Security Leftovers
-
Security Week ☛ In Other News: Crypto Exchange Hack Guilty Plea, Rating Hey Hi (AI) Vulnerabilities, Intellexa Spyware
Noteworthy stories that might have slipped under the radar: Cryptocurrency exchange hacker pleads guilty, rating LLM vulnerabilities, Intellexa spyware analysis.
-
Hong Kong Free Press ☛ Hong Kong’s privacy watchdog ‘very disappointed’ at data breach involving 2.6 million Carousell users worldwide
Hong Kong’s privacy watchdog has said it was “very disappointed” that online marketplace Carousell saw the leakage of personal data involving 2.6 million users worldwide, including more than 320,000 users in the city.
-
Bruce Schneier ☛ Data Exfiltration Using Indirect Prompt Injection
Interesting attack on a LLM:
In Writer, users can enter a ChatGPT-like session to edit or create their documents. In this chat session, the LLM can retrieve information from sources on the web to assist users in creation of their documents. We show that attackers can prepare websites that, when a user adds them as a source, manipulate the LLM into sending private information to the attacker or perform other malicious activities.
The data theft can include documents the user has uploaded, their chat history or potentially specific private information the chat model can convince the user to divulge at the attacker’s behest...
-
Security Week ☛ CISA Warns of FXC Router, QNAP NVR Vulnerabilities Exploited in the Wild
CISA released ICS advisories for FXC router and QNAP NRV flaws and added them to its known exploited vulnerabilities catalog.
-
Security Week ☛ Inmate, Staff Information Stolen in Rhode Island Prison Data Breach
The Donald W. Wyatt Detention Facility says the data of 2,000 inmates, staff, and vendors was stolen in a cyberattack.
-
SANS ☛ Python Keylogger Using Mailtrap.io, (Sat, Dec 23rd)
I found another Python keylogger... This is pretty common because Python has plenty of modules to implement this technique in a few lines of code:
-
Security Week ☛ Chameleon Android Malware Can Bypass Biometric Security
A variant of the Chameleon Android banking trojan features new bypass capabilities and has expanded its targeting area.
-
Security Week ☛ UK Teen Gets Indefinite Hospital Order For ‘Grand Theft Auto’ Hack
Arion Kurtaj was found responsible by a British court of carrying out one of the biggest breaches in the history of the video game industry
-
Security Week ☛ Iranian Hackers Targeting US Defense Industrial Base Entities With New Backdoor [Ed: It says "Microsoft has observed", but Microsoft is in fact the culprit here]
Microsoft has observed Iranian state-sponsored hackers targeting employees at US DIB entities with the FalseFont backdoor.
-
Security Week ☛ Malicious GPT Can Phish Credentials, Exfiltrate Them to External Server: Researcher
A researcher has shown how malicious actors can create custom GPTs that can phish for credentials and exfiltrate them to external servers.