The Register - Anti-Virus

Also, TheMoon botnet back for EoL SOHO routers, Sellafield to be prosecuted for 'infosec failures', plus critical vulns

Infosec in brief  Nearly a year on from the discovery of a massive data theft at healthcare biz Harvard Pilgrim, and the number of victims has now risen to nearly 2.9 million people in all US states.…

Theresa Payton on why US needs a national privacy law

Interview  Congress is mulling legislation that will require TikTok's Chinese parent ByteDance to cut ties with the video-sharing mega-app, or the social network will be banned in the USA.…

Still claims the personal info wasn't stolen from its systems

AT&T confirmed over the weekend that more than 73 million records of its current and former customers dumped on the dark web in mid-March do indeed describe its subscribers, though it still denies the data came direct from its systems.…

Code shines up nicely in production, says Chocolate Factory's Bergstrom

Echoing the past two years of Rust evangelism and C/C++ ennui, Google reports that Rust shines in production, to the point that its developers are twice as productive using the language compared to C++.…

STOP USAGE OF FEDORA RAWHIDE, says Red Hat while Debian Unstable and others also affected

Red Hat on Friday warned that a malicious backdoor found in the widely used data compression software library xz may be present in instances of Fedora Linux 40 and the Fedora Rawhide developer distribution.…

CVE-2024-1086 turns the page tables on system admins

A Linux privilege-escalation proof-of-concept exploit has been published that, according to the bug hunter who developed it, typically works effortlessly on kernel versions between at least 5.14 and 6.6.14. …

Vendor takes hardline approach to patch disclosure to new levels

Updated  JetBrains TeamCity users are urged to apply the latest version upgrade this week after the vendor disclosed 26 new security issues in the CI/CD web application.…

Could have been worse: Prosecutors wanted decades more

Fallen crypto-king Sam Bankman-Fried has been jailed for 25 years after New York federal judge Lewis Kaplan expressed disbelief at almost every argument from his legal team.…

Flaws enable privilege escalation and remote code execution

Nvidia's AI-powered ChatRTX app launched just six week ago but already has received patches for two security vulnerabilities that enabled attack vectors, including privilege escalation and remote code execution.…

After all, it's only about keeping the essentials on – no rush

America's long-awaited cyber attack reporting rules for critical infrastructure operators are inching closer to implementation, after the Feds posted a notice of proposed rulemaking for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA).…

In happier news, Ubuntu Pro extended support now goes up to 12 years

After multiple waves of cryptocurrency credential-stealing apps were uploaded to the Snap store, Canonical is changing its policies.…

Sensitive documents dumped on leak site amid claims of 3 TB of data stolen in total

NHS Scotland says it managed to contain a ransomware group's malware to a regional branch, preventing the spread of infection across the entire institution.…

One might say this is a wurst case scenario

The German Federal Office for Information Security (BSI) has issued an urgent alert about the poor state of Microsoft Exchange Server patching in the country.…

Simply look out for libraries imagined by ML and make them real, with actual malicious code. No wait, don't do that

In-depth  Several big businesses have published source code that incorporates a software package previously hallucinated by generative AI.…

Government issues stern warning over despot money-making scheme

Two executives were issued arrest warrants in Japan on Wednesday, reportedly for charges related to establishing a business that outsourced work to North Korean IT engineers.…

Report claims Beijing is most displeased by junta's failure to address slave labor scam settlements

The military junta controlling Myanmar has struggled to control all of its territory thanks in part to China backing rebel forces as a way of expressing its displeasure about cyberscam centers operating from the country.…

Beware support calls offering a fix

Apple device owners, consider yourselves warned: a targeted multi-factor authentication bombing campaign is under way, with the goal of exhausting iUsers into allowing an unwanted password reset.…

We're dreaming of a white list, because we're just like the ones you used to know

More than half of Americans are using ad blocking software, and among advertising, programming, and security professionals that fraction is more like two-thirds to three-quarters.…

Anyscale claims issue is 'long-standing design decision' – as users are raided by intruders

Thousands of companies remain vulnerable to a remote-code-execution bug in Ray, an open-source AI framework used by Amazon, OpenAI, and others, that is being abused by miscreants in the wild to steal sensitive data and illicitly mine for cryptocurrency.…

I ain't afraid of no ghosts, but in this case...

To spy on rival Snapchat and get data on how the app was being used, Meta – when it was operating as Facebook – allegedly initiated a program called Project Ghostbusters, which intercepted data traffic from mobile apps. And it used that data to harm its competitors' ad business.…