Panera Bread got hit by ransomware.
"Panera Sip Club members were particularly frustrated because they could not take advantage of the unlimited drinks they had paid $14.99 per month for as part of their subscription."
https://t.co/7YtLlvAiuS
We just finished processing or in other words we just "Slash & Grabbed" this amazing report from @HuntressLabs team. Made some updates and added some new Sigma rules. But fortunately a lot of it was already covered by old generic rules.
Here is a quick thread on every Sigma rules from @sigma_hq you can use to catch things mentioned in this ๐report
7 days and counting with no email during account takeover. 3 emails to executive customer support. 7 calls to customer support. Still no email. #fail thanks @EarthLink#customersupportfail
7 days and counting with no email during account takeover. 3 emails to executive customer support. 7 calls to customer support. Still no email. #fail thanks @EarthLink#customersupportfail
10 days and counting. No emails returned from my corporate email. 56 minutes on hold this call. 6 hours invested so far. Nice job @EarthLink#customersupportfail
๐งต The historic NYT v. @OpenAI lawsuit filed this morning, as broken down by me, an IP and AI lawyer, general counsel, and longtime tech person and enthusiast.
Tl;dr - It's the best case yet alleging that generative AI is copyright infringement. Thread. ๐
This iMessage exploit is crazy. TrueType vulnerability that has existed since the 90s, 2 kernel exploits, a browser exploit, and an undocumented hardware feature that was not used in shipped software:
https://t.co/YJdY6alLbV
Cybersecurity expert here: no.
The stories of teenage hacking are sensationalized.
As far as we can tell, he didn't hack into the company using a FireTV stick. He accessed the company using his phone.
Specifically, he connected his phone to the TV and its bluetooth keyboard, through the FireTV stick. This made things more convenient when accessing the Internet from his phone, but was by no mean such things were essential.
Moreover, the story sounds like he'd hacked into the company and stolen the content weeks before. He then just logged into their Slack to taunt them while in the hotel room. Accessing Slack from you phone is not terribly difficult.
As for his skills, most teenagers have no skill in general, but have been taught by other teenagers one specific skill. What makes it work isn't because the teenagers are smart but because their targets are dumb. The NSA already has all these skills.
The one thing that would be valuable to the NSA is autistic obsession with tech. There are a lot of autism-spectrum people who you could just stick in a room and watch blossom with tech skills because they are obsessed with them. You don't have to 'train' them, they'll train themselves.
But, their goals aren't aligned with the NSA. The NSA doesn't go romping through the Internet hacking whomever they find. NSA hackers are given specific tasks to achieve, they must play by the rules, and the paperwork involved is more arduous than the actual hacking. Such autistic kids would not do well in that environment.
The kind kids the NSA wants to hire are those that are socialized enough they won't get so angry at the needless paperwork and roadblocks that they go off on a rampage (like Snowden). That's a rare enough skill to find. All the rest of the hacking skills can be taught.
If you are an organization with zero skills of your own, then sure, hiring such kids will at least get you started. But you'll exhaust their value within 3 months, after which you've got a sociopath on your hands that you have to deal with.