Apple’s $95M Siri Settlement: What IT Security Professionals need to know
Apple has agreed to pay $95 million to resolve a class-action lawsuit alleging that Siri unintentionally recorded private conversations and shared them with third parties for targeted advertising. Background The core of the lawsuit revolves around claims that Siri was activated without the user’s explicit command, leading to unintended recordings of private conversations. Users reported […]
Read More
LDAP Nightmare: Exploiting CVE-2024-49112 in Windows Servers
A new Remote Code Execution (RCE) vulnerability has been discovered. With a CVSS score of 9.8, this vulnerability affects Windows Domain Controllers (DCs) and other Windows Servers, potentially putting organizational networks at risk. SafeBreach Labs took a deep dive, revealing a zero-click Proof of Concept (PoC) capable of crashing unpatched systems. This flaw doesn’t require […]
Read More
Chinese APT Targets U.S. Treasury via Third-Party Provider
Chinese state-sponsored hackers successfully breached the U.S. Treasury Department’s security framework this December. The breach was executed through the compromise of BeyondTrust, a trusted third-party cybersecurity service provider. By obtaining a crucial digital key, the attackers were able to override security measures, remotely access Treasury user workstations, and exfiltrate unclassified documents. Breach background The threat […]
Read More
AI Best-of-N Jailbreaking
A new study has been published that describes a novel attack method known as Best-of-N (BoN) Jailbreaking, which poses significant risks to even the most sophisticated AI models. What is BoN Jailbreaking? BoN Jailbreaking is a black-box attack method designed to exploit AI systems across various input types – text, images, and audio – without […]
Read More
Volkswagen’s bad streak: We know where your car is
Volkswagen has landed in hot water once again. A recent investigation by the Chaos Computer Club (CCC) reveals that the company has been systematically collecting and storing movement data from hundreds of thousands of vehicles across its brands (VW, Audi, Skoda, and Seat). The data, which includes detailed location information and even vehicle owner details, […]
Read More
Beware of Google Calendar Phishing Scams
Google Calendar, used by over 500 million people worldwide, has become a prime target for cyber criminals. Recently, hackers have manipulated Google tools like Calendar and Google Drawings to send phishing emails that appear to come directly from legitimate sources. These emails often include links to malicious forms or fake pages designed to steal personal […]
Read More
OSINT tools for different countries! 🌍
Discover an incredible treasure trove of Open Source Intelligence (OSINT) tools and resources tailored to specific countries around the world 🌏. Whether you’re diving into investigative reporting or tracking online footprints, this repository is a game-changer! From Argentina to Uzbekistan, and even multi-country resources, there’s something for every OSINT enthusiast 🔍. Contributors are encouraged to […]
Read More
AI/LLMs in the Service of Criminals 👾
As we witness the evolution of adversarial AI techniques, one of the most concerning developments is the use of large language models (LLMs) to obfuscate malicious JavaScript code. Recent research by Palo Alto Networks’ Unit 42 reveals how these models can rewrite existing malware at scale, bypassing traditional detection methods and posing a serious challenge […]
Read More