Geek-Guy.com

Category: encryption

OpenSSL issued security updates to fix 12 flaws, including Remote Code Execution

OpenSSL released security updates that address 12 flaws, including a high-severity remote code execution vulnerability. OpenSSL issued security updates fixing 12 vulnerabilities in the open-source cryptographic library, including a high-severity remote code execution flaw. Cybersecurity firm Aisle discovered the twelve vulnerabilities. The addressed issues are mainly tied to memory safety, parsing robustness, and resource handling.…

CISA publishes a post-quantum shopping list for agencies. Security professionals aren’t sold

The Cybersecurity and Infrastructure Security Agency is hoping to guide federal agencies through the murky process of updating their technology stack with quantum-resistant encryption. On Jan. 23, the agency released a list of different IT software and hardware products that are commonly purchased by the federal government and use cryptographic algorithms for encryption or authentication.…

NIST officials detail impact of staff cuts on encryption and other priorities

The National Institute for Standards and Technology is starting 2026 with a smaller staff, a shrinking budget and some big responsibilities around supporting national security and cybersecurity. At a meeting Wednesday of the Information Security Privacy Advisory Board, NIST officials provided updates on how they’re grappling with several Trump administration priorities, including mandates on AI,…

Your favourite phone apps might be leaking your company’s secrets

Most of the apps on your phone are talking to a server somewhere – sending and receiving data through messages sent through APIs, the underlying infrastructure that allows apps to communicate. And here’s the problem – hackers have determined that the APIs of mobile apps, when left visible and exploitable, can be a goldmine. Read…

Wyden calls on FTC to investigate Microsoft for ‘gross cybersecurity negligence’ in protecting critical infrastructure

Sen. Ron Wyden, D-Ore., on Wednesday called for the Federal Trade Commission to investigate Microsoft, saying the company’s default configurations are leaving customers vulnerable and contributing to ransomware, hacking and other threats. That includes the 2024 Ascension hospital ransomware attack, which resulted in the theft of personal data, medical data, payment information, insurance information and…

Smashing Security podcast #432: Oops! I auto-filled my password into a cookie banner

We unpack how some password managers can be tricked into coughing up your secrets, with a clickjacking sleight-of-hand, what website owners can do to prevent it, and how to lock down your personal password vault. Then we time-hope to the post-quantum scramble: “harvest-now, decrypt later”, Microsoft’s 2033 quantum-safe pledge, and whether your printer will survive…

PCI SSC Releases New Guidance on Authentication and Cryptography

Authentication and cryptography are two essential security controls that protect sensitive data and systems. Authentication helps verify who can access information, while cryptography protects data whether it is stored or transmitted over networks. Nearly every security measure depends on these two fundamental controls in some way. However, both authentication methods and cryptographic standards are constantly…

PCI SSC Releases New Guidance on Authentication and Cryptography

Authentication and cryptography are two essential security controls that protect sensitive data and systems. Authentication helps verify who can access information, while cryptography protects data whether it is stored or transmitted over networks. Nearly every security measure depends on these two fundamental controls in some way. However, both authentication methods and cryptographic standards are constantly…

PCI SSC Releases New Guidance on Authentication and Cryptography

Authentication and cryptography are two essential security controls that protect sensitive data and systems. Authentication helps verify who can access information, while cryptography protects data whether it is stored or transmitted over networks. Nearly every security measure depends on these two fundamental controls in some way. However, both authentication methods and cryptographic standards are constantly…

Waltz brushes off SignalGate questions, points finger at CISA 

Former White House national security adviser Mike Waltz brushed aside criticisms Tuesday that he put sensitive military operations at risk by holding discussions about military strikes in a Signal group chat, claiming the app’s use was authorized by the federal government’s top civilian cyber agency. In a Senate Foreign Relations Committee hearing, Waltz — who…

How Does PKI Work? A Look at the Inner Workings of Public Key Infrastructure

You enjoy the benefits of PKI every day, but have you ever wondered what goes on behind the scenes? Learn how public key infrastructure works to ensure data security and… The post How Does PKI Work? A Look at the Inner Workings of Public Key Infrastructure appeared first on InfoSec Insights.

Cellebrite to acquire mobile testing firm Corellium in $200 million deal

Security technology company Cellebrite has announced plans to acquire Florida-based mobile testing startup Corellium for $170 million in cash, with an additional $20 million converted to equity at closing and the potential for $30 million more based on performance milestones. The Israel-headquartered Cellebrite, known for its forensic equipment that unlocks smartphones, said the acquisition would…

Preparing for the post-quantum era: a CIO’s guide to securing the future of encryption

Quantum computing is on the verge of revolutionizing the technology landscape, much like AI did in 2024. By the end of 2025, quantum computing will emerge as a defining force, ushering in a new era filled with both unprecedented opportunities and significant challenges in securing digital assets. While state-of-the-art quantum computers aren’t yet capable of…

After Signal controversy, do private conversations online exist anymore?

Every day, we place our trust in technology. Whether in the boardroom or the living room, technology has become the linchpin of security that protects our most sensitive and private information. And more so than any time in our history, that goes for our conversations, too. Intimate discussions with our spouse or romantic partner. Collaboration…

Ukrainian extradited to US for alleged Nefilim ransomware attack spree

Federal authorities extradited a Ukrainian citizen to the United States on Wednesday to face charges for participating in a series of ransomware cyberattacks on organizations based in the U.S. and multiple European countries.  Artem Stryzhak, 35, was arrested in Spain in June 2024 and was scheduled to appear for arraignment Thursday in the U.S. District…

Smashing Security podcast #412: Signalgate sucks, and the quandary of quishing

QR codes are being weaponised by scammers — so maybe think twice before scanning that parking meter. And in a blunder so dumb it makes autocorrect look smart, the White House explains how it leaked war plans on Signal because an iPhone mistook a journalist for a government insider. Plus! Don’t miss our featured interview…

Privacy-boosting tech could prevent breaches, data misuse with government aid, report says

Governments should prioritize the use of privacy-boosting technologies like encryption, de-identification and hashing to prevent breaches and data misuse, a report that New America’s Open Technology Institute published Tuesday recommends. The study comes as cyber and privacy experts warn about the dangers of the Trump administration’s Department of Government Efficiency (DOGE) accessing sensitive information at…

Cape opens $99/month beta of its privacy-first mobile plan, inks Proton deal, raises $30M

Mobile networks continue to be a major target for cybersecurity breaches, and Chinese hacking group Salt Typhoon‘s persistent attacks on multiple carriers are only the latest known examples.  The mobile carrier startup Cape is taking a novel approach to addressing the problem: it has built a service it says can provide a more secure, private…

Legislative push for child online safety runs afoul of encryption advocates (again)

Two members of the Senate Judiciary Committee are preparing to introduce  a bipartisan bill that would mandate tech companies to more swiftly report and remove child sexual abuse material hosted on their platforms, but critics warn it could result in the weakening or elimination of encrypted messaging services that many Americans rely on. The Stop…

Chainguard’s FIPS-compliant Cassandra addresses security demand of federal and regulated markets

Open-source software security firm Chainguard announced Wednesday that it is now building FIPS-validated images for Apache Cassandra, achieving what it describes as a first-of-its-kind accomplishment in the open-source community.  The project enables organizations in regulated industries — including government, health care, and finance — to deploy Cassandra with cryptographic libraries compliant with the National Institute…

Cybersecurity Impact of DOGE, Apple’s Stand Against Encryption Backdoors

In this episode, Kevin and Tom discuss current events including the latest developments with DOGE and the significant changes happening at the Cybersecurity and Infrastructure Security Agency (CISA). They also touch on Apple’s decision to refuse creating backdoors for encryption, setting a new precedent in digital security. Tune in for an insightful discussion on the…

Deeper Network Promo Deeper Network Promo Deeper Network Promo Image

Cybersecurity Impact of DOGE, Apple’s Stand Against Encryption Backdoors

In this episode, Kevin and Tom discuss current events including the latest developments with DOGE and the significant changes happening at the Cybersecurity and Infrastructure Security Agency (CISA). They also touch on Apple’s decision to refuse creating backdoors for encryption, setting a new precedent in digital security. Tune in for an insightful discussion on the…

Threat actors are increasingly trying to grind business to a halt

Cybercriminals intentionally disrupted operations at a growing rate last year, Palo Alto Networks’ threat intelligence firm Unit 42 said in an annual incident response report released Tuesday. Of the nearly 500 major cyberattacks Unit 42 responded to last year, 86% involved business disruption, including operational downtime, fraud-related losses, increased operating costs and negative reputational impacts. …

Apple pulls end-to-end encryption feature from UK after demands for law enforcement access 

Apple has pulled Advanced Data Protection, a feature that provides end-to-end encrypted data storage through iCloud, from the United Kingdom following a fight with the British government over law enforcement access. Starting Friday, U.K. users who attempt to access the feature on their phones or computers will be denied. Users who already had Advanced Data…

What is an encryption backdoor?

Talk of backdoors in encrypted services is once again doing the rounds after reports emerged that the U.K. government is seeking to force Apple to open up iCloud’s end-to-end encrypted (E2EE) device backup offering. Officials were said to be leaning on Apple to create a “backdoor” in the service that would allow state actors to…

Biden cyber executive order gets mostly plaudits, but its fate is uncertain

A sweeping executive order on cybersecurity released Thursday won largely positive reviews, with the main question being its timing — and what will come of it with the executive branch set to be handed over from president to president. Chris Inglis, the former national cyber director for Joe Biden who has served under both Democrats…