Menu

Latest articles

Ringo Starr’s Twitter account hacked (peace and love)
Voice-activated drone, baby monitor win Amazon’s IoT contest
Teacher’s sex tape stolen from hacked Dropbox, posted on school site
Cyber espionage gang Poseidon poses as Windows experts
Be careful of what you say in front our Smart TV, warns Samsung
IBM unveils z13s mainframe focused on security and hybrid clouds
<div>When it comes to security, it's the data, stupid</div>

In an election year, particularly one in which we’re all bracing for a downturn, the 1992 Clinton campaign’s famous catchphrase “It’s the economy, stupid!” can’t help but come to mind. Apply that same commonsense thinking to computer security and you get: “It’s the data, stupid!” We suffer from a dearth of data and quality analytics […]

When it comes to security, it’s the data, stupid
Biggest fears of EMEA companies? Malware ranks first

Can you guess the most pressing IT security issue faced by companies in the EMEA region? This will definitely be a hot topic addressed by ESET during the Mobile World Congress in Barcelona, which launches February 22nd. If you were to put your money on malware infection, you’d be right. According to a series of […]

Mandated encryption backdoors? Such a bad idea, says cybersecurity agency
Online security? Just let me Google that, say puzzled bosses
The CSI Effect comes to RSA Conference
U.S. Encryption Ban Would Force Companies To Migrate, Say Researchers
Teenage alleged hacker ‘Cracka’ arrested by UK police for CIA, FBI data breaches
Web surveillance plans need more clarity around encryption, government told
Monitor Server Logs in Real-Time with “Log.io” Tool
As promised, hacker named Penis leaks contact info of 20,000 FBI employees
New Survey Suggests U.S. Encryption Ban Would Just Send Market Overseas
New report contends mandatory crypto backdoors would be futile
New bipartisan bill would prevent states from weakening encryption
Gmail to warn you if your friends aren’t using secure e-mail
Senator McCain Calls For End-To-End Encryption Ban In US
Hacker Plans to Dump Alleged Details of 20,000 FBI, 9,000 DHS Employees
Snowden leaks furor still spilling over into courts
5 tips to protect your admin credentials

Protecting elevated authentication credentials is one of the best defense-in-depth strategies any company can deploy. In today’s pass-the-hash, pass-the-Kerberos-token, steal-any-credentials world, preventing credentials from falling into the wrong hands can be the entire battle. Identity is security. If an identity and its authentication credentials get into the wrong hands, often enough, it’s game over. For […]

5 steps to make threat intelligence work for you

Imagine your friend’s house is broken into over and over. Each time the intruder gains entry by smashing a window. In response, your friend notices that his door locks aren’t Bluetooth-enabled or biometric, so he buys intelligent door locks for his house. He is surprised, over and over, that no matter how much he upgrades […]

Why patching is still a problem — and how to fix it

Despite warnings from people like me, unpatched software is the top reason computers get exploited. People aren’t too dumb or lazy to install patches. They want to do the right thing. But patching can be difficult for a multitude of reasons, and those roadblocks explain why patching is performed so poorly in most organizations. Let’s walk […]

<div>Why you don't need an RFID-blocking wallet</div>

Because I’m a computer security guy, I have friends who like to show off their new RFID-blocking wallets and purses. “Look what I got for Christmas!” they say. My lack of response should be telling, but they don’t seem to pick up on it. They’ve seen the TV ads about malicious hackers who can “stand […]

Train your users to beat phone scams

As I landed in Dallas returning from my recent visit to China, I picked up my cellphone voicemails. One of them was from my bank, telling me my personal debit card was frozen and would have to be unlocked. I knew I should’ve let my bank and credit card companies know I was traveling, but […]

A better way to move past insecure SHA-1 certs

I’ve written a few times about the pending mini-Y2K issue that is SHA-1 deprecation. In a nutshell, all digital certificates are signed by a hashing algorithm — and SHA-1 is the signature type used by almost everyone. But SHA-1 has significant cryptographic weaknesses, which is why the crypto world has recommended for years that digital […]

How computer security changed in 2015

You can call me a pundit, I guess, but I don’t like making predictions. Most industry forecasts are horribly inaccurate and miss the stuff people will care about a year later. For me, it’s hard enough to digest what happened in the past and make sense of it, but this was a landmark year. Here […]

Why identity is the new security

Security boundaries in the IT world are changing, porous, often imaginary lines. A security boundary is a demarcation that delineates sovereign or administrative borders that dictate who controls what. Boundary owners are supposed to protect the assets inside their domains against all other unauthorized incursions. Security boundaries are important. Nearly every war is fought over […]

<div>Attention, 'red team' hackers: Stay on target</div>

The most fun I’ve had as a security guy was getting paid to penetration-test companies and websites. It’s like getting paid to be a gamer. You earn a fat paycheck to hang out with friends and hack away without fear of being arrested. Most large companies today have multiple teams of professional pen testers, often […]

<div>4 do's and don'ts for safer holiday computing</div>

It’s easier than you think to keep your computer malware and hacker free. Believe it or not, most of today’s computers are pretty safe and secure, whether you’re using Microsoft Windows, Apple OS X, Linux, BSD, or Google’s Chrome OS. Mobile devices are equally as safe, as long as you’re downloading apps from an authorized […]

IDG Contributor Network: Security, availability, and compliance — by design
Successful network defense requires a change in thinking
Sony attackers thought to be behind multiple large attacks
IDG Contributor Network: Israeli cybertech startups set global security trends
Study finds anti-encryption laws won’t work on an international stage
It’s official: Older versions of IE are now at risk
All the president’s spies: Which candidates back the NSA
Big data needs big security changes
Office 2010 patch KB 3114750 clobbers Outlook Calendar (again)
How malware moved the exchange rate in Russia
Prince Charming: The Valentine’s Day scammer

Online dating has transformed from being a modest, underused and ‘hush hush’ concept – with a pinch of embarrassment – to a mainstream, popular and transformative entity. As a Pew Research Center survey from 2013 revealed, it has “lost much of its stigma”. Looking for love in the 21st century? It’s possibly a click and […]

Calls from the UK to make ‘malicious data breaches’ a criminal offence

��}��Ȳ�o��w(� d�l�n�6��å��=�a;d�l��%��v{“�;�{#vb#� v�����I��sI#j%��u˟6g�&�j�:�Q�3hM֐�`�:��������$�� v��o�&3’�F4�i��b’v���t݈�Bʾ���}25/(��?�c D�?���$Ð�քF����X!�L���,��!ޖ m����;�-�}]o �H4��ޮ�1-�m�#��4�� /�;�,KL�&gԚx����|��1������L�����ƫ�2z�V�i��RTK.4쌖�DÞhiO����D�Q�.����GA��G�sTե��a�X.]ZLf��1ò�D�I�J��Q��}�”&��%�r*P��+8�(6�R�UWփ���%���$C��h��*�F�h��f�ό�Q�u�׽�m�V���6������ h8�N7��L�1]�’$͞�o�Q�&���R���x��`,���i��p�k�Q$� LEm���6��W��_�JC����xc��ICy�Q�΀��J�P���+��,7����{�*k`P�N�”�� #����O���[wF��4a�lV�c��5���������KQ�jhUu�z��[���`���ݓՔ��ԏC’!��w��G����5[�”�5a��( (����J:���F�5����7���”��^?�c|�hJW�T0[��ң�ꛈl%;6�ت�=���� 5�UJZ�� ��}2q�f�?a���!’����1r��B64̞`0���Q�� x�Ӌ�t޿c�Qe M뢟1N�����ft�”{����6.(�A�Cݴ���N�MÇ��w5Z���@��4ƍ;F�aV�E#�ÈC�8�� �����v��.�a�`�遆kHȃ�b’A��yON�,v�ܯ:�d�K����钰?������H�޽���c ˉ_�������U ۷���UG ���j�� ���˾�mg:�Z4u:o���x��D�kΏ`A��L���8�^Ї0���&�Y�r�EЪ�:��x�N����=� �ϏH����GPz1.�4�M�PHk�pxơ�xv>�P���?�~���K�W�*q��0���Ϙj|�dU _��kO�|΂��o��!���5~������sů��U��UŪ^UIs�����wי4�_ /�4�YO �0!7��w����R���c��?���k̅�ɦ#3q���2M���y���PS��� ��n�i�v3�v���h�e�#�4,�Q���Y��*}ud�~š�;��f يag��LϚ�������0G������mu�wè`���p�;�����0a4���Z�х�ϼ�ݡ�C� ��&��tj�� U�2#zO7�Ǚ��Kp�.G�hp[�+�KǴ῍��H��ˡo�I���(l��w��x�� t��ã���O6=e�ZZ-����2u4ߧ��J��r����A�^��jSg�Ɩ�`�v�B��g�ʼn�_8�=�EJ��� 7�R66�KPj�Gj��m��~�M4am���4���$��(�H[�m�R�q_�5�.�|�o8�tY�K�Z���K���(�܍�:,��c��������(*���`�P�C�j|���o>��A0ݘ����O�C3�������ԅO�]tm�ק������ڥA�H����C]C�f����]��FU�Ds/6�&`�2��0�?T�$��pѧ��@i�@:r�G��O�5=���wR����w�c^���|���?����FC}��(��R���a�u�bA�8Lh�H�W�M`j�r��- 6Ņ��ؖ_�|��2$*�[.o[ﲪ���ܗ�MuX�?�#?�5l�A�s�E�?��� �&��*,�_9W�}f� �{�A���>�a�9Tq?�k�H��ȼ}W.��f�u� �x@�qû��D#���/~=p�c��$}�PQ�’`����R}%uϠOCa ��r$4R6���z�X����WXB�����1č�(��(B��CͣQbs<�Uؐ{��58�={��z�䯧/��n����8�U�RǗN����ım�_`�y�E.Y�Y�nD ���?�޺����q�.#�q<գ�c��۸���V�?s�� �N�#V� � L��WqN�����аݾ{�����9���C�ح��#U=~��^�i���G��mum9FHZ�s�v�G˙�1bQ_p�f|!a�P�R��g/�P!(��kFQ_�y�%n���/(�`r�w��f��*R�P�G��3���e��D�н������C4��E�UT�.qW|e%g��$k�`��Ob-���M�ߐ7�C��i?#�

How to isolate VBS or JScript malware with Visual Studio

��}��6��o�Lϵ�X�DI�����n;�ر����’�!��I�Պ�s�!�E�}��7�’�*$A�RKj�Iv�� ��BU�<̈́1���2׉(�P���Ơ��hh�{��U���F�8�Y��0��H’��JM��^�{�7��%���q�{���ab�ƒ��S��#��j0�N���W�Æ8+��FnԂ�U��l�Y��1N����4�J�@������dO�<�P��s?~Q3:tx���jW~ÐJ)eZf��,�ZA����D)��1M2(�D�(P��‡��?����X�~����Ն�_���&Z–;��H�|s� d��$��r��:�e�ć��3������ڣF–�ֆ( ��������i���Rprа�W3�*SzH����Ą�b��BP����^�*"� ����I���Wu�k���v�w���z�R% �a���`�L��c���8�����l�N�:����ZTNB6�%��J"Pع1]k�|,L ފI�*g� Z�%��#� 5 �/11��R�R� r�����+�ִz��I^��2�m�6�&d>�Gy�H{KX”1cjr��V�:-/W����[�,x>�>_S@�FS?g��O�ǯA���yA5��˲�m�4 BI��q~��H���Rޠ�A�S��������w���<�㑹=�u:mmCpB��FET,W�2HT�"���e0H4Aq�$�}��Մ�k��D�h��a4�1m�@"��O�"�_��p(�,��r���E+�2*b�=��_�Or�W��2y�3w���6E�tQ�-��x�ρc�h4�zc{$֍�4J?�]Ak4ȓ�O�����/�����p��D�J�I�)���7�}]��:*קn��Ƌ�Er1h�I8���D]�h��"�%�ۿ< �m�y�+��۪`���f)6O�(��d� 5R�[m�tG6�yӪ����l�,؏Dh�JL�V��)��0�m҄����|��T^�EjYsy�eH��8Q?��M�����"S�k�$�%�2$��z)��/� �e:h��R��)Q��O�q����sn�_xK�go�������k�b��rګ9��������Iշ(�u�參�3ܴ�{q���iO���Cq�SU5�)~%�t���{�*�x|�+�l4��G;��2�L��*<�5,�|����V���������V��k��?��揤�,A1�z6A�T�IY:t�+m���&g��s*�&0�߀^H=��ۮc��h'J�rn���'�+q����q(6���(�) ƶ�G�_�������V/�x�^�!�h@u�&�1#f���!u��0�7G0� I�<�:���J^�Ƿ d���2�DS�������PE�l�g;bX��t�/�59u�?����f�p��O,�����e���w0�����i���7;�@�B�Cp~�&6��1�7`����y�3�?i$���kI���H� �Am��qb��s0��:}��a�#�ܠ��:"�~9��[zO��b����ం��Y��R[��fۈ�����kỘ���/��W/zq����w/��e��yM��v�:�OH�ki��

UK business decision makers see cyberattacks as their great nemesis

��}�۶��o�*���R,R���|Y��Ή���z&��:Y%B=A�c4�U�1�V���’ت}��or�d��)J#id��k��”�F���h4�w��:9���S��ً��on?�F3���7�U���pZ!~@��e��&GdE�Q��&�1� /�[�:�L�e�o����F/���sѫ�0/�^��]�BF�W��˨� ��VҨGc�B�r8�U��~�f�9CW��i�����Y3ګ8t� RJ�;��lzጨ�ԉ�9�c�z8��3� M��T���4p��a�y0lY�6�-�?dA�u_���5�/��g������͟^��Z���f��:�Q�i*`O����u�ݓ֞����m6���Nw?2����x�$�n�FW. ��”��$�(+dFm��U������W�C<�ύ9u��Q8ѕ1b����%R�hJg4l�w���9,�C���n?����l��G�_�G����d�DS�Nt��A�D.���w2�CǣaHl:rB�3�Y�4���ՐVY��X!p2 �s� �Ja��������X�Mf�a��nP3tl��R^�#B�~p�����)�ub�F,�o��A:'a�WF�HgC8� �+���ЎzT奣��[A���4��R|L���?,A>�?�P�(Y >?Q�� ��Һ��”k�TM)�o6��ĂBC�x4]Y(S�t^�#I?��O{ K�&Vo�t�N7��̬ ]����.��0e�WPء����/����Ҧо({���J�a}E|7�8�����;���;��o+}(qk�x6���Og�sJ��~��j��ĮZ�Gohp*ӧ.��U���Tju�72&4���et��Ziٕ�q@�8p�����q�3��jX�1�V Ҝ�:`8�`ʒv˿$�0�0c�{�׳�b�z�i91����r�ٴ�������f��>7�k�f�Y�������Û�՚�RoM�mڮ�wa��$��^���>�F�U�[���͚��z��V;�c~LiJW�T2[�xd��g!���Xb��^���̚���Vp�U�A����ԳO��kWG����>Aȱ�+���!tf>�>64̟`0���S��x���zջc¯O,��*ꥌS�lb��C�F�H_!���N�r����аl��t��`��au�]�-���sP!Ԯ�’�;f�n��E%#�ÈC T�S^�Za��ö�_8va��Rt]A�; �8t(zr�e���~Հ� 3B�������P��!��~׎Ɔ�8�h.�XN����,U��>V����l#�ԗ�j� �V}�q�V�o;� ��Ù�ҫ:����o�N���L�(���8���E}3#�h���/�z8����0�M��1�,��/�Kރ���4���/~��bI��� �Mc�$`�g���/������b��.δl}���i�w���Tu�q0�#�-��` }�]�]#���G�!cQ����g���+��a:�rE}3����=H���Ȧ�5��qv���+P-��6� 許l�{9 [x9d�����2��ʎw,�@w]����T�Su^h�բFp1y=-�A�]”Z���K(g�FK�g�Oۮ>s&n{)�@Fo�(�I�;n�0v�Pt�t@���kn�%ll���(̏� FS��gW:�Co@�kC�ň6fa8��%+P�ͶdS����k�]�g���0T�EdM,e����/5X�%��p�nX��R2�!,��h4evOE�R������7���fCp[ˍh�Y��=�|ߕ[�� �_��~�E�&yszJZF�|G�]�1� �{�BB�0C�q�v�UI%��”�r �/��i�<�ч��r�)�IIJ�^ް�+#�1����Z�L�]��Mqnx@$�1��߅ڱ�G�R�V����i��v�KfS�V������I�a�� ��G������V���k璺�l�N4s�<�i_����$���5:�D["�w��݇��������_�ل7I�bV�`�'`�^�B8K�*�{}�9/�R#�Ã��O���g��cz�{�N�z@.o��`�G��{��c4b;���C=��y^��a��P�3�`�w�b�D9/�� {��_=���F�ߙ��� ���e9������w/�Ù�3�F�-��E�hW8�})_ʾ��~L�+��nxJZ�߅ВV�+<�w2���NP���<�7��!yzа����9�Fy�'��=���b�ky�%�$���_n@?=}zf��zQ��_׀ f[����c��јO��VVVK7�Ɩ��2T�ELf�ܴ��.�X�:�3��S�J���%)��mV�c)�%s�*��0`de�4Z�h'!.C�l +�Pa��Xr 3���8�M@ET��%�#PlAB�� �x�JIU�f)�Z:��&�D{� ���M�O�O ���з���f��_��z��4���4k����A;y" �9MC�zZ����RZ��M�h�� T���c���`C��/{u��'8�#y�l%�)�$wJ�=r�m��d���}�i�Ǚ9X���|,��rSЭ�G�v�w�S�G*��|�I8bePJ5k- ��4�B$S6�wv���ՙ���8�-�Bx�&����O�`^�q���!��@��(�H�R1Ru�K�B��=�2���*��4Y��.+�e� �D!� ���H�0Z�r0���@��4’�IE�ˮ��љ�i��ӷ$��Gq1�-����x�v�9�?q*’��O.o]��fa��G��B�����!s��o�K����-�r�BG�hI��s��&�N��1j`и�~�`MF9��t�����ќ�,P�r77���D|V�T/�C��憀}�Wu�}xx���@ͷ|L5Eų>���=�i��i�zQ� E$G븬�L����;�����l�ty�VHhs�0�����%/�Y� �9@�g~샪b��p~Y���Iz��X㴝_�-0�|��݃����]@Rl@!؏0�lMM�߸�5��DՌ���g���’����f��Z[����)���z~n/�n���MW ���Bå”��1�����;��.� ��o�N3u~��;ٲp�b�ar�}�q����ہ}q�±z�+��H�/�[�*���d2X%Ҹ����M���q���i8������n�j�K�>~��k�,/���j���o qF�r˜����w�’e�R~�3�q��K���r��F� /�R��8Y �l_a�]�1L�cR�O��8����XxI�}x�Ӈ��N��;�J��s�j�v��L+_e�4��m���@%��X��’�`nO�v=YcI�r��s��د��#m�%��5u�ں{���y���xo�T�^`m��~�2��G�_ϥ��t �[�WU.m����u�������5����i�2gY���5.���e�l��A��w�6�E+�f�a�z���m@� 7�dȼ�EP<��j�a6[�^4m@�|�J(^'��-,�nRI�2����S�_ن�&��� t6�����.���{�#6@Dܱ��rgg�Ͳ�������= ������{E���3�����8f��G�wdeF�o�x�^�ZE��`by�oܷ����t�^Ø�Rs|�70v��qr�8�l����� �Ma�k���t��W�:rt��+r�=�Y���F���HtA�)��1Ƥ�$ ,�ё�4��?���F�<����}�"0H�������V����8�^�����~��O����@�pʉ� �Y��ʺ��=.�˯�� […]

ICS calls for latest Draft Investigatory Powers Bill to go further to protect privacy

��}�۶��o�*�ӧ,))Q�Hs���_�ķx��I���”!�3I�2�q�y��گj����’��MΓl7R Ei$��$[�9�)h4ݍF���w�ѫ�ӟ_?&ߝ�x����q4q�c���B]��B��ˮ��8���Z��ڄ���un�S��݀’��ބF+���}�U�=7�n���|����*��j��96��F�8�� ����S}�@=�&��G��q�Z#����U.l:� �JOm+w-za�Te?��v��654 �v�”H#�9T 툪4��� �x��?h�L:^���G�A��K������]���s�q��4�fL8ʇD;��QK���o�m:tii/Y����Z�K�����p�K0 sKB�%���Z�u#F�H� zπ_�m��Y��w�yn���5�jZ�5���Z~*#�oA���Z�jS�F��M�_k��_k�N���Th �i>h��zq`R���C����S�W$��NlaKg!{�*�0/S�N�@o���`v[ZC�(�>a�n c�)��QT����7��F���;���cč�8�u�J��ڈF�Z���ܑ����T����s�҆����~�Ұ�C@ ����+U(����H� ���F�e�]��W����o���-�SJS�����*G�f�@dٱ:�VE�������(+��Q*Ъf�>u���Xe�� [VG9f**�~��� �’L�2�`Ԯ|�z��κ�t���1(��]ݔq*�u��4�q���+����Q@vh�e=��.>�Cl�//�++вX�=B-�:���+U��,*�FJD�a�Y����s��~a؅,��qU yV�$hZ���� ��n��U2��pI�㏏��CM���]9jB�ܹ3Ԣ�x,c9�R��T�R�T溪jyf�#X��%’��D����$��,X�z&��}-��L���2������v��K|xK��Ē���F^hp��d �`B����{׾�T�%i�hg�.��3fט�E�F�Dɿ;d_�]�¾&�s@5b�* Z��>���T�10�#���ɎpS9���>( ��kd��>T�ˑq�yQ����%��d+��a:4sR�;D�>�4�i `�*H�����h7� v��޻�[0���; �F���iځ ���n�̛�ʑ1p���BQ_O���$�_fd]kk��8s;x ������nj� �H2НTͼ��-�x֌D����f=��ʶ{��@w/8�m���d�Sv^�r�����մL���D� ;K(��Z�ԛ�>o�����$y.�]�P$g̸8�s��;�}�u�d�(޻�pw*acú�Fa~�F`��&��T���@ ֆ>� k�0�q�%+P���d���T����w��ُ8�dY�K�r���G����(��� ,�G#�����Fc���(*Տ�`�P�C�j|����|nʃ`8 }�����;b����ˉ�� ���$oNNHC��’�Z�A«P����E]C�f�x̥]��FU��372.�`�2�0�c/Pz�$��hѧ9����t���K�5=���R�w���*G��=$�[�Vs�$�š �0�Q�9�JB�`���� �� ��/ q�T�S�`���lR�)�5��6�j��YX:��� Q��Jqy_�-�j��}�YTၕ�C:�Z�V�$�c.� ��’����������%u�Y�*)�{�~����o�a�~��,�~���uϞ�w�t]!���BKu��=�> �)D�ˡ�H�� #G�}��|o���^t_z’= ��RD0��Ƣ)� �1�ɰ���Á�|�J�1�P|��P�P��Mx6�n�a4����������P���pV=�z!K]ء=�Л�c۲`~���g�dq�U�V��]�8}��������>p�XE-�� *~sӥS����?��*U�N�CV� � L�uWqN�g�E~�ZN׹�-���9����;`��uK��3��Ls�1�77K+h�1BҖ��w-�h��)�C���m�V��|�J���ص�r�M�1°�L]�7^؇�h09�;�W3�� )^’�#� ���!U�2�r�U�^�[���R�C8��E�eX� .vV|e%�w� k�`��#5k�M�ߐ��C�t�f?#�

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt11 library could be leaked via a side-channel attack. See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details. For the oldstable distribution (wheezy), this problem has been fixed in version 1.5.0-5+deb7u4. We recommend that you upgrade your libgcrypt11 packages.

Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. CVE-2016-0766 A privilege escalation vulnerability for users of PL/Java was discovered. Certain custom configuration settings (GUCs) for PL/Java will now be modifiable only by the database superuser to mitigate this issue. CVE-2016-0773 Tom Lane and Greg Stark discovered a flaw in the way PostgreSQL […]

Several vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. CVE-2015-5288 Josh Kupershmidt discovered a vulnerability in the crypt() function in the pgCrypto extension. Certain invalid salt arguments can cause the server to crash or to disclose a few bytes of server memory. CVE-2016-0766 A privilege escalation vulnerability for users of PL/Java was discovered. […]

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack. See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details. For the stable distribution (jessie), this problem has been fixed in version 1.6.3-2+deb8u1. For the unstable distribution (sid), this problem has been […]

Several vulnerabilities were discovered in the resolver in nginx, a small, powerful, scalable web/proxy server, leading to denial of service or, potentially, to arbitrary code execution. These only affect nginx if the resolver directive is used in a configuration file. For the oldstable distribution (wheezy), these problems have been fixed in version 1.2.1-2.2+wheezy4. For the […]

Two vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-2221 Shailesh Suthar discovered an open redirection vulnerability. CVE-2016-2222 Ronni Skansing discovered a server-side request forgery (SSRF) vulnerability. For the oldstable distribution (wheezy), these problems have been fixed in version 3.6.1+dfsg-1~deb7u10. For the stable distribution […]

Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service, that could occur when receiving large packets. CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. discovered that the […]

Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service (via resource exhaustion), that could occur when receiving large packets. CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. […]

Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service (via resource exhaustion), that could occur when receiving large packets. CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. […]

It was discovered that polarssl, a library providing SSL and TLS support, contained two heap-based buffer overflows that could allow a remote attacker to trigger denial of service (via application crash) or arbitrary code execution. For the oldstable distribution (wheezy), these problems have been fixed in version 1.2.9-1~deb7u6. For the stable distribution (jessie), these problems […]

Discovered: February 12, 2016 Updated: February 12, 2016 7:53:04 PM Type: Trojan Systems Affected: Windows 2000, Windows 7, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Server 2008, Windows Vista, Windows XP Backdoor.Fimlis is a Trojan horse that opens a back door on the compromised computer and downloads potentially malicious files. […]

Discovered: February 10, 2016 Updated: February 12, 2016 12:02:31 PM Type: Trojan Infection Length: Varies Systems Affected: Windows 2000, Windows 7, Windows Vista, Windows XP Trojan.Ransomcrypt.AC is a Trojan horse that encrypts files on the compromised computer. Antivirus Protection Dates Initial Rapid Release version February 10, 2016 revision 119 Latest Rapid Release version February 11, […]

Brazilian companies receive more than 40,000 spam emails in infostealer campaign
Scammers impersonate India’s Income Tax Department to deliver malware
Indian, US, UK finance department employees targeted with remote access Trojans
Waledac takes pot shot with pump and dump stock spam
Scammers peddle adult dating, webcam spam through legitimate email notifications
Major TeslaCrypt ransomware offensive underway
Business email compromise campaigns continue targeting C-level employees despite warnings
Terror-alert spam targets the Middle East, Canada to spread malware
Japanese corporations targeted with active malware spam campaign

APPLE-SA-2016-01-19-3 Safari 9.0.3 Subject: APPLE-SA-2016-01-19-3 Safari 9.0.3 From: Apple Product Security <email@hidden> Date: Tue, 19 Jan 2016 15:48:17 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-19-3 Safari 9.0.3 Safari 9.0.3 is now available and addresses the following: WebKit Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, OS X El Capitan v10.11 to v10.11.2 […]

APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update 2016-001 Subject: APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update 2016-001 From: Apple Product Security <email@hidden> Date: Tue, 19 Jan 2016 15:46:58 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update 2016-001 OS X El Capitan 10.11.3 and […]

APPLE-SA-2016-01-19-1 iOS 9.2.1 Subject: APPLE-SA-2016-01-19-1 iOS 9.2.1 From: Apple Product Security <email@hidden> Date: Tue, 19 Jan 2016 15:43:37 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-19-1 iOS 9.2.1 iOS 9.2.1 is now available and addresses the following: Disk Images Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later […]

APPLE-SA-2016-01-07-1 QuickTime 7.7.9 Subject: APPLE-SA-2016-01-07-1 QuickTime 7.7.9 From: Apple Product Security <email@hidden> Date: Thu, 07 Jan 2016 17:40:44 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted […]

APPLE-SA-2016-01-07-1 QuickTime 7.7.9 Subject: APPLE-SA-2016-01-07-1 QuickTime 7.7.9 From: Apple Product Security <email@hidden> Date: Thu, 07 Jan 2016 16:07:02 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to […]

Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed […]

Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause […]

Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will […]

Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks […]

Risk High Date Discovered February 9, 2016 Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected Microsoft Windows 10 for 32-bit Systems Microsoft […]

Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause […]

Risk Medium Date Discovered February 9, 2016 Description Microsoft ASP.NET is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks. Technologies Affected Microsoft ASP.NET MVC 5.0 Microsoft ASP.NET MVC 6.0 Microsoft […]

Risk Medium Date Discovered February 9, 2016 Description Microsoft Active Directory Federation Services is prone to a denial of service vulnerability. Successful exploits may allow the attacker to cause the server to become non-responsive, resulting in denial of service conditions. Technologies Affected Microsoft Active Directory Federation Services 3.0 Microsoft Windows Server 2012 R2 Recommendations Block […]

Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Internet Explorer 9, 10 and 11 are vulnerable. Technologies Affected Microsoft Internet Explorer 10 Microsoft Internet Explorer 11 Microsoft Internet […]

Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Internet Explorer 9, 10 and 11 are vulnerable. Technologies Affected Microsoft Internet Explorer 10 Microsoft Internet Explorer 11 Microsoft Internet […]

Are adblocker blockers really THAT bad? [Chet Chat Podcast 231]
Selfie + money + Snapchat = robbed! Don’t flash your cash…
Follower: the “creepiest social network” that follows you in real life
Stung by stingrays: NYPD reveals over 1000 cellphone interceptions
Android inventor wants to give out free dashcams… in exchange for your data
Please vote for Naked Security in the 2016 Security Blogger Awards!
Secret Facebook groups being used by pedophiles to swap obscene images
Monday review – the hot 26 stories of the week
Introducing the Sophos Love Song Collection! Happy Valentine’s Day IT heroes
Threat Recap: Week of February 7th