Geek-Guy.com

Month: January 2025

Consent Phishing: The New, Smarter Way to Phish

What is consent phishing? Most people are familiar with the two most common types of phishing — credential phishing and phishing payloads, where attackers trick users into revealing credentials and downloading malicious software respectively. However, there is a third type of phishing on the rise: consent phishing. Consent phishing deceives users into granting a third-party SaaS application…

Hindustan Unilever in talks to acquire Peak XV-backed Minimalist for up to $350M

Consumer goods giant Hindustan Unilever is in advanced talks to acquire four-year-old direct-to-consumer startup Minimalist for up to $350 million, according to two people familiar with the matter. An acquisition would add to the Unilever subsidiary’s buying spree in India, where it expanded into the health and wellbeing category by acquiring Oziva and Wellbeing Nutrition…

New AI Jailbreak Method ‘Bad Likert Judge’ Boosts Attack Success Rates by Over 60%

Cybersecurity researchers have shed light on a new jailbreak technique that could be used to get past a large language model’s (LLM) safety guardrails and produce potentially harmful or malicious responses. The multi-turn (aka many-shot) attack strategy has been codenamed Bad Likert Judge by Palo Alto Networks Unit 42 researchers Yongzhe Huang, Yang Ji, Wenjun…

LDAPNightmare PoC Exploit Crashes LSASS and Reboots Windows Domain Controllers

A proof-of-concept (PoC) exploit has been released for a now-patched security flaw impacting Windows Lightweight Directory Access Protocol (LDAP) that could trigger a denial-of-service (DoS) condition. The out-of-bounds reads vulnerability is tracked as CVE-2024-49113 (CVSS score: 7.5). It was addressed by Microsoft as part of Patch Tuesday updates for December 2024, alongside CVE-2024-49112 (

Critical Deadline: Update Old .NET Domains Before January 7, 2025 to Avoid Service Disruption

Microsoft has announced that it’s making an “unexpected change” to the way .NET installers and archives are distributed, requiring developers to update their production and DevOps infrastructure. “We expect that most users will not be directly affected, however, it is critical that you validate if you are affected and to watch for downtime or other…

The Critical Risk of Using Dummy Email Domains in Payment Gateways

During our recent security assessments across multiple clients, we discovered a concerning pattern: many companies are unknowingly exposing their customers’ sensitive payment information through a simple yet critical misconfiguration in… The post The Critical Risk of Using Dummy Email Domains in Payment Gateways appeared first on Strobes Security. The post The Critical Risk of Using…

Secure by design vs by default – which software development concept is better?

As cybersecurity professionals, we need to know that the software products we acquire are safe and able to support or accommodate the procedures and tools we use to keep attackers at bay while performing their given functions. With attacks perennially on the rise and the software supply chain remaining as vulnerable as ever, there is…

Cloudflare’s VPN app among half-dozen pulled from Indian app stores

More than half-a-dozen VPN apps, including Cloudflare’s widely-used 1.1.1.1, have been pulled from India’s Apple App Store and Google Play Store following intervention from government authorities, TechCrunch has learned.  The Indian Ministry of Home Affairs issued removal orders for the apps, according to a document reviewed by TechCrunch and a disclosure made by Google to…

Apple to Pay Siri Users $20 Per Device in Settlement Over Accidental Siri Privacy Violations

Apple has agreed to pay $95 million to settle a proposed class action lawsuit that accused the iPhone maker of invading users’ privacy using its voice-activated Siri assistant. The development was first reported by Reuters. The settlement applies to U.S.-based individuals current or former owners or purchasers of a Siri-enabled device who had their confidential…

Federal vs. State Regulations: Their Role in Delivery Truck Crashes

GUEST OPINION: When delivery trucks hit the road, they carry more than just packages—they also carry significant responsibility. With the rise of e-commerce, delivery vehicles are increasingly a common sight on highways and local streets. While these trucks keep commerce flowing, their presence also raises safety concerns, particularly when accidents occur. The role of federal…

Federal vs. State Regulations: Their Role in Delivery Truck Crashes

GUEST OPINION: When delivery trucks hit the road, they carry more than just packages—they also carry significant responsibility. With the rise of e-commerce, delivery vehicles are increasingly a common sight on highways and local streets. While these trucks keep commerce flowing, their presence also raises safety concerns, particularly when accidents occur. The role of federal…

Federal vs. State Regulations: Their Role in Delivery Truck Crashes

GUEST OPINION: When delivery trucks hit the road, they carry more than just packages—they also carry significant responsibility. With the rise of e-commerce, delivery vehicles are increasingly a common sight on highways and local streets. While these trucks keep commerce flowing, their presence also raises safety concerns, particularly when accidents occur. The role of federal…

How to watch CES 2025’s press conferences

CES 2025 kicks off January 7. The annual Las Vegas event sets the tone for the year’s consumer electronics and automotive industries. As always, TechCrunch will be there, sniffing stories from the most exciting startups and tech giants. If you really want a piece of the action without paying for the hotel and flight, many…

xAI’s next-gen AI model didn’t arrive on time, adding to a trend

The list of flagship AI models that missed their promised launch windows continues to grow. Last summer, billionaire Elon Musk, the founder and CEO of AI company xAI, said that Grok 3, xAI’s next major AI model, would arrive by “end of year” 2024. Grok, xAI’s answer to models like OpenAI’s GPT-4o and Google’s Gemini,…

Best of 2024: National Public Data (NPD) Breach: Essential Guide to Protecting Your Identity

Following the publication of our in-depth analysis on the National Public Data (NPD) breach last week, Constella Intelligence received several inquiries about how to safeguard against identity attacks using the exposed SSNs.  The recent National Public Data (NPD) breach stands as the largest social security number (SSN) exposures in history. With 292 million individuals exposed,…

DEF CON 32 – War Games Red Team for OT Based on Real World Case Studies

Author/Presenter: Shishir Gupta Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel. Permalink The post DEF CON 32 – War Games Red Team for OT Based on Real World…

Cybertruck explosion outside Trump hotel in Vegas leaves 1 dead, 7 injured

A Tesla Cybertruck that exploded and burst into flames Wednesday morning just outside the Trump International Hotel Las Vegas has left one person dead and seven people injured, according to the Las Vegas Metropolitan Police Department (LVMPD). Matthew Alan Livelsberger, a 37-year-old man who was an active duty U.S. Army Green Beret from Colorado Springs,…

Enhancing Cybersecurity with Zero Trust Security

Cybersecurity has become an increasingly pressing issue in today’s digital age, with advanced threats and the latest security exploits constantly posing risks to organizations and individuals. As such, implementing a robust security strategy is essential to safeguarding sensitive information and preventing cyber attacks. One approach that has gained traction in recent years is the concept…

US soldier linked to Trump call log hack arrested in Texas

Court documents unsealed Monday show that US authorities have arrested a 20-year-old soldier, Cameron John Wagenius, charged with two counts of selling or attempting to sell confidential phone records without the customer’s authorization. But behind the scant details provided in the charge sheet submitted to the US District Court for the Western District of Washington…

CES 2025: What to expect from the year’s first and biggest tech show

CES 2025 officially kicks off in Las Vegas on Tuesday morning, running through the end of the day on January 10. The “official” dates are specific to when the floor of the Las Vegas Convention Center is open to attendees, and ultimately belie the show’s true duration. A pair of press days kick off Sunday…

DEF CON 32 – V2GEvil: Ghost in the Wires

Authors/Presenters: Pavel Khunt & Thomas Sermpinis aka Cr0wTom Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel. Permalink The post DEF CON 32 – V2GEvil: Ghost in the Wires…

Spotify’s partner program for podcast hosts is now available

Spotify announced Thursday the launch of its new “Partner Program” that lets popular podcast hosts monetize their video content. Spotify’s new program gives qualifying creators on its platform opportunities for extra income beyond just advertising revenue, such as video payouts. The program was initially announced back in November and is officially available in the U.S.,…

Thomson Reuters acquires tax automation company SafeSend for $600M

Thomson Reuters has acquired tax automation company SafeSend in an all-cash transaction valued at $600 million. Founded in 2008, Ann Arbor, Michigan-based SafeSend serves a cloud-based platform designed to streamline the processing and sharing of sensitive financial documents. It provides tools for delivering tax returns, gathering e-signatures, collecting payments, automating workflows, meeting compliance obligations, and…

Best of 2024: Cisco Vulnerability: CISA Alerts Of Smart Install Exploits

In light of recent cybercrime incidents, the United States (US) Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert pertaining to a Cisco vulnerability. As per recent reports, the Cisco vulnerability prevails within the Smart Install (SMI) feature and can be exploited for access to sensitive data. In this article, we’ll explore the vulnerability…

Tesla Cybertruck fails to boost 2024 sales as annual deliveries fall for first time

Tesla delivered fewer cars last year than it did in 2023, marking its first year-to-year drop and signaling that the company is struggling to reach new buyers. That means Tesla’s Cybertruck, which is the company’s first true new model since 2020, did little to boost the company’s growth in its first full year of sales.…

Apheris rethinks the AI data bottleneck in life science with federated computing

AI is fundamentally dependent on data, but the vast majority of health data goes unused for understandable reasons — chiefly patient privacy, regulation and IP protection. “This is the core underlying problem” of building AI solutions for life sciences and related areas like pharmaceutics, said German entrepreneur Robin Röhm. And not only that: collaboration when…

Envision 2025: India’s first energy festival returns with the theme ‘Ground Zero for Net-Zero’ | January 30 – February 1, 2025

COMPANY NEWS:  The climate crisis is no longer a distant warning—it is impacting our daily lives, demanding immediate attention and action. With an array of indigenous innovations and diverging technologies emerging worldwide, achieving a sustainable, net-zero future requires collective effort; no country, company, or community can do it alone.

Envision 2025: India’s first energy festival returns with the theme ‘Ground Zero for Net-Zero’ | January 30 – February 1, 2025

COMPANY NEWS:  The climate crisis is no longer a distant warning—it is impacting our daily lives, demanding immediate attention and action. With an array of indigenous innovations and diverging technologies emerging worldwide, achieving a sustainable, net-zero future requires collective effort; no country, company, or community can do it alone.

Envision 2025: India’s first energy festival returns with the theme ‘Ground Zero for Net-Zero’ | January 30 – February 1, 2025

COMPANY NEWS:  The climate crisis is no longer a distant warning—it is impacting our daily lives, demanding immediate attention and action. With an array of indigenous innovations and diverging technologies emerging worldwide, achieving a sustainable, net-zero future requires collective effort; no country, company, or community can do it alone.

Envision 2025: India’s first energy festival returns with the theme ‘Ground Zero for Net-Zero’ | January 30 – February 1, 2025

COMPANY NEWS:  The climate crisis is no longer a distant warning—it is impacting our daily lives, demanding immediate attention and action. With an array of indigenous innovations and diverging technologies emerging worldwide, achieving a sustainable, net-zero future requires collective effort; no country, company, or community can do it alone.

Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API

Details have emerged about three now-patched security vulnerabilities in Dynamics 365 and Power Apps Web API that could result in data exposure. The flaws, discovered by Melbourne-based cybersecurity company Stratus Security, have been addressed as of May 2024. Two of the three shortcomings reside in Power Platform’s OData Web API Filter, while the third vulnerability…

What Top Technologies IT Leaders Want From Solution Providers in 2025

Now that we’ve turned the page over to the new year, organizations will begin to set their sights on what technologies and services they should prioritize this year. Enterprises must deliver successful digital initiatives while navigating budget constraints. According to Gartner’s 2025 CIO Agenda, CIOs should aim to “grow the digital vanguard by making it…

Cross-Domain Attacks: A Growing Threat to Modern Security and How to Combat Them

In the past year, cross-domain attacks have gained prominence as an emerging tactic among adversaries. These operations exploit weak points across multiple domains – including endpoints, identity systems and cloud environments – so the adversary can infiltrate organizations, move laterally and evade detection. eCrime groups like SCATTERED SPIDER and North Korea-nexus adversaries such as FAMOUS

Telegram rolls out third-party account verification, filters

Telegram has rolled out its first update of the year, adding a new account verification method powered by third-parties, new message search filters, and the ability to turn gifts into NFTs. The chat app already had a program to verify public figures and organizations on the platform, and it has now launched a new project…

Chinese government hackers reportedly targeted US Treasury’s sanctions office during December cyberattack

Chinese government hackers targeted the U.S. Treasury’s highly sensitive sanctions office during a December cyberattack, according to reports. According to The Washington Post, the state-sponsored hackers targeted the Office of Foreign Assets Control (OFAC), a government department that imposes economic and trade sanctions against countries and individuals, to potentially access information on Chinese organizations that…

Malicious Obfuscated NPM Package Disguised as an Ethereum Tool Deploys Quasar RAT

Cybersecurity researchers have discovered a malicious package on the npm package registry that masquerades as a library for detecting vulnerabilities in Ethereum smart contracts but, in reality, drops an open-source remote access trojan called Quasar RAT onto developer systems. The heavily obfuscated package, named ethereumvulncontracthandler, was published to npm on December 18, 2024, by a…

SquareX Researchers Expose OAuth Attack on Chrome Extensions Days Before Major Breach

SquareX, an industry-first Browser Detection and Response (BDR) solution, leads the way in browser security. About a week ago, SquareX reported large-scale attacks targeting Chrome Extension developers aimed at taking over the Chrome Extension from the Chrome Store. On December 25th, 2024, a malicious version of Cyberhaven’s browser extension was published on the Chrome Store that…

CISO – Traumjob oder eher Albtraum

loading=”lazy” width=”400px”>Der CISO-Job kann auch zu einem Albtraum werden – gerade wenn die Unterstützung und das Budget fehlt. Toma Stepunina – shutterstock.com „Die Rolle des CISO (Chief Information Security Office) ist nicht erstrebenswert“ – so lautet eine der zentralen Thesen der IT-Security-Spezialisten von WatchGuard Technologies für das Jahr 2025. Dabei seien die typische Probleme, die…

Feel Reassured with Advanced Identity and Access Management

Why Should We Manage Non-Human Identities and Secrets? Imagine a bustling international airport with countless travelers moving in every direction. Now, consider these travelers as your non-human identities (NHIs), each carrying a unique passport (the Secret). The airport, in this case, represents your cloud environment. To ensure a secure, smooth journey for every passenger, would…

Take Control: Empowering Your Team with NHIDR Solutions

Are You Truly Harnessing the Power of NHIDR Solutions? It’s no secret that Non-Human Identities and Data Rights (NHIDR) solutions are crucial for maintaining a robust security system, particularly where cloud environments are involved. But do you fully grasp the potential that these tools can offer when it comes to empowering your team and taking…

Trustworthy Cloud Platforms: Ensuring Secure Access

Is Your Organization’s Trust in Cloud Technology Well-Placed? In this expanding digital landscape where businesses are heavily reliant on cloud technology, can we confidently assert that our data is safe in the cloud? Regardless of the size of your business, trust in cloud platforms should be reinforced. It is a misconception that simply shifting your…

LDAPNightmare: SafeBreach Labs Publishes First Proof-of-Concept Exploit for CVE-2024-49112

SafeBreach researchers developed a zero-click PoC exploit that crashes unpatched Windows Servers using the Windows Lightweight Directory Access Protocol (LDAP) remote code execution vulnerability (CVE-2024-49112). The post LDAPNightmare: SafeBreach Labs Publishes First Proof-of-Concept Exploit for CVE-2024-49112 appeared first on SafeBreach. The post LDAPNightmare: SafeBreach Labs Publishes First Proof-of-Concept Exploit for CVE-2024-49112 appeared first on Security…

Police investigating Cybertruck fire outside Trump hotel in Vegas

A Tesla Cybertruck that caught fire Wednesday morning just outside the Trump International Hotel in Las Vegas is being investigated by local law enforcement. The Las Vegas Metropolitan Police Department said in a post on social media site X that the fire was out and being investigated. The fire was reported around 8:40 a.m. PT,…

Toyota’s CES 2025 press conference: How to watch

Five years ago, Toyota Chairman Akio Toyoda went to CES to share with the world his “personal field of dreams” — a plan to build a prototype city on a 175-acre site at the foot of Mount Fuji in Japan, where people would live and work amongst all of Toyota’s projects, including autonomous vehicle technology,…

Internal SpaceX documents show the sweet stock deals offered to investors like a16z, Gigafund

Like many highly valued startups, SpaceX sometimes allows its employees to cash out some of their shares by selling to company-authorized outside investors. TechCrunch has gotten a peek at an internal SpaceX document about such a tender offer from May 2022. Musk posted on X last month that SpaceX holds such sales for employees about…

Robinhood, already a ‘comeback’ stock, has even more aggressive plans for 2025

Robinhood CEO Vlad Tenev has a lot to celebrate this holiday season. After a bumpy few years following Robinhood’s 2021 IPO — a period during which shares of the commission-free trading app plummeted by more than 90% after it abruptly restricted trading in some meme stocks —  the 12-year-old company was just declared Yahoo Finance’s…

WordPress Appliance - Powered by TurnKey Linux