Interesting

Category: Security (Page 1 of 27)

Microsoft Recall AI screenshots credit cards and Social Security numbers, even with the “sensitive information” filter enabled

Still a privacy nightmare.

Avram Piltch, writing in Tom’s Hardware »

Microsoft’s Recall feature recently made its way back to Windows Insiders after having been pulled from test builds back in June, due to security and privacy concerns. The new version of Recall encrypts the screens it captures and, by default, it has a “Filter sensitive information,” setting enabled, which is supposed to prevent it from recording any app or website that is showing credit card numbers, social security numbers, or other important financial / personal info. In my tests, however, this filter only worked in some situations (on two e-commerce sites), leaving a gaping hole in the protection it promises.

Elsewhere » The Verge | ReadWrite | Laptop Mag | TechSpot | XDA | Wired

Security research team bypasses Microsoft Azure MFA with ease

Oasis Security’s research team has uncovered a critical vulnerability in Microsoft’s Multi-Factor Authentication (MFA) implementation, allowing cyber criminals to bypass it and gain unauthorized access to the user’s account, including Outlook emails, OneDrive files, Teams chats, and Azure Cloud, and other Office 365 services.

Oasis Security report that the bypass was simple, took around an hour to execute, required no user interaction. It did not generate any notification nor provide the account holder with any indication of trouble.

Oasis Security Research team’s full report »

Elsewhere » The Hacker News | Security Week

The third party 2024 security audit of the Mullvad VPN app has concluded that the app has a high security level

Mullvad VPN AB »

Four people from X41 D-Sec performed a penetration test and source code audit of the Mullvad VPN app on all supported platforms for a total of 30 person-days. The audit was performed between 23rd October 2024 and 28th November 2024. The audit report was handed over to Mullvad on 30th November 2024.

Three quotes with key conclusions from the report:

  •     A total of six vulnerabilities were discovered during the test by X41. None were rated as having a critical severity, three as high, two as medium, and one as low. Additionally, three issues without a direct security impact were identified.
  •     Overall, the Mullvad VPN Application appear to have a high security level and are well positioned to protect from the threat model proposed in this report. The use of safe coding and design patterns in combination with regular audits and penetration tests led to a very hardened environment.
  •     In conclusion, the client applications exposed a limited number of relevant vulnerabilities. Mullvad VPN AB addressed them swiftly and the fixes were audited to be working properly.

The final report is available on X41’s website.

US Bitcoin ATM operator ‘Byte Federal’ reports security breach affecting 58K customers

Florida-based Byte Federal, the operator of 1,356 Bitcoin ATMs in the USA, is asking customers to reset login credentials following the data breach.

On December 12, 2024 Byte Federal submitted a filing with Maine’s attorney general, reporting a data breach resulting in unauthorized access to the personal data of some 58,000 customers.

Byte Federal reported it discovered the breach on November 18th, 49 days after it occurred on September 30th.

Byte Federal reported the hacker attempted to gain unauthorized access to the personal information of as many as 58,000 clients. The data included names, dates of birth, addresses, phone numbers, email addresses, government-issued IDs, social security numbers, transaction activity, and photographs of users.

Byte Federal operates 1,356 Bitcoin ATMs, accounting for 4.3% of all crypto ATMs in that country, according to data from CoinATMRadar.

Source » Cointelegraph

Researchers uncover Chinese spyware EagleMsgSpy used to target Android devices

Ravie Lakshmanan, writing for The Hacker News »

“EagleMsgSpy collects extensive data from the user: third-party chat messages, screen recording and screenshot capture, audio recordings, call logs, device contacts, SMS messages, location data, [and] network activity.”

EagleMsgSpy has been described by its developers as a “comprehensive mobile phone judicial monitoring product” that can obtain “real-time mobile phone information of suspects through network control without the suspect’s knowledge, monitor all mobile phone activities of criminals, and summarize them.”

Elsewhere » TechCrunch | Recorded Future | BleepingComputer

International operation takes down another encrypted messaging service used by criminals

A joint investigation team involving French and Dutch authorities has taken down an encrypted messaging service that went by the name Matrix. It is important at the onset to make clear that this encrypted cybercriminal communications network, has no relationship with the Matrix.org Foundation or the Matrix protocol itself.

For three months, authorities monitored the messages of possible criminals. The infrastructure consisted of more than 40 servers spread over several countries. More than 2.3 million messages in 33 languages were intercepted and deciphered during the investigation.

The messages that were intercepted are linked to serious crimes such as international drug trafficking, arms trafficking, and money laundering, according to the Europol press release.

During a coordinated operation supported by Eurojust and Europol, the messaging service was taken down by Dutch and French authorities and follow-up actions were executed by their Italian, Lithuanian, and Spanish counterparts.

Actions to take down the service and pursue serious criminals happened on December 3rd in four countries. In France, one suspect was arrested, and his house searched. In Spain, two suspects were arrested following a European Arrest Warrant from the Netherlands and six houses were searched. Six houses were searched in Lithuania. The main servers in France and Germany were taken down.

Cybercriminals using the messaging service are alerted to the interception by the authorities through a splash page. Through legal requests, authorities will now be able to access the messages for their investigations.

 

As payment fraud proliferates, governments, banks and tech companies disagree on who should cover consumer losses

Financial Times »

Audio, video and images generated by AI — so-called deepfakes — are one of the factors behind that rise. Accounting and consulting firm Deloitte estimates that AI-generated content contributed to more than $12bn in fraud losses in the US last year, and could reach $40bn by 2027.

As the problem has grown in a range of countries, so has the debate between government, banks and technology companies over who should foot the bill when the money cannot be recovered.

In the UK, the government ruled that banks are liable for up to £85,000 in losses. In Australia, more of the blame may be pinned on tech companies.

In the US, the question of who must pay remains unanswered — and is becoming politically fraught. Some senior Democrats want the banks to take more responsibility, and the Consumer Financial Protection Bureau is investigating Zelle, an account-to-account payments system owned by a consortium of large US banks which has been used by scammers.

 

« Older posts

© 2025 Downshift

Theme by Anders NorenUp ↑