News
Shhh! Microsoft, Intel, Google and more sign up to the Confidential Computing Consortium
The Linux Foundation has signed up the likes of Microsoft and Google for its Confidential Computing Consortium, a group with the laudable goal of securing sensitive data.…
Disgruntled bug-hunter drops Steam zero-day to get back at Valve for refusing him a bounty
A security bod angry at Valve's handling of bug reports has released a zero-day vulnerability affecting the games giant's flagship Steam app.…
The Joy of Six... critical security patches: Cisco small biz switches open to hijacking via web UI
Cisco has emitted a fresh round of software updates to address security holes in its network switches and controllers.…
Finally. Thanks so much, nerds. Google, Apple, Mozilla end government* internet spying for good
On Wednesday, Google, Apple, and Mozilla said their web browsers will block the Kazakhstan root Certificate Authority (CA) certificate – following reports that ISPs in the country have required customers to install a government-issued certificate that enables online spying.…
Here's a top tip: Don't trust the new guy – block web domains less than a month old. They are bound to be dodgy
IT admins could go a long way towards protecting their users from malware and other dodgy stuff on the internet if they ban access to any web domain less than a month old.…
Microsoft: Reckon our code is crap? Prove it and $30k could be yours
Having finally pushed out the first Beta preview of its Chromium-based browser, Microsoft has launched a bounty programme aimed at getting researchers to kick the tyres on its latest and greatest.…
Sorry script kiddies, hacktivism isn't cool anymore: No one cares about stuff that's easy-peasy to defend against
The youthful doings of US presidential wannabe Beto O'Rourke are in sharp decline, according to threat intel biz Recorded Future, which reckons folk have fallen out of love with hacktivism.…
Stuff like sophisticated government spyware is scary and all – but don't forget, a single .wmv file can pwn you via VLC
VideoLAN has issued an update to address a baker's dozen of CVE-listed security vulnerabilities in its widely used VLC player software.…
30+ countries, 160,000 emails, $4.2m in cyber-heists… maybe it's time for the Silence hacker crew to change its name
The rapidly growing hacking crew dubbed Silence, has – in less than three years – gone from ransacking small regional banks in Eastern Europe to stealing millions from some of the largest international banks.…
No REST for the wicked: Ruby gem hacked to siphon passwords, secrets from web devs
An old version of a Ruby software package called rest-client that was modified and released about a week ago has been removed from the Ruby Gems repository – because it was found to be deliberately leaking victims' credentials to a remote server.…
Huawei goes all <i>Art of War</i> on us: Switches on 'battle mode' and vows to 'dominate the world'
An internal memo to Huawei staff sent by boss Ren Zhengfei is long on military metaphors and warns that the company needs to go into "battle mode" to counter trade barriers put up by the United States.…
Breaker, breaker. Apple's iOS 12.4 update breaks jailbreak break, un-breaks the break. 10-4
iPhone hackers have discovered Apple's most recent iOS update, 12.4, released in July, accidentally reopened a code-execution vulnerability that was previously patched – a vulnerability that can be abused to jail-break iThings.…
The Pwn Star State: Nearly two dozen Texas towns targeted by tiresome ransomware
Twenty-three towns in Texas have been targeted with ransomware in what appears to be a coordinated attack.…
Dear Planet Earth: Patch Webmin now – zero-day exploit emerges for potential hijack hole in server control panel
The maintainers of Webmin – an open-source application for system administration tasks on Unix-flavored systems – have released Webmin version 1.930 and the related Usermin version 1.780 to patch a vulnerability that can be exploited to achieve remote code execution in certain configurations.…
Teen TalkTalk hacker ordered to pay £400k after hijacking popular Instagram account
One of the crew who hacked TalkTalk has been ordered to hand over £400,000 after seizing control of a high-profile Instagram account following a hack on Aussie telco Telstra.…
KNOB turns up the heat on Bluetooth encryption, hotels leak guest info, city hands $1m to crook, and much, much more
Roundup Let's run through all the bits and bytes of security news beyond what we've already covered. Also, don't forget our articles from this year's Black Hat, DEF CON, and BSides Las Vegas conferences in the American desert.…
iFrame clickjacking countermeasures appear in Chrome source code. And it only took *checks calendar* three years
Three years ago, Google software engineer Ali Juma proposed that Chrome should be modified to ignore recently moved iframe elements on web pages as a defense against clickjacking.…
Subcontractor's track record under spotlight as London Mayoral e-counting costs spiral
Concerns have been raised over a key supplier of an e-counting system for the London Mayoral elections in 2020.…
Chrome add-on warns netizens when they use a leaked password. Sometimes, they even bother to change it
Between February and March this year, after Google released a Chrome extension called Password Checkup to check whether people's username and password combinations had been stolen and leaked from website databases, computer scientists at the biz and Stanford University gathered anonymous telemetry from 670,000 people who installed the add-on.…
NSA asks Congress to permanently reauthorize spying program that was so shambolic, the snoops had shut it down
Analysis In the clearest possible sign that the US intelligence services live within their own political bubble, the director of national intelligence has asked Congress to reauthorize a spying program that the NSA itself decided to shut down after it repeatedly – and illegally – gathered the call records of millions of innocent Americans.…
Pages
