Category: Uncategorized
-
New Cryptanalysis of the Fiat-Shamir Protocol
New Cryptanalysis of the Fiat-Shamir Protocol A couple of months ago, a new paper demonstrated some new attacks against the Fiat-Shamir transformation. Quanta published a good article that explains the results. This is a pretty exciting paper from a theoretical perspective, but I don’t see it leading to any practical real-world cryptanalysis. The fact that…
-
AI in Government
AI in Government Just a few months after Elon Musk’s retreat from his unofficial role leading the Department of Government Efficiency (DOGE), we have a clearer picture of his vision of government powered by artificial intelligence, and it has a lot more to do with consolidating power than benefitting the public. Even so, we must…
-
Signed Copies of Rewiring Democracy
Signed Copies of Rewiring Democracy When I announced my latest book last week, I forgot to mention that you can pre-order a signed copy here. I will ship the books the week of 10/20, when it is published. Bruce Schneier Go to bruce schneier
-
My Latest Book: Rewiring Democracy
My Latest Book: Rewiring Democracy I am pleased to announce the imminent publication of my latest book, Rewiring Democracy: How AI will Transform our Politics, Government, and Citizenship: coauthored with Nathan Sanders, and published by MIT Press on October 21. Rewiring Democracy looks beyond common tropes like deepfakes to examine how AI technologies will affect…
-
Friday Squid Blogging: The Origin and Propagation of Squid
Friday Squid Blogging: The Origin and Propagation of Squid New research (paywalled): Editor’s summary: Cephalopods are one of the most successful marine invertebrates in modern oceans, and they have a 500-million-year-old history. However, we know very little about their evolution because soft-bodied animals rarely fossilize. Ikegami et al. developed an approach to reveal squid fossils,…
-
Generative AI as a Cybercrime Assistant
Generative AI as a Cybercrime Assistant Anthropic reports on a Claude user: We recently disrupted a sophisticated cybercriminal that used Claude Code to commit large-scale theft and extortion of personal data. The actor targeted at least 17 distinct organizations, including in healthcare, the emergency services, and government and religious institutions. Rather than encrypt the stolen…
-
Indirect Prompt Injection Attacks Against LLM Assistants
Indirect Prompt Injection Attacks Against LLM Assistants Really good research on practical attacks against LLM agents. “Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous” Abstract: The growing integration of LLMs into applications has introduced new security risks, notably known as Promptware—maliciously engineered prompts designed to manipulate LLMs…
-
1965 Cryptanalysis Training Workbook Released by the NSA
1965 Cryptanalysis Training Workbook Released by the NSA In the early 1960s, National Security Agency cryptanalyst and cryptanalysis instructor Lambros D. Callimahos coined the term “Stethoscope” to describe a diagnostic computer program used to unravel the internal structure of pre-computer ciphertexts. The term appears in the newly declassified September 1965 document Cryptanalytic Diagnosis with the…
-
Baggage Tag Scam
Baggage Tag Scam I just heard about this: There’s a travel scam warning going around the internet right now: You should keep your baggage tags on your bags until you get home, then shred them, because scammers are using luggage tags to file fraudulent claims for missing baggage with the airline. First, the scam is…
-
Friday Squid Blogging: Catching Humboldt Squid
Friday Squid Blogging: Catching Humboldt Squid First-person account of someone accidentally catching several Humboldt squid on a fishing line. No photos, though. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. Bruce Schneier Go to bruce schneier
-
The UK May Be Dropping Its Backdoor Mandate
The UK May Be Dropping Its Backdoor Mandate The US Director of National Intelligence is reporting that the UK government is dropping its backdoor mandate against the Apple iPhone. For now, at least, assuming that Tulsi Gabbard is reporting this accurately. Bruce Schneier Go to bruce schneier
-
We Are Still Unable to Secure LLMs from Malicious Inputs
We Are Still Unable to Secure LLMs from Malicious Inputs Nice indirect prompt injection attack: Bargury’s attack starts with a poisoned document, which is shared to a potential victim’s Google Drive. (Bargury says a victim could have also uploaded a compromised file to their own account.) It looks like an official document on company meeting…
-
Encryption Backdoor in Military/Police Radios
Encryption Backdoor in Military/Police Radios I wrote about this in 2023. Here’s the story: Three Dutch security analysts discovered the vulnerabilities—five in total—in a European radio standard called TETRA (Terrestrial Trunked Radio), which is used in radios made by Motorola, Damm, Hytera, and others. The standard has been used in radios since the ’90s, but…
-
Poor Password Choices
Poor Password Choices Look at this: McDonald’s chose the password “123456” for a major corporate system. Bruce Schneier Go to bruce schneier
-
AI Agents Need Data Integrity
AI Agents Need Data Integrity Think of the Web as a digital territory with its own social contract. In 2014, Tim Berners-Lee called for a “Magna Carta for the Web” to restore the balance of power between individuals and institutions. This mirrors the original charter’s purpose: ensuring that those who occupy a territory have a…
-
I’m Spending the Year at the Munk School
I’m Spending the Year at the Munk School This academic year, I am taking a sabbatical from the Kennedy School and Harvard University. (It’s not a real sabbatical—I’m just an adjunct—but it’s the same idea.) I will be spending the Fall 2025 and Spring 2026 semesters at the Munk School at the University of Toronto.…
-
Friday Squid Blogging: Bobtail Squid
Friday Squid Blogging: Bobtail Squid Nice short article on the bobtail squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. Bruce Schneier Go to bruce schneier
-
Jim Sanborn Is Auctioning Off the Solution to Part Four of the Kryptos Sculpture
Jim Sanborn Is Auctioning Off the Solution to Part Four of the Kryptos Sculpture Well, this is interesting: The auction, which will include other items related to cryptology, will be held Nov. 20. RR Auction, the company arranging the sale, estimates a winning bid between $300,000 and $500,000. Along with the original handwritten plain text…
-
Subverting AIOps Systems Through Poisoned Input Data
Subverting AIOps Systems Through Poisoned Input Data In this input integrity attack against an AI system, researchers were able to fool AIOps tools: AIOps refers to the use of LLM-based agents to gather and analyze application telemetry, including system logs, performance metrics, traces, and alerts, to detect problems and then suggest or carry out corrective…
-
Zero-Day Exploit in WinRAR File
Zero-Day Exploit in WinRAR File A zero-day vulnerability in WinRAR is being exploited by at least two Russian criminal groups: The vulnerability seemed to have super Windows powers. It abused alternate data streams, a Windows feature that allows different ways of representing the same file path. The exploit abused that feature to trigger a previously…
-
Eavesdropping on Phone Conversations Through Vibrations
Eavesdropping on Phone Conversations Through Vibrations Researchers have managed to eavesdrop on cell phone voice conversations by using radar to detect vibrations. It’s more a proof of concept than anything else. The radar detector is only ten feet away, the setup is stylized, and accuracy is poor. But it’s a start. Bruce Schneier Go to…
-
Trojans Embedded in .svg Files
Trojans Embedded in .svg Files Porn sites are hiding code in .svg files: Unpacking the attack took work because much of the JavaScript in the .svg images was heavily obscured using a custom version of “JSFuck,” a technique that uses only a handful of character types to encode JavaScript into a camouflaged wall of text.…
-
Friday Squid Blogging: Squid-Shaped UFO Spotted Over Texas
Friday Squid Blogging: Squid-Shaped UFO Spotted Over Texas Here’s the story. The commenters on X (formerly Twitter) are unimpressed. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. Bruce Schneier Go to bruce schneier
-
LLM Coding Integrity Breach
LLM Coding Integrity Breach Here’s an interesting story about a failure being introduced by LLM-written code. Specifically, the LLM was doing some code refactoring, and when it moved a chunk of code from one file to another it changed a “break” to a “continue.” That turned an error logging statement into an infinite loop, which…
-
AI Applications in Cybersecurity
AI Applications in Cybersecurity There is a really great series of online events highlighting cool uses of AI in cybersecurity, titled Prompt||GTFO. Videos from the first three events are online. And here’s where to register to attend, or participate, in the fourth. Some really great stuff here. Bruce Schneier Go to bruce schneier
-
SIGINT During World War II
SIGINT During World War II The NSA and GCHQ have jointly published a history of World War II SIGINT: “Secret Messengers: Disseminating SIGINT in the Second World War.” This is the story of the British SLUs (Special Liaison Units) and the American SSOs (Special Security Officers). Bruce Schneier Go to bruce schneier
-
Automatic License Plate Readers Are Coming to Schools
Automatic License Plate Readers Are Coming to Schools Fears around children is opening up a new market for automatic license place readers. Bruce Schneier Go to bruce schneier
-
Google Project Zero Changes Its Disclosure Policy
Google Project Zero Changes Its Disclosure Policy Google’s vulnerability finding team is again pushing the envelope of responsible disclosure: Google’s Project Zero team will retain its existing 90+30 policy regarding vulnerability disclosures, in which it provides vendors with 90 days before full disclosure takes place, with a 30-day period allowed for patch adoption if the…
-
Friday Squid Blogging: New Vulnerability in Squid HTTP Proxy Server
Friday Squid Blogging: New Vulnerability in Squid HTTP Proxy Server In a rare squid/security combined post, a new vulnerability was discovered in the Squid HTTP proxy server. Bruce Schneier Go to bruce schneier
-
China Accuses Nvidia of Putting Backdoors into Their Chips
China Accuses Nvidia of Putting Backdoors into Their Chips The government of China has accused Nvidia of inserting a backdoor into their H20 chips: China’s cyber regulator on Thursday said it had held a meeting with Nvidia over what it called “serious security issues” with the company’s artificial intelligence chips. It said US AI experts…
-
Surveilling Your Children with AirTags
Surveilling Your Children with AirTags Skechers is making a line of kid’s shoes with a hidden compartment for an AirTag. Bruce Schneier Go to bruce schneier
-
The Semiconductor Industry and Regulatory Compliance
The Semiconductor Industry and Regulatory Compliance Earlier this week, the Trump administration narrowed export controls on advanced semiconductors ahead of US-China trade negotiations. The administration is increasingly relying on export licenses to allow American semiconductor firms to sell their products to Chinese customers, while keeping the most powerful of them out of the hands of…
-
First Sentencing in Scheme to Help North Koreans Infiltrate US Companies
First Sentencing in Scheme to Help North Koreans Infiltrate US Companies An Arizona woman was sentenced to eight-and-a-half years in prison for her role helping North Korean workers infiltrate US companies by pretending to be US workers. From an article: According to court documents, Chapman hosted the North Korean IT workers’ computers in her own…
-
Spying on People Through Airportr Luggage Delivery Service
Spying on People Through Airportr Luggage Delivery Service Airportr is a service that allows passengers to have their luggage picked up, checked, and delivered to their destinations. As you might expect, it’s used by wealthy or important people. So if the company’s website is insecure, you’d be able to spy on lots of wealthy or…
-
Friday Squid Blogging: A Case of Squid Fossil Misidentification
Friday Squid Blogging: A Case of Squid Fossil Misidentification What scientists thought were squid fossils were actually arrow worms. Bruce Schneier Go to bruce schneier
-
Cheating on Quantum Computing Benchmarks
Cheating on Quantum Computing Benchmarks Peter Gutmann and Stephan Neuhaus have a new paper—I think it’s new, even though it has a March 2025 date—that makes the argument that we shouldn’t trust any of the quantum factorization benchmarks, because everyone has been cooking the books: Similarly, quantum factorisation is performed using sleight-of-hand numbers that have…
-
Measuring the Attack/Defense Balance
Measuring the Attack/Defense Balance “Who’s winning on the internet, the attackers or the defenders?” I’m asked this all the time, and I can only ever give a qualitative hand-wavy answer. But Jason Healey and Tarang Jain’s latest Lawfare piece has amassed data. The essay provides the first framework for metrics about how we are all…
-
Aeroflot Hacked
Aeroflot Hacked Looks serious. Bruce Schneier Go to bruce schneier
-
That Time Tom Lehrer Pranked the NSA
That Time Tom Lehrer Pranked the NSA Bluesky thread. Here’s the paper, from 1957. Note reference 3. Bruce Schneier Go to bruce schneier
-
Microsoft SharePoint Zero-Day
Microsoft SharePoint Zero-Day Chinese hackers are exploiting a high-severity vulnerability in Microsoft SharePoint to steal data worldwide: The vulnerability, tracked as CVE-2025-53770, carries a severity rating of 9.8 out of a possible 10. It gives unauthenticated remote access to SharePoint Servers exposed to the Internet. Starting Friday, researchers began warning of active exploitation of the…
-
Subliminal Learning in AIs
Subliminal Learning in AIs Today’s freaky LLM behavior: We study subliminal learning, a surprising phenomenon where language models learn traits from model-generated data that is semantically unrelated to those traits. For example, a “student” model learns to prefer owls when trained on sequences of numbers generated by a “teacher” model that prefers owls. This same…
-
Friday Squid Blogging: Stable Quasi-Isodynamic Designs
Friday Squid Blogging: Stable Quasi-Isodynamic Designs Yet another SQUID acronym: “Stable Quasi-Isodynamic Design.” It’s a stellarator for a fusion nuclear power plant. Bruce Schneier Go to bruce schneier
-
How Solid Protocol Restores Digital Agency
How Solid Protocol Restores Digital Agency The current state of digital identity is a mess. Your personal information is scattered across hundreds of locations: social media companies, IoT companies, government agencies, websites you have accounts on, and data brokers you’ve never heard of. These entities collect, store, and trade your data, often without your knowledge…
-
Google Sues the Badbox Botnet Operators
Google Sues the Badbox Botnet Operators It will be interesting to watch what will come of this private lawsuit: Google on Thursday announced filing a lawsuit against the operators of the Badbox 2.0 botnet, which has ensnared more than 10 million devices running Android open source software. These devices lack Google’s security protections, and the…
-
“Encryption Backdoors and the Fourth Amendment”
“Encryption Backdoors and the Fourth Amendment” Law journal article that looks at the Dual_EC_PRNG backdoor from a US constitutional perspective: Abstract: The National Security Agency (NSA) reportedly paid and pressured technology companies to trick their customers into using vulnerable encryption products. This Article examines whether any of three theories removed the Fourth Amendment’s requirement that…
-
Another Supply Chain Vulnerability
Another Supply Chain Vulnerability ProPublica is reporting: Microsoft is using engineers in China to help maintain the Defense Department’s computer systems—with minimal supervision by U.S. personnel—leaving some of the nation’s most sensitive data vulnerable to hacking from its leading cyber adversary, a ProPublica investigation has found. The arrangement, which was critical to Microsoft winning the…
-
New Mobile Phone Forensics Tool
New Mobile Phone Forensics Tool The Chinese have a new tool called Massistant. Massistant is the presumed successor to Chinese forensics tool, “MFSocket”, reported in 2019 and attributed to publicly traded cybersecurity company, Meiya Pico. The forensics tool works in tandem with a corresponding desktop software. Massistant gains access to device GPS location data, SMS…
-
Friday Squid Blogging: The Giant Squid Nebula
Friday Squid Blogging: The Giant Squid Nebula Beautiful photo. Difficult to capture, this mysterious, squid-shaped interstellar cloud spans nearly three full moons in planet Earth’s sky. Discovered in 2011 by French astro-imager Nicolas Outters, the Squid Nebula’s bipolar shape is distinguished here by the telltale blue emission from doubly ionized oxygen atoms. Though apparently surrounded…
-
Security Vulnerabilities in ICEBlock
Security Vulnerabilities in ICEBlock The ICEBlock tool has vulnerabilities: The developer of ICEBlock, an iOS app for anonymously reporting sightings of US Immigration and Customs Enforcement (ICE) officials, promises that it “ensures user privacy by storing no personal data.” But that claim has come under scrutiny. ICEBlock creator Joshua Aaron has been accused of making…
-
Hacking Trains
Hacking Trains Seems like an old system system that predates any care about security: The flaw has to do with the protocol used in a train system known as the End-of-Train and Head-of-Train. A Flashing Rear End Device (FRED), also known as an End-of-Train (EOT) device, is attached to the back of a train and…
-
Report from the Cambridge Cybercrime Conference
Report from the Cambridge Cybercrime Conference The Cambridge Cybercrime Conference was held on 23 June. Summaries of the presentations are here. Bruce Schneier Go to bruce schneier
-
Tradecraft in the Information Age
Tradecraft in the Information Age Long article on the difficulty (impossibility?) of human spying in the age of ubiquitous digital surveillance. Bruce Schneier Go to bruce schneier
-
Squid Dominated the Oceans in the Late Cretaceous
Squid Dominated the Oceans in the Late Cretaceous New research: One reason the early years of squids has been such a mystery is because squids’ lack of hard shells made their fossils hard to come by. Undeterred, the team instead focused on finding ancient squid beaks—hard mouthparts with high fossilization potential that could help the…
-
Using Signal Groups for Activism
Using Signal Groups for Activism Good tutorial by Micah Lee. It includes some nonobvious use cases. Bruce Schneier Go to bruce schneier
-
Yet Another Strava Privacy Leak
Yet Another Strava Privacy Leak This time it’s the Swedish prime minister’s bodyguards. (Last year, it was the US Secret Service and Emmanuel Macron’s bodyguards. in 2018, it was secret US military bases.) This is ridiculous. Why do people continue to make their data public? Bruce Schneier Go to bruce schneier
-
Hiding Prompt Injections in Academic Papers
Hiding Prompt Injections in Academic Papers Academic papers were found to contain hidden instructions to LLMs: It discovered such prompts in 17 articles, whose lead authors are affiliated with 14 institutions including Japan’s Waseda University, South Korea’s KAIST, China’s Peking University and the National University of Singapore, as well as the University of Washington and…
-
Friday Squid Blogging: How Squid Skin Distorts Light
Friday Squid Blogging: How Squid Skin Distorts Light New research. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. Bruce Schneier Go to bruce schneier
-
Surveillance Used by a Drug Cartel
Surveillance Used by a Drug Cartel Once you build a surveillance system, you can’t control who will use it: A hacker working for the Sinaloa drug cartel was able to obtain an FBI official’s phone records and use Mexico City’s surveillance cameras to help track and kill the agency’s informants in 2018, according to a…
-
How Cybersecurity Fears Affect Confidence in Voting Systems
How Cybersecurity Fears Affect Confidence in Voting Systems American democracy runs on trust, and that trust is cracking. Nearly half of Americans, both Democrats and Republicans, question whether elections are conducted fairly. Some voters accept election results only when their side wins. The problem isn’t just political polarization—it’s a creeping erosion of trust in the…
-
The Age of Integrity
The Age of Integrity We need to talk about data integrity. Narrowly, the term refers to ensuring that data isn’t tampered with, either in transit or in storage. Manipulating account balances in bank databases, removing entries from criminal records, and murder by removing notations about allergies from medical records are all integrity attacks. More broadly,…
-
Friday Squid Blogging: What to Do When You Find a Squid “Egg Mop”
Friday Squid Blogging: What to Do When You Find a Squid “Egg Mop” Tips on what to do if you find a mop of squid eggs. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. Bruce Schneier Go to…
-
What LLMs Know About Their Users
What LLMs Know About Their Users Simon Willison talks about ChatGPT’s new memory dossier feature. In his explanation, he illustrates how much the LLM—and the company—knows about its users. It’s a big quote, but I want you to read it all. Here’s a prompt you can use to give you a solid idea of what’s…
-
Here’s a Subliminal Channel You Haven’t Considered Before
Here’s a Subliminal Channel You Haven’t Considered Before Scientists can manipulate air bubbles trapped in ice to encode messages. Bruce Schneier Go to bruce schneier
-
Largest DDoS Attack to Date
Largest DDoS Attack to Date It was a recently unimaginable 7.3 Tbps: The vast majority of the attack was delivered in the form of User Datagram Protocol packets. Legitimate UDP-based transmissions are used in especially time-sensitive communications, such as those for video playback, gaming applications, and DNS lookups. It speeds up communications by not formally…
-
Surveillance in the US
Surveillance in the US Good article from 404 Media on the cozy surveillance relationship between local Oregon police and ICE: In the email thread, crime analysts from several local police departments and the FBI introduced themselves to each other and made lists of surveillance tools and tactics they have access to and felt comfortable using,…
-
Friday Squid Blogging: Gonate Squid Video
Friday Squid Blogging: Gonate Squid Video This is the first ever video of the Antarctic Gonate Squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Bruce Schneier Go to bruce schneier
-
Self-Driving Car Video Footage
Self-Driving Car Video Footage Two articles crossed my path recently. First, a discussion of all the video Waymo has from outside its cars: in this case related to the LA protests. Second, a discussion of all the video Tesla has from inside its cars. Lots of things are collecting lots of video of lots of…
-
Ghostwriting Scam
Ghostwriting Scam The variations seem to be endless. Here’s a fake ghostwriting scam that seems to be making boatloads of money. This is a big story about scams being run from Texas and Pakistan estimated to run into tens if not hundreds of millions of dollars, viciously defrauding Americans with false hopes of publishing bestseller…
-
Where AI Provides Value
Where AI Provides Value If you’ve worried that AI might take your job, deprive you of your livelihood, or maybe even replace your role in society, it probably feels good to see the latest AI tools fail spectacularly. If AI recommends glue as a pizza topping, then you’re safe for another day. But the fact…
-
Upcoming Speaking Engagements
Upcoming Speaking Engagements This is a current list of where and when I am scheduled to speak: I’m speaking at the International Conference on Digital Trust, AI and the Future in Edinburgh, Scotland on Tuesday, June 24 at 4:00 PM. The list is maintained on this page. Bruce Schneier Go to bruce schneier
-
Friday Squid Blogging: Stubby Squid
Friday Squid Blogging: Stubby Squid Video of the stubby squid (Rossia pacifica) from offshore Vancouver Island. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Bruce Schneier Go to bruce schneier
-
Paragon Spyware Used to Spy on European Journalists
Paragon Spyware Used to Spy on European Journalists Paragon is an Israeli spyware company, increasingly in the news (now that NSO Group seems to be waning). “Graphite” is the name of its product. Citizen Lab caught it spying on multiple European journalists with a zero-click iOS exploit: On April 29, 2025, a select group of…
-
Airlines Secretly Selling Passenger Data to the Government
Airlines Secretly Selling Passenger Data to the Government This is news: A data broker owned by the country’s major airlines, including Delta, American Airlines, and United, collected U.S. travellers’ domestic flight records, sold access to them to Customs and Border Protection (CBP), and then as part of the contract told CBP to not reveal where…
-
New Way to Track Covertly Android Users
New Way to Track Covertly Android Users Researchers have discovered a new way to covertly track Android users. Both Meta and Yandex were using it, but have suddenly stopped now that they have been caught. The details are interesting, and worth reading in detail: >Tracking code that Meta and Russia-based Yandex embed into millions of…
-
Report on the Malicious Uses of AI
Report on the Malicious Uses of AI OpenAI just published its annual report on malicious uses of AI. By using AI as a force multiplier for our expert investigative teams, in the three months since our last report we’ve been able to detect, disrupt and expose abusive activity including social engineering, cyber espionage, deceptive employment…
-
Hearing on the Federal Government and AI
Hearing on the Federal Government and AI On Thursday I testified before the House Committee on Oversight and Government Reform at a hearing titled “The Federal Government in the Age of Artificial Intelligence.” The other speakers mostly talked about how cool AI was—and sometimes about how cool their own company was—but I was asked by…
-
Friday Squid Blogging: Squid Run in Southern New England
Friday Squid Blogging: Squid Run in Southern New England Southern New England is having the best squid run in years. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Bruce Schneier Go to bruce schneier
-
The Ramifications of Ukraine’s Drone Attack
The Ramifications of Ukraine’s Drone Attack You can read the details of Operation Spiderweb elsewhere. What interests me are the implications for future warfare: If the Ukrainians could sneak drones so close to major air bases in a police state such as Russia, what is to prevent the Chinese from doing the same with U.S.…
-
New Linux Vulnerabilities
New Linux Vulnerabilities They’re interesting: Tracked as CVE-2025-5054 and CVE-2025-4598, both vulnerabilities are race condition bugs that could enable a local attacker to obtain access to access sensitive information. Tools like Apport and systemd-coredump are designed to handle crash reporting and core dumps in Linux systems. […] “This means that if a local attacker manages…
-
Australia Requires Ransomware Victims to Declare Payments
Australia Requires Ransomware Victims to Declare Payments A new Australian law requires larger companies to declare any ransomware payments they have made. Bruce Schneier Go to bruce schneier
-
Why Take9 Won’t Improve Cybersecurity
Why Take9 Won’t Improve Cybersecurity There’s a new cybersecurity awareness campaign: Take9. The idea is that people—you, me, everyone—should just pause for nine seconds and think more about the link they are planning to click on, the file they are planning to download, or whatever it is they are planning to share. There’s a website—of…
-
Surveillance Via Smart Toothbrush
Surveillance Via Smart Toothbrush The only links are from The Daily Mail and The Mirror, but a marital affair was discovered because the cheater was recorded using his smart toothbrush at home when he was supposed to be at work. Bruce Schneier Go to bruce schneier
-
Friday Squid Blogging: NGC 1068 Is the “Squid Galaxy”
Friday Squid Blogging: NGC 1068 Is the “Squid Galaxy” I hadn’t known that the NGC 1068 galaxy is nicknamed the “Squid Galaxy.” It is, and it’s spewing neutrinos without the usual accompanying gamma rays. Bruce Schneier Go to bruce schneier
-
Location Tracking App for Foreigners in Moscow
Location Tracking App for Foreigners in Moscow Russia is proposing a rule that all foreigners in Moscow install a tracking app on their phones. Using a mobile application that all foreigners will have to install on their smartphones, the Russian state will receive the following information: Residence location Fingerprint Face photograph Real-time geo-location monitoring This…
-
Chinese-Owned VPNs
Chinese-Owned VPNs One one my biggest worries about VPNs is the amount of trust users need to place in them, and how opaque most of them are about who owns them and what sorts of data they retain. A new study found that many commercials VPNS are (often surreptitiously) owned by Chinese companies. It would…
-
Signal Blocks Windows Recall
Signal Blocks Windows Recall This article gives a good rundown of the security risks of Windows Recall, and the repurposed copyright protection took that Signal used to block the AI feature from scraping Signal data. Bruce Schneier Go to bruce schneier
-
Friday Squid Blogging: US Naval Ship Attacked by Squid in 1978
Friday Squid Blogging: US Naval Ship Attacked by Squid in 1978 Interesting story: USS Stein was underway when her anti-submarine sonar gear suddenly stopped working. On returning to port and putting the ship in a drydock, engineers observed many deep scratches in the sonar dome’s rubber “NOFOUL” coating. In some areas, the coating was described…
-
The Voter Experience
The Voter Experience Technology and innovation have transformed every part of society, including our electoral experiences. Campaigns are spending and doing more than at any other time in history. Ever-growing war chests fuel billions of voter contacts every cycle. Campaigns now have better ways of scaling outreach methods and offer volunteers and donors more efficient…
-
More AIs Are Taking Polls and Surveys
More AIs Are Taking Polls and Surveys I already knew about the declining response rate for polls and surveys. The percentage of AI bots that respond to surveys is also increasing. Solutions are hard: 1. Make surveys less boring. We need to move past bland, grid-filled surveys and start designing experiences people actually want to…
-
DoorDash Hack
DoorDash Hack A DoorDash driver stole over $2.5 million over several months: The driver, Sayee Chaitainya Reddy Devagiri, placed expensive orders from a fraudulent customer account in the DoorDash app. Then, using DoorDash employee credentials, he manually assigned the orders to driver accounts he and the others involved had created. Devagiri would then mark the…
-
The NSA’s “Fifty Years of Mathematical Cryptanalysis (1937–1987)”
The NSA’s “Fifty Years of Mathematical Cryptanalysis (1937–1987)” In response to a FOIA request, the NSA released “Fifty Years of Mathematical Cryptanalysis (1937-1987),” by Glenn F. Stahly, with a lot of redactions. Weirdly, this is the second time the NSA has declassified the document. John Young got a copy in 2019. This one has a…
-
Communications Backdoor in Chinese Power Inverters
Communications Backdoor in Chinese Power Inverters This is a weird story: U.S. energy officials are reassessing the risk posed by Chinese-made devices that play a critical role in renewable energy infrastructure after unexplained communication equipment was found inside some of them, two people familiar with the matter said. […] Over the past nine months, undocumented…
-
Friday Squid Blogging: Pet Squid Simulation
Friday Squid Blogging: Pet Squid Simulation From Hackaday.com, this is a neural network simulation of a pet squid. Autonomous Behavior: The squid moves autonomously, making decisions based on his current state (hunger, sleepiness, etc.). Implements a vision cone for food detection, simulating realistic foraging behavior. Neural network can make decisions and form associations. Weights are…
-
AI-Generated Law
AI-Generated Law On April 14, Dubai’s ruler, Sheikh Mohammed bin Rashid Al Maktoum, announced that the United Arab Emirates would begin using artificial intelligence to help write its laws. A new Regulatory Intelligence Office would use the technology to “regularly suggest updates” to the law and “accelerate the issuance of legislation by up to 70%.” AI would create a…
-
Google’s Advanced Protection Now on Android
Google’s Advanced Protection Now on Android Google has extended its Advanced Protection features to Android devices. It’s not for everybody, but something to be considered by high-risk users. Wired article, behind a paywall. Bruce Schneier Go to bruce schneier