Security: Keeping Up to Date

[Security: Keeping Up to Date @keepingupwsec]

Are these all currently possible? Especially the RCE that can be used to listen in. How would you set it up to connect to someone’s TV if you’re not on the network already?

First, you’d have to get into the network, right? and then you’d connect to the computer.

[IT Guy @T3chFalcon]

What the TV does by design:

— scans your entire home network continuously. in their test: one TV identified 38 unrelated devices including phones, smartwatches, printers, and thermostats belonging to people not involved in the test.

— collects the names and signal strengths of every nearby WiFi network, plus location data. all sent to LG Ad Solutions.

— runs ACR (Automatic Content Recognition) on everything displayed on screen. including HDMI inputs. your laptop, gaming console, or work monitor connected to the TV is being fingerprinted.

— one TV exchanged roughly 4GB of ACR-related data per month.

What the TV does that LG says it doesn't:

LG publicly stated their TVs "do not collect, record, or store ambient conversations."

Gamers Nexus found:
— the TV converts speech to plain text and stores it in on-device logs

— the microphone window stays open 10 to 15 seconds after talking stops, capturing bystanders who never addressed the TV

— the TV recorded room audio while the screen appeared off and the Ethernet cable was unplugged, then exfiltrated the file the moment it reconnected

The security vulnerabilities on top:
Beyond the designed behavior, researchers found remote code execution vulnerabilities in webOS that could allow a compromised TV to be weaponized as a covert listening device.

these sets are in hospitals. waiting rooms. boardrooms. hotels.

a surgeon asked Gamers Nexus where that leaves patient confidentiality.

Gamers Nexus has no answer. neither does LG.

What to do right now:
— disconnect your LG TV from your network entirely. route streaming through an Apple TV, Roku, or Fire Stick instead.

— if you must keep it connected: put it on a separate IoT VLAN or guest network so it cannot reach your other devices.

— disable the built-in microphone in settings.

— check your privacy dashboard and opt out of ACR and ad personalization.

— after every firmware update: recheck all of the above.

Credit to Gamers Nexus, Level1Techs, and other independent researchers.

[Security: Keeping Up to Date @keepingupwsec]

Curious how well it works

[Hugging Models @HuggingModels]

Ever wanted an AI that doesn't just talk cybersecurity but actively helps you break into systems? Meet GLM-5.3-CYBERSECURITY-FP8, a specialized text-generation model for offensive security, red teaming, and pentesting. It's refusal-removed, so it's built to assist without holding back. #AI #CyberSecurity

[Security: Keeping Up to Date @keepingupwsec]

This is why I was always so wary of using verification services.

Unfortunately, I never had the resources to decline. If you want or need to use the resource, you need to follow its rules.

[vx-underground @vxunderground]

I really recommending reading this.

In summary, a company which does ID verification for in-person interactions (hotels, car rentals, ID verification for alcohol or marijuana, etc) has some how exposed over 153,000,000 drivers licenses for people in the United States and Canada.

It is a catastrophic data breach, probably one of the worse I've ever seen. If you're in the United States and have traveled, gotten a hotel, purchased marijuana or alcohol, there is a high probability you're in this.

Unlike other breaches, this includes a photo of the person (from the license), making verification you've identified the person significantly easier.

This poses a significant threat to celebrities (musicians, YouTubers, streamers, adult entertainers, actors, etc), politicians, lawyers, wealthy people (CEOs, investors, people of public interest), Law Enforcement Officers, etc

Krebs himself, and several other security researchers, have already confirmed they're in the data leak.

tl;dr gah damn dawg this company is going to be sued into oblivion

https://t.co/QpsegBUzH5

[Security: Keeping Up to Date @keepingupwsec]

What breach and where’s it available?
This is unrelated to the Norton breach
What’s nexus?

[Alexander Panfilov @kotekjedi_ml]

In the paper we discuss more threats like misuse uplift (see the pic attached), jailbreaking and invisible prompt injection.

[Security: Keeping Up to Date @keepingupwsec]

@OscarSpatial @ClaudeDevs You use auto mode? You don’t have it set to bypass permissions in a sandbox?

I find it slightly laughable that people apparently use auto mode. What do you do…, sit around waiting to click approve all day pretending like you know what Claude code is actually doing?

[Security: Keeping Up to Date @keepingupwsec]

@ClaudeDevs Auto mode uses up to 89% more usage and only increases the amount of time spent on tasks by up to 14%

[Security: Keeping Up to Date @keepingupwsec]

@actuallyaridan Adnan’s Aripods. Threw my head for a spin there. Nice pun. Nice pun.

[Security: Keeping Up to Date @keepingupwsec]

@yoheinakajima Almost identical to the story Anthropic put out about Mythos. 1:1. Except this one also happened to hack HuggingFace with stolen credentials

[Security: Keeping Up to Date @keepingupwsec]

In case you get flagged.

I also something about the model itself using fewer tokens if you use images

[cheaty @cheatyyyy]

THE SAFETY CLASSIFIER DOES NOT HAVE VISION I REPEAT THE SAFETY CLASSIFIER DOES NOT HAVE VISION

[Security: Keeping Up to Date @keepingupwsec]

Carmax and CoreWeave breached

[nader dabit @dabit3]

This is crazy. The hacker installed a dead-man's switch that will wipe your computer if you revoke the GitHub token they stole from you. Revoking the token is what triggers the wipe.

[Security: Keeping Up to Date @keepingupwsec]

😍

[Abdel @rockkdev]

New Robinhood phishing chain that's kinda beautiful:

1. Attacker creates an RH account using the Gmail dot trick of your email (same inbox, different address)
2. Sets device name to HTML
3. RH's "unrecognized activity" email renders the device name unsanitized (html injection)

The result is a real email from [email protected], DKIM pass, SPF pass, DMARC pass, with a phishing CTA

Just because it's real, doesn't mean it's safe... $HOOD

[Security: Keeping Up to Date @keepingupwsec]

Nice. Finally use Claude as it’s meant to be used.

[ultra @0x_ultra]

fuck it, authorization letter generator

Claude does not push back when reading one of these lol

https://t.co/szZ4vQDl08

[Security: Keeping Up to Date @keepingupwsec]

As of today's changelog, Anthropic shifted Claude Code from being a bundled JavaScript application (running via node) to a native binary.
To a firewall like LuLu, a "native binary" looks like a brand-new application trying to access the internet for the first time.

[Security: Keeping Up to Date @keepingupwsec]

why did claude code suddenly start getting caught getting tons of outbound requests today?
lulu alerting me
inside iterm2, running claude

Answer below. Yes, telemetry, but:

[Security: Keeping Up to Date @keepingupwsec]

@sharbel Isn’t this abliteration, something we’ve been doing for a couple years now?

What’s different? Are they able to inject it post-API, and that’s new?

[Kit Klarenberg @KitKlarenberg]

I warned back in December 2023 (!!!) that push notifications were a major opsec hazard being exploited by US intelligence to break encryption, and now here were are:

https://t.co/8yZWy6tv53

[Alex Spring @_alexspring]

Your "stealth" browser gets detected by 3 lines of JavaScript.

Set background-color: ActiveText on a div. Read getComputedStyle().

ActiveText is a CSS system color, it pulls from your OS theme.

Real desktop? Unique themed color.

Headless cloud machine? Chromium returns its hardcoded default: rgb(255, 0, 0).

[Chaofan Shou @shoucccc]

26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet.

We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts.

Check our paper: https://t.co/zyWz25CDpl