News
Microsoft quietly shuts down Windows shortcut flaw after years of espionage abuse
Microsoft has quietly closed off a critical Windows shortcut file bug long abused by espionage and cybercrime networks.…
Aisuru botnet turns Q3 into a terabit-scale stress test for the entire internet
The internet has spent the past three months ducking for cover as the Aisuru botnet hurled record-shattering DDoS barrages from an army of up to 4 million infected machines.…
TLS 1.3 includes welcome improvements, but still allows long-lived secrets
Systems Approach As we neared the finish line for our network security book, I received a piece of feedback from Brad Karp that my explanation of forward secrecy in the chapter on TLS (Transport Layer Security) was not quite right.…
Rust core library partly polished for industrial safety spec
Memory-safe Rust code can now be more broadly applied in devices that require electronic system safety, at least as measured by International Electrotechnical Commission (IEC) standards.…
'Exploitation is imminent' as 39 percent of cloud environs have max-severity React hole
A maximum-severity flaw in the widely used JavaScript library React, and several React-based frameworks including Next.js allows unauthenticated, remote attackers to execute malicious code on vulnerable instances. The flaw is easy to abuse, and mass exploitation is "imminent," according to security researchers.…
Here’s your worst nightmare: E-tailer resumes partial sales 45 days after ransomware attack
Japanese e-tailer Askul has resumed online sales, 45 days after a ransomware attack.…
Indian government reveals GPS spoofing at eight major airports
India’s Civil Aviation Minister has revealed that local authorities have detected GPS spoofing and jamming at eight major airports.…
Two Android 0-day bugs disclosed and fixed, plus 105 more to patch
Two high-severity Android bugs were exploited as zero-days before Google issued a fix, according to its December Android security bulletin. …
University of Pennsylvania joins list of victims from Clop's Oracle EBS raid
The University of Pennsylvania has become the latest victim of Clop's smash-and-grab spree against Oracle's E-Business Suite (EBS) customers, with the Ivy League school now warning more than a thousand individuals that their personal data was siphoned from its systems.…
Europol nukes Cryptomixer laundering hub, seizing €25M in Bitcoin
Law enforcement agencies in Germany and Switzerland have shut down cryptocurrency laundering platform Cryptomixer in Europe's latest pushback against cybercrime infrastructure.…
Kensington and Chelsea confirms IT outage was a data breach after all
Kensington and Chelsea Council has admitted that data was quietly lifted from its systems during last week's cyber meltdown, confirming that the outage was not just an IT faceplant but a bona fide data breach.…
FTC schools edtech outfit after intruder walked off with 10M student records
US edtech provider Illuminate Education just got dinged by the Federal Trade Commission for allegedly failing to keep an attacker from pilfering data on 10 million students.…
India demands smartphone makers install a government app on every handset
India’s government has issued a directive that requires all smartphone manufacturers to install a government app on every handset in the country and has given them 90 days to get the job done – and to ensure users can’t remove the code.…
Stealthy browser extensions waited years before infecting 4.3M Chrome, Edge users with backdoors and spyware
A seven-year malicious browser extension campaign infected 4.3 million Google Chrome and Microsoft Edge users with malware, including backdoors and spyware sending people's data to servers in China. And, according to Koi researchers, five of the extensions with more than 4 million installs are still live in the Edge marketplace.…
Four arrested in South Korea over massive IP camera snooping spree
Cybercrime suspects and offenders across three continents have been rounded up this week, with cases spanning hacked IP cameras in South Korea, evil twin Wi-Fi traps in Australia, and a dark web drug empire in rural England.…
Dutch study finds teen cybercrime is mostly just a phase
Young threat actors may be rebels without a cause. These cybercriminals typically grow out of their offending ways by the time they turn 20, according to data published by the Dutch government.…
South Korea's answer to Amazon admits breach exposed 33.7M customers
South Korean retail behemoth Coupang has admitted to a data breach that exposed the personal details of 33.7 million customers, turning the company's famed "Rocket Delivery" logistics empire into an express shipment for personal information.…
French Football Federation faces own-goal after club software data breach
The French Football Federation (FFF) has conceded that attackers broke into its member management software using a compromised account, scoring a match sheet's worth of player data in the process.…
Google and Apple ordered to stop fake government TXTs
Asia in Brief Singapore’s government last week told Google and Apple to prevent fake government messages.…
Swiss government says give M365, and all SaaS, a miss as it lacks end-to-end encryption
Infosec In Brief Switzerland’s Conference of Data Protection Officers, Privatim, last week issued a resolution calling on Swiss public bodies to avoid using hyperscale clouds and SaaS services due to security concerns.…
Pages
