Latest Articles

Heartbleed bust, Fingerprint fakery, WhatsApp privacy SNAFU - 60 Sec Security [VIDEO]


What happens if you hack your local tax office? Can you trust the Samsung Galaxy S5's fingerprint security? Did WhatsApp finally get security right in its app?

Find out the answers in one entertaining minute of video - it's 60 Second Security!

Don't share your location with your friends on WhatsApp


A group of budding security researchers at the University of New Haven in Connecticut recently taught themselves a handy lesson about the difference between *liking* WhatsApp and *trusting* it.

PCI DSS - What's new in v3.0?

PCI DSS - What's new in v3.0?

If the PCI DSS applies to your business you should also know that the document has been updated. With nearly 100 changes, the current version has incremented one full revision and stands at v3.0. We focus on some of the changes and their impact.

Clicking 'Like' can cancel your right to sue a company

Clicking 'Like' can cancel your right to sue a company

General Mills might be the first company to rig its legal terms to ensure that interacting with it in just about any way online - downloading or printing a coupon, visiting its website, or getting its email newsletter - means you can't sue it.

Samsung Galaxy S5 fingerprint reader hacked - it's the iPhone 5s all over again!


The Samsung Galaxy S5 fingerprint scanner can be fooled with wood glue, just like Apple's "Touch ID" sensor in the iPhone 5s.

So why are both Apple and Samsung touting fingerprint scanners as more secure than passwords?

Heartbleed sees first arrest in wake of Canada Revenue Agency breach

Heartbleed sees first arrest in wake of Canada Revenue Agency hack

The arrest of Stephen Arthuro Solis-Reyes, who is alleged to have grabbed 900 Social Insurance Numbers from the Canadian tax authorities over a period of six hours, marks the first time that authorities have apprehended someone in relation to the "heartbleed" bug in OpenSSL.

The Dirty Dozen Spampionship: Who's who in the global spam-sending league?


It's once again time for our quarterly Spampionship charts.

We looked at the sending countries for all our spam in the first three months of 2014, and turned the figures into a League Table - the sort of league you *don't* want to win!

Phishing boom in China bucks global trends

Fish. Image courtesy of Shutterstock.

There's been a sharp upturn in the numbers of phishing pages observed, with the majority of them hosted in China and targeting Chinese victims and sites, according to analysis of world phishing trends from the Anti-Phishing Working Group (APWG).

SSCC 143 - Heartbleed revisited, cybercrooks busted, failed malware cleanup censured by FTC [PODCAST]


From the latest Heartbleed revelations to various successes by law enforcement, Sophos experts Chester Wisniewski and Paul Ducklin take you through the big computer security stories of the week.

Be entertained as you learn from the news, all in our regular quarter-hour podcast format.

Hardware maker LaCie admits to year-long credit card breach

Hardware maker LaCie admits to year-long credit card breach

The major hardware maker has admitted to a nearly year-long credit card breach - just the latest in a string of companies that have suffered Adobe ColdFusion vulnerabilities-related exploits.

Massive FBI facial recognition database raises privacy fears

Facial recognition. Image courtesy of Shutterstock.

The FBI is building a massive facial recognition database that could contain as many as 52 million images by 2015, including 4.3 million non-criminal images, according to information obtained by the EFF via a freedom of information request.

Cyber extortionists swipe cosmetic surgery records, try to blackmail Harley Medical Group

Cosmetic surgery. Image courtesy of Shutterstock.

Cyber crooks may have broken into Harley Medical Group, a cosmetic surgery firm with 21 clinics in the UK, to filch the intimate details of about 480,000 potential patients and then try to extort money from the company.

No Heartbleed holes in Java, but here comes a sea of patches anyway


Oracle's quarterly Patch Tuesday updates are out.

Java gets 37 fixes, 35 of them what Oracle calls "Remote Exploit without Authentication".

The silver lining? No Heartbleed bug in Java Standard Edition...

Heartbleed jabs its first victims: UK parents' site Mumsnet, Canadian tax agency

Heartbleed jabs its first victims: UK parents' site Mumsnet, Canadian tax agency

Two high-profile organisations, the UK parenting site Mumsnet and the Canada Revenue Agency, are the first known victims of the Heartbleed OpenSSL vulnerability to experience data breaches.

Notorious troll and hacker Weev has conviction overturned

Weev conviction overturned, CFAA left to wobble along

The courts have overturned Weev's conviction without having to deal with the sticky subject of the Computer Fraud and Abuse Act. They did it on grounds that surprised nobody: namely, venue.

Obama leaves loophole open for NSA to exploit zero-day vulnerabilities

Obama leaves loophole open for NSA to exploit zero-day vulnerabilities

No, the US White House didn't know about Heartbleed and didn't exploit the OpenSSL bug to snoop, it said, but it's reserving the prerogative to use zero-day exploits as a wedge to pry out intelligence if it serves national security interests.

Please vote for Sophos Naked Security in the European Security Blogger Awards 2014 !


The second annual European Security Blogger Awards are coming up soon, and we're up for a prize in two categories.

We'd love you to vote for us!

(This time you don't have to vote in every category.)

Zeus malware - nine charged with conspiracy to steal millions of dollars

US charges 9 with stealing millions of dollars with Zeus malware

The US Department of Justice (DOJ) has charged nine individuals over their alleged involvement in a criminal organisation that stole millions of dollars from victims' bank accounts.

Facebook wages war on Like-baiting and spammy posts

Facebook wages war on Like-baiting and spammy posts

It's a full frontal assault on cute kittens and the Pages that pimp them out for Likes. Facebook's tweaked its algorithms to try to scrape off the clingy, whiny, needy stories published by Pages that deliberately try to game Facebook's News Feed to get more distribution than they normally would.