Yahoo staff knew they were breached two years ago

Its quarterly report says that a state-sponsored actor had access to the company’s network in late 2014

Facebook is buying up stolen passwords on the black market

Does good, preventative password hygiene make it right to subsidize cyber crooks?

iPhone autodial bug parties like it’s 2008

A researcher who found an autodial bug in mobile Safari more than 8 years ago has found it's still there in another part of iOS.

Infect every TorMail user? That’s not what the FBI’s warrant said

The judge authorized FBI agents to infect computers that were clearly seeking, accessing, or sharing child pornography

Virus-spreading smart bulbs? Researchers say it’s possible

And they used a drone to prove it!

Google hits incorrigible sites with “Repeat Offender” tag

Google is toughening its Safe Browsing policies for sites that won't clean up their act

November Patch Tuesday fixes controversial Windows 0-day hole

This month: 14 bulletins, seven remote code execution holes closed, and one controversial 'promote yourself to administrator' zero-day bug fixed.

Tech support scammers bite Chrome users with forgotten 2014 bug

Vulnerability found two years ago remains unpatched by Google

WoT pulls browser extension after privacy failure

WoT has left its users exposed on the web by not properly anonymizing the user data it has been selling to third parties.

Facebook suspends plans to collect WhatsApp user data in the UK

Consumer rights 'aren't properly protected', says the ICO as it says users should be given 'ongoing control' over their data

Would your password withstand 100 guesses from a hacker?

A little PII could be enough to give attackers the edge

Hacker used password resets to break into 1,050 university email accounts

How secure are university email accounts?

Microsoft to shield world chess champion from Russian hackers

Leading up to Friday's world championship, he asked for help in keeping months of computer-intensive analysis and preparations safe.

Who needs a Stingray when Wi-Fi can do the job?

Ordinary Wi-Fi hotspots can be used to extract indentifiers from your cellphone, researchers have found

Worried about the Tesco Bank attack? Here’s our advice

Tesco Bank has pledged to refund any money stolen from customers, but it's always a good idea to review your security, whoever you bank with

Tor marketplaces shut down by Operation Hyperion

Tor, the conduit for below-the-radar browsing, and drugs, weapons and other illegal activities, has been under the microscope by law enforcement in the past two years. In the past months alone, we saw Brian Richard Farrell, who helped run Silk Road …

Oil exec accused of impersonating Elon Musk in an email sues Tesla over Twitter hack

Todd Katz says Tesla illegally accessed his Twitter account in its investigation of a Yahoo email crafted to look like it came from Musk.

Ukrainian hackers ‘snatch huge email cache from Kremlin’

The emails reportedly show Russia's organizing Ukrainian separatists. The hack, if legit, shows Russian leaders are as vulnerable as others.

Monday review – the hot 17 stories of the week

From getting busted on the Dark Web and the 'super cookie' stopped by Firefox to the grandmother billed $5K for alleged piracy, and more!

Apple's iOS App Store Faceplant: Infiltration of Hundreds of Fake Apps

There’s no best way to handle disclosure of zero-day vulnerabilities

Earlier this week, the headlines flashed with news that Google had disclosed a vulnerability to Microsoft that allows local privilege escalation in Windows 10. This vulnerability is a zero-day, meaning these vulnerabilities did not have an immediate…