Cicada ransomware may be a BlackCat/ALPHV rebrand and upgrade
Researchers find many similarities, and nasty new customizations such as embedded compromised user credentials
Research04 Sep 2024 |
Research
Novel attack on Windows spotted in phishing campaign run from and targeting China
Resources hosted at Tencent Cloud involved in Cobalt Strike campaign
Research02 Sep 2024 | 3
Tired of airport security queues? SQL inject yourself into the cockpit, claim researchers
Updated Infosec hounds say they spotted vulnerability during routine travel in the US
Research30 Aug 2024 | 28
31.5M invoices, contracts, patient consent forms, and more exposed to the internet
Exclusive Unprotected database with 12 years of biz records yanked offline
CSO26 Aug 2024 | 28
110K domains targeted in 'sophisticated' AWS cloud extortion campaign
Updated If you needed yet another reminder of what happens when security basics go awry
Research21 Aug 2024 | 4
Digital wallets can allow purchases with stolen credit cards
Researchers find it's possible to downgrade authentication checks, and shabby token refresh policies
Research20 Aug 2024 | 36
Multiple flaws in Microsoft macOS apps unpatched despite potential risks
Windows giant tells Cisco Talos it isn't fixing them
Research19 Aug 2024 | 21
Google raps Iran's APT42 for raining down spear-phishing attacks
US politicians and Israeli officials among the top targets for the IRGC’s cyber unit
Research15 Aug 2024 | 1
China-linked cyber-spies infect Russian govt, IT sector
No, no, go ahead, don't let us stop you, Xi
Research15 Aug 2024 | 17
Who uses LLM prompt injection attacks IRL? Mostly unscrupulous job seekers, jokesters and trolls
Because apps talking like pirates and creating ASCII art never gets old
AI + ML13 Aug 2024 | 17
Raptor Lake microcode limits Intel chips to a mere 1.55 volts to prevent CPU destruction
Is that a lot? Depends on the context. GHz, no. Voltage, yes
Personal Tech09 Aug 2024 | 28
It's 2024 and we're just getting round to stopping browsers insecurely accessing 0.0.0.0
Can't reach someone's private server on localhost from outside? No problem
Research09 Aug 2024 | 39
Cloud storage lockers from Microsoft and Google used to store and spread state-sponsored malware
Black Hat Why run your own evil infrastructure when Big Tech offers robust tools hosted at trusted URLs?
Black Hat and DEF CON08 Aug 2024 | 2
Faulty instructions in Alibaba's T-Head C910 RISC-V CPUs blow away all security
Black Hat Let's get physical, physical ... I don't wanna hear your MMU talk
Black Hat and DEF CON07 Aug 2024 | 48
Small CSS tweaks can help nasty emails slip through Outlook's anti-phishing net
A simple HTML change and the warning is gone!
Research07 Aug 2024 | 13
SharpRhino malware targets IT admins – Hunters International gang suspected
Fake Angry IP Scanner will make you furious - or maybe remind you of how the Hive gang went about its banal business
Security07 Aug 2024 |
Georgia's voter portal gets a crash course in client versus backend input validation
Trying to cancel a citizen's registration would be caught by humans no matter what the page said, officials say
Research07 Aug 2024 | 36
Bad apps bypass Windows security alerts for six years using newly unveiled trick
Windows SmartScreen and Smart App Control both have weaknesses of which to be wary
Research06 Aug 2024 | 16
Sneaky SnakeKeylogger slithers into Windows inboxes to steal sensitive secrets
Malware logs users' keystrokes, pilfers credentials, exfiltrates data
Research05 Aug 2024 | 15
DARPA suggests turning old C code automatically into Rust – using AI, of course
Who wants to make a TRACTOR pull request?
Research03 Aug 2024 | 146
Popular
Google says replacing C/C++ in firmware with Rust is easy
Not so much when trying to convert coding veterans
Pat Gelsinger's grand plan to reinvent Intel is in jeopardy
Comment Foundry faces a reckoning
To patch this server, we need to get someone drunk
On Call When maintenance windows are hard to open, a little lubrication helps
FTC urged to stop tech makers downgrading devices after you've bought them
Some brick devices they'd rather not support, kill apps that drive functions, or add post-sale subscriptions
Datacenters to emit 3x more carbon dioxide because of generative AI
Carbon capture outfits could be making up to $45B, say analysts
Foot-thick wall workaround: Gigabit network links beamed through solid concrete
Makes cabling a bit less onerous, says WaveCore maker
SQL king Larry Ellison becomes sequel sultan with controlling interest in Paramount Global
Oh, great: another tech billionaire owns a media company – although his son probably runs the show
VMware revenue bounces for Broadcom, chips were a little undercooked
CEO says market for non-AI silicon has bottomed out
NASA's solar sailing spacecraft is tumbling – but that's part of the plan
Who needs fuel – or even engines – when you could use the sun to push a spacecraft along?
Dutch government takes ASML export measures off Uncle Sam's hands
Photolithography giant assures customers it is under no new restrictions
STORIES
Russia takes aim at Sitting Ducks domains, bags 30,000+
Eight-year-old domain hijacking technique still claiming victims
Research31 Jul 2024 |
Proofpoint phishing palaver plagues millions with 'perfectly spoofed' emails from IBM, Nike, Disney, others
They DKIM here, they DKIM there
Research30 Jul 2024 | 33
Meta's AI safety system defeated by the space bar
'Ignore previous instructions' thwarts Prompt-Guard model if you just add some good ol' ASCII code 32
AI + ML29 Jul 2024 | 57
Malware crew Stargazers Goblin used 3,000 GitHub accounts to make bank
May even have targeted other malware gangs, and infosec researchers
Cyber-crime26 Jul 2024 | 9
Beware of fake CrowdStrike domains pumping out Lumma infostealing malware
PSA: Only accept updates via official channels ... ironically enough
Malware Month25 Jul 2024 | 3
FYI: Data from deleted GitHub repos may not actually be deleted
And the forking Microsoft-owned code warehouse doesn't see this as much of a problem
CSO25 Jul 2024 | 49
Oops. Apple relied on bad code while flaming Google Chrome's Topics ad tech
Yes, you can be fingerprinted and tracked via Privacy Sandbox – tho the risk isn't as high as feared
Personal Tech24 Jul 2024 | 8
Forget security – Google's reCAPTCHA v2 is exploiting users for profit
Updated Web puzzles don't protect against bots, but humans have spent 819 million unpaid hours solving them
Security24 Jul 2024 | 73
How did a CrowdStrike file crash millions of Windows computers? We take a closer look at the code
Analysis Maybe next time some staged rollouts? A bit of QA too?
CSO23 Jul 2024 | 119
Russia’s FIN7 is peddling its EDR-nerfing malware to ransomware gangs
Major vendors' products scuppered by novel techniques
Research18 Jul 2024 | 5
Release the hounds! Securing datacenters may soon need sniffer dogs
Nothing else can detect attackers with implants designed to foil physical security
Security18 Jul 2024 | 35
Ransomware continues to pile on costs for critical infrastructure victims
Millions more spent without any improvement in recovery times
Malware Month17 Jul 2024 | 5
FBI gains access to Trump rally shooter's phone
Hasn't said how it did it, but has form cracking devices
Research16 Jul 2024 | 115
RADIUS networking protocol blasted into submission through MD5-based flaw
If someone can do a little MITM'ing and hash cracking, they can log in with no valid password needed
Research10 Jul 2024 | 11
Latest Ghostscript vulnerability haunts experts as the next big breach enabler
There's also chatter about whether medium severity scare is actually code red nightmare
Research05 Jul 2024 | 25
Traeger security bugs bad news for grillers with neighborly beef
Never risk it when it comes to brisket – make sure those updates are applied
Research03 Jul 2024 | 20
CISA looked at C/C++ projects and found a lot of C/C++ code. Wanna redo any of it in Rust?
So, so many lines of memory-unsafe routines in crucial open source, and unsafe dependencies
Research28 Jun 2024 | 81
'Skeleton Key' attack unlocks the worst of AI, says Microsoft
Simple jailbreak prompt can bypass safety guardrails on major models
AI + ML28 Jun 2024 | 115
Polyfill.io owner punches back at 'malicious defamation' amid domain shutdown
Updated No supply-chain attacks to see over here!
Research28 Jun 2024 | 28
If you're using Polyfill.io code on your site – like 100,000+ are – remove it immediately
Scripts turn sus after mysterious CDN swallows domain
CSO25 Jun 2024 | 61
'Mirai-like' botnet observed attacking EOL Zyxel NAS devices
Seems like as good a time as any to upgrade older hardware
Research24 Jun 2024 | 3
Risk of installing dodgy extensions from Chrome store way worse than Google's letting on, study suggests
All depends on how you count it – Chocolate Factory claims 1% fail rate
Research23 Jun 2024 | 34
Phoenix UEFI flaw puts long list of Intel chips in hot seat
Researchers discuss it in same breath as BlackLotus and MosaicRegressor
Research21 Jun 2024 | 21
That PowerShell 'fix' for your root cert 'problem' is a malware loader in disguise
Control-C, Control-V, Enter ... Hell
Research19 Jun 2024 | 18
CHERI Alliance formed to promote memory security tech ... but where's Arm?
Updated Academic-industry project takes next step as key promoter chip designer licks its wounds
Research18 Jun 2024 | 3
Uncle Sam ends financial support to orgs hurt by Change Healthcare attack
Billions of dollars made available but worst appears to be over
Research18 Jun 2024 | 3
Arm security defense shattered by speculative execution 95% of the time
'TikTag' security folks find anti-exploit mechanism rather fragile
Research18 Jun 2024 | 27
Stanford Internet Observatory wilts under legal pressure during election year
Because who needs disinformation research at times like these
Research14 Jun 2024 | 85
Cybercrooks get cozy with BoxedApp to dodge detection
Some of the biggest names in the game are hopping on the trend
Research04 Jun 2024 | 2
Researchers warn robot cars can be crashed with tinfoil and paint daubed on cardboard
Use Baidu's platform to show how the fusion of Lidar, radar, and cameras can be fooled by stuff from your kids' craft box
Research03 Jun 2024 | 34
Pretty much all the headaches at MSPs stem from cybersecurity
More cybercrime means more problems as understaffed teams stretched to the limit
Research30 May 2024 | 14
How Apple Wi-Fi Positioning System can be abused to track people around the globe
In-depth SpaceX is smart on this, Cupertino and GL.iNet not so much
Networks23 May 2024 | 78
'China-aligned' spyware slingers operating since 2018 unmasked at last
Unfading Sea Haze adept at staying under the radar
Research23 May 2024 | 1
Uncle Sam to inject $50M into auto-patcher for hospital IT
Boffins, why not simply invent an algorithm that autonomously fixes flaws, thereby ending ransomware forever
Public Sector22 May 2024 | 33
Critical Fluent Bit bug affects all major cloud providers, say researchers
Crashes galore, plus especially crafty crims could use it for much worse
Research21 May 2024 | 2
With ransomware whales becoming so dominant, would-be challengers ask 'what's the point?'
Fewer rivals on the scene as big-gang success soars
Research21 May 2024 | 3
Researchers call out QNAP for dragging its heels on patch development
WatchTowr publishes report claiming vendor failed to issue fixes after four months
Research20 May 2024 | 4
An attorney says she saw her library reading habits reflected in mobile ads. That's not supposed to happen
Feature Follow us down this deep rabbit hole of privacy policy after privacy policy
Personal Tech18 May 2024 | 140
AI red-teaming tools helped X-Force break into a major tech manufacturer 'in 8 hours'
RSAC Hint: It's the 'the largest' maker of a key computer component
Spotlight on RSA13 May 2024 | 7
GhostStripe attack haunts self-driving cars by making them ignore road signs
Cameras tested are specced for Baidu's Apollo
Research10 May 2024 | 51
Watch out for rogue DHCP servers decloaking your VPN connections
Avoid traffic-redirecting snoops who have TunnelVision
Spotlight on RSA07 May 2024 | 34
Brit security guard biz exposes 1.2M files via unprotected database
Exclusive Thousands of ID cards plus CCTV snaps of suspects found online
Research07 May 2024 | 25
Meta, Spotify break Apple's device fingerprinting rules – new claim
Updated And the iOS titan doesn't seem that bothered with data leaking out
Research07 May 2024 | 29
Governments issue alerts after 'sophisticated' state-backed actor found exploiting flaws in Cisco security boxes
Don't get too comfortable: 'Line Dancer' malware may be targeting other vendors, too
Security24 Apr 2024 | 11
If Britain is so bothered by China, why do these .gov.uk sites use Chinese ad brokers?
Exclusive One wonders why are there adverts on public-sector portals at all
Research24 Apr 2024 | 109
Old Windows print spooler bug is latest target of Russia's Fancy Bear gang
Putin's pals use 'GooseEgg' malware to launch attacks you can defeat with patches or deletion
Security23 Apr 2024 | 7
Researchers claim Windows Defender can be fooled into deleting databases
BLACK HAT ASIA Two rounds of reports and patches may not have completely closed this hole
Security22 Apr 2024 | 19
Kremlin's Sandworm blamed for cyberattacks on US, European water utilities
Water tank overflowed during one system malfunction, says Mandiant
Research17 Apr 2024 | 10
OpenAI's GPT-4 can exploit real vulnerabilities by reading security advisories
While some other LLMs appear to flat-out suck
AI + ML17 Apr 2024 | 6
Alleged cryptojacker accused of stealing $3.5M from cloud to mine under $1M in crypto
No prizes for guessing the victims
Research16 Apr 2024 | 2
96% of US hospital websites share visitor info with Meta, Google, data brokers
Could have been worse – last time researchers checked it was 98.6%
Research11 Apr 2024 | 13
Global taxi software vendor exposes details of nearly 300K across UK and Ireland
Exclusive High-profile individuals including MPs said to be caught up in leak
Research11 Apr 2024 | 7
It's 2024 and Intel silicon is still haunted by data-spilling Spectre
Go, go InSpectre Gadget
Research10 Apr 2024 | 23
What can be done to protect open source devs from next xz backdoor drama?
Kettle What happened, how it was found, and what your vultures have made of it all
Research06 Apr 2024 | 93
Hotel check-in terminal bug spews out access codes for guest rooms
Attacks could be completed in seconds, compromising customer safety
Research05 Apr 2024 | 31
Security pioneer Ross Anderson dies at 67
Obituary A man with a list of accolades long enough for several lifetimes, friends remember his brilliance
Research03 Apr 2024 | 35
Malicious xz backdoor reveals fragility of open source
Analysis This time, we got lucky. It mostly affected bleeding-edge distros. But that's not a defense strategy
Devops01 Apr 2024 | 98
Row breaks out over true severity of two DNSSEC flaws
Updated Some of us would be happy being rated 7.5 out of 10, just sayin'
CSO26 Mar 2024 | 11
GoFetch security exploit can't be disabled on M1 and M2 Apple chips
For now, cryptographic work should be run on slower Icestorm cores
Research25 Mar 2024 | 14
Some 300,000 IPs vulnerable to this Loop DoS attack
Easy to exploit, not yet exploited, not widely patched – pick three
Research24 Mar 2024 | 24
3 million doors open to uninvited guests in keycard exploit
As months go by without fixes, hotels take the scenic route to securing rooms
Research22 Mar 2024 | 53
Hardware-level Apple Silicon vulnerability can leak cryptographic keys
Short of redesigning CPUs, the fix will seriously degrade performance
Research22 Mar 2024 | 22
Truck-to-truck worm could infect – and disrupt – entire US commercial fleet
The device that makes it possible is required in all American big rigs, and has poor security
Security22 Mar 2024 | 74
It's 2024 and North Korea's Kimsuky gang is exploiting Windows Help files
New infostealer may indicate a shift in tactics – and maybe targets too, beyond Asia
Research21 Mar 2024 | 5
As if working at Helldesk weren't bad enough, IT helpers now targeted by cybercrims
Wave of Okta attacks mark what researchers are calling the biggest security trend of the year
Research15 Mar 2024 | 15
Poking holes in Google tech bagged bug hunters $10M
A $2M drop from previous year. So … things are more secure?
Security13 Mar 2024 | 4
Apple promises to protect iMessage chats from quantum computers
Easy to defend against stuff that may never actually work – oh there we go again, being all cynical like
Research21 Feb 2024 | 30
How to weaponize LLMs to auto-hijack websites
We speak to professor who with colleagues tooled up OpenAI's GPT-4 and other neural nets
Research17 Feb 2024 | 24
Cutting kids off from the dark web – the solution can only ever be social
Expert weighs in after Brianna Ghey murder amid worrying rates of child cybercrime
Cyber-crime16 Feb 2024 | 93
Cybercriminals are stealing iOS users' face scans to break into mobile banking accounts
Deepfake-enabled attacks against Android and iPhone users are netting criminals serious cash
Research15 Feb 2024 | 30
Miscreants turn to ad tech to measure malware metrics
Now that's what you call dual-use tech
Research15 Feb 2024 | 4
Raspberry Robin devs are buying exploits for faster attacks
One of most important malware loaders to cybercrims who are jumping on vulnerabilities faster than ever
Research08 Feb 2024 | 2
Raspberry Pi Pico cracks BitLocker in under a minute
Windows encryption feature defeated by $10 and a YouTube tutorial
Research07 Feb 2024 | 143
New kids on the ransomware block in 2023: Akira and 8Base lead dozens of newbies
How good are your takedowns when fresh gangs are linked to previous ops, though?
Research06 Feb 2024 | 1
Researchers remotely exploit devices used to manage safe aircraft landings and takeoffs
The closest thing we may ever get to a real-life Die Hard 2 scenario
Research03 Feb 2024 | 17
Nearly 4-year-old Cisco vuln linked to recent Akira ransomware attacks
Evidence mounts of an exploit gatekept within Russia's borders
Research31 Jan 2024 |
COVID-19 test lab accused of exposing 1.3 million patient records to open internet
Now that's a Dutch crunch
Research24 Jan 2024 | 2
IT consultant fined for daring to expose shoddy security
Spotting a plaintext password and using it in research without authorization deemed a crime
Research19 Jan 2024 | 94
Google TAG: Kremlin cyber spies move into malware with a custom backdoor
The threat hunters believe COLDRIVER has used SPICA since at least November 2022
Research18 Jan 2024 | 5
Vast botnet hijacks smart TVs for prime-time cybercrime
Updated 8-year-old op responsible for DDoS attacks and commandeering broadcasts to push war material
Research18 Jan 2024 | 7
Biting the hand that feeds IT
