Cybersecurity is the rickety scaffolding supporting everything you do online. For every new feature or app, there are a thousand different ways it can break – and a hundred of those can be exploited by criminals for data breaches, identity theft, or outright cyber heists. Staying ahead of those exploits is a full-time job, and one of the most lucrative and sought-after skills in the tech industry. All too often, it’s something up-and-coming companies decide to skip out on, only to pay the price later on.
Eiliko and its manufacturer, Energize Lab, are seemingly not to be trusted.
SecurityWeek reports that Meta says “99% of the data the hackers took was business data, in the form of software code related to some of its products. The remaining 1% was personal data,” some of which was “synthetic or anonymized.” Most of that personal data reportedly belonged to Meta employees in the US.
The latest fear-drop from an AI lab is this report from an Anthropic team, working through scenarios where small AI models could form autonomous, self-propagating worm botnets that are “challenging” to shut down, and what to do to try and stop it from happening:
It’s uncertain exactly what form autonomous AI replication will take. It could be a slow, distributed “digital slime mold,” living on relatively insecure compute. It could also be a powerful cyber model that breaches datacenters at a high pace, or a model that scams people for compute credits.
Hackers are increasingly using vulnerable civilian cameras to track, surveil, and aid attacks on opposing military operations, with an estimated 1.2 billion internet-connected cameras impacted globally. That ranges from Iran watching through chicken coop cameras in Israel, Ukraine monitoring Russian submarines via external building surveillance, and corporate teleconferencing devices being hacked through unsecured apps.
[Wall Street Journal]
The actions Anthropic observed from its Claude AI include “Claude submitting a sensitive form on a real website when it should not have,” and the company detailed how Claude gave Philadelphia police a fake tip about an unsolved homicide.
Axios also says that, according to a State Department official, Anthropic contacted the department and said a model in testing submitted “19 non-immigrant visa applications in August and one application in May.” In a statement to Axios, the Trump administration’s Super Intelligence Force says that “SI companies must immediately disclose incidents involving their models and follow with swift, decisive action to remedy any and all harm.”
Dutch police also arrested another suspected ShinyHunters hacker following last month’s FBI breach.
[The New York Times]
As reported by BBC News, search terms like “reclaimed vintage”, “glamorous wide fit” and “Asos petite” appeared in the breached data. Asos says an “unauthorised party” accessed an Asos employee’s account by “impersonating a trusted contact,” The Guardian reports.
Earlier this week, alleged hackers sent a push notification to Asos users, warning they have “fully compromised” the UK-based clothing retailer.
The server privacy bot says hackers copied about 12GB of data, including Discord usernames and user IDs, IP addresses, location data, and email addresses. The attackers also took control of the bot’s Discord token, posted links “in about 50 large servers,” and “used a stolen payment key to commit financial fraud on a separate account.”
[Double Counter]
Reuters reports the FBI removed a contractor for failing to implement a security patch, with sources reporting it was an Accenture worker managing Oracle’s PeopleSoft platform. Last month, hacking group ShinyHunters claimed they used the HR platform to access data on “all FBI employees and applicants.”
Users of the Asos app received an unexpected notification from alleged hackers claiming to have “fully compromised” the company’s Snowflake cloud platform, linking to a Telegram channel. The alert may have only gone out to iOS users, since my partner’s Android phone never received it. Asos’ website and app still seem to be working.
The OSS VRP — which paid out for bugs found across Google’s open-source ecosystem — will be frozen until at least next year. It’s slop’s fault: the pause is down to a “significant rise” in AI submissions, “the vast majority of which are not valid.” Linux has been suffering from a similar problem.
[X (formerly Twitter)]
Advanced Protection, which launched last year as an option for people who need stronger security safeguards, will now automatically lock down a device if it detects repeated authentication failures within settings menus and apps.
This builds upon several other capabilities available with Advanced Protection, including features that block unknown USB chargers and prevent apps from abusing accessibility features.
New models are helping Big Tech shore up its cyber defenses. What about everyone else?
On Friday, OpenAI said its “misaligned models” review after the Hugging Face hack would take months, but has mostly found mundane research activity. Then it mentioned 53 incidents of the bots uploading “user-provided” images (anonymized content from personal accounts that haven’t opted out or organizations that opt in) to image-hosting sites.
Now the New York Times confirms that other unusual behavior found includes pulling public data from the Census Bureau and the SEC, while with the Education Department, it “tried to hack the website to gather data from the department’s civil rights office but failed.”
Bitget says $351.6 million in crypto was stolen by hackers on Thursday, and reportedly suspects the breach may be linked to North Korea. Meanwhile, Protos reports three other DeFi projects that posted about being hacked on Thursday, with losses totaling $7 million at Duelbits, $2.3 million at Meter, and $1.8 million at Payy Network.
The desktop version of the browser now offers an opt-in toggle to automatically enable the built-in VPN whenever you connect to a public or unsecured Wi-Fi network. Sounds like an easy way to make public Wi-Fi Russian roulette a little safer to play. It’s rolling out today in the US and France.
A new “Copy code” button is rolling out to Gmail inboxes on Android and iOS that previews authentication codes below the subject line, letting you copy them with a single tap without opening the email. It isn’t available on web, but it should make mobile logins less tedious.
According to The Washington Post, the spy agency is set to undergo its largest restructuring in over a decade. Army general and NSA director Joshua M. Rudd is leading the effort. According to the Post:
Rudd’s initiative calls for the creation at NSA’s Fort Meade, Maryland, headquarters of five new organizations inside the agency, in artificial intelligence, China, cybersecurity, combat support or warfighting, and global intelligence. Each will be led by a newly elevated “mission director” …
[The Washington Post]
Now you can move both passwords and passkeys between Google Password Manager, 1Password, Bitwarden, and Dashlane, with more password managers to come. It works at the OS level, so there’s no unencrypted text file for you to deal with on the import / export.
After OpenAI confirmed that its AI agents hijacked a German wiki as a way to communicate, Reuters reports similar incidents have occurred across at least 10 other websites. Reuters says most of the sites OpenAI agents swarmed were “obscure,” including “communally edited wikis, online text storage sites, and a pair of link shorteners run by two universities.”
As previously announced, Google has halved the release cycle for its web browser with today’s stable release of Chrome 153 on desktop, Android, and iOS. Chrome 154 Beta is now ready for testing, ahead of its stable release on September 22nd.
