I wouldn’t say this is a list of my favourite breaches from this year as that’s a bit of a disingenuous term, but oh boy were there some memorable ones. So many of the incidents I deal with are relatively benign in terms of either the data they expose or the nature of the service,…
Month: November 2024
Data loss, Global Security News, Guest blog, hospital, malware, NHS, Ransomware
UK hospital, hit by cyberattack, resorts to paper and postpones procedures
A British hospital is grappling with a major cyberattack that has crippled its IT systems and disrupted patient care. Read more in my article on the Hot for Security blog.
Conti, Exploits, Global Security News, Guest blog, malware, Ransomware, vulnerability
Mimic ransomware: what you need to know
What makes Mimic particularly unusual is that it exploits the API of a legitimate Windows file search tool (“Everything” by Voidtools) to quickly locate files for encryption. Find out more about the threat in my article on the Tripwire State of Security blog.
CCTV, DNA, Global Security News, Guest blog, Law & order, Podcast, Smashing Security, social media, Social networks, vulnerability
Smashing Security podcast #395: Gym hacking, disappearing DNA, and a social lockout
A Kansas City man is accused of hacking into local businesses, not to steal money, but to… get a cheaper gym membership? A DNA-testing firm has vanished, leaving customers in the dark about what’s happened to their sensitive genetic data. And Australia mulls a social media ban for youngsters. All this and much much more…
A Little Sunshine, AT&T, Boxfan, buttholio, Connor Riley Moucka, cyb3rph4nt0m, DDoS-for-Hire, Global Security News, John Erin Binns, Judische, Kiberphant0m, Naver, Ne'er-Do-Well News, North America, Proman557, Ransomware, Reverseshell, Shi-Bot, Snowflake, South Korea, telekomterrorist, The Coming Storm, Vars_Secc, Verizon, Waifu
Hacker in Snowflake Extortions May Be a U.S. Soldier
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake, but a third suspect — a prolific hacker known as Kiberphant0m — remains at large and continues to publicly extort victims. However, this person’s identity may not remain a secret for long:…
AI, ChatGPT, Global Security News, Google, Law & order, Microsoft, openai, Podcast, privacy, robot, The AI Fix
The AI Fix #26: Would AI kill sentient robots, and is water wet?
In episode 26 of The AI Fix, an AI does surgery on pork chops, holographic Jesus wants your consent to use cookies, Mark opens the pod bay doors, our hosts discover OpenAI’s couch potato health coach, and Graham finds a robot made of drain pipes. Graham pits Mark against an AI in a morality quiz…
data breach, Data loss, Global Security News, Guest blog, Microsoft, NHS, Power Pages, privacy
Data leaks from websites built on Microsoft Power Pages, including 1.1 million NHS records
A security researcher has blamed misconfigured implementations of Microsoft Power Pages for a slew of data breaches from web portals – including the leak of 1.1 million NHS employee records. Read more in my article on the Hot for Security blog.
Global Security News
Roche to Acquire Poseida Therapeutics in a Deal Worth Up to $1.5 Billion
The deal allows the pharmaceutical company to bring in house its current partner with the aim of developing cell therapies in oncology, immunology and neurology.
data breach, Data loss, Global Security News, Guest blog, privacy
FlipaClip animation app data breach exposes details of almost 900,000 users
Flipaclip, an animation creation app that is particularly popular with youngsters, has exposed the details of over 890,000 users. Read more in my article on the Hot for Security blog.
Global Security News, Weekly update
Weekly Update 427
I was going to write about how much I’ve enjoyed “tinkering” with the HIBP API, but somehow, that term doesn’t really seem appropriate any more for a service of this scale. On the contrary, we’re putting in huge amounts of effort to get this thing fast, stable, and sustainable. We could do the first two…
Global Security News, Technology
Meta-Powered Military Chatbot Advertised Giving “Worthless” Advice on Airstrikes
Meta’s in-house ChatGPT competitor is being marketed unlike anything that’s ever come out of the social media giant before: a convenient tool for planning airstrikes. As it has invested billions into developing machine learning technology it hopes can outpace OpenAI and other competitors, Meta has pitched its flagship large language model, Llama, as a handy…
Global Security News, Technology
Meta-Powered Military Chatbot Advertised Giving “Worthless” Advice on Airstrikes
Meta’s in-house ChatGPT competitor is being marketed unlike anything that’s ever come out of the social media giant before: a convenient tool for planning airstrikes. As it has invested billions into developing machine learning technology it hopes can outpace OpenAI and other competitors, Meta has pitched its flagship large language model, Llama, as a handy…
Global Security News, Technology
Meta-Powered Military Chatbot Advertised Giving “Worthless” Advice on Airstrikes
Meta’s in-house ChatGPT competitor is being marketed unlike anything that’s ever come out of the social media giant before: a convenient tool for planning airstrikes. As it has invested billions into developing machine learning technology it hopes can outpace OpenAI and other competitors, Meta has pitched its flagship large language model, Llama, as a handy…
Global Security News, Technology
The Intercept’s Lawsuit Against OpenAI Advances on Claim It Removed Reporters’ Bylines
In an order on Friday, a federal court rejected OpenAI’s effort to toss a lawsuit filed by The Intercept over using its journalists’ work to train ChatGPT without permission or credit. One of The Intercept’s claims under the Digital Millenium Copyright Act will move forward against OpenAI, although another claim was dismissed, along with all…
Global Security News, Technology
The Intercept’s Lawsuit Against OpenAI Advances on Claim It Removed Reporters’ Bylines
In an order on Friday, a federal court rejected OpenAI’s effort to toss a lawsuit filed by The Intercept over using its journalists’ work to train ChatGPT without permission or credit. One of The Intercept’s claims under the Digital Millenium Copyright Act will move forward against OpenAI, although another claim was dismissed, along with all…
Global Security News, Technology
The Intercept’s Lawsuit Against OpenAI Advances on Claim It Removed Reporters’ Bylines
In an order on Friday, a federal court rejected OpenAI’s effort to toss a lawsuit filed by The Intercept over using its journalists’ work to train ChatGPT without permission or credit. One of The Intercept’s claims under the Digital Millenium Copyright Act will move forward against OpenAI, although another claim was dismissed, along with all…
A Little Sunshine, Ahmed Hossam Eldin Elbadawy, Evans Onyeaka Osiebo, Global Security News, Joel Martin Evans, Joeleoli, Kingbob, lastpass, Mailchimp, Namecheap, Ne'er-Do-Well News, Noah Michael Urban, ogusers, Okta, Oktapus, Scattered Spider, SIM Swapping, Sosa, T-Mobile, Twilio, Tylerb
Feds Charge Five Men in ‘Scattered Spider’ Roundup
Federal prosecutors in Los Angeles this week unsealed criminal charges against five men alleged to be members of a hacking group responsible for dozens of cyber intrusions at major U.S. technology companies between 2021 and 2023, including LastPass, MailChimp, Okta, T-Mobile and Twilio. A visual depiction of the attacks by the SMS phishing group known…
Azure, CloudFlare, Emerging Tech, Global Security News, Have I Been Pwned
Closer to the Edge: Hyperscaling Have I Been Pwned with Cloudflare Workers and Caching
I’ve spent more than a decade now writing about how to make Have I Been Pwned (HIBP) fast. Really fast. Fast to the extent that sometimes, it was even too fast: The response from each search was coming back so quickly that the user wasn’t sure if it was legitimately checking subsequent addresses they entered…
abyss0, BreachForums, Data Breaches, Finastra, Global Security News, ke-la.com, Latest Warnings, Ne'er-Do-Well News, The Coming Storm
Fintech Giant Finastra Investigating Data Breach
The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world’s top 50 banks, notified customers of the security incident after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen…
Global Security News
Most Venture Investors Want Their Startups to Go Public. Not This One.
Investor Alcon Research is suing portfolio company Aurion Biotech to stop it from pursuing an IPO.
Asia Pacific, Global Security News, Politics, Technology
Trump’s Election Is Also a Win for Tech’s Right-Wing “Warrior Class”
Donald Trump pitched himself to voters as a supposed anti-interventionist candidate of peace. But when he reenters the White House in January, at his side will be a phalanx of pro-military Silicon Valley investors, inventors, and executives eager to build the most sophisticated weapons the world has ever known. During his last term, the U.S.…
Asia Pacific, Global Security News, Politics, Technology
Trump’s Election Is Also a Win for Tech’s Right-Wing “Warrior Class”
Donald Trump pitched himself to voters as a supposed anti-interventionist candidate of peace. But when he reenters the White House in January, at his side will be a phalanx of pro-military Silicon Valley investors, inventors, and executives eager to build the most sophisticated weapons the world has ever known. During his last term, the U.S.…
Asia Pacific, Global Security News, Politics, Technology
Trump’s Election Is Also a Win for Tech’s Right-Wing “Warrior Class”
Donald Trump pitched himself to voters as a supposed anti-interventionist candidate of peace. But when he reenters the White House in January, at his side will be a phalanx of pro-military Silicon Valley investors, inventors, and executives eager to build the most sophisticated weapons the world has ever known. During his last term, the U.S.…
Global Security News, Weekly update
Weekly Update 426
I have absolutely no problem at all talking about the code I’ve screwed up. Perhaps that’s partly because after 3 decades of writing software (and doing some meaningful stuff along the way), I’m not particularly concerned about showing my weaknesses. And this week, I screwed up a bunch of stuff; database queries that weren’t resilient…
A Little Sunshine, Aleksandr Ermakov, chronopay, Data Breaches, Dmitri Golubov, Global Security News, Helkern, Home Depot breach, Hydra Market, MikeMike, Mikhail Lenin, Mikhail Shefel, Ne'er-Do-Well News, North America, pavel vrublevsky, Peter Vrublevsky, Pharma Wars, Sprut, Sugar ransomware, target breach
An Interview With the Target & Home Depot Hacker
In December 2023, KrebsOnSecurity revealed the real-life identity of Rescator, the nickname used by a Russian cybercriminal who sold more than 100 million payment cards stolen from Target and Home Depot between 2013 and 2014. Moscow resident Mikhail Shefel, who confirmed using the Rescator identity in a recent interview, also admitted reaching out because he…
Global Security News
So Human It’s Scary: My Day Alone Talking to Bots That Sound Like Us
Joanna Stern strapped chatbots from Meta, Google, OpenAI and Microsoft to a tripod and took them to the woods to uncover the secrets of AI friendship.
Exploits, Global Security News, Have I Been Pwned
Inside the DemandScience by Pure Incubation Data Breach
Apparently, before a child reaches the age of 13, advertisers will have gathered more 72 million data points on them. I knew I’d seen a metric about this sometime recently, so I went looking for “7,000”, which perfectly illustrates how unaware we are of the extent of data collection on all of us. I started…
CVE-2024-43451, CVE-2024-43602, CVE-2024-49019, CVE-2024-49039, CVE-2024-49040, Exploits, Global Security News, Google TAG, Microsoft Patch Tuesday November 2024, Satnam Narang, Security Tools, Tenable, Time to Patch
Microsoft Patch Tuesday, November 2024 Edition
Microsoft today released updates to plug at least 89 security holes in its Windows operating systems and other software. November’s patch batch includes fixes for two zero-day vulnerabilities that are already being exploited by attackers, as well as two other flaws that were publicly disclosed prior to today. The zero-day flaw tracked as CVE-2024-49039 is…
Global Security News
23andMe Lays Off 40% of Staff, Shuts Drug Development Business
The genetics company is closing a unit that was once seen as core to its future.
Global Security News
When Did Apple’s Notes App Become an Extension of Our Brains?
The simple iPhone app is a receptacle for nearly everything: passwords, grocery lists, baby-name brainstorms, the occasional ‘Vanderpump’ brain dump.
A Little Sunshine, emergency data request, fake EDR, fbi, Global Security News, Kodex, Latest Warnings, Matt Donahue, North America, pwnstar, The Coming Storm, Web Fraud 2.0
FBI: Spike in Hacked Police Emails, Fake Subpoenas
The Federal Bureau of Investigation (FBI) is urging police departments and governments worldwide to beef up security around their email systems, citing a recent increase in cybercriminal services that use hacked police email accounts to send unauthorized subpoenas and customer data requests to U.S.-based technology companies. In an alert (PDF) published this week, the FBI…
Global Security News, Weekly update
Weekly Update 425
This was a much longer than usual update, largely due to the amount of time spent discussing the Earth 2 incident. As I said in the video (many times!), the amount of attention this has garnered from both Earth 2 users and the company itself is incommensurate with the impact of the incident itself. It’s…
Global Security News
2023 Top Routinely Exploited Vulnerabilities
Summary The following cybersecurity agencies coauthored this joint Cybersecurity Advisory (hereafter collectively referred to as the authoring agencies): United States: The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and National Security Agency (NSA) Australia: Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) Canada: Canadian Centre for Cyber Security (CCCS) New…
Global Security News, Politics, Technology
Crypto Sweep Puts Congress on Notice: Vote With Us or We’ll Come After You With Millions
The cryptocurrency industry took a victory lap Wednesday. Devotees of digital currencies had cause to celebrate: An ally in Donald Trump had taken the White House and a slew of pro-crypto congressional candidates won races that included at least two Senate seats. Only two years after the spectacular collapse of frauds like Sam Bankman-Fried ushered…
Global Security News, Politics, Technology
Crypto Sweep Puts Congress on Notice: Vote With Us or We’ll Come After You With Millions
The cryptocurrency industry took a victory lap Wednesday. Devotees of digital currencies had cause to celebrate: An ally in Donald Trump had taken the White House and a slew of pro-crypto congressional candidates won races that included at least two Senate seats. Only two years after the spectacular collapse of frauds like Sam Bankman-Fried ushered…
Global Security News, Politics, Technology
Crypto Sweep Puts Congress on Notice: Vote With Us or We’ll Come After You With Millions
The cryptocurrency industry took a victory lap Wednesday. Devotees of digital currencies had cause to celebrate: An ally in Donald Trump had taken the White House and a slew of pro-crypto congressional candidates won races that included at least two Senate seats. Only two years after the spectacular collapse of frauds like Sam Bankman-Fried ushered…
Global Security News, Politics, Technology
Trump Might Get Unfettered Surveillance Powers. How Did We Get Here?
If Donald Trump wins on Tuesday, he will regain the keys to a global surveillance apparatus with few limits. Privacy advocates have warned since Edward Snowden’s revelations in 2013 that the government’s surveillance tools could be misused by presidents of any stripe. In the intervening decade, however, Congress has failed to rein in those powers.…
Global Security News, Politics, Technology
Trump Might Get Unfettered Surveillance Powers. How Did We Get Here?
If Donald Trump wins on Tuesday, he will regain the keys to a global surveillance apparatus with few limits. Privacy advocates have warned since Edward Snowden’s revelations in 2013 that the government’s surveillance tools could be misused by presidents of any stripe. In the intervening decade, however, Congress has failed to rein in those powers.…
Global Security News, Weekly update
Weekly Update 424
I have really clear memories of listening to the Stack Overflow podcast in the late 2000’s and hearing Jeff and Joel talk about the various challenges they were facing and the things they did to overcome them. I just suddenly thought of that when realising how long this week’s video went for with no real…