Geek-Guy.com

Category: Technology

Auto Added by WPeMatico

Meta confused over WhatsApp ban issued to House staffers

A notice to House offices Monday from the chamber’s chief administrative officer said that staffers are forbidden from having WhatsApp on official devices starting next week, prompting a rebuttal from the app’s parent company Meta. “The Office of Cybersecurity has deemed WhatsApp a high-risk to users due to the lack of transparency in how it…

Unusually patient suspected Russian hackers pose as State Department in ‘sophisticated’ attacks on researchers

The hackers targeting prominent researcher and Russian military expert Keir Giles were different this time.  The attackers, suspected to be working on behalf of the Russian government, had ginned up the May solicitation email for a consultation with a state.gov address, one that didn’t get a bounceback message when Giles replied. They spoke convincing English,…

Paragon spyware found on the phones of Euro journos

Researchers revealed Wednesday that they have confirmed Paragon spyware on an Apple product for the first time, on the phones of European journalists, amid an unfolding surveillance scandal in Italy. University of Toronto’s Citizen Lab published a report on its findings, which confirmed spyware on the phone of an Italian journalist named Ciro Pellegrino, following…

How Amazon Web Services uses AI to be a security ‘force multiplier’

When Amazon Web Services deploys thousands of new digital sensors around the globe, it often runs into a ruthless truth of the internet: Within minutes, the sensors are poked, prodded, and attacked. However, using large language models, the company is turning those immediate attacks into actionable security intelligence for its vast array of cloud-centered services.  …

Microsoft Patch Tuesday addresses 66 vulnerabilities, including an actively exploited zero-day

Microsoft addressed 66 vulnerabilities across its suite of products and systems, including a zero-day in WebDAV that allows unauthorized attackers to remotely execute code, the company said in its latest security update Tuesday.  The espionage group Stealth Falcon exploited the zero-day — CVE-2025-33053 — to execute malware on a defense company in Turkey in March,…

Cellebrite to acquire mobile testing firm Corellium in $200 million deal

Security technology company Cellebrite has announced plans to acquire Florida-based mobile testing startup Corellium for $170 million in cash, with an additional $20 million converted to equity at closing and the potential for $30 million more based on performance milestones. The Israel-headquartered Cellebrite, known for its forensic equipment that unlocks smartphones, said the acquisition would…

Vibe coding is here to stay. Can it ever be secure? 

Software powers the world, and soon, the bulk of the work making it may be done by machines. As generative AI tools have gotten more proficient at coding, their use in software development has exploded. Proponents say the tools have made it dramatically easier for individual entrepreneurs or companies to create the kind of slick,…

Vibe coding is here to stay. Can it ever be secure? 

Software powers the world, and soon, the bulk of the work making it may be done by machines. As generative AI tools have gotten more proficient at coding, their use in software development has exploded. Proponents say the tools have made it dramatically easier for individual entrepreneurs or companies to create the kind of slick,…

Vibe coding is here to stay. Can it ever be secure? 

Software powers the world, and soon, the bulk of the work making it may be done by machines. As generative AI tools have gotten more proficient at coding, their use in software development has exploded. Proponents say the tools have made it dramatically easier for individual entrepreneurs or companies to create the kind of slick,…

Salesforce customers duped by series of social-engineering attacks

A financially motivated threat group posing as IT support has intruded the systems of about 20 organizations by duping employees into installing a malicious, illegitimate version of Salesforce’s Data Loader and granting broader access to cloud-based environments, Google Threat Intelligence Group said in a threat report released Wednesday. The attacks, which Google attributes to UNC6040,…

Salesforce customers duped by series of social-engineering attacks

A financially motivated threat group posing as IT support has intruded the systems of about 20 organizations by duping employees into installing a malicious, illegitimate version of Salesforce’s Data Loader and granting broader access to cloud-based environments, Google Threat Intelligence Group said in a threat report released Wednesday. The attacks, which Google attributes to UNC6040,…

Salesforce customers duped by series of social-engineering attacks

A financially motivated threat group posing as IT support has intruded the systems of about 20 organizations by duping employees into installing a malicious, illegitimate version of Salesforce’s Data Loader and granting broader access to cloud-based environments, Google Threat Intelligence Group said in a threat report released Wednesday. The attacks, which Google attributes to UNC6040,…

Google addresses 34 high-severity vulnerabilities in June’s Android security update

Google’s June security update for Android devices contains 34 vulnerabilities, all of which the company designates as high-severity defects. The company didn’t disclose any actively exploited vulnerabilities. Attackers could exploit the most serious flaw — CVE-2025-26443 affecting the Android system — to achieve local escalation of privilege with no additional privileges required. Google said exploitation…

Google addresses 34 high-severity vulnerabilities in June’s Android security update

Google’s June security update for Android devices contains 34 vulnerabilities, all of which the company designates as high-severity defects. The company didn’t disclose any actively exploited vulnerabilities. Attackers could exploit the most serious flaw — CVE-2025-26443 affecting the Android system — to achieve local escalation of privilege with no additional privileges required. Google said exploitation…

Google addresses 34 high-severity vulnerabilities in June’s Android security update

Google’s June security update for Android devices contains 34 vulnerabilities, all of which the company designates as high-severity defects. The company didn’t disclose any actively exploited vulnerabilities. Attackers could exploit the most serious flaw — CVE-2025-26443 affecting the Android system — to achieve local escalation of privilege with no additional privileges required. Google said exploitation…

Future-ready cybersecurity: Lessons from the MITRE CVE crisis

The recent funding crisis surrounding MITRE’s Common Vulnerabilities and Exposures (CVE) program was more than just a bureaucratic hiccup — it was a wake-up call for an industry that has relied on CVEs for years to identify, categorize, and prioritize vulnerabilities. Out of the blue, we discovered the foundation was suddenly at risk. Worse still,…

Future-ready cybersecurity: Lessons from the MITRE CVE crisis

The recent funding crisis surrounding MITRE’s Common Vulnerabilities and Exposures (CVE) program was more than just a bureaucratic hiccup — it was a wake-up call for an industry that has relied on CVEs for years to identify, categorize, and prioritize vulnerabilities. Out of the blue, we discovered the foundation was suddenly at risk. Worse still,…

Future-ready cybersecurity: Lessons from the MITRE CVE crisis

The recent funding crisis surrounding MITRE’s Common Vulnerabilities and Exposures (CVE) program was more than just a bureaucratic hiccup — it was a wake-up call for an industry that has relied on CVEs for years to identify, categorize, and prioritize vulnerabilities. Out of the blue, we discovered the foundation was suddenly at risk. Worse still,…

OpenAI’s Pitch to Trump: Rank the World on U.S. Tech Interests

OpenAI has always said it’s a different kind of Big Tech titan, founded not just to rack up a stratospheric valuation of $400 billion (and counting), but also to “ensure that artificial general intelligence benefits all of humanity.”  The meteoric machine-learning firm announced itself to the world in a December 2015 press release that lays…

OpenAI’s Pitch to Trump: Rank the World on U.S. Tech Interests

OpenAI has always said it’s a different kind of Big Tech titan, founded not just to rack up a stratospheric valuation of $400 billion (and counting), but also to “ensure that artificial general intelligence benefits all of humanity.”  The meteoric machine-learning firm announced itself to the world in a December 2015 press release that lays…

OpenAI’s Pitch to Trump: Rank the World on U.S. Tech Interests

OpenAI has always said it’s a different kind of Big Tech titan, founded not just to rack up a stratospheric valuation of $400 billion (and counting), but also to “ensure that artificial general intelligence benefits all of humanity.”  The meteoric machine-learning firm announced itself to the world in a December 2015 press release that lays…

FCC looking to expand anti-robocalling initiative 

Federal Communications Commission Chair Brendan Carr told Congress the agency is looking to expand the use of call authentication protocols that help crack down on robocalling more broadly, while floating the possibility that he may ask for enhanced authorities to take bad actors to court for AI-generated deepfakes over telephone and broadcast networks. While testifying…

Microsoft Says It’s Censoring Employee Emails Containing the Word “Palestine”

Following multiple employee-led protests against the company’s contracts with the Israeli military, Microsoft workers discovered that any emails they send containing the word “Palestine” inexplicably disappear. According to internal communications reviewed by The Intercept, employees on Wednesday began noticing that email messages sent from their company account containing a handful of keywords related to Palestine…

U.S. Spy Agencies Are Getting a One-Stop Shop to Buy Your Most Sensitive Personal Data

The ever-growing market for personal data has been a boon for American spy agencies. The U.S. intelligence community is now buying up vast volumes of sensitive information that would have previously required a court order, essentially bypassing the Fourth Amendment. But the surveillance state has encountered a problem: There’s simply too much data on sale…

Appeals court rejects attempt by Khashoggi widow to renew suit against NSO Group

An appeals court on Wednesday rejected a bid by the widow of murdered Washington Post journalist Jamal Khashoggi to revive a lawsuit against spyware maker NSO Group, whom she alleged played a role in her husband’s death. The U.S. District Court for the Eastern District of Virginia had dismissed the suit from Hanan Elatr Khashoggi,…

Massachusetts man will plead guilty in PowerSchool hack case

A Massachusetts man will plead guilty to charges related to the hack of PowerSchool, the education software vendor that says it supports more than 60 million students, and that led to ransom demands at school boards and districts across the United States. In court documents filed Tuesday, prosecutors spelled out charges against 19-year-old Assumption University…

Google Worried It Couldn’t Control How Israel Uses Project Nimbus, Files Reveal

Before signing its lucrative and controversial Project Nimbus deal with Israel, Google knew it couldn’t control what the nation and its military would do with the powerful cloud-computing technology, a confidential internal report obtained by The Intercept reveals. The report makes explicit the extent to which the tech giant understood the risk of providing state-of-the-art…

Facebook Flaws and Privacy Laws: A Journey into Early Social Media Security from 2009

Join hosts Tom Eston, Scott Wright, and Kevin Johnson in a special best-of episode of the Shared Security Podcast. Travel back to 2009 with the second-ever episode featuring discussions on early Facebook bugs, cross-site scripting vulnerabilities, and a pivotal Canadian privacy ruling involving Facebook. Gain insights into social media security from the past and see…

SonicWall customers confront resurgence of actively exploited vulnerabilities

Vulnerabilities are proliferating in SonicWall devices and software this year, putting the vendor’s customers at risk of intrusion via secure access gateways and firewalls. The year started off on a sour note for the California-based company when it released security advisories for nine vulnerabilities on Jan. 7. The total number of vulnerabilities publicly disclosed by…

Democrats Woke Up to Trump’s Crypto Grift. Will They Stop Other Scammers?

Cryptocurrency legislation once seemed to be the rare issue that could draw bipartisan support in Donald Trump’s Washington, thanks to the industry’s prolific donations on both sides of the aisle. Then Trump and his family attempted to monetize the presidency through a meme coin and a $2 billion crypto deal involving an Abu Dhabi-backed venture…

CrowdStrike cuts 5% of workforce after revenue jumped 29% last year

CrowdStrike is cutting 5% of its workforce, about 500 positions, telling its staff that it’s shifting resources and realigning its operating model for growth in new market segments, according to a Wednesday filing with the Securities and Exchange Commission. The company is slashing headcount following a year of significant growth in a strong market. CrowdStrike’s revenue…

NSO Group owes $168M in damages to WhatsApp over spyware infections, jury says

A federal jury decided Tuesday that NSO Group must pay WhatsApp approximately $168 million in damages after a judge ruled that it violated anti-hacking laws when 1,400 of the messaging application’s users became infected with Pegasus spyware. It’s the latest in a series of wins in court for WhatsApp in its pioneering lawsuit that has produced…

Google addresses 1 actively exploited vulnerability in May’s Android security update

Google addressed 47 vulnerabilities affecting Android devices in its May security update, including an actively exploited software defect that was first disclosed in March. Google said the high-severity vulnerability, CVE-2025-27363, “may be under limited, targeted exploitation.” The out-of-bounds write defect in FreeType versions 2.13.0 and below may result in arbitrary code execution, Facebook said in…

Amazon, CrowdStrike, Google and Palo Alto Networks claim no change to threat intel sharing under Trump

SAN FRANCISCO — Threat intelligence sharing is flowing between the private sector and federal government and remains unimpeded thus far by job losses and budget cuts across federal agencies that support the cyber mission, according to executives at major security firms. Top brass at Amazon, CrowdStrike, Google and Palo Alto Networks said there’s been no…

Quantum computer threat spurring quiet overhaul of internet security

SAN FRANCISCO — Cryptography experts say the race to fend off future quantum-computer attacks has entered a decisive but measured phase, with companies quietly replacing the internet plumbing that the majority of the industry once considered unbreakable. Speaking at Cloudflare’s Trust Forward Summit on Wednesday, encryption leaders at IBM Research, Amazon Web Services and Cloudflare…

North Korean operatives have infiltrated hundreds of Fortune 500 companies

SAN FRANCISCO — North Korean nationals have infiltrated the employee ranks at top global companies more so than previously thought, maintaining a pervasive and potentially widening threat against IT infrastructure and sensitive data. “There are hundreds of Fortune 500 organizations that have hired these North Korean IT workers,” Mandiant Consulting CTO Charles Carmakal said Tuesday…

Trump’s Auto Tariff Relief “Helps Tesla a Lot” — Leaving Other Carmakers Behind

Donald Trump’s latest adjustment to automobile tariffs were billed as relief for the Big Three carmakers, but a leading analyst said Wednesday that Elon Musk’s Tesla will benefit most while others will be stuck “in quicksand” — potentially creating a slight advantage for a company whose CEO donated nearly $300 million to Trump and other…

U.S. Companies Honed Their Surveillance Tech in Israel. Now It’s Coming Home.

Illustration: The Intercept In partnership with Rita Murad, a 21-year-old Palestinian citizen of Israel and student at the Technion Israel Institute of Technology, was arrested by Israeli authorities in November 2023 after sharing three Instagram stories on the morning of October 7. The images included a picture of a bulldozer breaking through the border fence in Gaza…

House passes legislation to criminalize nonconsensual deepfakes

The House passed a bill Monday evening that would criminalize using a person’s likeness to create nonconsensual deepfake pornography. The Take It Down Act sailed through the chamber on a vote of 402-2, marking one of the first major pieces of legislation passed by Congress to address AI-generated deepfakes. The bill makes it a federal…

AI Firm Behind Mysterious Trump Donation Is Run by Alleged Election Overthrow Plotter

An obscure nonprofit group that gave $100,000 to Donald Trump’s inaugural committee was bankrolled by an artificial intelligence company whose CEO was an unindicted co-conspirator in Trump’s election interference case in Georgia, the company’s president confirmed to The Intercept. Unlike more established megadonors such as Boeing or the Heritage Foundation, however, the Institute for Criminal…

Judge limits evidence about NSO Group customers, victims in damages trial

A federal judge last week placed strict limits on the kind of evidence NSO Group can raise during a trial on damages in the lawsuit WhatsApp brought against the spyware vendor over allegations it hacked 1,400 of the messaging platform’s users. Under the order, NSO Group is prohibited from presenting evidence about its customers’ identities,…

Multiple top CISA officials behind ‘Secure by Design’ resign 

Two top officials at the Cybersecurity and Infrastructure Security Agency who worked with the private sector to manufacture secure products and technology are leaving the agency. Bob Lord, senior technical adviser and Lauren Zabierek, senior advisor at CISA, were both chief architects behind CISA’s Secure by Design initiative, which garnered voluntary commitments from major vendors…

House investigation into DeepSeek teases out funding, security realities around Chinese AI tool

A House panel has concluded that the U.S. government should double down on export controls and other tools to slow down the progress of Chinese AI companies like DeepSeek, while also preparing for a future where those efforts fail. In a report released Wednesday, the House Select Committee on the Chinese Communist Party further fleshes…

35 countries use Chinese networks for transporting mobile user traffic, posing cyber risks

U.S. allies are among the 35 countries where mobile providers employ China-based networks for transporting user traffic, opening travelers and residents in those nations to potential surveillance, an analysis published Thursday concludes. “Everyone knows that they have to be careful with their phones when they travel to China,” Rocky Cole, chief operating officer at iVerify,…

Is Ivanti the problem or a symptom of a systemic issue with network devices?

Network edge devices — hardware that powers firewalls, VPNs and network routers — have quickly moved up the list of attackers’ preferred intrusion points into enterprise networks. While dozens of companies make and sell these devices, customers of one company in particular — Ivanti — have confronted exploited vulnerabilities in their products more than any…

Judges strike skeptical note of NSO Group’s argument to dismiss case from El Salvadoran journos

A panel of U.S. judges considering an appeal of a ruling that went against El Salvadoran journalists suing NSO Group over alleged infections of their phone by the company’s Pegasus spyware appeared more skeptical Thursday of the vendor’s arguments than those of the reporters. Judge James Donato of the District Court for the Northern District…

Google addresses 2 actively exploited vulnerabilities in security update

Google addressed 62 vulnerabilities affecting Android devices in its April security update, including a pair of actively exploited software defects that were first disclosed in December. Google said the two vulnerabilities — CVE-2024-53197 and CVE-2024-53150 — “may be under limited, targeted exploitation.” The pair of flaws under active exploitation are high-severity and affect the Linux…

Voluntary ‘Pall Mall Process’ seeks to curb spyware abuses

Twenty-one nations signed on to a voluntary accord last week in Paris to govern the use of commercial hacking tools commonly known as spyware, after more than a year of work on the agreement. The Pall Mall Process, or Code of Practices for States, has four pillars for the responsible use of the surveillance tech,…

The 23andMe Collapse, Signal Gate Fallout

In this episode, we discuss the urgent need to delete your DNA data from 23andMe amid concerns about the company’s potential collapse and lack of federal protections for your personal information. Kevin joins the show to give his thoughts on the Signal Gate scandal involving top government officials, emphasizing the potential risks and lack of…

Google Is Helping the Trump Administration Deploy AI Along the Mexican Border

Five years after Google Cloud CEO Thomas Kurian assured employees that the company was “not working on any projects associated with immigration enforcement at the southern border,” federal contract documents reviewed by The Intercept show that the tech giant is at the center of project to upgrade the so-called virtual wall. U.S. Customs and Border…

Independent tests show why orgs should use third-party cloud security services

Businesses don’t always get what they pay for in cybersecurity. Some of the most expensive cloud network firewall vendors are among the worst performers against exploits and evasions, according to the most comprehensive, independent testing CyberRatings.org has conducted to date. Cisco, by far the most expensive cloud network firewall offering across the top 10 vendors…

Apple issues fixes for vulnerabilities in both old and new OS versions

Apple released security updates Monday to address software defects in the latest version of the company’s Safari browser and other applications across iOS, iPadOS and macOS.  The security issues addressed across the latest versions of Apple’s most popular platforms include 62 vulnerabilities affecting iOS 18.4 and iPadOS 18.4, 131 vulnerabilities affecting macOS Sequoia 15.4 and…

Understanding Privacy Changes: eBay’s AI Policy and The Future of Data Privacy

In this episode, host Tom Eston discusses recent privacy changes on eBay related to AI training and the implications for user data. He highlights the hidden opt-out feature for AI data usage and questions the transparency of such policies, especially in regions without strict privacy laws like the United States. The host also explores how…

Commerce limits 19 Chinese, Taiwanese companies from buying U.S. tech

The Commerce Department plans to finalize economic sanctions this week on nearly 20 Chinese and Taiwanese organizations, citing the need to limit their access to U.S. cloud, artificial intelligence and quantum computing technologies. The sanctions, which will be detailed and published Friday in the Federal Register , would place additional license requirements on, and limit…

U.S. Officials Called Signal a Tool for Terrorists and Criminals. Now They’re Using It.

For years, U.S. officials villainized end-to-end encrypted messaging apps like Signal as the domain of criminals and terrorists and a threat to national security. As fallout over a Signal group chat about Yemen war plans ricocheted through Washington, however, CIA Director John Ratcliffe revealed at a Senate Intelligence Committee hearing on Tuesday that the app…

From Spreadsheets to Solutions: How PlexTrac Enhances Security Workflows

In this special episode of the Shared Security Podcast, join Tom Eston and Dan DeCloss, CTO and founder of PlexTrac, as they discuss the challenges of data overload in vulnerability remediation. Discover how PlexTrac addresses these issues by integrating various data sources, providing customized risk scoring, and enhancing remediation workflows. The episode offers an insightful…

FCC’s Carr alleges Chinese companies are making ‘end run’ around Chinese telecom bans, announces investigation 

The first initiative from The Federal Communications Commission’s newly-created Council on National Security will be a “sweeping” investigation of Chinese-made equipment in America’s telecommunications infrastructure, the agency announced Friday. In particular, FCC Commissioner Brendan Carr said the focus will be on equipment and services from Chinese companies already barred from U.S. networks under the Secure…

Musk Is Firing Federal Workers Who Prevent Bloated Tech Contracts

Earlier this month, all of the employees at 18F, a unit of government technologists under the General Services Administration, awoke to a surprise.  The entire department — which helps build, buy, and share technological products across government agencies — discovered they’d been placed on administrative leave.  18F, named after its headquarters at 18th and F…

DEA Insiders Warned About Legality of Phone Tracking Program. Their Concerns Were Kept Secret.

When the Drug Enforcement Administration’s access to a secret trove of billions of American phone records was exposed in 2013, the Obama administration said the data had been collected under a perfectly legal program. Civil liberties advocates, however, were not convinced about that the data collection program — which let the DEA see who you…

Cloudflare rolls out post-quantum encryption for enterprise users

Internet security company Cloudflare, the world’s largest DDoS-mitigation service, plans to shift a sizable chunk of its traffic through post-quantum encrypted services over the next year. Approximately 35% of human-directed web traffic to Cloudflare’s network is currently protected through advanced encryption algorithms. These algorithms are theoretically designed to withstand attacks from significantly  more powerful quantum…

Tackling Data Overload: Strategies for Effective Vulnerability Remediation

In part one of our three part series with PlexTrac, we address the challenges of data overload in vulnerability remediation. Tom hosts Dahvid Schloss, co-founder and course creator at Emulated Criminals, and Dan DeCloss, CTO and founder of PlexTrac. They share their expertise on the key data and workflow hurdles that security teams face today.…

Are your iPhone or MacBook hacked?

Understanding Common Misconceptions Digital security is a growing concern, and many Apple users suspect their iPhones or MacBooks have been hacked. However, in most cases, these fears stem from new features, security alerts, or misinterpretations of system behaviour rather than actual cyberattacks. This article explores common reasons why people believe their Apple devices are compromised…

Are your iPhone or MacBook hacked?

Understanding Common Misconceptions Digital security is a growing concern, and many Apple users suspect their iPhones or MacBooks have been hacked. However, in most cases, these fears stem from new features, security alerts, or misinterpretations of system behaviour rather than actual cyberattacks. This article explores common reasons why people believe their Apple devices are compromised…

Apple discloses zero-day vulnerability, releases emergency patches

Apple released emergency software patches Tuesday that address a newly identified zero-day vulnerability in the company’s WebKit web browser engine.  Tracked as CVE-2025-24201, an attacker can potentially escape the constraints of Webkit’s Web Content sandbox, potentially leading to unauthorized actions. The sandbox is a security feature that isolates untrusted web content in order to prevent…

New York sues Allstate and subsidiaries for back-to-back data breaches

Allstate and several of the insurance company’s subsidiaries were accused of poor security practices resulting in data breaches in 2020 and 2021 that exposed sensitive data on nearly 200,000 people, the New York State Attorney General office said in a lawsuit filed Monday.  National General, an insurance company Allstate acquired for $4 billion in 2021,…

WordPress Appliance - Powered by TurnKey Linux