This seems like a bad idea. And there are ongoing lawsuits against Amazon for selling them. ChatGPT Is Ingesting Corporate Secrets According to internal Slack messages that were leaked to Insider, an Amazon lawyer told workers that they...
A new malware, called Ramsay, can jump air gaps: ESET said they’ve been able to track down three different versions of the Ramsay malware, one compiled in September 2019 (Ramsay v1), and two others in early and late March 2020 (Ramsay v2.a...
In short: Discover how Ramsay malware jumps air gaps to infect isolated networks and steal data, plus learn about innovative methods for stealing data over offline com... (AI summary)
Researchers have discovered a new way to covertly track Android users. Both Meta and Yandex were using it, but have suddenly stopped now that they have been caught. The details are interesting, and worth reading in detail: Tracking code that Meta and Russia-based Yandex embed into millions of...
In short: Discover how Meta and Yandex covertly track Android users, bypassing security protections. Learn about Google's Advanced Protection now available on Android for high-risk users. (AI summary)
Interesting summary of various ways to derive the public key from digitally signed files. Normally, with a signature scheme, you have the public key and want to know whether a given signature is valid. But what if we instead have a message...
A data broker owned by the country’s major airlines, including Delta, American Airlines, and United, collected U.S. travellers’ domestic flight records, sold access to them to Customs and Border Protection (CBP), and then as part of the contract told CBP to not reveal where the data came from...
In short: Uncover airlines selling passenger data to government, learn about SQL injection attack on airport security, and discover secrets of Known Crewmember and Cockpit Access Security System. (AI summary)
It has produced several reports outlining what’s wrong and what needs to be fixed. It’s not fixing them: GAO looked at three DoD-designed initiatives to see whether the Pentagon is following through on its own goals. In a majority of cases, DoD has not completed the cybersecurity training and...
In short: DoD Failing to Fix Cybersecurity Problems: Report reveals lack of progress in completing cybersecurity training and awareness tasks set out by the Pentagon. ... (AI summary)
In the early stages of the war in Ukraine in 2022, PIPEDREAM, a known malware was quietly on the brink of wiping out a handful of critical U.S. electric and liquid natural gas sites. PIPEDREAM is an attack toolkit with unmatched and unprecedented capabilities developed for use against industrial...
Thieves cut through the wall of a coffee shop to get to an Apple store, bypassing the alarms in the process. I wrote about this kind of thing in 2000, in Secrets and Lies (page 318): My favorite example is a band of California art thieves that would break into people’s houses by cutting a hole in...
In short: Learn about a coffee shop theft bypassing security systems and the accidental secret microphone in Nest home alarms. Discover how thieves cut through walls t... (AI summary)
The range of impacts is so broad because of the nature of the vulnerability itself. Developers use logging frameworks to keep track of what happens in a given application. To exploit Log4Shell, an attacker only needs to get the system to log a strategically crafted string of code. From there they...
Narrowly, the term refers to ensuring that data isn’t tampered with, either in transit or in storage. Manipulating account balances in bank databases, removing entries from criminal records, and murder by removing notations about allergies from medical records are all integrity attacks. More...
Try “site:schneier.com” on: Marginalia · Mojeek · Wiby · DuckDuckGo · Bing · Google · Wikipedia · Internet Archive