Agregátor RSS

Chinese hackers tracked as 'UAT-7810' are actively evolving their malware to expand their Operational Relay Box (ORB) network by compromising internet-facing networking devices, primarily unpatched Ruckus routers. [...]

Private browsing. Incognito. Privacy mode.

Web browser functions like those trace their roots back more than a decade, and the feature — first found in a top browser in 2005 — spread quickly as one copied another, made tweaks and minor improvements.

But privacy-promising labels can be treacherous. Simply put, going “incognito” is as effective in guarding online privacy as witchcraft is in warding off a common cold.

That’s because private browsing is intended to wipe local traces of where you’ve been, what you’ve searched for, the contents of forms you’ve filled. It’s meant to hide, and not always conclusively at that, your tracks from others with access to the personal computer. That’s it.

How to keep web browsing private

We’ve spelled out how to go into incognito or private browsing mode for the four major browsers in this order:

• Google Chrome’s Incognito mode
• Microsoft Edge’s InPrivate browsing
• Mozilla Firefox’s New Private Window mode
• Apple Safari’s New Private window mode

At their most basic, these features promise that they won’t record visited sites to the browsing history, save cookies that show you’ve been to and logged into sites, or remember credentials like passwords used during sessions. But your traipses through the web are still traceable by internet providers (and the authorities who serve subpoenas to those entities), employers who control the company network, and advertisers who follow your every footstep.

To end that cognitive dissonance, most browsers have added more advanced privacy tools, generically known as “anti-trackers,” which block various kinds of bite-sized chunks of code that advertisers and websites use to trace where people go in attempts to compile digital dossiers or serve targeted advertisements.

Although it might seem reasonable that a browser’s end game would be to craft a system that blends incognito modes with anti-tracking, it’s highly unlikely. Using either private browsing or anti-tracking carries a cost: site passwords aren’t saved for the next visit or sites break under the tracker scrubbing. Nor are those costs equal. It’s much easier to turn on some level of anti-tracking by default than it would be to do the same for private sessions, as evidenced by the number of browsers that do the former without complaint while none do the latter.

Private browsing will, by necessity, always be a niche, as long as sites rely on cookies for mundane things like logins and cart contents.

But the mode remains a useful tool whenever the browser — and the computer it’s on — are shared. To prove that, we’ve assembled instructions and insights on using the incognito features and anti-tracking tools offered by the top four browsers: Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari.

How to go incognito with Google Chrome

Although incognito may be a synonym to some users for any browser’s private mode, Google gets credit for grabbing the word as the feature’s snappiest name when it launched the tool in late 2008, just months after Chrome debuted.

The easiest way to open an Incognito window is with the keyboard shortcut combination Ctrl-Shift-N (Windows) or Command-Shift-N (macOS).

Another way is to click on the menu on the upper right — it’s the three vertical dots — and select New Incognito Window from the list.

width="1024" height="876" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Open a new Incognito window in Chrome using keyboard shortcuts or from the menu by choosing “New Incognito window.”

Google

The new Incognito window can be recognized by the dark background and the stylized “spy” icon just to the left of the three-dots menu. Chrome also reminds users of just what Incognito does and doesn’t do each time a new window is opened. The message may get tiresome for regular Incognito users, but it may also save a job or reputation; it’s important that users remember Incognito doesn’t prevent ISPs, businesses, schools and organizations from knowing where customers, workers, students, and others went on the web or what they searched for.

width="1024" height="699" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Each time a new Incognito window is opened, Chrome reminds users what Incognito doesn’t save. The browser also puts a toggle on the screen for blocking third-party cookies.

Google

Incognito’s introductory screen also displays a toggle — it’s on by default — along with text that states third-party cookies will be blocked while in the privacy mode. Although cookies are never saved locally as long as the user stays in Incognito, websites have been able to track user movements from site to site while within Incognito. Such tracking might be used, for example, to display ads to a user visiting multiple sites in Incognito. This third-party cookie blocking, which halts such behavior, debuted in May 2020.

Google has been experimenting with new language on Chrome’s Incognito introductory page, but it’s yet to make it to the desktop browser. In the Canary build of Chrome on Android, however, the intro now outlines “What Incognito does” and “What Incognito doesn’t do,” to make the mode’s capabilities somewhat clearer to the user. (Some have speculated that the changes were made in reaction to a still-ongoing class-action lawsuit file in 2020 that alleged Google continued to track users’ online behavior and movements in Incognito.)

Once a tab in Incognito has been filled with a website, Chrome continues to remind users that they’re in Incognito by the dark background of the address bar and window title.

A link on an existing page can be opened directly into Incognito by right-clicking the link, then choosing Open Link in Incognito Window from the resulting menu.

width="1024" height="876" sizes="auto, (max-width: 1024px) 100vw, 1024px">

What Incognito looks like after pulling up a website. Note the “spy” icon at the right of the address bar.

Google

Pro tip: To close an Incognito window, shutter it like any other Chrome window by clicking the X in the upper right corner (Windows) or the red dot in the upper left (macOS).

How to privately browse with Microsoft Edge

Microsoft borrowed the name of its private browsing mode, InPrivate, from Internet Explorer (IE), the retired legacy browser. InPrivate appeared in IE in March 2009, about three months after Chrome’s Incognito and three months before Firefox’s privacy mode. When Edge was first released in 2015 and then relaunched as a clone of Chrome in January 2020, InPrivate was part of the package, too.

At the keyboard, the combination of Ctrl-Shift-N (Windows) or Command-Shift-N (macOS) opens an InPrivate window.

A slower way to get there is to click on the menu at the upper right — it’s three dots arranged horizontally — and choose New InPrivate Window from the menu.

width="1024" height="874" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Like other browsers, Edge will take you incognito from the menu when you pick New InPrivate window.

Microsoft

Edge does a more thorough job of explaining what its private browsing mode does and doesn’t do than any of its rivals, with on-screen paragraphs dedicated to describing what data the browser collects in InPrivate and how the strictest additional anti-tracking setting can be called on from within the mode. In addition, Edge uses the more informal “What Incognito does” and “What Incognito doesn’t do” language on its InPrivate introductory screen.

Microsoft’s browser also well marks InPrivate when the mode is operating: an oval marked “In Private” to the right of the address bar combines with a full-black screen to make sure users know where they’re at.

width="1024" height="843" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Edge offers a detailed explanation of what its private browsing mode does and doesn’t do.

Microsoft

It’s also possible to launch an InPrivate session by right-clicking a link within Edge and selecting Open in InPrivate Window. That option is grayed out when already in a private browsing session but using Open Link in New Tab does just that within the current InPrivate frame.

To end InPrivate browsing, simply shut the window by clicking the X in the upper right corner (Windows) or click the red dot at the upper left (macOS).

Although Edge is based on Chromium, the same open-source project that comes up with the code to power Chrome, the Redmond, WA company integrated anti-tracking into its browser. Dubbed “Tracking Prevention,” it works both in Edge’s standard and InPrivate modes.

To set Tracking Prevention, choose Settings from the three-ellipses menu at the right, then at the next page, pick Privacy, Search and Services. Choose one of the three options — Basic, Balanced or Strict — and make sure the toggle for Tracking prevention is in the “on” position. If you want InPrivate to always default to the harshest anti-tracking — not a bad idea — toggle Always use “Strict” tracking prevention when browsing InPrivate to “on.”

width="1024" height="708" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Toggle Always use Strict to the ‘on’ position and InPrivate will apply the most stringent anti-tracking even though Edge’s standard mode is set to, say, Balanced.

Microsoft

Pro tip: To open Edge with InPrivate — rather than first opening Edge in standard mode, then launching InPrivate — right-click the Edge icon in the Windows taskbar and select New InPrivate Window from the list. There is no similar one-step way to do this in macOS.

How to privately browse with Mozilla Firefox

After Chrome trumpeted Incognito, browsers without something similar hustled to catch up. Mozilla added its take — dubbed Private Browsing — about six months after Google, in June 2009.

From the keyboard, a private browsing session can be called up using the combination Ctrl-Shift-P (Windows) or Command-Shift-P (macOS).

Alternately, a private window will open from the menu at the upper right of Firefox — three short horizontal lines — after selecting New private window.

width="1024" height="889" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Opening a private browsing window is as simple as choosing New Private Window from the Firefox menu.

Mozilla

A private session window is marked by the purple “mask” icon in the title bar of the Firefox frame. In Windows, the icon is to the left of the minimize/maximize/close buttons; on a Mac, the mask squats at the far right of the title bar. Unlike Chrome and Edge, Firefox does not color-code the top components of the browser window to signify the user is in privacy mode.

Like other browsers, Firefox warns users that private browsing is no cure-all for privacy ills but is limited in what it blocks from being saved during a session. “Private window: Firefox clears your search and browsing history when you close all private windows. This doesn’t make you anonymous,” the caution reads.

width="1024" height="654" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Firefox reminds users that while a private session doesn’t save searches or browsing histories, it doesn’t cloak them in complete anonymity. The page also links to more detailed information.

Mozilla

A link can be opened into a Firefox Private Window by right-clicking the link, then choosing Open Link in New Private Window from the menu.

To close a Private Window, shut it down just as one would any Firefox window by clicking the X in the upper right corner (Windows) or the red dot in the upper left (macOS).

Notable is that Firefox’s private browsing mode is accompanied by the browser’s superb “Enhanced Tracking Protection,” a suite of tracker blocking tools that stymie all sorts of ad-and-site methods for identifying users, then watching and recording their online behavior. While the earliest version of this was offered only inside Private Windows, the expanded technologies also work within standard mode.

Because Enhanced Tracking Protection is enabled by default within Firefox, it doesn’t matter which of its settings — Standard, Strict or Custom — is selected as far as private browsing goes; everything that can be blocked will be blocked.

width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px">

The shield appears in the address bar to note what trackers were blocked by Firefox in a Private Window. Clicking on the icon brings up an accounting of what was barred.

Mozilla

Pro tip: Private Browsing sessions take place over the more secure HTTPS, not the once-standard HTTP protocol. Users don’t need to do anything: The new HTTPS-only policy is on by default. (If the destination site doesn’t support HTTPS, Firefox will go into fallback mode, connecting via HTTP instead.)

How to browse privately with Apple’s Safari

Chrome may get far more attention for its Incognito mode than any other browser — no surprise, since it’s by far the most popular browser on the planet — but Apple’s Safari was actually the first to introduce private browsing. The term private browsing was first bandied in 2005 to describe early Safari features that limited what was saved by the browser.

Side note: Early in private browsing, the label porn mode was often used as a synonym to describe what many writers and reporters assumed was the primary application of the feature. The term has fallen out of favor.

To open what Safari calls a Private Window on a Mac, users can do a three-key combination of Command-Shift-N, the same shortcut Chrome adopted. Otherwise, a window can be called up by selecting the File menu and clicking on New Private Window.

width="1024" height="803" sizes="auto, (max-width: 1024px) 100vw, 1024px">

From the File menu in Safari, selecting New Private Window gets you started.

Apple

Safari tags each Private Window by darkening the address bar. It also issues a reminder of what it does — or more accurately — what it doesn’t do. “Safari will keep your browsing history private for all tabs of this window. After you close this window, Safari won’t remember the pages you visited, your search history or your AutoFill information,” the top-of-the-page note reads. The warning is more terse than those of other browsers and omits cautions about still-visible online activity.

width="1024" height="321" sizes="auto, (max-width: 1024px) 100vw, 1024px">

The darkened address bar at the top — and the Private button in the left window corner — signal that this Safari window is for private browsing.

Apple

Like Firefox, Safari automatically engages additional privacy technologies, whether the user browses in standard or private mode. Safari’s Intelligent Tracking Protection (ITP), which has been around for nearly a decade and repeatedly upgraded, now blocks all third-party cookies, among other components advertisers and services use to track people as they bounce from one site to another. ITP is controlled by a single on-off switch — on is the default — found in Preferences under the Privacy icon. If the Website tracking: box is checked to mark Prevent cross-site tracking, ITP is on.

width="1024" height="453" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Switching on cross-site tracking enables Safari’s Intelligent Tracking Protection, which blocks a wide variety of bits advertisers try to use to follow you around the web while you’re using a Private Window.

Apple

A link can be opened directly to a Private Window by right-clicking, then selecting Open Link in New Private Window. Close a Private Window just as any Safari window, by clicking the red dot in the upper left corner of the browser frame.

Pro tip: Once in a Safari Private Window, opening a new tab — either by clicking the + icon at the upper right or by using the Command-T key combo — omits the Private Browsing Enabled notice. (The darkened address bar remains as the sole indicator of a private browsing session.) Other browsers, such as Firefox, repeat their cautionary messages each time a tab is opened in an incognito session.

Related reading:

• Chromium explained: How the open-source engine drives today’s browsers
• AI web browsers are cool, helpful, and utterly untrustworthy
• How AI will transform your Windows web browser

Každý měsíc vybíráme nejlepší chytré hodinky v několika kategoriích • Dělíme je podle zaměření i podle propojení s mobilními systémy • Nezapomněli jsme ani na fitness náramky

A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an attacker to gain administrative access to the device's web management panel. [...]

EXCLUSIVE There's no honor among thieves as a new worm steals from other infectious software. It pilfers “multiple” victims’ credentials and mines for cryptocurrency while killing competitors’ processes, including similar secret-harvesting malware. It’s called Cloud AI Infrastructure Attack Framework (CAI), and it’s a centralized botnet that targets cloud-native developer tools like Docker, Kubernetes, Redis, etcd, Kubelet, and Ray for credential theft and cryptomining. The scripts “are heavily inspired” by the likes of other similar credential-stealing worms that have wreaked havoc across cloud environments and supply chains this year, “using code comments like ‘PCPJack-aligned,’” according to security researcher Michael R. “CAI explicitly seeks out and kills TeamPCP and PCPJack processes, to further monopolize on compromised targets,” he posted on X. TeamPCP is the malware-developing crew behind the mini Shai-Hulud, Miasma, and Canister worms that have been poisoning open source registries and harvesting cloud access tokens, credentials, API keys, and other sensitive data since the Trivy supply-chain attack earlier this year. And PCPJack is a newer secret-stealing copycat worm that not only nabs credentials, but also deletes TeamPCP artifacts to kick that competitor out of victims’ cloud infrastructure. CAI seems to have taken lessons from both. “CAI is a constantly evolving framework meant to rival toolkits utilized by TeamPCP and PCPJack,” Hunt.io threat researcher Michael Rippey told The Register. Hunt.io’s team was the first to spot CAI on June 15, when it observed the first of three open directories via the security shop’s web-scanning engine, AttackCapture, that were linked to the operator. “Over three weeks, the operator moved from testing worm code mimicking TTPs used by PCPJack, to full production, deployment and compromise of networks,” Rippey said. “The codebase shows signs of LLM-assisted development, reflecting a deliberate progression of someone studying what works to build a competitive platform.” While the malware isn’t “overly sophisticated,” it is effective, with recent command-and-control logs confirming “active exploitation attempts, with wallet activity confirming multiple successful compromises,” Rippey said. CAI’s framework consists of a “scanning engine [that] feeds targets into automated exploit queues, with centralized C2 control coordinating attacks across cloud infrastructure with an emphasis on Docker, Redis, etcd, Kubelet, and more,” he added. “Currently, compromised hosts receive miners, credential stealers, and a Python backdoor,” Rippey said. “CAI’s emergence alongside TeamPCP and PCPJack indicates a growing number of competing threat actors targeting each other and cloud infrastructure.” Defenders and developers alike should take note, as we’ve already seen the damage that these new-ish cloud worms leave in their wake as they burrow across supply chains. Plus, it’s unlikely that this will be the last of the miscreants seeking to monetize companies’ cloud infrastructure and developers’ secrets.®

A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service. It lets even low-skill criminals take over a victim's phone, steal their banking logins, and capture the one-time codes that protect their accounts. Zimperium's zLabs, which found the operation, says it looks like a new variant of Oblivion, a $300-a-month rent-a-malware tool

A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service. It lets even low-skill criminals take over a victim's phone, steal their banking logins, and capture the one-time codes that protect their accounts. Zimperium's zLabs, which found the operation, says it looks like a new variant of Oblivion, a $300-a-month rent-a-malware tool Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

PACT chce nahradit CAPTCHA anonymním ověřováním důvěryhodnosti uživatelů. • Webům slibuje lepší ochranu proti botům bez narušení soukromí. • Zároveň ale může změnit fungování otevřeného webu.

A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project. From there, they could read live conversations, steal the data users shared, and make the bots send attacker-written messages, including requests to re-enter a password. Security firm Varonis found it

A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project. From there, they could read live conversations, steal the data users shared, and make the bots send attacker-written messages, including requests to re-enter a password. Security firm Varonis found it Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Eight victims of Greece’s spyware scandal, later dubbed “Predatorgate,” have sued the Athens-based company behind the program used to surveil them. According to the Predator victims’ lawyer, Zacharias Kesses, each of the plaintiffs is asking for €1 million in moral damages after having their devices hacked between 2020 and 2021. Among those seeking damages is journalist Thanasis Koukakis, who was one of the most high-profile victims at the time. Others include lawyers, intelligence officials, law enforcement workers, and more. Kesses said that the lawsuit was directed at Intellexa SA and 13 individuals associated with it, including founder Tal Dilian. “The lawsuits detail the structure, operation and division of roles of the network of companies and individuals associated with the development, distribution and use of Predator,” Kesses told Greek newspaper Kathimerini. “This process constitutes the next institutional step towards full accountability of all those involved and redress for victims, both at national and European levels.” Intellexa is a distinct Athens-based corporate entity, but also the name of a consortium of other companies that sit around it as holding companies and vendors, all registered in different jurisdictions. Put simply, it developed Predator spyware, one of the most capable offerings of its kind. Athens-based Intellexa SA, Irish companies Intellexa Limited and Thalestris Limited, North Macedonia-based Cytrox AD, and Hungary-based Cytrox Holdings were all added to the US Treasury’s sanctions list in 2024 for their roles in supporting Predator spyware. Key figures such as consortium founder Dilian and his ex-wife Sara Hamou, a corporate offshoring specialist who worked for the consortium, joined the organizations on the list at the same time. Both Dilian and Hamou, as well as Greeks Felix Bitzios and Yiannis Lavranos, a former Intellexa boss and owner of Krikel, a Predator vendor, respectively, were found guilty earlier this year of violating telephone communications confidentiality and illegally accessing personal data. An Athens misdemeanors court sentenced each to 126 years and eight months in prison, pending appeals, although domestic law would cap these at eight years. Greek government officials have continuously waved away the numerous accusations that it, or its intelligence services, were behind the attacks on Greeks in 2020-2021. A resulting probe into Predatorgate revealed that at least 87 high-profile Greeks were targeted by Predator spyware via hundreds of SMS messages containing malicious links that exploited Chrome and Android zero-day vulnerabilities. Civil liberties groups, such as Amnesty International, continue to question whether the state was in any way involved in the procurement of Predator for use in these attacks, despite its repeated denials. A 2024 Supreme Court prosecutor's probe found no evidence that the Greek government or its intelligence services were involved in the scandal, which first came to light in 2022. The Greek spyware scandal came at a similar time as others like it involving other EU member states, including Spain, Hungary, and Poland. Frustrated at the lack of action following these separate cases, campaigners co-signed an open letter this week calling on the EU to properly investigate and attribute each of the illegal spyware attacks that have occurred across member states. ®

Začalo to skriptem v Pythonu pro hledání historického počasí, který Jakub Čížek zveřejnil na X. Pokračovalo projektem pro AI agenty a nakonec tímto článkem. Na hračce s počasím lze totiž pěkně ukázat, jak AI agenti fungují a jak je využít pro vytvoření zajímavé aplikace. Ta naše najde bez ...

The National Police in Spain have arrested a man who is suspected of being an active member of the CyberArmy of Russia Reborn (CARR) and Z-Pentest, both pro-Russian hacktivist groups. [...]

A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between the last week of June 2026 and into early July, per findings from ZeroBEC. "The campaign did not depend on a fake Microsoft password page. It used a malicious collaboration-style lure to push users into the legitimate Microsoft device login experience,

A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between the last week of June 2026 and into early July, per findings from ZeroBEC. "The campaign did not depend on a fake Microsoft password page. It used a malicious collaboration-style lure to push users into the legitimate Microsoft device login experience,Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

A 16-year-old KVM vulnerability recently hit the news, and honestly? It’s a healthy dose of reality. We like to think of our hypervisors as these impenetrable walls, but this is a reminder that VM isolation isn't a permanent guarantee.  Even in the most mature Linux virtualization stacks, you’ve got code paths that haven't been touched in over a decade, just waiting for the right researcher to pull on the wrong thread. For those of us running KVM hosts, this isn't just about grabbing the late...

One of the easiest mistakes to make in detection engineering is assuming a rule keeps working simply because nobody has touched it. Most of the time, nobody removes the rule. Nobody disables it. It just gets forgotten.