Security > More stories

The first RAF F-35B Lightning II to land in the UK. Crown copyright
116

Blighty's super-duper F-35B fighter jets are due to arrive in a few weeks

Britain's first permanently based F-35B fighter jets are due to arrive in our green and pleasant land in June. The news nugget was delivered by defence secretary Gavin Williamson, who informed world+dog that the supersonic stealth jets will arrive at RAF Marham in Norfolk in a few weeks. The announcement was timed for the …
Gareth Corfield, 17 May 2018
Telegram from dictionary
10

Russian malware harvesting Telegram Desktop creds, chats

Already under attack by Russia's telecommunications regulator, a new source of woe has emerged for crypto-chat app Telegram: malware. In news that won't surprise anybody at all, researchers from Cisco Talos say the malware attacking Telegram's desktop app was written by a Russian speaker. Vitor Ventura and Azim Khodjibaev …
Hammer and Nails
19

Oh, great, now there's a SECOND remote Rowhammer exploit

Hard on the heels of the first network-based Rowhammer attack, some of the boffins involved in discovering Meltdown/Spectre have shown off their own technique for flipping bits using network requests. With a gigabit connection to the victim, the researchers reckon, they can induce security-critical bit flips using crafted …
malware
17

DOJ convicts second bloke for helping malware go undetected

The US Federal government has got its second conviction in the dismantling of a service that helped malware writers get around security software. A jury in the Eastern Virginia District Court convicted 37 year-old Ruslan Bondars, on charges of computer intrusion, conspiracy to commit wire fraud, and conspiracy to violate the …
Shaun Nichols, 17 May 2018
A broken front door

Running Cisco DNA Center? Update right now to get rid of the static admin credential

Cisco has issued updates to address a trio of critical vulnerabilities in its Digital Network Architecture (DNA) Center appliance. The networking giant says DNA Center, a network management and administration box Cisco sells directly to customers, has three flaws that would each potentially allow an attacker to take over the …
Shaun Nichols, 16 May 2018
82

Lawyers for Marcus Hutchins: His 'I made malware' jail phone call isn't proper evidence

Malware reverse-engineer Marcus Hutchins has tried to throw out phone transcripts and legal documents used against him by US prosecutors, who have accused him of computer crimes and fraud. Lawyers for Hutchins, a British citizen facing trial in America, has asked an east Wisconsin district court to dismiss the Brits' Waiver of …
Shaun Nichols, 16 May 2018
Fixed stamp
13

Mining apps? We're cool so long as they admit to it, says Canonical

Canonical has responded to last week's discovery that its Snap store carried apps containing embedded crypto-currency miners, by pledging to introduce a “verified developer” program. When users complained that apps by Nicholas Tomb included the mining code, they were pulled from the Ubuntu Snap store, with Canonical promising …
DDoS
70

UPnP joins the 'just turn it off on consumer devices, already' club

Universal Plug 'n' Play, that eternal feast of the black-hat, has been identified as helping to amplify denial-of-service attacks. Researchers at Imperva looked into misbehaving UPnP implementations after spotting odd attack traffic while analysing a Simple Service Discovery Protocol (SSDP, an Internet proposal absorbed into …
Security alert red light
18

Red Hat admin? Get off Twitter and patch this DHCP client bug

Red Hat has announced a critical vulnerability in its DHCP client and while it doesn't have a brand name it does have a Tweetable proof-of-concept. Discovered by Googler Felix Wilhelm, CVE-2018-1111 is a command injection bug in the Red Hat Enterprise Linux and derivative DHCP clients. Wilhelm Tweeted: “CVE 2018-1111 is a …
Pentagon - building - houses the US dept of defense in Arlington Virginia
15

Ex-CIA man fingered as prime suspect in Vault 7 spy tool manuals leak

A former CIA employee has been named as the prime suspect behind last year's leak of thousands of top-secret documents on the agency's hacking practices. According to the Washington Post, court documents name Joshua Adam Schulte as the person authorities believe to be behind the massive Vault 7 online dump of CIA internal …
Shaun Nichols, 15 May 2018
Julian Assange via Shutterstock
128

Julian Assange said to have racked up $5m security bill for Ecuador

The government of Ecuador spent nearly $5m to provide protected internet access to asylum-seeker Julian Assange and he responded by hacking their systems, an anonymously sourced report has claimed. According to a report from The Guardian, internal documents show that the the Wikileaks boss required surveillance and security …
Shaun Nichols, 15 May 2018
40

Kaspersky Lab's move from Russia to Switzerland fails to save it from Dutch oven

It has been a busy few days for beleaguered antivirus-flinger Kaspersky Lab. Today's confirmation of an infrastructure move to Switzerland comes hot on the heels of a comment from the Netherlands government that use of the Russian firm's software is a bit risky. Kaspersky is moving a number of its core processes from Russia to …
Richard Speed, 15 May 2018
London, UK - March, 2018. Police officers patrolling Leicester Square and Piccadilly Circus in central London.  Pic Paolo Paradiso / Shutterstock.com
121

Zero arrests, 2 correct matches, no criminals: London cops' facial recog tech slammed

London cops' facial recognition kit has only correctly identified two people to date – neither of whom were criminals – and the UK capital's police force has made no arrests using it, figures published today revealed. According to information released under Freedom of Information laws, the Metropolitan Police's automated …
Rebecca Hill, 15 May 2018
35

Wanna break Microsoft's Edge browser? Google's explained how

Back in February 2018, Google's Project Zero went public with a Microsoft Edge bug that Redmond couldn't fix in time for its next patch release. Now, the Google researcher - Ivan Fratric - has provided a detailed technical explanation of the problem and says Microsoft's fix might not be adequate. Fratric discovered that an …
75

How could the Facebook data slurping scandal get worse? Glad you asked

Yet another rogue Facebook app that gathered and sold "intimate" details on millions of users has come to light. A report from New Scientist finds that the myPersonality app had collected and shared the personal information for as many as three million users who had installed the app on their Facebook profile. The data has …
Shaun Nichols, 15 May 2018
Spy
44

S/MIME artists: EFAIL email app flaws menace PGP-encrypted chats

Security researchers have gone public with vulnerabilities in some secure mail apps that can be exploited by miscreants to decrypt intercepted PGP-encrypted messages. The flaws, collectively dubbed EFAIL, are present in the way some email clients handle PGP and S/MIME encrypted messages. By taking advantage of the way the …
Shaun Nichols, 14 May 2018
49

How many ways can a PDF mess up your PC? 47 in this Adobe update alone

Adobe has posted security updates for Acrobat, Reader, and Photoshop, many of them critical fixes. The developer says the Acrobat and Reader update will address a total of 47 CVE-listed vulnerabilities, including two dozen remote code execution flaws in the PDF readers. Adobe notes that none of the bugs are being actively …
Shaun Nichols, 14 May 2018
The UK's sole F-35B in flight. Crown copyright
84

Britain to slash F-35 orders? Erm, no, scoffs Lockheed UK boss

F-35 maker Lockheed Martin’s UK chief has breezily dismissed the idea of Britain cutting the number of jets it is buying from the US firm. Speaking to the Press Association, Peter Ruddock said he was “respectful” of the Ministry of Defence’s financial situation, which happens to include a whopping great big black hole to the …
Gareth Corfield, 14 May 2018
139

Navy names new attack sub HMS Agincourt

The Royal Navy, always keeping up with the times, has named its newest attack submarine HMS Agincourt, after the 1415 battle where an English army beat French troops led by its nobility. Agincourt the boat is the seventh and final Astute-class attack sub. The nuclear-powered vessels are used primarily to defend British …
Gareth Corfield, 14 May 2018
police look over the evidence
107

Wah, encryption makes policing hard, cries UK's National Crime Agency

Encryption is making it more difficult for law enforcement agencies to detect dangerous offenders, according the the National Crime Agency's (NCA) yearly assessment of serious organised crime in Britain. "Since 2010, communication service providers have migrated to encrypted services 'by default', a process that accelerated …
Kat Hall, 14 May 2018
37

PGP and S/MIME decryptors can leak plaintext from emails, says infosec professor

Updated A professor of Computer Security at the Münster University of Applied Sciences‏ has warned that popular email encryption tool Pretty Good Privacy (PGP) might actually allow Pretty Grievous P0wnage thanks to bugs that can allow supposedly encrypted emails to be read as plaintext. Professor Sebastian Schinzel took to Twitter …
Simon Sharwood, 14 May 2018
A Ransom Note
17

Family Planning office warns customers private parts may be exposed

The Australian State of New South Wales' reproductive and sexual health organisation Family Planning NSW has advised users of an April 2018 ransomware attack that may have compromised sensitive information. The agency apparently retained web form messages on the public-facing server, meaning if its database was breached, …
30

Ubuntu sends crypto-mining apps out of its store and into a tomb

Admins of the Ubuntu Store have pulled all apps from a developer who signed himself "Nicholas Tomb", and from his e-mail signature apparently wanted to crypto-mine himself into a Ferrari. Mr Tomb's "2048buntu" and "Hextris" applications are now absent from the store, with their removal sparked by a GitHub comment about the …
Atom with nucleus and electrons

Have you updated your Electron app? We hope so. There was a bad code-injection bug in it

Electron – the widely used desktop application framework that renders top programs such as Slack, Atom, and Visual Studio Code – suffered from a security vulnerability that potentially allows miscreants to execute evil code on victims' computers. That means applications relying on Electron may need updating. If you use an …
Hammer and hardhat, image via Shutterstock
15

Rowhammer strikes networks, Bolton strikes security jobs, and Nigel Thornberry strikes Chrome, and more

Roundup Here's a roundup of everything that's happened in the world of infosec this week, beyond what we've already covered. 7Zip gets 7Ripped Researchers have poked a hole in the 7-Zip archiving tool, and you'll want to update the software as soon as possible. The bug, discovered by researcher landave, allows remote code execution …
Shaun Nichols, 12 May 2018
62

Hacking train Wi-Fi may expose passenger data and control systems

Vulnerabilities on the Wi-Fi networks of a number of rail operators could expose customers' credit card information, according to infosec biz Pen Test Partners this week. The research was conducted over several years, said Pen Test's Ken Munro. "In most cases they are pretty secure, although whether the Wi-Fi works or not is …
Kat Hall, 11 May 2018
Laser
92

Shining lasers at planes in the UK could now get you up to 5 years in jail

The ban on shining lasers at cars and aeroplanes has been strengthened with a five-year prison sentence now available for those who train their laser pointers on ships, aircraft or air traffic control towers. "Under the new law, it is a crime to shine or direct a laser beam that dazzles or distracts, or is likely to dazzle or …
Gareth Corfield, 11 May 2018
Australian cloud

Telstra warns cloud customers they’re at risk of malware or worse

UPDATE Telstra has advised users of its cloud who run self-managed resources that their “internet facing servers are potentially vulnerable to malware or other malicious activity.” The company says that it spotted a weakness in its service on May 4th and is now telling users to “delete or disable” the “TOPS or TIRC account on your …
Simon Sharwood, 11 May 2018
25

New law would stop Feds from demanding encryption backdoor

US lawmakers from both major political parties came together on Thursday to reintroduce a bill that, if passed, would prohibit the American government from forcing tech product makers to undermine the security of their wares. The bill, known as the Secure Data Act of 2018, was returned to the US House of Representatives by …
Thomas Claburn, 10 May 2018
password
50

Bombshell discovery: When it comes to passwords, the smarter students have it figured

Students who get good grades have better passwords than their less academically successful peers, though this finding should be considered alongside several caveats. JV Roig, consulting director and software developer at Asia Pacific College (APC) in the Philippines, wanted to find out whether school smarts had any bearing on …
Thomas Claburn, 10 May 2018
Schoolkids in uniform studying with books/apple. Photo by shutterstock
33

Brit govt told to do its homework ahead of talks over post-Brexit spy laws and data flows

There is no doubt that the UK's surveillance regimes will come under scrutiny in negotiations on continued data flows with Europe after Brexit, and the government needs to start preparing for that now, MPs have been told. The British government has been repeatedly warned that gaining an adequacy decision from the EU will not …
Rebecca Hill, 10 May 2018
USB Ban symbol
207

IBM bans all removable storage, for all staff, everywhere

IBM has banned its staff from using removable storage devices. In an advisory to employees, IBM global chief information security officer Shamla Naidoo said the company “is expanding the practice of prohibiting data transfer to all removable portable storage devices (eg: USB, SD card, flash drive).” The advisory stated some …
Simon Sharwood, 10 May 2018
Here we go again
138

Every major OS maker misread Intel's docs. Now their kernels can be hijacked or crashed

Updated Linux, Windows, macOS, FreeBSD, and some implementations of Xen have a design flaw that could allow attackers to, at best, crash Intel and AMD-powered computers. At worst, miscreants can, potentially, "gain access to sensitive memory information or control low-level operating system functions,” which is a fancy way of saying …
Spraying bugs with insecticide
19

Second wave of Spectre-like CPU security flaws won't be fixed for a while

The new bunch of Spectre-like flaws revealed last week won't be patched for at least 12 days. German outlet Heise, which broke news of the eight Spectre-like vulnerabilities last week has now reported that Intel wants disclosure of the flaws delayed until at least May 21. “Intel is now planning a coordinated release on May 21 …
botnet

Mirai botnet cost you $13.50 per infected thing, say boffins

Berkeley boffins reckon the Dyn-based Internet of Things attack that took down Brian Krebs' Website in 2016 cost device owners over $US320,000. Since the 2016 hit on KrebsOnSecurity involved devices in their tens of thousands, the costs to individuals (in power consumption and bandwidth charges) only ends up a handful of …
A Microsoft cloud... sorta
42

It's 2018, and a webpage can still pwn your Windows PC – and apps can escape Hyper-V

Patch Tuesday Microsoft and Adobe have patched a bunch of security bugs in their products that can be exploited by hackers to commandeer vulnerable computers, siphon people's personal information, and so on. Redmond emitted 68 patches alone, 21 rated critical and at least two being actively exploited in the wild. There are browser and …
Chris Williams, 09 May 2018

Biting the hand that feeds IT © 1998–2018