Read Time:4 Second
Phishing attacks using DocuSign impersonations targeting state agencies have surged 98% since Nov 8
Category Archives: News
North Korean IT Worker Network Tied to BeaverTail Phishing Campaign
Read Time:6 Second
BeaverTail malware has been used to target tech job seekers through fake recruiters, Palo Alto Networks’ Unit 42 has found
FTC Records 50% Drop in Nuisance Calls Since 2021
Read Time:5 Second
The US Federal Trade Commission is celebrating a halving of unwanted telemarketing and scam calls since 2021
NCSC Warns UK Shoppers Lost £11.5m Last Christmas
Read Time:8 Second
The UK’s National Cyber Security Centre is urging shoppers to stay safe this Christmas after revealing they lost £11.5m to fraudsters in 2023
Friday Squid Blogging: Female Gonatus Onyx Squid Carrying Her Eggs
Read Time:6 Second
Fantastic video of a female Gonatus onyx squid swimming while carrying her egg sack.
Palo Alto Networks Confirms New Zero-Day Being Exploited by Threat Actors
Read Time:6 Second
The security provider has elevated its warning about a vulnerability affecting firewall management interfaces after observing active exploitation
Bitfinex Hacker Jailed for Five Years Over Billion Dollar Crypto Heist
Read Time:5 Second
Ilya Lichtenstein hacked into the cryptocurrency exchange in 2016 and stole around 120,000 bitcoins
watchTowr Finds New Zero-Day Vulnerability in Fortinet Products
Read Time:6 Second
The new vulnerability was named “FortiJump Higher” due to its similarity with the “FortiJump” vulnerability discovered in October
Good Essay on the History of Bad Password Policies
Read Time:1 Minute, 23 Second
Stuart Schechter makes some good points on the history of bad password policies:
Morris and Thompson’s work brought much-needed data to highlight a problem that lots of people suspected was bad, but that had not been studied scientifically. Their work was a big step forward, if not for two mistakes that would impede future progress in improving passwords for decades.
First, was Morris and Thompson’s confidence that their solution, a password policy, would fix the underlying problem of weak passwords. They incorrectly assumed that if they prevented the specific categories of weakness that they had noted, that the result would be something strong. After implementing a requirement that password have multiple characters sets or more total characters, they wrote:
These improvements make it exceedingly difficult to find any individual password. The user is warned of the risks and if he cooperates, he is very safe indeed.
As should be obvious now, a user who chooses “p@ssword” to comply with policies such as those proposed by Morris and Thompson is not very safe indeed. Morris and Thompson assumed their intervention would be effective without testing its efficacy, considering its unintended consequences, or even defining a metric of success to test against. Not only did their hunch turn out to be wrong, but their second mistake prevented anyone from proving them wrong.
That second mistake was convincing sysadmins to hash passwords, so there was no way to evaluate how secure anyone’s password actually was. And it wasn’t until hackers started stealing and publishing large troves of actual passwords that we got the data: people are terrible at generating secure passwords, even with rules.
Ransomware Groups Use Cloud Services For Data Exfiltration
Read Time:4 Second
SentinelOne described some of ransomware groups’ favorite techniques for targeting cloud services