即将举行的活动和其他信息

勒索软件团伙向SEC提起诉讼

2023年11月17日-上午11:31

Bruce Schneier

A ransomware gang, annoyed at not being paid, filed an SEC complaint against its victim for not disclosing its security breach within the required four days.

This is over the top, but is just another example of the extreme pressure ransomware gangs put on companies after seizing their data. Gangs are now going through the data, looking for particularly important or embarrassing pieces of data to threaten executives with exposing. I have heard stories of executives’ families being threatened, of consensual porn being identified (people regularly mix work and personal email) and exposed, and of victims’ customers and partners being directly contacted. Ransoms are in the millions, and gangs do their best to ensure that the pressure to pay is intense...

Read More >

联邦贸易委员会的语音克隆挑战

2023年11月16日-下午1:46

Bruce Schneier

The Federal Trade Commission is running a competition “to foster breakthrough ideas on preventing, monitoring, and evaluating malicious voice cloning.”

Read More >

在公共代码中保留身份验证凭据

2023年11月16日-上午11:24

Bruce Schneier

Interesting article about a surprisingly common vulnerability: programmers leaving authentication credentials and other secrets in publicly accessible software code:

Researchers from security firm GitGuardian this week reported finding almost 4,000 unique secrets stashed inside a total of 450,000 projects submitted to PyPI, the official code repository for the Python programming language. Nearly 3,000 projects contained at least one unique secret. Many secrets were leaked more than once, bringing the total number of exposed secrets to almost 57,000...

Read More >

New SSH Vulnerability

2023年11月15日-下午12:51

Bruce Schneier

This is interesting:

For the first time, researchers have demonstrated that a large portion of cryptographic keys used to protect data in computer-to-server SSH traffic are vulnerable to complete compromise when naturally occurring computational errors occur while the connection is being established.

[…]

The vulnerability occurs when there are errors during the signature generation that takes place when a client and server are establishing a connection. It affects only keys using the RSA cryptographic algorithm, which the researchers found in roughly a third of the SSH signatures they examined. That translates to roughly 1 billion signatures out of the 3.2 billion signatures examined. Of the roughly 1 billion RSA signatures, about one in a million exposed the private key of the host...

Read More >

Spaf on the Morris Worm

2023年11月14日-上午11:47

B. Schneier

Gene Spafford wrote an essay reflecting on the Morris Worm of 1988—thirty-five years ago. His lessons from then are still applicable today.

Read More >

涉嫌敲诈心理治疗患者面临审判

2023年11月16日-下午2:59

BrianKrebs

芬兰检察官本周开始对Julius Kivimäki进行刑事审判, 一名26岁的芬兰男子被指控敲诈勒索一家曾经很受欢迎、现已破产的在线心理治疗诊所和数千名患者. In a 2,200-page report, 芬兰当局阐述了他们如何将勒索狂潮与Kivimäki联系起来, 一名臭名昭著的黑客，2015年被判犯有数万起网络犯罪, including data breaches, payment fraud, 操作僵尸网络，报警说有炸弹威胁.

Read More >

微软补丁星期二，2023年11月版

2023年11月14日-下午6点

BrianKrebs

微软今天发布了更新，以修复其Windows操作系统和相关软件中的50多个安全漏洞, 包括微软警告称已经在主动攻击中被利用的三个“零日”漏洞.

Read More >

在益百利，任何人都很容易成为你

2023年11月11日-下午12:59

BrianKrebs

In the summer of 2022, KrebsOnSecurity记录了几位读者的困境，他们在三大消费者信用报告机构益百利(Experian)的账户被劫持，身份窃贼只是用不同的电子邮件地址重新注册了账户. 16个月过去了，益百利显然没有解决这个安全漏洞. 我知道是因为我在益百利的账户最近被劫持了, 唯一能恢复访问权限的方法就是重新创建账号.

Read More >

谁是美国特警换货服务的幕后推手?

November 6, 2023 - 8:51am

BrianKrebs

Last week, 克雷布森安全公司爆料称，一家最大的为赃物洗钱的网络犯罪服务机构最近遭到了黑客攻击, 公开其内部操作, 财务及组织架构. In today's Part II, mg不朽情缘游戏网址将研究“无所畏惧”留下的真实身份的线索,这是特警美国空投服务的老板给他取的绰号.

Read More >

俄罗斯转运服务“SWAT美国空投”曝光

2023年11月2日-下午3:55

BrianKrebs

一个最大的为赃物洗钱的网络犯罪服务最近被黑了, 公开其内部操作, 财务及组织架构. 以下是总部位于俄罗斯的SWAT美国空投服务的详细介绍, 哪个公司目前的雇员超过1人,全美国有200人有意或无意地参与了用被盗信用卡购买的昂贵消费品的再运输.

Read More >