Troy Hunt

SEPTEMBER 5, 2018

As time has gone by, one of the things I've enjoyed the most in running Have I Been Pwned (HIBP) is seeing how far I could make the dollars stretch. How big can it go whilst at the same time, running it on a shoestring? I keep finding new ways of optimising cost and the two most significant contributions to that since launching almost 5 years ago have come via serverless technology provided by 2 of my favourite tech companies: Cloudflare and Microsoft.

Passwords 235

Passwords Architecture Data breaches Technology 235

Krebs on Security

SEPTEMBER 4, 2018

mSpy , the makers of a software-as-a-service product that claims to help more than a million paying customers spy on the mobile devices of their kids and partners, has leaked millions of sensitive records online, including passwords, call logs, text messages, contacts, notes and location data secretly collected from phones running the stealthy spyware.

Spyware 204

Spyware Mobile Advertising Software 204

The Last Watchdog

SEPTEMBER 6, 2018

All companies today are exposed to intense cyber-attacks. And yet the vast majority simply do not have the capability to effectively defend their networks. That’s where managed security services providers, or MSSPs, come in. MSSPs monitor and manage cybersecurity systems as a contracted service. This can include spam filtering, malware detection, firewalls upkeep, vulnerability management and more.

Digital transformation 189

Digital transformation Technology Mobile Firewall 189

Schneier on Security

SEPTEMBER 5, 2018

It's amazing that this is even possible: " SonarSnoop: Active Acoustic Side-Channel Attacks ": Abstract: We report the first active acoustic side-channel attack. Speakers are used to emit human inaudible acoustic signals and the echo is recorded via microphones, turning the acoustic system of a smart phone into a sonar system. The echo signal can be used to profile user interaction with the device.

Passwords 156

Passwords Authentication Hacking 156

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Troy Hunt

SEPTEMBER 7, 2018

It's been a week of travel for me with API Days in Melbourne on Tuesday, Fortinet Fast & Secure in Sydney on Wednesday then the Varonis webinar yesterday (recorded, I'll share once it's online). Be that as it may, I did manage to pump out a long-awaited blog post on the total cost of running Pwned Passwords in HIBP and its. 2.6c per day ??. This week there's also a few random things ranging from online authenticity (the human kind), changes in Chrome 69 (there's some major visual security in

Spyware 112

Spyware Authentication Passwords Hacking 112

Krebs on Security

SEPTEMBER 6, 2018

A 19-year-old man from the United Kingdom who headed a cybercriminal group whose motto was “Feds Can’t Touch Us” pleaded guilty this week to making bomb threats against thousands of schools. On Aug. 31, officers with the U.K.’s National Crime Agency (NCA) arrested Hertfordshire resident George Duke-Cohan, who admitted making bomb threats to thousands of schools and a United Airlines flight traveling from the U.K. to San Francisco last month.

DDOS 182

DDOS Internet Internet Cybercrime 182

Schneier on Security

SEPTEMBER 4, 2018

I am pleased to announce the publication of my latest book: Click Here to Kill Everybody: Security and Survival in a Hyper-connected World. In it, I examine how our new immersive world of physically capable computers affects our security. I argue that this changes everything about security. Attacks are no longer just about data, they now affect life and property: cars, medical devices, thermostats, power plants, drones, and so on.

Government 150

Government Internet Internet Authentication 150

WIRED Threat Level

SEPTEMBER 4, 2018

"Whatever we propose is going to be controversial. But it’s important we do something, because everyone is unsatisfied by URLs. They kind of suck.".

89

89

Krebs on Security

SEPTEMBER 5, 2018

Popular file-sharing site Mega.nz is warning users that cybercriminals hacked its browser extension for Google Chrome so that any usernames and passwords submitted through the browser were copied and forwarded to a rogue server in Ukraine. This attack serves as a fresh reminder that legitimate browser extensions can and periodically do fall into the wrong hands, and that it makes good security sense to limit your exposure to such attacks by getting rid of extensions that are no longer useful or

Risk 161

Risk Hacking Software Phishing 161

The Last Watchdog

SEPTEMBER 5, 2018

There is a concept in computing, called runtime, that is so essential and occurs so ubiquitously that it has long been taken for granted. Now cyber criminals have begun to leverage this heretofore innocuous component of computing to insinuate themselves deep inside of company networks. Related: The coming wave of ‘microcode’ attacks. They’ve figured out how to manipulate applications while in runtime and execute powerful and stealthy attacks that bypass conventional security tools.

Mobile 140

Mobile Internet Internet Ransomware 140

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

Schneier on Security

SEPTEMBER 7, 2018

I did a Reddit AMA on Thursday, September 6.

114

114

Security Affairs

SEPTEMBER 5, 2018

Security expert discovered that S kype has a malloc(): memory corruption vulnerability that could be triggered while users share some media/file with someone during a call. . Tested on: Linux zero 4.15.0-29-generic #31-Ubuntu SMP Tue Jul 17 15:39:52 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux (Ubuntu 18.04 LTS). Product affected: Skype for linux (skypeforlinux_8.27.0.85_amd64.deb) Steps to reproduce this issue: 1.

Advertising 92

Advertising Media Hacking 92

Krebs on Security

SEPTEMBER 2, 2018

A 20-year-old from Vancouver, Washington was indicted last week on federal hacking charges and for allegedly operating the “ Satori ” botnet, a malware strain unleashed last year that infected hundreds of thousands of wireless routers and other “Internet of Things” (IoT) devices. This outcome is hardly surprising given that the accused’s alleged alter ego has been relentless in seeking media attention for this global crime machine.

IoT 125

IoT Media DDOS Internet 125

The Last Watchdog

SEPTEMBER 7, 2018

Over the past couple of decades, some amazing advances in locking down software code have quietly unfolded in, of all places, Hollywood. Related: HBO hack spurs cyber insurance market. Makes sense, though. Digital media and entertainment giants like Netflix, Amazon, Hulu, HBO, ESPN, Sony, and Disney are obsessive about protecting their turf. These Tinsel Town powerhouses retain armies of investigators and lawyers engaged in a never-ending war to keep piracy and subscription fraud in check.

IoT 133

IoT Technology Software Digital transformation 133

Advertisement

How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.

Cybersecurity

eSecurity Planet

SEPTEMBER 5, 2018

Enterprises are turning to SOAR solutions to streamline response to cybersecurity incidents.

Cybersecurity 102

Cybersecurity 102

Thales Cloud Protection & Licensing

SEPTEMBER 4, 2018

It’s hard to believe we are nine weeks away from the midterm elections here in the United States. Regardless of the winners and losers, all eyes will focus on election security. And there are so many factors to consider. Just last month at Def Con and Black Hat, we found out just how easy it is to break into election machines. White Hat (ethical) hackers worked in under 15 minutes to disrupt the entire voting process from the moment someone attempted to register to vote to the point at which res

Software 67

Software Hacking Encryption Internet 67

WIRED Threat Level

SEPTEMBER 7, 2018

Adware Doctor has long been one of the top-selling apps in the Mac App Store. But researchers say it harvested browsing data, and sent it to China.

Adware 72

Adware Spyware 72

The Last Watchdog

SEPTEMBER 4, 2018

Most large enterprises today can point to multi-millions of dollars expended over the past two decades erecting “layered defenses” to protect their digital systems. Yet catastrophic network breaches continue apace. Turns out there’s a downside to “defense in depth.”. Related: Obsolecense creeps into legacy systems. There’s no doubt that monitoring and continually updating all parts of a multi-tiered security system is a must-do best practice.

Penetration Testing 133

Penetration Testing Firewall Data breaches Malware 133

Advertiser: Revenera

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.

Risk

Security Affairs

SEPTEMBER 4, 2018

Security researchers at the SANS Internet Storm Center discovered that thousands of 3D printers are exposed online without proper defense. The news is worrisome, thousands of 3D printers are exposed online to remote cyber attacks. According to the experts at SANS Internet Storm Center that scanned the internet for vulnerable 3D printers, a Shodan query has found more than 3,700 instances of OctoPrint interfaces exposed online, most in the United States (1,600).

Internet 78

Internet Internet Advertising VPN 78

Thales Cloud Protection & Licensing

SEPTEMBER 6, 2018

In my recent blog on the evolving PCI SSC initiatives in 2018, “ Minor on PCI DSS, major on almost everything else ,” I outlined how the organisation is covering new areas to reflect the migration from physical card payments to online digital payments. Much of the latest innovation involves the use of mobile devices (for both initiation and acceptance ) to provide greater flexibility in how payments can be made and offer additional methods to authenticate transactions.

Mobile 66

Mobile Software Encryption Risk 66

Dark Reading

SEPTEMBER 7, 2018

These methods may not yet be on your security team's radar, but given their impact, they should be.

86

86

WIRED Threat Level

SEPTEMBER 6, 2018

After years of abuse and spreading conspiracy theories, Alex Jones finally went too far for Twitter with a relatively tame rant.

74

74

Advertisement

Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.

Software

Security Affairs

SEPTEMBER 2, 2018

The Wireshark team has addressed three serious vulnerabilities that could be exploited by a remote unauthenticated attacker to crash the analyzer. The Wireshark development team has fixed three serious flaws that could be exploited by a remote unauthenticated attacker to trigger a DoS condition in the world’s most popular network protocol analyzer. The three vulnerabilities tracked as CVE-2018-16056 , CVE-2018-16057 and CVE-2018-16058 affect respectively the Bluetooth Attribute Protocol (ATT

Firewall 75

Firewall System Administration Advertising Antivirus 75

Threatpost

SEPTEMBER 7, 2018

A macOS App called Adware Doctor blocks ads, but share’s user browser history with a China-based domain.

Adware 78

Adware 78

Dark Reading

SEPTEMBER 5, 2018

Blockchain is being used as a security tool. If you haven't thought about adopting it, you might want to reconsider your take.

75

75

Kali Linux

SEPTEMBER 4, 2018

We love it when community members come up with new ideas or interesting builds, and this one caught our attention. Jacek Kowalczyk hit us up on twitter with a really interesting story. His approach to tweaking Kali to be specific to his needs is exactly why this feature is so important to us and we wanted to share his story more widely. Jacek’s live-build recipe was for a lightweight version of Kali using his favourite desktop environments, including some nice desktop configurations.

Media 52

Media Hacking 52

Advertisement

Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!

Cybersecurity

Security Affairs

SEPTEMBER 6, 2018

The MEGA Chrome browser extension had been hacked and replaced with a one that steals users’ credentials for popular web services. Are you using the MEGA Chrome browser extension? Uninstall it now because the Chrome extension for MEGA file storage service had been hacked and replaced with a one that steals users’ credentials for popular web services (i.e.

Hacking 76

Hacking Cryptocurrency Advertising Accountability 76

eSecurity Planet

SEPTEMBER 6, 2018

Some accounts are more valuable than others. Privileged access management (PAM) can help.

Accountability 82

Accountability 82

Dark Reading

SEPTEMBER 6, 2018

Today's security operations center is all about reducing the number of alerts with emerging technologies - and enhancing old-school human collaboration. Here's how some real-world SOCs are evolving.

Technology 60

Technology 60

WIRED Threat Level

SEPTEMBER 4, 2018

The governor of Arizona announced Tuesday that Jon Kyl will replace the Senate seat vacated by the late John McCain. He may now further push to regulate tech giants like Facebook.

49

49

Advertisement

Within the past few years, ransomware attacks have turned to critical infrastructure, healthcare, and government entities. Attackers have taken advantage of the rapid shift to remote work and new technologies. Add to that hacktivism due to global conflicts and U.S. elections, and an increased focus on AI, and you have the perfect recipe for a knotty and turbulent 2024.

Cybersecurity