
National Cyber Security Centre: One year on
I’m so proud to launch our annual review today, marking the first anniversary since the National Cyber Security Centre came into existence.
I can’t quite believe it’s been a whole year.
The review sets out what we’ve achieved, so…

2013 Yahoo Breach Affected All 3 Billion Accounts
A massive breach of Yahoo’s systems in 2013 impacted every account in existence at the time.

Windows Defender Bypass Tricks OS into Running Malicious Code
Researchers have developed a method for bypassing Windows Defender that will allow any malware to execute on a Windows machine.

Brightening the outlook for security in the cloud
We've recently worked with a variety of teams across the public sector to help them decide whether to move the functions of their older IT systems into the cloud, or to upgrade the software and servers they're using.
It's a question being asked…

Deloitte: ‘Very Few Clients’ Impacted by Cyber Attack
The Guardian citing sources at the company, claims attackers may have had access to Deloitte’s systems since October 2016.

Amazon S3 Again: Verizon Internal Credentials
Organisations continue to leak data through Amazon S3 with their lax attitudes toward data ownership & responsibility.

Secure development and deployment
Today we are pleased to share with you an alpha draft of our secure development and deployment guidance. You may be wondering, 'who this is aimed at?' And 'why is it in alpha?' This blog post will answer those questions.
Increased automation
We…

Modernising Windows 10 Management
Deploying an array of devices has many benefits for end users - choice of device and platform are obvious wins. But, having to manage multiple infrastructures can seriously add to the workload of IT Admins. It may not be a panacea, but Windows…

Air-Gapped Networks via CCTV Steal Data
Attackers can use surveillance cameras and infrared for bi-directional covert comms between the internal networks of organisations.

Cyber Security meet Engineering, Engineering meet Cyber Security…
Reading this year’s 'State Of The Nation' report (PDF), it struck me that civil engineering, like many kinds of engineering, is driven by the fundamental vision to make peoples’ lives better.
New digital technologies help this…

Artificial Intelligence Improves Password Guessing
Artificial intelligence is creeping into information security, one unexpected application has emerged. Passwords.

Cloud-Focused Firms Earn High Marks for Security
Companies pushing the cloud envelope are most likely to run safer cleaner code.

iOS 11 Update includes Patches for Eight Vulnerabilities
iOS 11 is out today with a new look and feel on the iPad. The release comes with eight patches for Apple iOS vulnerabilities.

Attackers use MS Office to Leak System Profile Data
The exploit affects Windows, iOS and Android. Spear phishing campaigns with the attachments are groundwork for future attacks.

Improving email security
Today we've added new guidance to our website, advising on two aspects of email security:...

VMware Patches Bug That Allows Guest to Execute Code on Host
VMware users are being encouraged to update due to a write vulnerability.

Email security and anti-spoofing
This guidance is intended to help you secure your organisation's email in two...

Thousands of Servers Host Point-of-Sale Malware
15,000 insecure Elasticsearch servers with 4,000 hosting the Point-of-Sale malware strains Alina and JackPoS.

Zerodium Offering $1M for Tor Browser Zero Days
The company said it will pay up to $1 million for fully functional, unknown zero day exploits for Tor Browser.

Microsoft Patches .NET Vulnerability in September Update
.NET framework vulnerability allows attackers to “take control of an affected system.”

Popular D-Link Router Riddled with Vulnerabilities
Bugs found in D-Link’s DIR-850L wireless AC1200 dual-band gigabit cloud routers which can be hijacked and taken control of.

Android Vulnerable to ‘High-Severity’ Overlay Attacks
Nearly all Android users should take action today and apply updates that are available to address this vulnerability.

Equifax Says Breach Affects 143 Million People
Attackers accessed Social Security numbers, birth dates, addresses, and driver’s license numbers.

Programming Error is source of Microsoft Kernel Bug
Windows kernel flaw has been present since Windows 2000, and is on Windows 10.

Vulnerabilities in NVIDIA, Qualcomm, Huawei Bootloaders
Six exploits in chipsets used by Huawei, Qualcomm, MediaTek and NVIDIA found in popular Android handsets, according to University of California computer scientists.

4M Time Warner Cable Records on Misconfigured AWS S3
The S3 buckets, owned by BroadSoft, contained SQL database dumps, code, access logs, customer billing addresses, and phone numbers, belonging to clients Time Warner Cable (TWC).

Military Contractor Vendor Leaks CVs with AWS S3
Applicants were seeking employment with a private military contractor, TigerSwan, blaming a 3rd party recruitor, TalentPen LLC, for the leak.

Living with password re-use
We are often told that re-using passwords is dangerous. The idea is simple; if criminals steal your password from one website, they will try and use it on your other online accounts. This could be a really important account, like your email.
We…

US Government Site Was Hosting Ransomware
US .gov site was hosting a .zip archive containing JavaScript that with obfuscated PowerShell, downloading a gif file which is a Cerber executable.

New Locky Variant Strikes Again
Locky is notorious for its effectiveness and profitability. In the last two years, Locky has extorted almost $7.8 million from victims, according to a recent study by Google.