Schneier on Security

NOVEMBER 26, 2024

which are two recently released versions of Apple’s mobile operating system, according to documents describing the tool’s capabilities in granular detail obtained by 404 Media. The documents do not appear to contain information about what Graykey can access from the public release of iOS 18.1,

Media 278

Media Manufacturing Mobile Hacking 278

Penetration Testing

DECEMBER 8, 2024

This searchable database... The post DDoSecrets Unveils Massive “Library of Leaks” Search Engine with Millions of Leaked Documents appeared first on Cybersecurity News.

Engineering 98

Engineering Cybersecurity 98

Schneier on Security

MAY 2, 2023

NIST has release a draft of Special Publication1800-38A: Migration to Post-Quantum Cryptography: Preparation for Considering the Implementation and Adoption of Quantum Safe Cryptography.”

295

295

Schneier on Security

NOVEMBER 19, 2024

According to an Italian Ministry of Justice document , as of December 2022 law enforcement in the country could rent spyware for €150 a day, regardless of which vendor they used, and without the large acquisition costs which would normally be prohibitive.

Spyware 289

Spyware Marketing Hacking 289

Krebs on Security

NOVEMBER 9, 2024

The trouble is, these EDRs largely bypass any official review and do not require the requester to supply any court-approved documents. Others simply sell access to hacked government or police email accounts, and leave it up to the buyer to forge any needed documents. “Unlimited Emergency Data Requests. . Reset as you please.

Hacking 276

Hacking Accountability Government Social Engineering 276

Krebs on Security

MARCH 14, 2025

Malicious macros became such a common malware threat that Microsoft was forced to start blocking macros by default in Office documents that try to download content from the web.

Phishing 216

Phishing Malware Scams Passwords 216

Security Affairs

JANUARY 21, 2025

On October 17, 2024, Rahman stole and leaked Top-Secret documents on a U.S. The CIA analyst photographed the classified documents and transmitted them to individuals he knew were not authorized to view them. Rahman has access to Sensitive Compartmented Information (SCI). “After Oct.

Media 68

Media Mobile Internet Internet 68

Malwarebytes

MARCH 4, 2025

Also, it seems weird that Docusign has been used to send a document that doesnt require a signature. I’ve you’ve received an email like this and want to verify if it’s genuine, go directly to Docusign.com, click ‘Access Documents’ (upper right-hand corner), and enter the security code displayed in the email.

Scams 133

Scams Accountability Phishing Banking 133

Schneier on Security

NOVEMBER 1, 2022

It’s Iran’s turn to have its digital surveillance tools leaked : According to these internal documents, SIAM is a computer system that works behind the scenes of Iranian cellular networks, providing its operators a broad menu of remote commands to alter, disrupt, and monitor how customers use their phones.

Surveillance 363

Surveillance Telecommunications Mobile Encryption 363

Security Affairs

NOVEMBER 12, 2024

Law enforcement warned that securely stored iPhones awaiting forensic examination are mysteriously rebooting, making them much harder to unlock, per a document obtained by 404 Media. 404 Media obtained the document from a mobile forensics source and verified it with another source. Three iPhones running iOS 18.0

Media 128

Media Wireless Mobile Encryption 128

Security Affairs

NOVEMBER 8, 2024

Law enforcement warns that securely stored iPhones awaiting forensic examination are mysteriously rebooting, making them much harder to unlock, per a document obtained by 404 Media. 404 Media obtained the document from a mobile forensics source and verified it with another source. Below is the hypothesis reported in the document.

Media 120

Media Mobile Passwords Hacking 120

Schneier on Security

DECEMBER 22, 2023

Interesting attack on a LLM: In Writer, users can enter a ChatGPT-like session to edit or create their documents. In this chat session, the LLM can retrieve information from sources on the web to assist users in creation of their documents.

335

335

Centraleyes

FEBRUARY 17, 2025

This document should outline governance structures, approval workflows, and ownership responsibilities to maintain consistency across the board. The post Best Policy Templates for Compliance: Essential Documents for Regulatory Success appeared first on Centraleyes.

Architecture 52

Architecture Government Risk Technology 52

Adam Shostack

FEBRUARY 12, 2025

This is a big, complex document. The apparent complexity is exacerbated by the intermingling of how to conduct with sample output and perhaps the document might be improved by breaking it into two: a how to guide and a sample output document or documents. What makes this level of detail right for this document?

Risk 147

Risk Manufacturing Encryption Surveillance 147

Hacker's King

FEBRUARY 9, 2025

To make it user-friendly for both beginners and experts, clear commands and comprehensive documentation are incorporated in this tool. Check the documentation for detailed instructions. User-Friendly Command-Line Interface (CLI): Diving into cybersecurity can feel overwhelming, especially when some tools seem designed for experts only.

Penetration Testing 52

Penetration Testing Architecture Cybercrime Cybersecurity 52

Hacker's King

FEBRUARY 9, 2025

To make it user-friendly for both beginners and experts, clear commands and comprehensive documentation are incorporated in this tool. Check the documentation for detailed instructions. User-Friendly Command-Line Interface (CLI): Diving into cybersecurity can feel overwhelming, especially when some tools seem designed for experts only.

Penetration Testing 52

Penetration Testing Architecture Cybercrime Cybersecurity 52

The Last Watchdog

JANUARY 27, 2025

demands a structured approach to implementation and preparation. demands a structured approach to implementation and preparation. demands a structured approach to implementation and preparation.

Password Management 130

Password Management Architecture Threat Detection Cybersecurity 130

Schneier on Security

JUNE 6, 2023

In 2013 and 2014, I wrote extensively about new revelations regarding NSA surveillance based on the documents provided by Edward Snowden. It’s a surreal experience, paging through hundreds of top-secret NSA documents. Both Greenwald and his employer, the Guardian , are careful about whom they show the documents to.

Surveillance 347

Surveillance Computers and Electronics Government Encryption 347

SecureList

MARCH 10, 2025

The document uses the remote template injection technique to download an RTF file stored on a remote server controlled by the attacker. The documents used various themes to deceive victims into believing they are legitimate. Some documents concerned nuclear power plants and nuclear energy agencies. pro document-viewer[.]info

Energy and Utilities 104

Energy and Utilities Malware Government Phishing 104

Security Affairs

OCTOBER 21, 2024

It provides a range of development resources, including SDKs (Software Development Kits), documentation, sample code, and learning materials for networking, security, and cloud infrastructure. DevHub is a platform designed for developers to access resources, tools, and APIs to build and integrate applications with Cisco’s technologies.

Cybercrime 131

Cybercrime Data breaches Technology Banking 131

SecureWorld News

NOVEMBER 11, 2024

Following a documented protocol keeps you on solid ground, especially when the stakes are high and the pressure is on. Document every decision and action Documentation may seem tedious in the middle of a breach response, but it's critical. Detailed records can protect your team by demonstrating a transparent, ethical response.

Data breaches 109

Data breaches Accountability Cybersecurity Account Security 109

PCI perspectives

MARCH 10, 2025

This document provides direction for merchants and service providers implementing controls to protect payment card data during e-commerce transactions. The PCI Security Standards Council (PCI SSC) has introduced a new information supplement: Payment Page Security and Preventing E-Skimming Guidance for PCI DSS Requirements 6.4.3 and 11.6.1.

eCommerce 109

eCommerce 109

Security Affairs

DECEMBER 7, 2024

Allegedly, invoice receipts, accounting documents, personal data, certificates, employment contracts, a huge amount of confidential information, confidentiality pic.twitter.com/Tad7LeOcsk — HackManac (@H4ckManac) December 6, 2024 According to the announcement published by the group on its Tor leak site, stolen data includes: Invoice Receipts (..)

Ransomware 124

Ransomware Hacking Accountability Cyber Attacks 124

Schneier on Security

JULY 23, 2024

Many more ODNI documents here. It’s heavily redacted , but still interesting.

278

278

Schneier on Security

OCTOBER 26, 2023

Interesting article about the Snowden documents, including comments from former Guardian editor Ewen MacAskill MacAskill, who shared the Pulitzer Prize for Public Service with Glenn Greenwald and Laura Poitras for their journalistic work on the Snowden files, retired from The Guardian in 2018.

Surveillance 328

Surveillance Government Marketing 328

Schneier on Security

AUGUST 24, 2022

The Washington Post has the scoop (with documents) and companion backgrounder. Peiter Zatko, aka Mudge, has filed a whistleblower complaint with the SEC against Twitter, claiming that they violated an eleven-year-old FTC settlement by having lousy security. This CNN story is also comprehensive.

Cybersecurity 326

Cybersecurity 326

Schneier on Security

FEBRUARY 11, 2022

It had no documented cyber incident response runbooks or IT recovery plans (apart from documented AD recovery plans) for recovering from a wide-scale ransomware event.

Antivirus 349

Antivirus Hacking Ransomware CISO 349

Adam Shostack

JANUARY 2, 2025

Ill add that not everything in the document is introduced in methodology, and Ill list those as we go. As always, and especially in these Threat Model Thursday posts, my goal is to point out interesting work in a constructive way. Let me start by saying that I love that theres a methodology section at the top.

Engineering 246

Engineering Authentication 246

Security Affairs

JANUARY 14, 2025

According to court documents, the Chinese government paid Mustang Panda to develop PlugX malware, used since 2014 to target U.S., The malware was operated by a China-linked threat actor, known as Mustang Panda (aka Twill Typhoon, to steal sensitive information from victim computers. European, and Asian entities. systems. .”

Malware 121

Malware Government Hacking Cybersecurity 121

Security Affairs

DECEMBER 4, 2024

The group claimed to have stolen 500GB of data including Finacial data, Organisation data, Users data and personal documents, NDA’s, Confidential data, and more. As proof of the data breach, the group published multiple screenshots, including pictures of passports and other documents.

Ransomware 126

Ransomware Telecommunications Healthcare Insurance 126

Schneier on Security

JANUARY 29, 2024

The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself.

Hacking 329

Hacking Accountability Passwords Cybersecurity 329

Schneier on Security

FEBRUARY 17, 2025

The EFF has released its Atlas of Surveillance , which documents police surveillance technology across the US.

Surveillance 208

Surveillance Technology 208

Schneier on Security

JANUARY 9, 2023

This is the interesting part: Investigators identified Greenwood and Crahan almost immediately after the attacks took place by using cell phone data that allegedly showed both men in the vicinity of all four substations, according to court documents.

Surveillance 334

Surveillance Internet Internet Risk 334

Schneier on Security

AUGUST 22, 2022

“Turns out the [AES] encryption key in that script is the first AES 128-bit CBC example key listed in the NIST document SP800-38A [PDF]” […]. Luck held out, in a way. “Greenluigi1” found within the firmware image the RSA public key used by the updater, and searched online for a portion of that key.

Encryption 346

Encryption Firmware Manufacturing Software 346

Schneier on Security

JULY 25, 2024

Details are here , but basically a digital wallet is a repository for personal data and documents. I am the Chief of Security Architecture at Inrupt, Inc. , the company that is commercializing Tim Berners-Lee’s Solid open W3C standard for distributed data ownership. Right now, there are hundreds of different wallets, but no standard.

Architecture 318

Architecture Data privacy 318

Security Affairs

FEBRUARY 24, 2025

Some documents detail the use of web content monitoring services to enforce censorship for public and private sector customers. ” The leaked documents show that TopSec worked on projects for China’s Ministry of Public Security in Dandong, Songjiang, and Pudong, including a Cloud Monitoring Service Project in Shanghai. .

Government 98

Government Cybersecurity Hacking Internet 98

Security Affairs

OCTOBER 25, 2024

The company published a document containing recommendations against password spray attacks aimed at Remote Access VPN (RAVPN) services. The content of the email was empty, and the message only included an attached document that was not visible in the email client. The researchers also published PoC exploit code for this vulnerability.

VPN 113

VPN Firewall Technology Passwords 113