Optus breach is a wake-up call for secure coding practices

A “coding error” in Optus Mobile's systems led to a massive data breach affecting over nine million customers, sparking a lawsuit from the Australian Communications and Media Authority (ACMA).

The case, filed under number VID429/2024 in the Federal Court of Australia, highlights the severe consequences of software vulnerabilities in large-scale systems.

The breach, which affected over nine million Optus users, was caused by a seemingly simple coding error—a stark...

Encryption under fire: Signal and rights groups oppose EU law

In a strongly worded statement, Meredith Whittaker, President of Signal, has called out the EU’s latest attempts to weaken end-to-end encryption under the guise of new terminology.

Her comments come in response to ongoing discussions surrounding the EU's chat control legislation, which has seen some European countries pushing for measures that could potentially compromise user privacy.

Whittaker's concerns are echoed by a joint statement issued in May by several...

Hackers are increasingly exploiting packers to spread malware

Cybersecurity researchers from Check Point have uncovered an increasing trend of hackers exploiting commercial packing tools like BoxedApp to conceal and distribute various malware strains. Over the past year, a significant surge in the abuse of BoxedApp products has been observed, particularly in attacks targeting financial institutions and government organisations.

BoxedApp offers a range of commercial packers – including BoxedApp Packer and BxILMerge – which provide...

Sonatype exposes malicious PyPI package ‘pytoileur’

Sonatype has exposed 'pytoileur', a malicious PyPI package designed to download and install trojanised Windows binaries capable of surveillance, commandeering persistence, and stealing cryptocurrency. This discovery is part of a broader, months-long "Cool package" campaign aimed at infiltrating the coding community.

Yesterday, an automated malware detection system operated by Sonatype, known as the Sonatype Repository Firewall, flagged a newly published PyPI package called...

GitHub Copilot gains extensions as GitHub and FileZilla face malware exploits

As GitHub Copilot gains extensions, GitHub and FileZilla face malware exploits

GitHub has announced a new feature that enables developers to extend Copilot with third-party skills, providing an extra layer of customisation.

At this year's Build conference, it announced the acquisition of a conversational assistant tool company called Semantic Machines to help enhance its products. GitHub's "AI pair programming tool," Copilot, also grabbed significant attention with the launch of its Copilot Extension. This new feature allows developers to extend Copilot...

UK authority calls for integral data protection in AI amid increasing breaches

UK authority calls for integral data protection in AI amid increasing breaches

The Information Commissioner's Office (ICO), the UK authority in charge of overseeing the use and collecting of personal data, has revealed that it received reports on more than 3,000 cyber breaches in 2023. 

This figure highlights an urgent concern in the world of technology: the need for strong data protection measures, particularly in the development of AI technologies. The UK's data watchdog has issued a warning to tech companies, demanding that data protection be...

Phylum uncovers targeted malware disguised in Python package

Phylum’s cybersecurity experts have detected a malicious payload embedded within a popular Python package on the PyPI repository. The package, named requests-darwin-lite, is an unauthorised variant of the widely-used requests library.

The requests-darwin-lite package was cleverly designed to emulate its legitimate counterpart but included a Go binary concealed within an oversized image file pretending to be a simple logo. This file – a PNG labelled as a sidebar image –...

Open letter criticises ‘flawed’ CSAM scanning plan

An open letter signed by 270 scientists and researchers across 33 countries has raised major technical concerns about the EU's proposed regulation mandating the scanning of messaging apps for child sexual abuse material (CSAM). The signees argue the techniques are fundamentally flawed and will "completely undermine communications and systems security."

"From a technical standpoint, to be effective, this new proposal will also completely undermine communications and systems...

CISA sounds alarm on critical GitLab flaw under active exploit

The US Cybersecurity and Infrastructure Security Agency (CISA) has labelled a critical vulnerability affecting the popular Git-based repository manager GitLab as a Known Exploited Vulnerability (KEV). The move comes in response to active exploitation attempts detected in the wild, underscoring the urgency for organisations to promptly apply security updates.

Tracked as CVE-2023-7028, the severe flaw (CVSS score: 10.0) could enable adversaries to take over user accounts by sending...

Google blocked 2M malicious apps from the Play Store in 2023

Google blocked 2.28 million policy-violating apps from being published on the Play Store in 2023, thanks to improved security measures and tighter developer vetting processes. The company rejected or had developers remediate almost 200,000 app submissions to prevent abuse of sensitive permissions like location tracking and SMS access.  

The company says providing a safe and trusted Play Store experience is its top priority, underpinned by principles to "safeguard users",...