of silent patching. Now, JetBrains has gone on…
UK council yanks IT systems and phone lines offline following cyber ambush
Targeting recovery this week, officials still trying to ‘dentify the nature of the incident’ Leicester City Council says IT systems and a number of its critical service phone lines will remain down until later this week at the earliest following…
French government sites disrupted by très grande DDoS
Russia and Sudan top the list of suspects Several French government websites have been disrupted by a severe distributed denial of service attack.… This article has been indexed from The Register – Security Read the original article: French government sites…
White House and lawmakers increase pressure on UnitedHealth to ease providers’ pain
US senator calls cyber attack ‘inexcusable,’ calls for mandatory security rules The Biden administration and US lawmakers are turning up the pressure on UnitedHealth group to ease medical providers’ pain after the ransomware attack on Change Healthcare, by expediting payments…
Kremlin accuses America of plotting cyberattack on Russian voting systems
Don’t worry, we have a strong suspicion Putin’s still gonna win The Kremlin has accused the United States of meddling in Russia’s upcoming presidential election, and even accused Uncle Sam of planning a cyberattack on the country’s online voting system.……
British Library pushes the cloud button, says legacy IT estate cause of hefty rebuild
Five months in and the mammoth post-ransomware recovery has barely begun The British Library says legacy IT is the overwhelming factor delaying efforts to recover from the Rhysida ransomware attack in late 2023.… This article has been indexed from The…
How do you lot feel about Pay or say OK to ads model, asks ICO
And does it count as consent? The UK’s Information Commissioner’s Office (ICO) has opened a consultation on “consent or pay” business models. We’re sure readers of The Register will have a fair few things to say.… This article has been…
Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability
PLUS: NSA shares cloud security tips; Infosec training for Jordanian women; Critical vulnerabilities Infosec in brief Cybersecurity researchers informed Microsoft that Notorious North Korean hackers Lazarus Group discovered the “holy grail” of rootkit vulnerabilities in Windows last year, but Redmond…
Cybercrime crew Magnet Goblin bursts onto the scene exploiting Ivanti holes
Plus: CISA pulls plug on couple of systems feared compromised There’s yet another group of miscreants out there hijacking insecure Ivanti devices: A new, financially motivated gang dubbed Magnet Goblin has emerged from the shadowy digital depths with a knack…
Microsoft confirms Russian spies stole source code, accessed internal systems
Still “no evidence” of any compromised customer-facing systems, we’re told Microsoft has now confirmed that the Russian cyberspies who broke into its executives’ email accounts stole source code and gained access to internal systems. The Redmond giant has characterized the…
Change Healthcare registers pulse after crippling ransomware attack
Remaining services are expected to return in the coming weeks after $22M ALPHV ransom Change Healthcare has taken the first steps toward a full recovery from the ransomware attack in February by bringing its electronic prescription services back online.… This…
Swiss cheese security? Play ransomware gang milks government of 65,000 files
Classified docs, readable passwords, and thousands of personal information nabbed in Xplain breach The Swiss government had around 65,000 files related to it stolen by the Play ransomware gang during an attack on an IT supplier, its National Cyber Security…