Schneier on Security

NOVEMBER 8, 2024

The Open Source Initiative has published (news article here ) its definition of “open source AI,” and it’s terrible. It allows for secret training data and mechanisms. It allows for development to be done in secret.

Artificial Intelligence 336

Artificial Intelligence 336

Schneier on Security

JULY 15, 2024

These details are stored as metadata, not visible in the article’s text directly, but assigned to a digital object identifier, or DOI—a unique identifier for each scientific publication. The result?

Hacking 348

Hacking 348

Joseph Steinberg

DECEMBER 21, 2024

While there is little doubt that the elected officials hope to protect children with the aforementioned act, the reality is that - as Australia has already learned in a previous case described in the article - the new law is more likely to make children less safe than more safe.

Media 277

Media Risk Artificial Intelligence Government 277

Schneier on Security

FEBRUARY 6, 2025

The first clip is an AI-generated “podcast” of this article made by Google’s NotebookLM featuring two AI “hosts.” ” Google’s NotebookLM created the podcast script and audio given only the text of this article.

Technology 247

Technology Scams 247

Schneier on Security

NOVEMBER 11, 2021

ArsTechnica’s Sean Gallagher has a two - part article on “securing your digital life.” ” It’s pretty good.

Risk 354

Risk Cybersecurity 354

Schneier on Security

JULY 31, 2024

News articles. Cloudflare reports on the state of applications security. It claims that 6.8% of Internet traffic is malicious. And that CVEs are exploited as quickly as 22 minutes after proof-of-concepts are published.

Internet 331

Internet Internet Malware 331

Schneier on Security

NOVEMBER 10, 2023

Article based on a Mozilla report.

329

329

Schneier on Security

AUGUST 27, 2024

Ars Technica has a good article on what’s happening in the world of television surveillance. More than even I realized.

Surveillance 312

Surveillance 312

Schneier on Security

OCTOBER 27, 2021

Vice has a detailed article about how the FBI gets data from cell phone providers like AT&T, T-Mobile, and Verizon, based on a leaked (I think) 2019 139-page presentation.

Mobile 346

Mobile Surveillance 346

Schneier on Security

SEPTEMBER 17, 2021

News articles on the exploit. Citizen Lab released a report on a zero-click iMessage exploit that is used in NSO Group’s Pegasus spyware. Apple patched the vulnerability; everyone needs to update their OS immediately.

Spyware 350

Spyware 350

Schneier on Security

APRIL 11, 2023

News articles. Car thieves are injecting malicious software into a car’s network through wires in the headlights (or taillights) that fool the car into believing that the electronic key is nearby.

Hacking 338

Hacking Software Malware 338

Security Boulevard

JANUARY 14, 2025

In this article, we touch on the trends and predictions that in the year 2025 and beyond will fashion cloud security. The post Future-Proofing Cloud Security: Trends and Predictions for 2025 and Beyond appeared first on Security Boulevard.

Threat Detection 118

Threat Detection Architecture Cybersecurity 118

Schneier on Security

DECEMBER 8, 2023

news articles. New attack breaks forward secrecy in Bluetooth. The vulnerability has been around for at least a decade.

Authentication 322

Authentication 322

Schneier on Security

JANUARY 20, 2023

From an article about Zheng Xiaoqing, an American convicted of spying for China: According to a Department of Justice (DOJ) indictment, the US citizen hid confidential files stolen from his employers in the binary code of a digital photograph of a sunset, which Mr Zheng then mailed to himself.

347

347

Schneier on Security

MAY 24, 2024

This Article accounts for and critiques these failures, providing a socio-technical history since 2014, particularly focusing on the conversation about trade in zero-day vulnerabilities and exploits. Second, this Article applies lessons from these failures to guide regulatory efforts going forward.

Marketing 325

Marketing Spyware Surveillance Government 325

Schneier on Security

JANUARY 30, 2024

News article. GCHQ has released new images of the WWII Colossus code-breaking computer, celebrating the machine’s eightieth anniversary (birthday?).

316

316

Adam Shostack

JANUARY 2, 2025

Theres a good article on the UKs National Cyber Security Centre blog, Telling users to avoid clicking bad links still isnt working. Almost the entire article is excellent, but theres a fly in the ointment, and that is a sentence which starts out well: Firstly, because one of the above controls may fail, and so defence in depth is always good.

Phishing 130

Phishing Accountability 130

Schneier on Security

JANUARY 30, 2024

Some news articles. It finally admitted to buying bulk data on Americans from data brokers, in response to a query by Senator Weyden. This is almost certainly illegal, although the NSA maintains that it is legal until it’s told otherwise.

Surveillance 328

Surveillance Data collection Data privacy 328

Schneier on Security

JULY 2, 2024

This article about an app that lets people remotely view bars to see if they’re crowded or not is filled with commentary—on both sides—about privacy and openness.

Surveillance 290

Surveillance 290

Schneier on Security

OCTOBER 3, 2023

No details in the article, but it seems that it’s easy to take control of the pump and have it dispense gas without requiring payment. Turns out pumps at gas stations are controlled via Bluetooth, and that the connections are insecure. It’s a complicated crime to monetize, though.

Hacking 342

Hacking 342

Security Affairs

OCTOBER 13, 2024

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape. Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape. Over 300,000!

Malware 123

Malware DDOS Cryptocurrency Education 123

Schneier on Security

APRIL 24, 2024

Law professor Dan Solove has a new article on privacy regulation. In his email to me, he writes: “I’ve been pondering privacy consent for more than a decade, and I think I finally made a breakthrough with this article.” ” His mini-abstract: In this Article I argue that most of the time, privacy consent is fictitious.

Data collection 315

Data collection Risk 315

Schneier on Security

OCTOBER 19, 2021

The article doesn’t contain a link to the original research. This works even if the person is covering the pad with their hands. If someone knows it, please put it in the comments. Slashdot thread.

352

352

Schneier on Security

MAY 4, 2021

News article. It would be possible for an attacker to unlock the doors and trunk, change seat positions, both steering and acceleration modes — in short, pretty much what a driver pressing various buttons on the console can do. This attack does not yield drive control of the car though. That last sentence is important.

Hacking 363

Hacking Software 363

Schneier on Security

OCTOBER 28, 2024

It has more ATMs than other European countries, and—if I read the article right—they have more money in them. It’s low tech , but effective. Why Germany?

Banking 273

Banking 273

Schneier on Security

JULY 29, 2022

Yet another article about cyber-weapons arms manufacturers and their particular supply chain. This one is about Windows and Adobe Reader zero-day exploits sold by an Austrian company named DSIRF. There’s an entire industry devoted to undermining all of our security. It needs to be stopped.

Manufacturing 311

Manufacturing 311

Schneier on Security

APRIL 12, 2023

News article. Carry your own charger and USB cord and use an electrical outlet instead. How much of a risk is this, really? I am unconvinced, although I do carry a USB condom for charging stations I find suspicious.

Malware 346

Malware Software Risk 346

Schneier on Security

AUGUST 25, 2021

Vice has an article about how data brokers sell access to the Internet backbone. This is netflow data. It’s useful for cybersecurity forensics, but can also be used for things like tracing VPN activity. At a high level, netflow data creates a picture of traffic flow and volume across a network.

Internet 363

Internet Internet Surveillance VPN 363

Security Affairs

OCTOBER 20, 2024

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape. Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape.

Malware 124

Malware Ransomware Encryption Phishing 124

Schneier on Security

MARCH 6, 2025

Interesting article —with photos!—of —of the US/UK “Combined Cipher Machine” from WWII.

224

224

Schneier on Security

OCTOBER 20, 2021

The article doesn’t link to the indictment, so I don’t know how they were discovered. They used gift cards and prepaid credit cards to buy the books, so there was no available balance when Amazon tried to charge them the buyout price for non-returned books. In all, they stole 14,000 textbooks worth over $1.5

Scams 341

Scams 341

Schneier on Security

APRIL 25, 2022

I am not getting the “Fedex package delivered” messages the article talks about. SMS phishing attacks — annoyingly called “smishing” — are becoming more common. I know that I have been receiving a lot of phishing SMS messages over the past few months.

Phishing 318

Phishing 318

Schneier on Security

JULY 10, 2024

News article. This forgery could give the attacker access to network devices and services without the attacker guessing or brute forcing passwords or shared secrets. The attacker does not learn user credentials. This is one of those vulnerabilities that comes with a cool name, its own website, and a logo. Research paper.

Authentication 302

Authentication Passwords 302

Schneier on Security

JANUARY 25, 2024

Interesting article. I am also skeptical that we are going to see useful quantum computers anytime soon. Since at least 2019, I have been saying that this is hard. And that we don’t know if it’s “land a person on the surface of the moon” hard, or “land a person on the surface of the sun” hard.

318

318

Graham Cluley

OCTOBER 17, 2024

Read more in my article on the Tripwire State of Security blog. And boy do we need some good news - amid reports that 389 US-based healthcare institutions were hit by ransomware last year - more than one every single day.

Ransomware 114

Ransomware Encryption Healthcare Data breaches 114

Schneier on Security

FEBRUARY 27, 2024

Lots of details in the news articles. Last week, someone posted something like 570 files, images and chat logs from a Chinese company called I-Soon. I-Soon sells hacking and espionage services to Chinese national and local government. These aren’t details about the tools or techniques, more the inner workings of the company.

Surveillance 308

Surveillance Hacking Government 308

Schneier on Security

MARCH 5, 2025

News article. Of the five , one is a Windows vulnerability, another is a Cisco vulnerability. We don’t have any details about who is exploiting them, or how. Slashdot thread.

224

224