Security Leftovers
-
Anker Tries To Bullshit The Verge About Security Problems In Its Eufy ‘Smart’ Camera
Anker, the popular maker of device chargers and the Eufy smart camera line, proudly proclaims on its website that user data will be stored locally, “never leaves the safety of your home,” footage only gets transmitted with “end-to-end” military-grade encryption, and that the company will only send that footage “straight to your phone.”
-
Short Topix: If Your Password Is Listed, CHANGE IT NOW!
The team behind NordPass, the same people behind NordVPN, have released their 2022 list of the 200 most common passwords. Many of these notoriously WEAK passwords can be hacked in less than one second.
The number one most common (and exceptionally weak) password is ... drum roll ... password. Perennial favorites like "123456789" or "7654321" or "1234554321" are also on the list, and are all capable of being guessed by a hacker in under one second.
We've run password security articles so many times during my 13.5 years tenure as the editor of The PCLinuxOS Magazine that I've actually lost count. I've attempted to go through past issues several times to count the number of times we've run password security articles, but I keep coming up with a different number every time. Your mileage may vary.
But, there are common and recurring themes. To better protect your private, personally identifiable information, adhere to these basic security rules that follow.
-
Introducing the book: The Security Analyst’s Guide to Suricata - Help Net Security
In this Help Net Security video interview, Eric Leblond, CTO at Stamus Networks, talks about The Security Analyst’s Guide to Suricata, a book he co-wrote with Peter Manev.
-
Security updates for Thursday [LWN.net]
Security updates have been issued by Debian (dlt-daemon, jqueryui, and virglrenderer), Fedora (firefox, vim, and woff), Oracle (kernel and nodejs:18), Red Hat (java-1.8.0-ibm and redhat-ds:11), Slackware (python3), SUSE (buildah, matio, and osc), and Ubuntu (heimdal and postgresql-9.5).
-
CISA Releases Three Industrial Control Advisories | CISA
CISA has released three (3) Industrial Control Systems (ICS) advisories on 08 December 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.
-
CISA Releases Phishing Infographic | CISA
Today, CISA published a Phishing Infographic to help protect both organizations and individuals from successful phishing operations. This infographic provides a visual summary of how threat actors execute successful phishing operations. Details include metrics that compare the likelihood of certain types of “bait” and how commonly each bait type succeeds in tricking the targeted individual. The infographic also provides detailed actions organizations and individuals can take to prevent successful phishing operations—from blocking phishing attempts to teaching individuals how to report successful phishing operations.
-
Leaked Signing Keys Are Being Used to Sign Malware - Schneier on Security
A bunch of Android OEM signing keys have been leaked or stolen, and they are actively being used to sign malware.
[...]
This is a huge problem. The whole system of authentication rests on the assumption that signing keys are kept secret by the legitimate signers. Once that assumption is broken, all bets are off...
-
Samsung’s Android app-signing key has leaked, is being used to sign malware