An Analysis of the EU’s Cyber Resilience Act
September 26 2024A good—long, complex—analysis of the EU’s new Cyber Resilience Act.
Read morePython Developers Targeted with Malware During Fake Job Interviews
September 17 2024Interesting social engineering attack: luring potential job applicants with fake recruiting pitches, trying to convince them to download malware. From a news article
These particular attacks from North...
Read more
On the Cyber Safety Review Board
August 6 2024When an airplane crashes, impartial investigatory bodies leap into action, empowered by law to unearth what happened and why. But there is no such empowered and impartial body to...
Read moreProviding Security Updates to Automobile Software
July 30 2024Auto manufacturers are just starting to realize the problems of supporting the software in older models:
Today’s phones are able to receive updates six to eight years after their...
Read more
Apple Is Alerting iPhone Users of Spyware Attacks
July 11 2024Not a lot of details: Apple has issued a new round of threat notifications to iPhone users across 98 countries, warning them of potential mercenary spyware attacks. It’s the second...
Read moreUsing LLMs to Exploit Vulnerabilities
June 17 2024Interesting research: “Teams of LLM Agents can Exploit Zero-Day Vulnerabilities.”
Abstract: LLM agents have become increasingly sophisticated, especially in the realm of cybersecurity. Researchers have shown that LLM agents...
Read more
Security and Human Behavior (SHB) 2024
June 8 2024This week, I hosted the seventeenth Workshop on Security and Human Behavior at the Harvard Kennedy School. This is the first workshop since our co-founder, Ross Anderson,
IBM Sells Cybersecurity Group
May 20 2024IBM is selling its QRadar product suite to Palo Alto Networks, for an undisclosed—but probably surprisingly small—sum.
I have a personal connection to this. In 2016, IBM bought...
Read moreMicrosoft and Security Incentives
April 23 2024Former senior White House cyber policy director A. J. Grotto talks about the economic incentives for companies to improve their security—in particular, Microsoft:
Grotto told us Microsoft had to...
Read more
Backdoor in XZ Utils That Almost Happened
April 11 2024Last week, the Internet dodged a major nation-state attack that would have had catastrophic cybersecurity repercussions worldwide. It’s a catastrophe that didn’t happen, so it won’t get much attention—but...
Read more
Recent Comments