[ad_1]
Because the Israel-Hamas war continues, with Israeli troops transferring into the Gaza Strip and encircling Gaza Metropolis, one piece of know-how is having an outsized influence on how we see and perceive the warfare. Messaging app Telegram, which has a historical past of lax moderation, has been used by Hamas to share gruesome images and videos. The data has then unfold to different social networks and hundreds of thousands extra eyeballs. Sources inform WIRED that Telegram has been weaponized to spread horrific propaganda.
Microsoft has had a tough few months in the case of the corporate’s personal safety, with Chinese language-backed hackers stealing its cryptographic signing key, continued points with Microsoft Exchange Servers, and its clients being impacted by failings. The corporate has now unveiled a plan to take care of the ever-growing vary of threats. It’s the Secure Future Initiative, which plans, amongst a number of parts, to make use of AI-driven instruments, enhance its software program improvement, and shorten its response time to vulnerabilities.
Additionally this week, we’ve appeared on the privateness practices of Bluesky, Mastodon, and Meta’s Threads as the entire social media platforms jostle for house in a world the place X, previously often known as Twitter, continues to implode. And things aren’t exactly great with this subsequent era of social media. With November arriving, we now have an in depth breakdown of the safety vulnerabilities and patches issued final month. Microsoft, Google, Apple, and enterprise corporations Cisco, VMWare, and Citrix all fixed major security flaws in October.
And there is extra. Every week, we spherical up the safety and privateness information we didn’t cowl in depth ourselves. Click on the headlines to learn the complete tales, and keep secure on the market.
The Flipper Zero is a flexible hacking instrument designed for safety researchers. The pocket-size pen-testing system can intercept and replay all types of wi-fi indicators—together with NFC, infrared, RFID, Bluetooth, and Wi-Fi. Meaning it is attainable to learn microchips and examine indicators being admitted from gadgets. Barely extra nefariously, we’ve found it can easily clone building-entry cards and skim bank card particulars by folks’s garments.
Over the previous couple of weeks, the Flipper Zero, which prices round $170, has been gaining some traction for its ability to disrupt iPhones, significantly by sending them into denial of service (DoS) loops. As Ars Technica reported this week, the Flipper Zero, with some customized firmware, is ready to ship “a continuing stream of messages” asking iPhones to attach through Bluetooth gadgets corresponding to an Apple TV or AirPods. The barrage of notifications, which is distributed by a close-by Flipper Zero, can overwhelm an iPhone and make it just about unusable.
“My telephone was getting these pop-ups each jiffy, after which my telephone would reboot,” safety researcher Jeroen van der Ham advised Ars a couple of DoS assault he skilled whereas commuting within the Netherlands. He later replicated the assault in a lab surroundings, whereas other security researchers have also demonstrated the spamming means in current weeks. In van der Ham’s checks, the assault solely labored on gadgets operating iOS 17—and for the time being, the one method to stop the assault is by turning off Bluetooth.
In 2019, hackers linked to Russia’s intelligence service broke into the community of software program agency SolarWinds, planting a backdoor and ultimately finding their way into thousands of systems. This week, the US Securities and Change Fee charged Tim Brown, the CISO of SolarWinds, and the corporate with fraud and “internal control failures.” The SEC alleges that Brown and the corporate overstated SolarWinds’ cybersecurity practices whereas “understating or failing to reveal identified dangers.” The SEC claims that SolarWinds knew of “particular deficiencies” within the firm’s safety practices and made public claims that weren’t mirrored in its personal inside assessments.
“Somewhat than handle these vulnerabilities, SolarWinds and Brown engaged in a marketing campaign to color a false image of the corporate’s cyber controls surroundings, thereby depriving buyers of correct materials data,” Gurbir S. Grewal, director of the SEC’s Division of Enforcement said in a statement. In response, Sudhakar Ramakrishna, the CEO of SolarWinds, said in a blog post that the allegations are a part of a “misguided and improper enforcement motion.”
For years, researchers have proven that face recognition methods, educated on hundreds of thousands of images of individuals, can misidentify ladies and folks of coloration at disproportionate charges. The methods have led to wrongful arrests. A new investigation from Politico, specializing in a 12 months’s value of face recognition requests made by police in New Orleans, has discovered that the know-how was virtually completely used to attempt to establish Black folks. The system additionally “did not establish suspects a majority of the time,” the report says. Evaluation of 15 requests for using face recognition know-how discovered that solely considered one of them was for a white suspect, and in 9 instances the know-how did not discover a match. Three of the six matches have been additionally incorrect. “The information has just about confirmed that [anti-face-recognition] advocates have been largely appropriate,” one metropolis councilor stated.
Identification administration firm Okta has revealed extra particulars about an intrusion into its methods, which it first disclosed on October 20. The corporate stated the attackers, who had accessed its buyer assist system, accessed files belonging to 134 customers. (In these cases, clients are particular person corporations that subscribe to Okta’s providers). “A few of these information have been HAR information that contained session tokens which might in flip be used for session hijacking assaults,” the corporate disclosed in a weblog put up. These session tokens have been used to “hijack” the Okta classes of 5 separate corporations. 1Password, BeyondTrust, and Cloudflare have all beforehand disclosed they detected suspicious exercise, however it’s not clear who the 2 remaining corporations are.
[ad_2]
Source
