New SteelFox Trojan mimics software activators, stealing sensitive data and mining cryptocurrency

Kaspersky experts have discovered a new SteelFox Trojan that mimics popular software like Foxit PDF Editor and JetBrains to spread a stealer-and-miner bundle. Continue reading New SteelFox Trojan mimics software activators, stealing sensitive data and mining cryptocurrency

Critical Vulnerability in Open SSL

There are no details yet, but it’s really important that you patch Open SSL 3.x when the new version comes out on Tuesday.

How bad is “Critical”? According to OpenSSL, an issue of critical severity affects common configurations and is also likely exploitable.

It’s likely to be abused to disclose server memory contents, and potentially reveal user details, and could be easily exploited remotely to compromise server private keys or execute code execute remotely. In other words, pretty much everything you don’t want happening on your production systems…

Continue reading Critical Vulnerability in Open SSL

Evaluating the use of encryption across the world’s top one million sites

A new report from security researcher and TLS expert Scott Helme, evaluates the use of encryption across the world’s top one million sites over the last six months and reveals the need for a control plane to automate the management of machine identitie… Continue reading Evaluating the use of encryption across the world’s top one million sites

How Everything We’re Told About Website Identity Assurance is Wrong

Presently sponsored by: Varonis. Reduce your ransomware blast radius with the leader in data-first security. Try it free!

I have a vehement dislike for misleading advertising. We see it every day; weight loss pills, make money fast schemes and if you travel in the same circles I do, claims that extended validation (EV) certificates actually do something useful:

Continue reading How Everything We’re Told About Website Identity Assurance is Wrong