S3 Ep98: The LastPass saga – should we stop using password managers? [Audio + Text]
Latest episode – listen now! Continue reading S3 Ep98: The LastPass saga – should we stop using password managers? [Audio + Text]
Author Archives: Paul Ducklin
URGENT! Apple quietly slips out zero-day update for older iPhones
Patch as soon as you can – that recent WebKit zero-day affecting new iPhones is apparently being used against older models, too. Continue reading URGENT! Apple quietly slips out zero-day update for older iPhones
Chrome patches 24 security holes, enables “Sanitizer” safety system
24 existing bugs fixed. And, we hope, numerous potential future bugs prevented. Continue reading Chrome patches 24 security holes, enables “Sanitizer” safety system
JavaScript bugs aplenty in Node.js ecosystem – found automatically
How to get the better of bugs in all the possible packages in your supply chain? Continue reading JavaScript bugs aplenty in Node.js ecosystem – found automatically
LastPass source code breach – do we still recommend password managers?
What does the recent LastPass breach mean for password managers? Just a bump in the road, or a reason to ditch them entirely? Continue reading LastPass source code breach – do we still recommend password managers?
Firefox 104 is out – no critical bugs, but update anyway
Two trust-spoofing bugs were the main culprits this month – but neither one was a zero-day. Continue reading Firefox 104 is out – no critical bugs, but update anyway
S3 Ep97: Did your iPhone get pwned? How would you know? [Audio + Text]
Latest episode – listen now! (Or read the transcript if you prefer the text version.) Continue reading S3 Ep97: Did your iPhone get pwned? How would you know? [Audio + Text]
Breaching airgap security: using your phone’s compass as a microphone!
One bit per second makes the Voyager probe data rate seem blindingly fast. But it’s enough to break your security assumptions… Continue reading Breaching airgap security: using your phone’s compass as a microphone!
Bitcoin ATMs leeched by attackers who created fake admin accounts
The criminals didn’t implant any malware. The attack was orchestrated via malevolent configuration changes. Continue reading Bitcoin ATMs leeched by attackers who created fake admin accounts
Laptop denial-of-service via music: the 1980s R&B song with a CVE!
We haven’t validated this vuln ourselves… but the source of the story is impeccable. (Impeccably dressed, at least.) Continue reading Laptop denial-of-service via music: the 1980s R&B song with a CVE!