Author: admin

The illegal marketplace was hacked prior to it’s takedown — the IRS has now tracked down those stolen funds, it said.

The Ragnar Locker operators released a stolen contract between Wild Turkey and actor Matthew McConaughey, as proof of compromise.

The actively exploited vulnerabilities discovered by Project Zero exist across iPhone, iPad and iPod devices.

The newly discovered malware uses GitHub and Pastebin to house component code, and harbors 12 different initial attack vectors.

Squid geopolitics.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Read my blog posting guidelines here.

Research paper: Rick Wash, “How Experts Detect Phishing Scam Emails“:

Abstract: Phishing scam emails are emails that pretend to be something they are not in order to get the recipient of the email to undertake some action they normally would not. While technical protections against phishing reduce the number of phishing emails received, they are not perfect and phishing remains one of the largest sources of security risk in technology and communication systems. To better understand the cognitive process that end users can use to identify phishing messages, I interviewed 21 IT experts about instances where they successfully identified emails as phishing in their own inboxes. IT experts naturally follow a three-stage process for identifying phishing emails. In the first stage, the email recipient tries to make sense of the email, and understand how it relates to other things in their life. As they do this, they notice discrepancies: little things that are “off” about the email. As the recipient notices more discrepancies, they feel a need for an alternative explanation for the email. At some point, some feature of the email — usually, the presence of a link requesting an action — triggers them to recognize that phishing is a possible alternative explanation. At this point, they become suspicious (stage two) and investigate the email by looking for technical details that can conclusively identify the email as phishing. Once they find such information, then they move to stage three and deal with the email by deleting it or reporting it. I discuss ways this process can fail, and implications for improving training of end users about phishing.

Here’s the latest podcast – listen now!

Cisco also disclosed high-severity vulnerabilities in its Webex and SD-WAN products.

Researchers figure out how to read what people are typing during a Zoom call using shoulder movements.

The Resident Evil creator reportedly been hit in a ransomware attack that stole 1TB of sensitive data.