Squire1039

Summary:

• The International Monetary Fund (IMF) detected the incident in February 2024.
• Hackers compromised 11 email accounts, but no evidence suggests access to other systems.
• The IMF uses Microsoft 365 for email and is investigating the incident with cybersecurity experts.
• This is not the first IMF cyberattack; a major breach occurred in 2011.
• Connection to recent Microsoft 365 breaches by a Russian hacking group is unclear.

Researchers presented new techniques to fight sophisticated hacking at a tech conference. Here are the highlights:

Self-destruct chips:

• A team from Vermont and Marvell created chips with unique fingerprints that can destroy themselves (through increased voltage) if tampered with. This prevents both counterfeiting and unauthorized access to information.
• Probe detection: Columbia and Intel researchers developed a circuit that detects probes attached to a circuit board, preventing hackers from gaining physical control of a system.
• Signal Obscuring: Researchers from Texas and Intel created a method to hide a chip's power and electromagnetic signals, making it harder for attackers to steal information.

These innovations could improve chip security and save businesses billions from chip counterfeiting.

Comments

NGL. After I saw "Self-destruct chips", I was just overwhelmed by Mission Impossible theme song.

https://youtu.be/PeKW0stTThk

Summary

Hackers are compromising WordPress sites to inject malicious scripts. These scripts can either steal cryptocurrency from visitors' wallets or hijack their browsers to launch brute-force attacks against other websites. The hackers are likely building a larger pool of compromised sites to launch more extensive attacks in the future.

The article discusses the mysterious nature of large language models and their remarkable capabilities, focusing on the challenges of understanding why they work. Researchers at OpenAI stumbled upon unexpected behavior while training language models, highlighting phenomena such as "grokking" and "double descent" that defy conventional statistical explanations. Despite rapid advancements, deep learning remains largely trial-and-error, lacking a comprehensive theoretical framework. The article emphasizes the importance of unraveling the mysteries behind these models, not only for improving AI technology but also for managing potential risks associated with their future development. Ultimately, understanding deep learning is portrayed as both a scientific puzzle and a critical endeavor for the advancement and safe implementation of artificial intelligence.

A trial program conducted by Pornhub in collaboration with UK-based child protection organizations aimed to deter users from searching for child abuse material (CSAM) on its website. Whenever CSAM-related terms were searched, a warning message and a chatbot appeared, directing users to support services. The trial reported a significant reduction in CSAM searches and an increase in users seeking help. Despite some limitations in data and complexity, the chatbot showed promise in deterring illegal behavior online. While the trial has ended, the chatbot and warnings remain active on Pornhub's UK site, with hopes for similar measures across other platforms to create a safer internet environment.

Summary:

• US courts have received over 130 requests from law enforcement to access push notification data from phones, reported the Washington Post.
• This data can reveal a user's location, device details, IP address, and more, even if they use encrypted messaging apps.
• This raises concerns about privacy, as prosecutors and foreign governments could potentially access this data for various reasons.
• While Apple and Google are promising more transparency regarding data requests, security experts highlight the potential for abuse by governments and marketing organizations.

Key Points:

• Push notification metadata includes information like the app receiving the notification, timestamp, and network details.
• This data is not encrypted and can be used to track user movements and activity.
• Law enforcement can use this data for investigations, but it also raises concerns about potential misuse by other parties.
• Experts recommend increased awareness about the information users share through push notifications and the potential privacy risks involved.

A security breach exposed two-factor authentication (2FA) codes/password reset links for millions of users on platforms like Facebook, Google, and TikTok.

Key Points:

• YX International, an SMS routing company, left an internal database exposed online without a password.
• The database contained one-time 2FA codes and password reset links for various tech giants.
• YX International secured the database and claims to have "sealed the vulnerability."
• The company wouldn't confirm how long the database was exposed or if anyone else accessed it.
• Representatives from Meta, Google, and TikTok haven't commented yet.

Concerns:

• This leak highlights the vulnerabilities of SMS-based 2FA compared to app-based methods.
• The lack of information regarding the leak's duration and potential access by others raises concerns.

Gemini Recommendations:

• Consider switching to app-based 2FA for increased security.
• Be cautious of suspicious communications and avoid clicking unknown links.
• Stay informed about potential security breaches affecting your online accounts.

Haha, brand new company with MD5 password hashes. Maybe they oughta consult about securities with their/other AIs more often. Hopefully, nobody did anything naughty on the site.

Other links on the story:

• https://cybernews.com/security/ai-editing-service-leaks-images-customer-data/
• https://www.hackread.com/ai-image-editing-tool-cutout-data-leak/

Scammers hacked the late actor Matthew Perry's Twitter account and posted a fake plea for cryptocurrency donations in the name of his foundation. The foundation confirmed the post was a scam and urged people not to donate.

The article details several possibilities for how the account may have been compromised, highlighting the importance of strong passwords and multi-factor authentication for securing social media accounts, especially for celebrities with large followings.

This article warns users about Android banking trojans, a type of malware that steals online banking credentials and drains accounts.

Key points:

• Prevalence: These trojans are disguised as legitimate apps and pose a serious threat to Android users, with Malwarebytes detecting over 88,500 in 2023 alone.
• Deception: They often masquerade as everyday apps like fitness trackers or QR readers or productivity or photography tools, making them difficult to identify.
• Permissions Requests: Once installed, they request permissions like accessing photos or files, but use them to steal login details.
• Sneaky Tactics: Some even hide their app icon on the home screen and download additional malware later, bypassing Google Play's security measures.
• End Goal: Their ultimate aim is to steal your banking information and use it to make unauthorized money transfers.

The article emphasizes that vigilance is crucial, as these trojans are becoming increasingly sophisticated. It also references a recent Anatsa Trojan: https://www.techradar.com/pro/security/this-nasty-new-android-malware-can-easily-bypass-google-play-security-and-its-already-been-downloaded-thousands-of-times

This article describes a new study using AI to identify sex differences in the brain with over 90% accuracy.

Key findings:

• An AI model successfully distinguished between male and female brains based on scans, suggesting inherent sex-based brain variations.
• The model focused on specific brain networks like the default mode, striatum, and limbic networks, potentially linked to cognitive functions and behaviors.
• These findings could lead to personalized medicine approaches by considering sex differences in developing treatments for brain disorders.

Additional points:

• The study may help settle a long-standing debate about the existence of reliable sex differences in the brain.
• Previous research failed to find consistent brain indicators of sex.
• Researchers emphasize that the study doesn't explain the cause of these differences.
• The research team plans to make the AI model publicly available for further research on brain-behavior connections.

Overall, the study highlights the potential of AI in uncovering previously undetectable brain differences with potential implications for personalized medicine.

Researchers at Guardio Labs discovered a vast campaign hijacking thousands of subdomains belonging to well-known brands (MSN, VMware, McAfee, The Economist, Cornell University, CBS, Marvel, eBay, etc.).

The attackers use these compromised subdomains to send millions of spammy and malicious emails daily, bypassing security measures by leveraging the trust associated with the hijacked brands.

Here's how it works:

• Attackers hijack subdomains of established brands through various methods like complex DNS manipulation and exploiting abandoned domains.
• They manipulate the hijacked subdomains' SPF records to make emails appear as if they originated from the legitimate brands.
• These emails often contain deceptive content like fake cloud storage warnings, phishing attempts, or misleading advertisements.

The campaign is alarming for several reasons:

• The scale: Over 8,000 domains have been compromised, and the number is growing.
• The potential harm: Millions of spam and malicious emails are being sent daily.