Security Leftovers
-
Your child’s name makes a horrible password
What’s in a name? A lot. It’s the first piece of information that identifies a person — from their first name given at birth to their last name which connects them to their family lineage. Even a fictional name like Clark Kent says a lot. Not surprisingly a lot of people use the name of their favorite superhero as passwords, which made us wonder: Do people still use their names or the names of their nearest and dearest as passwords? The unfortunate answer: Yes, they do. This year, in recognition of Safer Internet Day, we explore how common this is and why it is not a good idea.
-
Google engineers plot to mitigate prototype pollution
Plan to create boundary between JavaScript objects and their blueprints gathers momentum
-
Trying to make sense of TikTok's cybersecurity concerns
It's not just regulators and lawmakers struggling to make sense of cybersecurity concerns about TikTok — even your Codebook author can't figure out which are overhyped and which are valid.
-
Latvian energy and transport companies come under cyber-attack
On February 7, Latvian energy and transport companies have been attacked by cybercriminals, national cyber defense agency CERT.lv confirmed Tuesday.
-
Germany Appoints Central Bank IT Chief to Head Cybersecurity
Germany appointed Claudia Plattner to lead its cybersecurity agency, months after her predecessor was removed following reports of possible problematic ties to Russia.
-
OpenSSL Ships Patch for High-Severity Flaws
The most serious of the vulnerabilities may allow an attacker to read memory contents or launch denial-of-service exploits.
-
Vulnerability Provided Access to Toyota Supplier Management Network
Security researcher finds severe vulnerability providing system admin access to Toyota’s global supplier management network.
-
Patch Released for Actively Exploited GoAnywhere MFT Zero-Day
A patch has been released for the GoAnywhere MFT zero-day vulnerability that has been exploited in attacks.
-
Linux Variant of Cl0p Ransomware Emerges [Ed: But how do these machines get compromised in the first place? Surely something else, likely unrelated to Linux]
A Cl0p ransomware variant targeting Linux systems emerged recently, but a flaw in the encryption algorithm has already allowed for the creation of a free decryptor.
-
VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
ESXiArgs ransomware attacks continue, with thousands of unpatched ESXi servers compromised within a few days via CVE-2021-21974.