News
New Mirai-like IoT botnet known as Reaper or IOTroop
It resembles Mirai in many ways, with the difference that it doesn't just use default password guesses to break into IoT devices but known security exploits. More than a million devices are already infected.
Ransomware outbreak in Russia and Ukraine
Dubbed "Bad Rabbit", it pretended to be an Adobe Flash Installer on news sites and asked to be installed. It took down public transport in Kiev, Odessa's airport and a few Russian news agencies.
Windows 10's anti-ransomware feature called Controlled Folder Access
Controlled Folder Access (CFA) is a nifty feature that let's you designate 'protected folders'. If a non-whitelisted process, such as ransomware, tries to modify those folders, it will be blocked and you will be alerted.
CoinHive's DNS hacked to mine cryptocurrency for hacker
CoinHive is a service that allows you to embed Javascript in your website that mines cryptocurrency in the visitor's browser. Their Cloudflare account was hacked and their library was replaced with a malicious version, causing everyone to mine for the hacker's benefit. Cue the slow clap.
Mac media player app Elmedia Player and download manager Folx backdoored
The applications were infected with the Proton malware, which is capable of stealing keychain passwords, cryptocurrency, browser information, etc. It's unknown when the infection started. If you installed any of these apps you'll need a full system wipe.
Hacking back, the worst idea in cybersecurity, rises again
A US bill has been proposed that would allow companies to 'hack back' at their attackers. That might seem like a good idea at first, but take a moment to think some more on it and then read the article on why it is actually a terrible, terrible idea.
Canada's spy agency releases malware-fighting tool to the public
Canada's CSE, basically their equivalent of the NSA, has released a tool called AssemblyLine. Files go in, get analysed, and roll out with a score to help separate new from old malware, determining which files require a closer look by a human. The repository can be found on Bitbucket here.
Apple responds to senator's Face ID concerns in letter
There are quite a few questions raised on security and privacy around FaceID. Tim Cook answers a set of questions on the issue, and more can be read in a short white paper on FaceID.
The 6-step "Happy Path" to HTTPS
Now that Chrome shows non-HTTPS pages as "Insecure" whenever they have an input field, Troy Hunt explains step by step how to get your website on HTTPS, including HSTS (HTTPS Strict Transport Security) and CSP (Content Security Policy).
movies-for-hackers: a curated list of movies every hacker & cyberpunk must watch
A Github repository with all movies, TV shows and documentaries on hackers and cybersecurity :-)
Sponsorships
Discover security flaws in your website before attackers exploit them
Attackers only need to find and exploit one vulnerability in your web application to create havoc.