by Paul Ducklin Remember the Log4Shell bug that showed up in Apache Log4j late in 2021? Log4j is one of the Apache Software Foundation’s many software projects (more than 350 at current count), and it’s a programming library that Java coders can use to manage logfiles in their own products. Logfiles are a vital part
Month: July 2022
Fewer people carry cash these days, kids included. This growing paperless reality fast-forwards the parenting task of educating kids on financial responsibility. As of 2021, most cash apps allow kids 13 and up to open accounts (previously, the age was 18). Kids can also get a cash app debit card for retail purchases. But while
Five months after announcing plans to disable Visual Basic for Applications (VBA) macros by default in the Office productivity suite, Microsoft appears to have rolled back its plans. “Based on feedback received, a rollback has started,” Microsoft employee Angela Robertson said in a July 6 comment. “An update about the rollback is in progress. I
Multiple Russian influence networks have been running disinformation and influence campaigns since May designed to sow division in the West over its support for Ukraine, according to Recorded Future. These efforts are being conducted by “state-controlled media, known covert intelligence outlets, and known propaganda and disinformation amplifiers” including ‘legitimate’ broadcasters like RT, disinformation outlets like Southfront,
by Paul Ducklin Just over a week ago, the newswires were abuzz with news of a potentially serious bug in the widely-used cryptographic library OpenSSL. Some headlines went as far as describing the bug as a possibly “worse-than-Heartbleed flaw”, which was dramatic language indeed. Heartbleed, as you may remember, was an incredibly high-profile data leakage
It’s a question we get a lot from parents: “How can I keep my kids safe when they are constantly hopping between so many different apps?” We get it, there’s a lot to stay on top and all of it changes constantly. Unfortunately, that question doesn’t have a simple answer. But there are some baseline
Here’s what to watch out for when buying or selling stuff on the online marketplace and how to tell if you’re being scammed Last year, Facebook Marketplace passed one billion global users. In so doing, it’s become a giant of the consumer-to-consumer space, allowing individual Facebook users to buy from and sell to each other
Researchers have disclosed a new large-scale cryptocurrency mining campaign targeting the NPM JavaScript package repository. The malicious activity, attributed to a software supply chain threat actor dubbed CuteBoi, involves an array of 1,283 rogue modules that were published in an automated fashion from over 1,000 different user accounts. “This was done using automation which includes
Google has released an update to its popular Chrome browser to fix four vulnerabilities, including one zero-day current being exploited by attackers. The new Chrome version 103.0.5060.114 will be rolled out to Windows users over the coming days and weeks, according to a Google advisory. It includes the high severity CVE-2022-2294, a heap buffer overflow bug in
by Paul Ducklin Google’s latest update to the Chrome browser fixes a varying number of bugs, depending on whether you’re on Android, Windows or Mac, and depending on whether you’re running the “stable channel” or the “extended stable channel“. Don’t worry if you find the the plethora of Google blog posts confusing… …we did too,
In the spirit of #PrideMonth, McAfee hosted month-long celebrations across the world. One of these was a live event hosted by the McAfee Pride Community with a guest speaker from the Resource Center that focused on the history of Pride, support, allyship, and belonging. We took a moment to ask our event guest speaker, Leslie
July may positively disrupt and adrenalize the old-fashioned Dynamic Application Security Scanning (DAST) market, despite the coming holiday season. The pathbreaking innovation comes from ImmuniWeb, a global application security company, well known for, among other things, its free Community Edition that processes over 100,000 daily security scans of web and mobile apps. Today, ImmuniWeb announced
An anonymous hacker has claimed to have stolen the personal information of 1 billion Chinese citizens, representing one of the biggest data breaches in history. Posting on the hacker forum Breach Forums last week, an online user posting under the name ‘ChinaDan’ said they obtained the information from a leaked Shanghai National Police database. They
by Paul Ducklin If you’re a Naked Security Pocast listener, you may remember, back in March 2022, that we spoke about a convicted cybercriminal from Canada by the name of Sebastien Vachon-Desjardins. By all accounts, he was part of several so-called Ransomware-as-a-Service (RaaS) gangs, such as REvil and NetWalker, where the actual ransomware attackers act
One in five organizations have teetered on the brink of insolvency after a cyberattack. Can your company keep hackers at bay? We all know cyber is a critical element of business risk. But how critical? Some boardrooms seem to pay little more than lip service to security and still manage to avoid serious repercussions. That’s
Change is a part of life, and nothing stays the same for too long, even with hacking groups, which are at their most dangerous when working in complete silence. The notorious REvil ransomware gang, linked to the infamous JBS and Kaseya, has resurfaced three months after the arrest of its members in Russia. The Russian
The British army’s Twitter and YouTube accounts were compromised by a malicious third party on Sunday and used to direct visitors to cryptocurrency scams. The Ministry of Defence (MoD) press office account took to Twitter at around 7pm local time to report the incident. “We are aware of a breach of the army’s Twitter and
Vulnerability coordination and bug bounty platform HackerOne on Friday disclosed that a former employee at the firm improperly accessed security reports submitted to it for personal gain. “The person anonymously disclosed this vulnerability information outside the HackerOne platform with the goal of claiming additional bounties,” it said. “In under 24 hours, we worked quickly to
Kaspersky security experts have discovered new malware targeting Microsoft Exchange servers belonging to several organizations worldwide. Dubbed “SessionManager” and first spotted by the company in early 2022, the backdoor enables threat actors to keep “persistent, update-resistant and rather stealth access to the IT infrastructure of a targeted organization.” According to Kaspersky, once propagated, SessionManager would enable
by Paul Ducklin The US Federal Bureau of Investigation (FBI) famously maintains a Ten Most Wanted Fugitives list. Currently, nine of them are men, suspected of 22 different offences between them: Accessory After the Fact Aiding and Abetting Armed Robbery Cocaine Importation Conspiracy Conspiracy to Commit Murder-for-Hire Conspiracy to Commit Violent Crimes in Aid of
The lead-up to the Canada Day festivities has brought a tax scam with it Even though the deadline to file taxes in Canada already passed on May 2nd, 2022, some people may have filed late or are still expecting their refund. Perhaps that’s why I received a phishing email yesterday purporting to come from the
Microsoft has detailed the evolving capabilities of toll fraud malware apps on Android, pointing out its “complex multi-step attack flow” and an improved mechanism to evade security analysis. Toll fraud belongs to a category of billing fraud wherein malicious mobile applications come with hidden subscription fees, roping in unsuspecting users to premium content without their
Microsoft’s Security Intelligence team has issued a new warning against a known cloud threat actor (TA) group. Tracked as 8220 and active since early 2017, the group would have now updated its malware toolset to breach Linux servers in order to install crypto miners as part of a long-running campaign. “The updates include the deployment
by Paul Ducklin We’ll tell this story primarily through the medium of images, because a picture is worth 1024 words. This cybercrime is a visual reminder of three things: It’s easy to fall for a phishing scam if you’re in a hurry. Cybercriminals don’t waste any time getting new scams going. 2FA isn’t a cybersecurity
As scammers continue to ask people to take fake surveys, can you recognize some common telltale signs you’re dealing with a scam? Scammers recently launched a campaign on WhatsApp where they trick unsuspecting victims into thinking that they qualify for a cash prize from Costco in exchange for taking a simple survey. Obviously this type
Following heightened worries that U.S. users’ data had been accessed by TikTok engineers in China between September 2021 and January 2022, the company sought to assuage U.S. lawmakers that it’s taking steps to “strengthen data security.” The admission that some China-based employees can access information from U.S. users came in a letter sent to nine
Human negligence, cyber skills gaps and disinterested C-level execs are putting manufacturing firms at an escalated risk of serious breaches, according to Capgemini. The global consultancy collected responses from cybersecurity leaders in 950 organizations to compile its report, Smart & Secure: Why smart factories need to prioritize cybersecurity. It revealed that while over half (51%) of respondents
by Paul Ducklin LISTEN NOW Click-and-drag on the soundwaves below to skip to any point. You can also listen directly on Soundcloud. With Doug Aamoth and Paul Ducklin. Intro and outro music by Edith Mudge. You can listen to us on Soundcloud, Apple Podcasts, Google Podcasts, Spotify, Stitcher and anywhere that good podcasts are found.
It’s Social Media Day! How are you celebrating? Reposting your very first profile picture from a decade ago? Sharing your most-loved status update or the photo you’re most proud of? This year, consider commemorating the day by learning more about how to keep your information safe. Enjoy your favorite platform, but be on the lookout
If the promise of a cash prize in return for answering a few questions sounds like a deal that is too good to be true, that’s because it is WhatsApp users should watch out for a scam that lures victims with the promise of cash rewards from retail giant Costco in return for completing a