More details released after devs allowed weeks to apply fixes We now know the remote code execution vulnerability in Apache Struts 2 disclosed back in November carries a near-maximum severity rating following the publication of the CVE.… This article has…
Category: The Register – Security
Lights out for 18 more DDoS booters in pre-Christmas Operation PowerOFF push
Holiday cheer comes in the form of three arrests and 27 shuttered domains The Europol-coordinated Operation PowerOFF struck again this week as cross-border cops pulled the plug on 27 more domains tied to distributed denial of service (DDoS) criminality.… This…
British Army zaps drones out of the sky with laser trucks
High-energy weapon proves its mettle in testing The British Army has successfully destroyed flying drones for the first time using a high-energy laser mounted on an armored vehicle. If perfected, the technology could form an effective counter-measure against drone attacks.… This article…
Firefox ditches Do Not Track because nobody was listening anyway
Few websites actually respect the option, says Mozilla When Firefox 135 is released in February, it’ll ship with one less feature: Mozilla plans to remove the Do Not Track toggle from its Privacy and Security settings. … This article has been…
Citrix goes shopping in Europe and returns with gifts for security-conscious customers
Acquires two companies that offer stuff for those on the nice list to keep naughty list types at bay Citrix has gone on a European shopping trip, and come home with its bag of gifts bulging thanks to a pair…
Blocking Chinese spies from intercepting calls? There ought to be a law
Sen. Wyden blasts FCC’s ‘failure’ amid Salt Typhoon hacks US telecoms carriers would be required to implement minimum cyber security standards and ensure their systems are not susceptible to hacks by nation-state attackers – like Salt Typhoon – under legislation…
Krispy Kreme Doughnut Corporation admits to hole in security
Belly-busting biz says it’s been hit by cowardly custards Doughnut slinger Krispy Kreme has admitted to an attack that has left many customers unable to order online.… This article has been indexed from The Register – Security Read the original…
Three more vulns spotted in Ivanti CSA, all critical, one 10/10
Patch up, everyone – that admin portal is mighty attractive to your friendly cyberattacker Ivanti just put out a security advisory warning of three critical vulnerabilities in its Cloud Services Application (CSA), including a perfect 10.… This article has been…
US names Chinese national it alleges was behind 2020 attack on Sophos firewalls
Also sanctions his employer – an outfit called Sichuan Silence linked to Ragnarok ransomware The US Departments of Treasury and Justice have named a Chinese business and one of its employees as the actors behind the 2020 exploit of a…
Microsoft holds last Patch Tuesday of the year with 72 gifts for admins
Twas the night before Christmas, and all through the house, patching was done with the click of a mouse Microsoft hasn’t added too much coal to the stocking this Patch Tuesday, with just 72 fixes, only one of which scored…
US military grounds entire Osprey tiltrotor fleet over safety concerns
Boeing-Bell V-22 can’t outfly its checkered past, it seems The US Navy, Air Force, and Marine Corps have grounded their fleet of Boeing-Bell-made Osprey V-22s on safety grounds.… This article has been indexed from The Register – Security Read the…
AMD secure VM tech undone by DRAM meddling
Boffins devise BadRAM attack to pilfer secrets from SEV-SNP encrypted memory Researchers have found that the security mechanism AMD uses to protect virtual machine memory can be bypassed with $10 of hardware – and perhaps not even that.… This article…
Fully patched Cleo products under renewed ‘zero-day-ish’ mass attack
Thousands of servers targeted while customers wait for patches Researchers at security shop Huntress are seeing mass exploitation of a vulnerability affecting three Cleo file management products, even on patched systems.… This article has been indexed from The Register –…
Heart surgery device maker’s security bypassed, data encrypted and stolen
Sounds like th-aorta get this sorted quickly A manufacturer of devices used in heart surgeries says it’s dealing with “a cybersecurity incident” that bears all the hallmarks of a ransomware attack.… This article has been indexed from The Register –…
Bitfinex heist gets the Netflix treatment after ‘cringey couple’ sentenced
Streamer’s trademark dramatic style takes on Bitcoin Bonnie and Clyde A documentary examining the 2016 Bitfinex burglars hits Netflix, bringing the curious case to living rooms for the first time.… This article has been indexed from The Register – Security…
WhatsApp finally fixes View Once flaw that allowed theft of supposedly vanishing pics
And it only took four months, tut WhatsApp has fixed a problem with its View Once feature, designed to protect people’s privacy with automatically disappearing pictures and videos.… This article has been indexed from The Register – Security Read the…
Police arrest suspect in murder of UnitedHealthcare CEO, with grainy pics the only tech involved
McDonald’s worker called it in, cops swooped, found ‘gun, suppressor, manifesto’ Police in Pennsylvania have arrested a man suspected of killing the CEO of insurer UnitedHealthcare in New York City, thanks to a McDonald’s employee who recognized the suspect in…
China’s Salt Typhoon recorded top American officials’ calls, says White House
No word yet on who was snooped on. Any bets? Chinese cyberspies recorded “very senior” US political figures’ calls, according to White House security boss Anne Neuberger.… This article has been indexed from The Register – Security Read the original…
Salt Typhoon recorded top US officials’ calls, says White House
No word yet on who. Any bets? Chinese cyberspies recorded “very senior” US political figures’ calls, according to White House security boss Anne Neuberger.… This article has been indexed from The Register – Security Read the original article: Salt Typhoon…
Crooks stole AWS credentials from misconfigured sites then kept them in open S3 bucket
ShinyHunters-linked heist thought to have been ongoing since March Exclusive A massive online heist targeting AWS customers during which digital crooks abused misconfigurations in public websites and stole source code, thousands of credentials, and other secrets remains “ongoing to this…