• Search for:
    28 Sep, 2021
    Apple AirTag Bug Enables ‘Good Samaritan’ Attack
    Cybersecurity , , , , , , ,

    The new $30 Airtag tracking device from Apple has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owner’s phone number if the Airtag has been set to lost mode. But according to new research, this same feature can be abused to redirect the Good Samaritan to an iCloud phishing page — or to any other malicious website. …

    Read MoreApple AirTag Bug Enables ‘Good Samaritan’ Attack

    8 Sep, 2021
    Microsoft: Attackers Exploiting Windows Zero-Day Flaw
    Cybersecurity , , , ,

    Microsoft Corp. warned Tuesday that attackers are exploiting a previously unknown vulnerability in Windows 10 and many Windows Server versions to seize control over PCs when users open a malicious document or visit a booby-trapped website. There is currently no official patch for the flaw, but Microsoft has released recommendations for mitigating the threat. …

    Read MoreMicrosoft: Attackers Exploiting Windows Zero-Day Flaw

    19 Aug, 2021
    Wanted: Disgruntled Employees to Deploy Ransomware
    Cybersecurity , , , , , , , , ,

    Criminal hackers will try almost anything to get inside a profitable enterprise and secure a million-dollar payday from a ransomware infection. Apparently now that includes emailing employees directly and asking them to unleash the malware inside their employer’s network in exchange for a percentage of any ransom amount paid by the victim company. …

    Read MoreWanted: Disgruntled Employees to Deploy Ransomware

    7 Jul, 2021
    Microsoft Issues Emergency Patch for Windows Flaw
    Cybersecurity , , , , , , ,

    Microsoft on Tuesday issued an emergency software update to quash a security bug that’s been dubbed “PrintNightmare,” a critical vulnerability in all supported versions of Windows that is actively being exploited. The fix comes a week ahead of Microsoft’s normal monthly Patch Tuesday release, and follows the publishing of exploit code showing would-be attackers how to leverage the flaw to break into Windows computers. …

    Read MoreMicrosoft Issues Emergency Patch for Windows Flaw

    2 Jul, 2021
    Another 0-Day Looms for Many Western Digital Users
    Cybersecurity , , , , , , , , , , ,

    Countless Western Digital customers saw their MyBook Live network storage drives remotely wiped in the past month thanks to a bug in a product line the company stopped supporting in 2015, as well as a previously unknown zero-day flaw. But there is a similarly serious zero-day flaw present in a much broader range of newer Western Digital MyCloud network storage devices that will remain unfixed for many customers who can’t or won’t upgrade to the latest operating system. …

    Read MoreAnother 0-Day Looms for Many Western Digital Users

    25 Jun, 2021
    MyBook Users Urged to Unplug Devices from Internet
    Cybersecurity , , , , , , , , , ,

    Hard drive giant Western Digital is urging users of its MyBook Live brand of network storage drives to disconnect them from the Internet, warning that malicious hackers are remotely wiping the drives using a previously unknown critical flaw that can be triggered by anyone who knows the Internet address of an affected device. …

    Read MoreMyBook Users Urged to Unplug Devices from Internet

    21 May, 2021
    How to Tell a Job Offer from an ID Theft Trap
    Cybersecurity , , , , , , , ,

    One of the oldest scams around — the fake job interview that seeks only to harvest your personal and financial data — is on the rise, the FBI warns. Here’s the story of a recent LinkedIn impersonation scam that led to more than 100 people getting duped, and one almost-victim who decided the job offer was too-good-to-be-true. …

    Read MoreHow to Tell a Job Offer from an ID Theft Trap

    19 May, 2021
    Recycle Your Phone, Sure, But Maybe Not Your Number
    Cybersecurity , , , , , , , ,

    Many online services allow users to reset their passwords by clicking a link sent via SMS, and this unfortunately widespread practice has turned mobile phone numbers into de facto identity documents. Which means losing control over one thanks to a divorce, job termination or financial crisis can be devastating. Even so, plenty of people willingly abandon a mobile number without considering the potential fallout to their digital identities when those digits invariably get reassigned to someone else. New research shows how fraudsters can abuse wireless provider websites to identify available, recycled mobile numbers that allow password resets at a range of email providers and financial services online. …

    Read MoreRecycle Your Phone, Sure, But Maybe Not Your Number

    5 May, 2021
    Malicious Office 365 Apps Are the Ultimate Insiders
    Cybersecurity , , , , , , , , ,

    Phishers targeting Microsoft Office 365 users increasingly are turning to specialized links that take users to their organization’s own email login page. After a user logs in, the link prompts them to install a malicious but innocuously-named app that gives the attacker persistent, password-free access to any of the user’s emails and files, both of which are then plundered to launch malware and phishing scams against others. …

    Read MoreMalicious Office 365 Apps Are the Ultimate Insiders

    26 Apr, 2021
    Experian’s Credit Freeze Security is Still a Joke
    Cybersecurity , , , , , , ,

    In 2017, KrebsOnSecurity showed how easy it is for identity thieves to undo a consumer’s request to freeze their credit file at Experian, one of the big three consumer credit bureaus in the United States.  Last week, KrebsOnSecurity heard from a reader who had his freeze thawed without authorization through Experian’s website, and it reminded me of how truly broken authentication and security remains in the credit bureau space. …

    Read MoreExperian’s Credit Freeze Security is Still a Joke