remixtures

joined 2 years ago
sorted by: new top controversial old
8
"Car rental giant Hertz has begun notifying its customers of a data breach that included their personal information and driver’s licenses. (tldr.nettime.org)
 

"Car rental giant Hertz has begun notifying its customers of a data breach that included their personal information and driver’s licenses.

The rental company, which also owns the Dollar and Thrifty brands, said in notices on its website that the breach relates to a cyberattack on one of its vendors between October 2024 and December 2024.

The stolen data varies by region, but largely includes Hertz customer names, dates of birth, contact information, driver’s licenses, payment card information, and workers’ compensation claims. Hertz said a smaller number of customers had their Social Security numbers taken in the breach, along with other government-issued identification numbers.

Notices on Hertz’s websites disclosed the breach to customers in Australia, Canada, the European Union, New Zealand, and the United Kingdom.

Hertz also disclosed the breach with several U.S. states, including California and Maine. Hertz said at least 3,400 customers in Maine were affected but did not list the total number of affected individuals, which is likely to be significantly higher."

https://techcrunch.com/2025/04/14/hertz-says-customers-personal-data-and-drivers-licenses-stolen-in-data-breach/

#CyberSecurity #DataBreaches #Hertz #Hacking #Privacy #DataProtection

17
"It appears that 4chan was susceptible to a hack because it was running very out of date code that contained various vulnerabilities, according to 404 Media’s look at the code and people sorting (tldr.nettime.org)
 

"It appears that 4chan was susceptible to a hack because it was running very out of date code that contained various vulnerabilities, according to 404 Media’s look at the code and people sorting through the hack online.

That starts to answer the question of how this happened. But why did it happen? This all has roots in a five year old meme fight.

Soyjak.party, the site where a user began posting about the 4chan hack, was an offshoot of 4chan created as a joke about five years ago. Besides being a general cesspool,
4chan has long been a place that incubates memes. lolcats, the NavySeal copypasta, and Pepe the Frog grew and spread on 4chan’s imageboards. From time to time a meme is overplayed or spammed and mods on the site get tired of it.

Five years ago, users spammed the /qa/ board with soyjaks. Unable to quash the tide of soyfaced jpegs, 4chan shut down the entire /qa/ board. The soyajk loving exiles of 4chan started a new site called soyjak.party where they could craft open mouthed soyboy memes to their heart’s content. When 4chan was hacked on the night of April 14, the /qa/ board briefly returned. “/QA/ RETURNS SOYJAK.PARTY WON” read a banner image at the top of the board.

As of this writing, 4chan is still down."

https://www.404media.co/4chan-is-down-following-what-looks-to-be-a-major-hack-spurred-by-meme-war/

#SocialMedia #CyberSecurity #4Chan #Hacking #Soyjak

11
"Google’s mobile operating system Android will now automatically reboot if the phone is locked for three days in a row. (tldr.nettime.org)
 

"Google’s mobile operating system Android will now automatically reboot if the phone is locked for three days in a row.

On Monday, the tech giant pushed updates to Google Play services, a core part of Android that provides functionalities for apps and the operating system itself. Listed under “Security & Privacy” is a new security feature that “will automatically restart your device if locked for 3 consecutive days.”

Last year, Apple rolled out the same feature for iOS. The thinking behind adding an automatic reboot after a certain period of inactivity is to make life more difficult for someone who is trying to unlock or extract data from a phone; for example, law enforcement using a forensic analysis device like those made by Cellebrite or Magnet Forensics."

https://techcrunch.com/2025/04/15/for-security-android-phones-will-now-auto-reboot-after-three-days/

#CyberSecurity #Android #Google #Privacy

12
"The European Commission is issuing burner phones and basic laptops to some US-bound staff to avoid the risk of espionage, a measure traditionally reserved for trips to China. (tldr.nettime.org)
 

"The European Commission is issuing burner phones and basic laptops to some US-bound staff to avoid the risk of espionage, a measure traditionally reserved for trips to China.

Commissioners and senior officials travelling to the IMF and World Bank spring meetings next week have been given the new guidance, according to four people familiar with the situation.

They said the measures replicate those used on trips to Ukraine and China, where standard IT kit cannot be brought into the countries for fear of Russian or Chinese surveillance.

“They are worried about the US getting into the commission systems,” said one official.

The treatment of the US as a potential security risk highlights how relations have deteriorated since the return of Donald Trump as US president in January.

Trump has accused the EU of having been set up to “screw the US” and announced 20 per cent so-called reciprocal tariffs on the bloc’s exports, which he later halved for a 90-day period.

At the same time, he has made overtures to Russia, pressured Ukraine to hand over control over its assets by temporarily suspending military aid and has threatened to withdraw security guarantees from Europe, spurring a continent-wide rearmament effort.

“The transatlantic alliance is over,” said a fifth EU official.""

https://www.ft.com/content/20d0678a-41b2-468d-ac10-14ce1eae357b

#USA #Trump #CyberSecurity #EU #Espionage #StateHacking

8
"When Let’s Encrypt, a free certificate authority, started issuing 90 day TLS certificates for websites, it was considered a bold move that helped push the ecosystem towards shorter certificate life (tldr.nettime.org)
 

"When Let’s Encrypt, a free certificate authority, started issuing 90 day TLS certificates for websites, it was considered a bold move that helped push the ecosystem towards shorter certificate life times. Beforehand, certificate authorities normally issued certificate lifetimes lasting a year or more. With 4.0, Certbot is now supporting Let’s Encrypt’s new capability for six day certificates through ACME profiles and dynamic renewal at:

  • 1/3rd of lifetime left
  • 1/2 of lifetime left, if the lifetime is shorter than 10 days"

https://www.eff.org/deeplinks/2025/04/certbot-40-long-live-short-lived-certs

#CyberSecurity #WebSecurity #TLS #Certbot #LetsEncrypt

8
"If you’re new to prompt injection attacks the very short version is this: what happens if someone emails my LLM-driven assistant (or “agent” if you like) and tells it to forward all of my emails to a (tldr.nettime.org)
 

"If you’re new to prompt injection attacks the very short version is this: what happens if someone emails my LLM-driven assistant (or “agent” if you like) and tells it to forward all of my emails to a third party?
(...)
The original sin of LLMs that makes them vulnerable to this is when trusted prompts from the user and untrusted text from emails/web pages/etc are concatenated together into the same token stream. I called it “prompt injection” because it’s the same anti-pattern as SQL injection.

Sadly, there is no known reliable way to have an LLM follow instructions in one category of text while safely applying those instructions to another category of text.

That’s where CaMeL comes in.

The new DeepMind paper introduces a system called CaMeL (short for CApabilities for MachinE Learning). The goal of CaMeL is to safely take a prompt like “Send Bob the document he requested in our last meeting” and execute it, taking into account the risk that there might be malicious instructions somewhere in the context that attempt to over-ride the user’s intent.

It works by taking a command from a user, converting that into a sequence of steps in a Python-like programming language, then checking the inputs and outputs of each step to make absolutely sure the data involved is only being passed on to the right places."

https://simonwillison.net/2025/Apr/11/camel/

#AI #GenerativeAI #LLMs #PromptInjection #Chatbots #CyberSecurity #Python #DeepMind #Google #ML #CaMeL

3
"A coalition of governments has published a list of legitimate-looking Android apps that were actually spyware and were used to target civil society that may oppose China’s state interests. (tldr.nettime.org)
 

"A coalition of governments has published a list of legitimate-looking Android apps that were actually spyware and were used to target civil society that may oppose China’s state interests.

On Tuesday, the U.K.’s National Cyber Security Centre, or NCSC, which is part of intelligence agency GCHQ, along with government agencies from Australia, Canada, Germany, New Zealand, and the United States, published separate advisories on two families of spyware, known as BadBazaar and Moonshine.

These two spywares hid inside legitimate-looking Android apps, acting essentially as “Trojan” malware, with surveillance capabilities such as the ability to access the phone’s cameras, microphone, chats, photos, and location data, the NCSC wrote in a press release on Wednesday.

BadBazaar and Moonshine, which have been previously analyzed by cybersecurity firms like Lookout, Trend Micro, and Volexity, as well as the digital rights nonprofit Citizen Lab, were used to target Uyghurs, Tibetans, and Taiwanese communities, as well as civil society groups, according to the NCSC.

Uyghurs are a Muslim-minority group largely in China that has for years faced detention, surveillance, and discrimination from the Chinese government, and thus has frequently been the target of hacking campaigns."

https://techcrunch.com/2025/04/09/governments-identify-dozens-of-android-apps-bundled-with-spyware/

#CyberSecurity #China #Android #Spyware #StateHacking #Uyghurs #Tibet #Taiwan

8
"Chinese officials acknowledged in a secret December meeting that Beijing was behind a widespread series of alarming cyberattacks on U.S. infrastructure, according to people familiar with the matter, (tldr.nettime.org)
 

"Chinese officials acknowledged in a secret December meeting that Beijing was behind a widespread series of alarming cyberattacks on U.S. infrastructure, according to people familiar with the matter, underscoring how hostilities between the two superpowers are continuing to escalate.

The Chinese delegation linked years of intrusions into computer networks at U.S. ports, water utilities, airports and other targets, to increasing U.S. policy support for Taiwan, the people, who declined to be named, said.

The first-of-its-kind signal at a Geneva summit with the outgoing Biden administration startled American officials used to hearing their Chinese counterparts blame the campaign, which security researchers have dubbed Volt Typhoon, on a criminal outfit, or accuse the U.S. of having an overactive imagination."

https://www.wsj.com/politics/national-security/in-secret-meeting-china-acknowledged-role-in-u-s-infrastructure-hacks-c5ab37cb

#USA #CyberSecurity #China #StateHacking #VoltTyphoon #Infrastructure

8
"Now, an exhibit published in the court document shows exactly in what countries 1,223 specific victims were located when they were targeted with NSO Group’s Pegasus spyware. (tldr.nettime.org)
 

"Now, an exhibit published in the court document shows exactly in what countries 1,223 specific victims were located when they were targeted with NSO Group’s Pegasus spyware.

The country breakdown is a rare insight into which NSO Group customers may be more active, and where their victims and targets are located.

The countries with the most victims of this campaign are Mexico, with 456 individuals; India, with 100; Bahrain with 82; Morocco, with 69; Pakistan, with 58; Indonesia, with 54; and Israel, with 51, according to a chart titled “Victim Country Count,” that WhatsApp submitted as part of the case.

There are also victims in Western countries like Spain (21 victims), the Netherlands (11), Hungary (8), France (7), United Kingdom (2), and one victim in the United States."

https://techcrunch.com/2025/04/09/court-document-reveals-locations-of-whatsapp-victims-targeted-by-nso-spyware/

#CyberSecurity #NSO #Spyware #WhatsApp #Meta #Mexico

58
"President Donald Trump today signed a Presidential Memorandum today revoking any active security clearance currently held by Chris Krebs, the former director of the Cybersecurity and Infrastructure (tldr.nettime.org)
 

"President Donald Trump today signed a Presidential Memorandum today revoking any active security clearance currently held by Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency, who famously rumbled publicly with Trump over the latter's false allegations of election fraud during and after the 2020 presidential election.

Trump, at the end of his first presidential term, fired Krebs via a November 17 tweet, two weeks after losing his re-election bid to President Joe Biden, saying that Krebs' claims about the security of the election were inaccurate and accusing him of overstepping his authority as a government official.

The move to strip Krebs of his security clearance follows a string of similar moves made by the Trump administration to strip the clearances of anyone who has been deemed to be disloyal to Trump. This includes many top officials and advisors who initially served Trump during his first presidency before becoming vocal critics of him and his policies."

https://www.zetter-zeroday.com/trump-signs-memorandum-revoking-security-clearance-of-former-cisa-director-chris-krebs/

#USA #Trump #CISA #CyberSecurity

10
"Since 3.5-sonnet, we have been monitoring AI model announcements, and trying pretty much every major new release that claims some sort of improvement. Unexpectedly by me, aside from a minor bump with (tldr.nettime.org)
 

"Since 3.5-sonnet, we have been monitoring AI model announcements, and trying pretty much every major new release that claims some sort of improvement. Unexpectedly by me, aside from a minor bump with 3.6 and an even smaller bump with 3.7, literally none of the new models we've tried have made a significant difference on either our internal benchmarks or in our developers' ability to find new bugs. This includes the new test-time OpenAI models.

At first, I was nervous to report this publicly because I thought it might reflect badly on us as a team. Our scanner has improved a lot since August, but because of regular engineering, not model improvements. It could've been a problem with the architecture that we had designed, that we weren't getting more milage as the SWE-Bench scores went up.

But in recent months I've spoken to other YC founders doing AI application startups and most of them have had the same anecdotal experiences: 1. o99-pro-ultra announced, 2. Benchmarks look good, 3. Evaluated performance mediocre. This is despite the fact that we work in different industries, on different problem sets. Sometimes the founder will apply a cope to the narrative ("We just don't have any PhD level questions to ask"), but the narrative is there.

I have read the studies. I have seen the numbers. Maybe LLMs are becoming more fun to talk to, maybe they're performing better on controlled exams. But I would nevertheless like to submit, based off of internal benchmarks, and my own and colleagues' perceptions using these models, that whatever gains these companies are reporting to the public, they are not reflective of economic usefulness or generality."

https://www.lesswrong.com/posts/4mvphwx5pdsZLMmpY/recent-ai-model-progress-feels-mostly-like-bullshit

#AI #GenerativeAI #LLMs #Chatbots #CyberSecurity #SoftwareDevelopment #Programming

10
"I'm not the only person for whom a detailed knowledge of scams created immunity from being scammed. Troy Hunt is the proprietor of HaveIBeenPwned.com, the internet's most comprehensive and reliable (tldr.nettime.org)
 

"I'm not the only person for whom a detailed knowledge of scams created immunity from being scammed. Troy Hunt is the proprietor of HaveIBeenPwned.com, the internet's most comprehensive and reliable breach notification site. Hunt pretty much invented the practice of tracking breaches, and he is steeped – saturated – in up-to-the-minute, nitty-gritty details of how internet scams work.

Guess who got phished?
(...)
Hunt had just gotten off a long-haul flight. He was jetlagged. He got a well-constructed, plausible counterfeit email from Mailchimp telling him that his mailing-list – which he absolutely relies upon – had been frozen after a spam complaint, and advising him to click on a link to contest the suspension. He was taken to a fake login screen that his password manager didn't autopopulate, so he manually pasted the password in (Mailchimp doesn't have 2FA). It was only when the login session hung that he realized he'd been scammed – and by then, it was too late. Within minutes, his mailing list had been exported by the scammers.

In his postmortem of the scam, Hunt identifies the overlapping factors that made him vulnerable. He was jetlagged. The mailing list was important. Bogus spam complaints are common. Big corporate sites like Mailchimp often redirect their logins through different domains, which causes password manager autofill to fail. Hunt had experienced near-identical phishing attempts before and spotted them, but this one just happened to land at the very moment that he was vulnerable. Plus – as with my credit union scam – it seems likely that Mailchimp itself had been breached (or has an insider threat), which allowed the scammers to pad out the scam with plausible details that made it seem legit."

https://pluralistic.net/2025/04/05/troy-hunt/#teach-a-man-to-phish

#Scams #Phishing #CyberSecurity

"It is now time to fix it for good. A new solution has been proposed: partitioning visited link history. This approach fundamentally changes how browsers store and expose visited link data. Instead of in c/cybersecurity@fedia.io
[–] remixtures@tldr.nettime.org 2 points 1 week ago

"Browsers keep track of the pages that a user has visited, and they use this information to style anchor elements on a page differently if a user has visited that link before. Most browsers give visited links a different color by default; some web developers rely on the :visited CSS selector to style visited links according to their own preferences.

It is well-known that styling visited links differently from unvisited links opens the door to side-channel attacks that leak the user’s browsing history. One notable attack used window.getComputedStyle and the methods that return a NodeList of HTMLCollection of anchor elements (e.g. document.querySelectorAll, document.getElementsByTagName, etc.) to inspect the styles of each link that was rendered on the page. Once attackers had the style of each link, it was possible to determine whether each link had been visited, leaking sensitive information that should have only been known to the user.

In 2010, browsers implemented a mitigation for this attack: (1) when sites queried link styling, the browser always returned the “unvisited” style, and (2) developers were now limited in what styles could be applied to links. However, these mitigations were complicated for both browsers to implement and web developers to adjust to, and there are proponents of removing these mitigations altogether." https://github.com/explainers-by-googlers/Partitioning-visited-links-history

"After the United Kingdom demanded that Apple create a backdoor that would allow government officials globally to spy on encrypted data, Apple decided to simply turn off encryption services in the UK in c/cybersecurity@fedia.io
[–] remixtures@tldr.nettime.org 10 points 1 month ago

"Today, in response to the U.K.’s demands for a backdoor, Apple has stopped offering users in the U.K. Advanced Data Protection, an optional feature in iCloud that turns on end-to-end encryption for files, backups, and more.

Had Apple complied with the U.K.’s original demands, they would have been required to create a backdoor not just for users in the U.K., but for people around the world, regardless of where they were or what citizenship they had. As we’ve said time and time again, any backdoor built for the government puts everyone at greater risk of hacking, identity theft, and fraud.

This blanket, worldwide demand put Apple in an untenable position. Apple has long claimed it wouldn’t create a backdoor, and in filings to the U.K. government in 2023, the company specifically raised the possibility of disabling features like Advanced Data Protection as an alternative."

https://www.eff.org/deeplinks/2025/02/cornered-uks-demand-encryption-backdoor-apple-turns-its-strongest-security-setting

"The doge.gov website that was spun up to track Elon Musk’s cuts to the federal government is insecure and pulls from a database that can be edited by anyone, according to two separate people who in c/cybersecurity@fedia.io
[–] remixtures@tldr.nettime.org 4 points 2 months ago

"At a press conference in the Oval Office this week, Elon Musk promised the actions of his so-called Department of Government Efficiency (DOGE) project would be “maximally transparent,” thanks to information posted to its website.

At the time of his comment, the DOGE website was empty. However, when the site finally came online Thursday morning, it turned out to be little more than a glorified feed of posts from the official DOGE account on Musk’s own X platform, raising new questions about Musk’s conflicts of interest in running DOGE.

DOGE.gov claims to be an “official website of the United States government,” but rather than giving detailed breakdowns of the cost savings and efficiencies Musk claims his project is making, the homepage of the site just replicated posts from the DOGE account on X."

https://www.wired.com/story/doge-website-is-just-one-big-x-ad/

"Paragon Solutions, whose military-grade hacking software was allegedly used to target 90 people, including journalists and members of civil society, in two dozen countries, has terminated its client in c/cybersecurity@fedia.io
[–] remixtures@tldr.nettime.org 4 points 2 months ago (1 children)

Fascists love to surveil and harass... 😕

"The Italian founder of the NGO Mediterranea Saving Humans, who has been a vocal critic of Italy’s alleged complicity in abuses suffered by migrants in Libya, has revealed WhatsApp informed him his mobile phone was targeted by military-grade spyware made by the Israel-based company Paragon Solutions.

Luca Casarini, an activist whose organisation is estimated to have saved 2,000 people crossing the Mediterranean to Italy, is the most high profile person to come forward since WhatsApp announced last week that 90 journalists and other members of civil society had probably had their phones compromised by a government client using Paragon’s spyware.

The work of the three alleged targets to have come forward so far – Casarini, the journalist Francesco Cancellato, and the Sweden-based Libyan activist Husam El Gomati – have one thing in common: each has been critical of the prime minister, Giorgia Meloni. The Italian government has not responded to a request for comment on whether it is a client of Paragon."

https://www.theguardian.com/technology/2025/feb/05/activists-critical-of-italian-pm-may-have-had-their-phones-targeted-by-paragon-spyware-says-whatsapp

"WhatsApp on Friday accused the commercial surveillance company Paragon of targeting about 90 of its users with spyware. in c/cybersecurity@fedia.io
[–] remixtures@tldr.nettime.org 2 points 2 months ago

"Paragon’s spyware was allegedly delivered to targets who were placed on group chats without their permission, and sent malware through PDFs in the group chat. Paragon makes no-click spyware, which means users do not have to click on any link or attachment to be infected; it is simply delivered to the phone.

It is not clear how long Cancellato may have been compromised. But the editor published a high-profile investigative story last year that exposed how members of Meloni’s far-right party’s youth wing had engaged in fascist chants, Nazi salutes and antisemitic rants.

Fanpage’s undercover reporters – although not Cancellato personally – had infiltrated groups and chat forums used by members of the National Youth, a wing of Meloni’s Brothers of Italy party. The outlet published clips of National Youth members chanting “Duce” – a reference to Benito Mussolini – and “sieg Heil”, and boasting about their familial connections to historical figures linked to neo-fascist terrorism. The stories were published in May."

"WhatsApp on Friday accused the commercial surveillance company Paragon of targeting about 90 of its users with spyware. in c/cybersecurity@fedia.io
[–] remixtures@tldr.nettime.org 4 points 2 months ago (1 children)

"An Italian investigative journalist who is known for exposing young fascists within prime minister Giorgia Meloni’s far-right party was targeted with spyware made by Israel-based Paragon Solutions, according to a WhatsApp notification received by the journalist.

Francesco Cancellato, the editor-in-chief of the Italian investigative news outlet Fanpage, was the first person to come forward publicly after WhatsApp announced on Friday that 90 journalists and other members of civil society had been targeted by the spyware.

The journalist, like dozens of others whose identities are not yet known, said he received a notification from the messaging app on Friday afternoon.

WhatsApp, which is owned by Meta, has not identified the targets or their precise locations, but said they were based in more than two dozen countries, including in Europe.

WhatsApp said it had discovered that Paragon was targeting its users in December and shut down the vector used to “possibly compromise” the individuals. Like other spyware makers, Paragon sells use of its spyware, known as Graphite, to government agencies, who are supposed to use it to fight and prevent crime."

https://www.theguardian.com/technology/2025/jan/31/italian-journalist-whatsapp-israeli-spyware

"Some Motorola automated license plate reader surveillance cameras are live-streaming video and car data to the unsecured internet where anyone can watch and scrape them, a security researcher has in c/cybersecurity@fedia.io
[–] remixtures@tldr.nettime.org 5 points 3 months ago (1 children)

"In just 20 minutes this morning, an automated license plate recognition (ALPR) system in Nashville, Tennessee captured photographs and detailed information from nearly 1,000 vehicles as they passed by. Among them: eight black Jeep Wranglers, six Honda Accords, an ambulance, and a yellow Ford Fiesta with a vanity plate.
This trove of real-time vehicle data, collected by one of Motorola's ALPR systems, is meant to be accessible by law enforcement. However, a flaw discovered by a security researcher has exposed live video feeds and detailed records of passing vehicles, revealing the staggering scale of surveillance enabled by this widespread technology.

More than 150 Motorola ALPR cameras have exposed their video feeds and leaking data in recent months, according to security researcher Matt Brown, who first publicised the issues in a series of YouTube videos after buying an ALPR camera on eBay and reverse engineering it."

https://www.wired.com/story/license-plate-reader-live-video-data-exposed/

"The message from President Biden’s national security adviser was startling. in c/cybersecurity@fedia.io
[–] remixtures@tldr.nettime.org 2 points 3 months ago

@dohpaz42@lemmy.world Yes, because they do worse... :-/

"Quien sí piensa que Pegasus se debe prohibir es Claudiu Dan Gheorghe, exingeniero jefe de WhatsApp. Pero el software de espionaje comercial funciona precisamente porque trabaja sobre monocultivos: un in c/cybersecurity@fedia.io
[–] remixtures@tldr.nettime.org 0 points 3 months ago (2 children)

@ointersexo Durante muitos anos não tive celular - só tablet. O problema é que cada vez mais muitos serviço básicos - banco, cartão de refeição, etc. - só funcionam com smartphone porque exigem uma app. Isso aí complica o cenário. Os reguladores para a concorrência deviam obrigar esses provedores a fornecerem uma versão web dessas mesmas app sem necessidade de recorrer a um celular.

"Quien sí piensa que Pegasus se debe prohibir es Claudiu Dan Gheorghe, exingeniero jefe de WhatsApp. Pero el software de espionaje comercial funciona precisamente porque trabaja sobre monocultivos: un in c/cybersecurity@fedia.io
[–] remixtures@tldr.nettime.org 0 points 3 months ago (4 children)

@ointersexo Sim, vejo cada vez mais gente a optar por um velho "tijolo"

view more: next ›