Schneier on Security

In this issue:

1. San Francisco Police Want Real-Time Access to Private Surveillance Cameras
2. Facebook Is Now Encrypting Links to Prevent URL Stripping
3. NSO Group’s Pegasus Spyware Used against Thailand Pro-Democracy Activists and Leaders
4. Russia Creates Malware False-Flag App
5. Critical Vulnerabilities in GPS Trackers
6. Apple’s Lockdown Mode
7. Securing Open-Source Software
8. New UEFI Rootkit
9. Microsoft Zero-Days Sold and Then Used
10. Ring Gives Videos to Police without a Warrant or User Consent
11. Surveillance of Your Car
12. Drone Deliveries into Prisons
13. SIKE Broken
14. NIST’s Post-Quantum Cryptography Standards
15. Hacking Starlink
16. A Taxonomy of Access Control
17. Twitter Exposes Personal Information for 5.4 Million Accounts
18. Upcoming Speaking Engagements

In this issue:

1. M1 Chip Vulnerability
2. Attacking the Performance of Machine Learning Systems
3. Tracking People via Bluetooth on Their Phones
4. Hertzbleed: A New Side-Channel Attack
5. Hidden Anti-Cryptography Provisions in Internet Anti-Trust Bills
6. Symbiote Backdoor in Linux
7. On the Subversion of NIST by the NSA
8. On the Dangers of Cryptocurrencies and the Uselessness of Blockchain
9. 2022 Workshop on Economics and Information Security (WEIS)
10. When Security Locks You Out of Everything
11. Ecuador’s Attempt to Resettle Edward Snowden
12. ZuoRAT Malware Is Targeting Routers
13. Analyzing the Swiss E-Voting System
14. NIST Announces First Four Quantum-Resistant Cryptographic Algorithms
15. Ubiquitous Surveillance by ICE
16. Apple’s Lockdown Mode
17. Nigerian Prison Break
18. Security Vulnerabilities in Honda’s Keyless Entry System
19. Post-Roe Privacy
20. New Browser De-anonymization Technique
21. Upcoming Speaking Engagements

In this issue:

1. The NSA Says that There are No Known Flaws in NIST’s Quantum-Resistant Algorithms
2. Attacks on Managed Service Providers Expected to Increase
3. iPhone Malware that Operates Even When the Phone Is Turned Off
4. Websites that Collect Your Data as You Type
5. Bluetooth Flaw Allows Remote Unlocking of Digital Locks
6. The Onion on Google Map Surveillance
7. Forging Australian Driver’s Licenses
8. The Justice Department Will No Longer Charge Security Researchers with Criminal Hacking
9. Manipulating Machine-Learning Systems through the Order of the Training Data
10. Malware-Infested Smart Card Reader
11. Security and Human Behavior (SHB) 2022
12. The Limits of Cyber Operations in Wartime
13. Clever — and Exploitable — Windows Zero-Day
14. Remotely Controlling Touchscreens
15. Me on Public-Interest Tech
16. Long Story on the Accused CIA Vault 7 Leaker
17. Leaking Military Secrets on Gaming Discussion Boards
18. Smartphones and Civilians in Wartime
19. Twitter Used Two-Factor Login Details for Ad Targeting
20. Cryptanalysis of ENCSecurity’s Encryption Implementation
21. Hacking Tesla’s Remote Key Cards
22. Upcoming Speaking Engagements

In this issue:

1. Undetectable Backdoors in Machine-Learning Models
2. Clever Cryptocurrency Theft
3. Long Article on NSO Group
4. Java Cryptography Implementation Mistake Allows Digital-Signature Forgeries
5. SMS Phishing Attacks are on the Rise
6. Zero-Day Vulnerabilities Are on the Rise
7. Microsoft Issues Report of Russian Cyberattacks against Ukraine
8. Video Conferencing Apps Sometimes Ignore the Mute Button
9. Using Pupil Reflection in Smartphone Camera Selfies
10. New Sophisticated Malware
11. 15.3 Million Request-Per-Second DDoS Attack
12. Corporate Involvement in International Cybersecurity Treaties
13. Apple Mail Now Blocks Email Trackers
14. ICE Is a Domestic Surveillance Agency
15. Surveillance by Driverless Car
16. Upcoming Speaking Engagements

In this issue:

1. US Critical Infrastructure Companies Will Have to Report When They Are Hacked
2. Breaking RSA through Insufficiently Random Primes
3. “Change Password”
4. Why Vaccine Cards Are So Easily Forged
5. Developer Sabotages Open-Source Software Package
6. White House Warns of Possible Russian Cyberattacks
7. NASA’s Insider Threat Program
8. Linux Improves Its Random Number Generator
9. Gus Simmons’s Memoir
10. A Detailed Look at the Conti Ransomware Gang
11. Stalking with an Apple Watch
12. Chrome Zero-Day from North Korea
13. Bypassing Two-Factor Authentication
14. Wyze Camera Vulnerability
15. Hackers Using Fake Police Data Requests against Tech Companies
16. Cyberweapons Arms Manufacturer FinFisher Shuts Down
17. US Disrupts Russian Botnet
18. AirTags Are Used for Stalking Far More than Previously Reported
19. De-anonymizing Bitcoin
20. John Oliver on Data Brokers
21. Russian Cyberattack against Ukrainian Power Grid Prevented
22. Industrial Control System Malware Discovered
23. Upcoming Speaking Engagements

In this issue:

1. Secret CIA Data Collection Program
2. Vendors are Fixing Security Flaws Faster
3. Possible Government Surveillance of the Otter.ai Transcription App
4. Stealing Bicycles by Swapping QR Codes
5. A New Cybersecurity “Social Contract”
6. Bypassing Apple’s AirTag Security
7. An Elaborate Employment Con in the Internet Age
8. Privacy Violating COVID Tests
9. Insurance Coverage for NotPetya Losses
10. Decrypting Hive Ransomware Data
11. Vulnerability in Stalkerware Apps
12. Details of an NSA Hacking Operation
13. Samsung Encryption Flaw
14. Hacking Alexa through Alexa’s Speech
15. Using Radar to Read Body Language
16. Fraud on Zelle
17. Where’s the Russia-Ukraine Cyberwar?
18. Leak of Russian Censorship Data
19. Upcoming Speaking Events

In this issue:

1. An Examination of the Bug Bounty Marketplace
2. UK Government to Launch PR Campaign Undermining End-to-End Encryption
3. Are Fake COVID Testing Sites Harvesting Data?
4. San Francisco Police Illegally Spying on Protesters
5. China’s Olympics App Is Horribly Insecure
6. Linux-Targeted Malware Increased by 35%
7. Merck Wins Insurance Lawsuit re NotPetya Attack
8. New DeadBolt Ransomware Targets NAS Devices
9. Tracking Secret German Organizations with Apple AirTags
10. Twelve-Year-Old Linux Vulnerability Discovered and Patched
11. Me on App Store Monopolies and Security
12. Finding Vulnerabilities in Open Source Projects
13. Interview with the Head of the NSA’s Research Directorate
14. The EARN IT Act Is Back
15. Amy Zegart on Spycraft in the Internet Age
16. Breaking 256-bit Elliptic Curve Encryption with a Quantum Computer
17. Bunnie Huang’s Plausibly Deniable Database
18. On the Irish Health Services Executive Hack
19. Upcoming Speaking Engagements

In this issue:

1. More Log4j News
2. More on NSO Group and Cytrox: Two Cyberweapons Arms Manufacturers
3. Stolen Bitcoins Returned
4. Apple AirTags Are Being Used to Track People and Cars
5. More Russian Cyber Operations against Ukraine
6. People Are Increasingly Choosing Private Web Search
7. Norton’s Antivirus Product Now Includes an Ethereum Miner
8. Fake QR Codes on Parking Meters
9. Apple’s Private Relay Is Being Blocked
10. Faking an iPhone Reboot
11. Using Foreign Nationals to Bypass US Surveillance Restrictions
12. Using EM Waves to Detect Malware
13. Upcoming Speaking Engagements

In this issue:

1. Securing Your Smartphone
2. Why I Hate Password Rules
3. Wire Fraud Scam Upgraded with Bitcoin
4. Is Microsoft Stealing People’s Bookmarks?
5. New Rowhammer Technique
6. “Crypto” Means “Cryptography,” Not “Cryptocurrency”
7. Apple Sues NSO Group
8. Proposed UK Law Bans Default Passwords
9. Intel Is Maintaining Legacy Technology for Security Research
10. Smart Contract Bug Results in $31 Million Loss
11. Testing Faraday Cages
12. Thieves Using AirTags to “Follow” Cars
13. Someone Is Running Lots of Tor Relays
14. New German Government is Pro-Encryption and Anti-Backdoors
15. Google Shuts Down Glupteba Botnet, Sues Operators
16. Law Enforcement Access to Chat Data and Metadata
17. NSO Group’s Pegasus Spyware Used Against US State Department Officials
18. On the Log4j Vulnerability
19. Upcoming Speaking Engagements

In this issue:

1. Book Sale: Click Here to Kill Everybody and Data and Goliath
2. Security Risks of Client-Side Scanning
3. Missouri Governor Doesn’t Understand Responsible Disclosure
4. Ransomware Attacks against Water Treatment Plants
5. Using Machine Learning to Guess PINs from Video
6. Textbook Rental Scam
7. Problems with Multifactor Authentication
8. Nation-State Attacker of Telecommunications Networks
9. New York Times Journalist Hacked with NSO Spyware
10. How the FBI Gets Location Information
11. More Russian SVR Supply-Chain Attacks
12. Squid Game Has a Cryptocurrency
13. Hiding Vulnerabilities in Source Code
14. On Cell Phone Metadata
15. Using Fake Student Accounts to Shill Brands
16. US Blacklists NSO Group
17. Squid Game Cryptocurrency Was a Scam
18. Drones Carrying Explosives
19. Hacking the Sony Playstation 5
20. Advice for Personal Digital Security
21. MacOS Zero-Day Used against Hong Kong Activists
22. Upcoming Speaking Engagements