News

Web devs advised to do their part to limit UI redress attacks

Web browsers still struggle to prevent clickjacking, an attack technique first noted in 2008 that repurposes web page interface elements to deceive visitors.…

CISA calls for 'fundamental, security-focused reforms' to happen ASAP, delaying work on other software

A review of the June 2023 attack on Microsoft's Exchange Online hosted email service – which saw accounts used by senior US officials compromised by a China-linked group called "Storm-0558" – has found that the incident would have been preventable save for Microsoft's lax infosec culture and sub-par cloud security precautions.…

And Diameter, too, for good measure

The FCC appears to finally be stepping up efforts to secure decades-old flaws in American telephone networks that are allegedly being used by foreign governments and surveillance outfits to remotely spy on and monitor wireless devices.…

Irony alerts: Open Web Application Security Project Foundation suffers lapse

A misconfigured MediaWiki web server allowed digital snoops to access members' resumes containing their personal details at the Open Web Application Security Project (OWASP) Foundation.…

Nothing says 'sorry' like 10 percent off shipping for a month

Ecommerce platform Pandabuy has apologized after two cybercriminals were spotted hawking personal data belonging to 1.3 million customers.…

Simple stuff like slapping on a logo fools more folks and travels further

As hundreds of millions of voters around the globe prepare to elect their leaders this year, there's no question that trolls will try to sway the outcomes using AI, according to Clint Watts, general manager of Microsoft's Threat Analysis Center.…

Cloud cyber resilience model could raise $700M despite $278M losses

Cloud security provider Rubrik has filed for an IPO on the New York Stock Exchange following a flurry of similar flotations.…

Victims of the powerful surveillance tool will soon find out the truth

Former Polish government officials may face criminal charges following an investigation into their use of the notorious spyware Pegasus to surveil political opponents and others.…

This follows attack on NHS services in Scotland last week

The cyber skids at INC Ransom are claiming responsbility for the ongoing cybersecurity incident at Leicester City Council, according to a post caught by eagle-eyed infosec watchers.…

Senders of more than 5K messages a day are in the crosshairs

It was 20 years ago on Monday that Google unleashed Gmail on the world, and the chocolate factory is celebrating with new rules that just might, hopefully, cut down on the amount of spam users receive.…

Ye cannae change the laws of physics, but you can change your mind

Opinion  Apple is good at security. It's good at processors. Thus GoFetch, a major security flaw in its processor architecture, is a double whammy.…

PLUS: Google Cloud ANZ boss departs; Japan revives airliner ambitions; China-linked attackers target Asian entities

ASIA IN BRIEF  Singapore's Monetary Authority on Monday launched an application, intuitively named "COllaborative Sharing of Money Laundering/TF Information & Cases" (COSMIC for short, obviously) to target money laundering and terrorism financing.…

At least not until Redmond's government edition is ready to roll

Staff working at the US House Of Representatives have been barred from using Microsoft's Copilot chatbot and AI productivity tools, pending the launch of a version tailored to the needs of government users.…

This time, we got lucky. It mostly affected bleeding-edge distros. But that's not a defense strategy

Analysis  The discovery last week of a backdoor in a widely used open source compression library called xz could have been a security disaster had it not been caught by luck and atypical curiosity about latency from a Microsoft engineer.…

Also, TheMoon botnet back for EoL SOHO routers, Sellafield to be prosecuted for 'infosec failures', plus critical vulns

Infosec in brief  Nearly a year on from the discovery of a massive data theft at healthcare biz Harvard Pilgrim, and the number of victims has now risen to nearly 2.9 million people in all US states.…

Theresa Payton on why US needs a national privacy law

Interview  Congress is mulling legislation that will require TikTok's Chinese parent ByteDance to cut ties with the video-sharing mega-app, or the social network will be banned in the USA.…

Time to update that password - and four-digit account pin, which was also among the pilfered records

That rumored AT&T dark web customer data dump from mid-March has been confirmed, and it's a whopper: A total of more than 73 million current and former customers are included in the cache, AT&T confirmed over the weekend.…

Code shines up nicely in production, says Chocolate Factory's Bergstrom

Echoing the past two years of Rust evangelism and C/C++ ennui, Google reports that Rust shines in production, to the point that its developers are twice as productive using the language compared to C++.…

Red Hat in all caps says STOP USAGE OF ANY FEDORA RAWHIDE INSTANCES

Red Hat on Friday warned that a malicious backdoor found in the widely used data compression library xz may be present in the upcoming Fedora Linux 40 and in the Fedora Rawhide developer distribution.…

CVE-2024-1086 turns the page tables on system admins

A Linux privilege-escalation proof-of-concept exploit has been published that, according to the bug hunter who developed it, typically works effortlessly on kernel versions between at least 5.14 and 6.6.14. …