Company’s removal from ransomware gang’s leak blog could mean negotiations underway Xerox has officially confirmed that a cyber baddie broke into the systems of its US subsidiary – a week after INC Ransom claimed to have exfiltrated data from the…
Tag: The Register – Security
Formal ban on ransomware payments? Asking orgs nicely to not cough up ain’t working
With the average demand hitting $1.5 million, something’s gotta change Emsisoft has called for a complete ban on ransom payments following another record-breaking year of digital extortion.… This article has been indexed from The Register – Security Read the original…
Google password resets not enough to stop these info-stealing malware strains
Now every miscreant is jumping on Big G’s OAuth account security hole Security researchers say info-stealing malware can still access victims’ compromised Google accounts even after passwords have been changed.… This article has been indexed from The Register – Security…
Court hearings become ransomware concern after justice system breach
From legal proceedings to potential YouTube fodder The court system of Victoria, Australia, was subject to a suspected ransomware attack in which audiovisual recordings of court hearings may have been accessed.… This article has been indexed from The Register –…
CEO arranged his own cybersecurity, with predictable results
Cleaning up after hackers is easy compared to surviving the politics of consultancy On Call It’s the last Friday of 2023, but because the need for tech support never goes away neither does On Call, The Register’s Friday column in…
A tale of 2 casino ransomware attacks: One paid out, one did not
What can be learned from MGM’s and Caesars’ infosec moves Feature The same cybercrime crew broke into two high-profile Las Vegas casino networks over the summer, infected both with ransomware, and stole data belonging to tens of thousands of customers…
Kaspersky reveals previously unknown hardware ‘feature’ used in iPhone attacks
‘This is no ordinary vulnerability’ sec pros explain Kaspersky’s Global Research and Analysis Team (GReAT) has exposed a previously unknown ‘feature’ in Apple iPhones that allows attackers to bypass hardware-based memory protection.… This article has been indexed from The Register…
Iranian cyberspies target US defense orgs with a brand new backdoor
Also: International cops crackdown on credit card stealers and patch these critical vulns Iranian cyberspies are targeting defense industrial base organizations with a new backdoor called FalseFont, according to Microsoft.… This article has been indexed from The Register – Security…
Cyber sleuths reveal how they infiltrate the biggest ransomware gangs
How do you break into the bad guys’ ranks? Master the lingo and research, research, research Feature When AlphV/BlackCat’s website went dark this month, it was like Chrimbo came early for cybersecurity defenders, some of whom seemingly believed law enforcement…
Lapsus$ teen sentenced to indefinite detention in hospital after Nvidia, GTA cyberattacks
Arion Kurtaj will remain hospitalized until a mental health tribunal says he can leave Two British teens who were members of the Lapsus$ gang have been sentenced for their roles in a cyber-crime spree that included compromising Uber, Nvidia, and…
Four in five Apache Struts 2 downloads are for versions featuring critical flaw
Seriously, people – please check the stuff you fetch more carefully Security vendor Sonatype believes developers are failing to address the critical remote code execution (RCE) vulnerability in the Apache Struts 2 framework, based on recent downloads of the code.……
Mozilla decides Trusted Types is a worthy security feature
DOM-XSS attacks have become scarce on Google websites since TT debuted Mozilla last week revised its position on a web security technology called Trusted Types, which it has decided to implement in its Firefox browser.… This article has been indexed…
Data loss prevention isn’t rocket science, but NASA hasn’t made it work in Microsoft 365
Privacy review finds breach response plan is a mess, training could be better, but protection regime mostly holds up NASA’s Office of Inspector General has run its eye over the aerospace agency’s privacy regime and found plenty to like –…
Something nasty injected login-stealing JavaScript into 50K online banking sessions
Why keeping your PC secure and free of malware remains paramount IBM Security has dissected some JavaScript code that was injected into people’s online banking pages to steal their login credentials, saying 50,000 user sessions with more than 40 banks…
Cybercrooks book a stay in hotel email inboxes to trick staff into spilling credentials
Research highlights how major attacks like those exploiting Booking.com are executed Cybercriminals are preying on the inherent helpfulness of hotel staff during the sector’s busy holiday season.… This article has been indexed from The Register – Security Read the original…
Manchester’s finest drowning in paperwork as Freedom of Information requests pile up
Enforcement notice issued months after data regulator schooled police force Greater Manchester Police (GMP) must clear the backlog of hundreds of Freedom of Information (FOI) Act requests – some years old – or find itself in contempt of court.… This…
SSH shaken, not stirred by Terrapin vulnerability
No need to panic, but grab those updates or mitigations anyway just to be safe A vulnerability in the SSH protocol can be exploited by a well-placed adversary to weaken the security of people’s connections, if conditions are right.… This…
Philippines, South Korea, Interpol cuff 3,500 suspected cyber scammers, seize $300M
Alleged crims used AI to pose as friends, family, romantic partners – and sold dodgy NFTs A transnational police operation has resulted in the arrest of 3,500 alleged cybercriminals and the seizure of $300 million in cash and digital assets.……
Millions of Xfinity customers’ info, hashed passwords feared stolen in cyberattack
35M-plus Comcast user IDs accessed by intruder via Citrix Bleed Millions of Comcast Xfinity subscribers’ personal data – including potentially their usernames, hashed passwords, contact details, and secret security question-answers – was likely stolen by one or more miscreants exploiting…
Before you go away for Xmas: You’ve patched that critical Perforce Server hole, right?
Microsoft bug hunters highlight weaknesses in source-wrangling suite Four vulnerabilities in Perforce Helix Core Server, including one critical remote code execution bug, should be patched “immediately,” according to Microsoft, which spotted the flaws and disclosed them to the software vendor.……