China now blocking TLS 1.3 with ESNI enabled, say Great-Firewall-watchers

The Register - 7 hours 21 min ago
And needs a very blunt instrument to do the job, because the protocol works as planned

China is now blocking encrypted HTTPS traffic that uses TLS 1.3 with ESNI enabled, according to observers at the Great Firewall Report (GFR).…

Categories: News

Peer-to-peer takes on a whole new meaning when used to spy on 3.7 million or more cameras, other IoT gear

The Register - Mon, 10/08/2020 - 22:28
In-depth dive into protocols exposing countless gadgets to miscreants

DEF CON  More than 3.7 million. That's the latest number of surveillance cameras, baby monitors, doorbells with webcams, and other internet-connected devices found left open to hijackers via two insecure communications protocols globally, we're told.…

Categories: News

Brit bank Barclays probed amid claims bosses used high-tech to spy on staff, measure productivity

The Register - Mon, 10/08/2020 - 20:06
Now that's a stretch: 'Work Yoga' memo tells folks to ignore calls, emails to 'stay in the zone'

The British offices of Barclays Bank are under investigation over allegations that managers spied upon their own staff as part of a workplace productivity improvement drive.…

Categories: News

Pen Test Partners: Boeing 747s receive critical software updates over 3.5" floppy disks

The Register - Mon, 10/08/2020 - 15:01
Industry binning old aircraft is an opportunity for aviation infosec

DEF CON  Boeing 747-400s still use floppy disks for loading critical navigation databases, Pen Test Partners has revealed to the infosec community after poking about one of the recently abandoned aircraft.…

Categories: News

Pay ransomware crooks, or restore the network? Guess which way this city chose after weighing up the costs

The Register - Mon, 10/08/2020 - 11:04
Plus: Sec wizard shows another way to pwn Mac users

In brief  A city in Colorado, USA, has swallowed its pride and paid off a malware gang after deciding the cost of a network nuke-and-pave was too high.…

Categories: News

What happens when holes perfect for spyware are found in the engine room of millions of Qualcomm-based phones? Let's find out

The Register - Sat, 08/08/2020 - 00:46
Start the clock on those patches – they'll be coming any day, week, month soon

DEF CON  In July, the makers of millions of smartphones powered by Qualcomm's Snapdragon system-on-chips received mitigation recommendations to address a bevy of security flaws in their products, all introduced by Qualcomm's technology.…

Categories: News

How did you spend your time at university? Pizza, booze, sleeping? This Oxford student is snooping on satellites

The Register - Fri, 07/08/2020 - 23:01
Bug-hunter details how his team slurped data… IN SPAAAAACE

DEF CON  FYI, if you didn't already know: readily available satellite TV electronics can be used to sniff and inspect satellite internet traffic.…

Categories: News

Android user chucks potential $10bn+ sueball at Google over 'spying', 'harvesting data'... this time to build supposed rival to TikTok called 'Shorts'

The Register - Fri, 07/08/2020 - 13:23
These are the class-action-suit-joining 'droids lawyers are looking for. (We'll get our coats)

Google "abuses Android OS to obtain a competitive advantage", according to a lawsuit filed this week alleging that the Alphabet offshoot "secretively monitored and collected users' sensitive personal data" to develop apps to compete with TikTok, Facebook, and Instagram.…

Categories: News

So you've decided you want to write a Windows rootkit. Good thing this chap's just demystified it in a talk

The Register - Fri, 07/08/2020 - 09:15
Demirkapi shows how drivers can be misused for deep pwnage

DEF CON  Writing a successful Windows rootkit is easier than you would think. All you need is do is learn assembly and C/C++ programming, plus exploit development, reverse engineering, and Windows internals, and then find and abuse a buggy driver, and inject and install your rootkit, and bam. Happy days.…

Categories: News

Chrome Web Store slammed again after 295 ad-injecting, spammy extensions downloaded 80 million times

The Register - Fri, 07/08/2020 - 07:02
Not exactly the first time this has happened, by a very long chalk

Google's Chrome Web Store is once again under fire for poor policing of harmful extensions.…

Categories: News

Trump administration labels WeChat, TikTok ‘threats’ to national security, bans transactions with both

The Register - Fri, 07/08/2020 - 04:32
On grounds that they can track users, conduct corporate espionage and oppress Chinese-Americans

United States president Donald Trump has issued two executive orders banning Chinese messaging service WeChat and made-in-China-but-only-operating-abroad social network TikTok, and labelling the two a “threat”.…

Categories: News

Capital One fined $80m for shoddy public cloud security. Yeah, same bank in that 106m customer-record hack

The Register - Fri, 07/08/2020 - 02:22
All that money must be wired to the US Treasury immediately

Capital One must pay a $80m fine for its shoddy public cloud security – yes, the US banking giant that was hacked last year by a miscreant who stole personal information on 106 million credit-card applicants in America and Canada.…

Categories: News

Foreshadow returns to the foreground: Secrets-spilling speculative-execution Intel flaw lives on, say boffins

The Register - Fri, 07/08/2020 - 01:00
A misunderstanding about the vulnerability means defenses fall short

Some of the boffins who in 2018 disclosed the data-leaking speculative-execution flaws known as Spectre and Meltdown today contend that attempts to extinguish the Foreshadow variant have missed the mark.…

Categories: News

When it comes to hacking societies, Russia remains the master at sowing discord and disinformation online

The Register - Thu, 06/08/2020 - 22:49
China can't hold a candle to GRU's shenanigans, says expert

Black Hat  While China is the bête noire du jour of the US government, Russia is the master of spreading disinformation, fostering conflict, and derailing discourse online, the Black Hat security conference was told today.…

Categories: News

Intel blueprints – 20GB of source code, schematics, specs, docs – spill onto web, Chipzilla denies hack

The Register - Thu, 06/08/2020 - 20:31
Leaker only 'a bit concerned' about getting sued

Updated  Swiss IT consultant Tillie Kottmann on Thursday published a trove of purportedly confidential Intel technical material, code, and documents related to various processors and chipsets.…

Categories: News

Think carefully about cyber insurance, says NCSC. But don't worry about buying off ransomware crooks

The Register - Thu, 06/08/2020 - 15:00
Should your policy cover that? Well that's up to you

The National Cyber Security Centre has urged British businesses to think carefully when picking a cyber insurance policy – but won’t say whether insurance that covers ransomware payoffs is a bad thing or not.…

Categories: News

National Crime Agency says Brit teen accused of Twitter hack has not been arrested

The Register - Thu, 06/08/2020 - 10:10
Bognor Regis man still faces 20 years in clink, though

The British teenager accused of being part of the gang that hacked Twitter and posted a cryptocurrency scam from various US celebrities' accounts has not yet been arrested.…

Categories: News

USA decides to cleanse local networks of anything Chinese under new five-point national data security plan

The Register - Thu, 06/08/2020 - 04:31
‘Clean Network’ initiative bans use of Chinese clouds, names Alibaba, Baidu, and Tencent as compromised

US secretary of state Mike Pompeo has announced a “Clean Network plan” he says offers a “comprehensive approach to guarding our citizens’ privacy and our companies’ most sensitive information from aggressive intrusions by malign actors, such as the Chinese Communist Party (CCP).”…

Categories: News

Canon not firing on all cylinders: Fledgling cloud loses people's pics'n'vids, then 'Maze ransomware' hits

The Register - Thu, 06/08/2020 - 03:18
'We are investigating the situation'

Canon has had a double shot of bad luck lately. First, its brand-new photo-and-video-hosting cloud started losing files. Now it's reportedly fallen victim to ransomware.…

Categories: News

US voting hardware maker's shock discovery: Security improves when you actually work with the community

The Register - Thu, 06/08/2020 - 02:09
ES&S takes the bold step of not ignoring vulnerability reports

Black Hat  Just hours after Professor Matt Blaze today discussed the state of election system security in America, one of the largest US voting machine makers stepped forward to say it's trying to improve its vulnerability research program.…

Categories: News


Subscribe to Sec Tec Limited aggregator - News