Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security. Show all posts
Network Server
CISO CISO best practices Cyber Security Cyberattacks. Network Safety Network Security Network Server

Cisco Warns of Actively Exploited SD-WAN Vulnerabilities Affecting Catalyst Network Systems

 

Cisco warns of several security holes in its Catalyst SD-WAN Manager, noting hackers have begun using at least one in live operations. Updates exist - applying them quickly reduces risk exposure. Exploitation is underway; delayed patching increases danger. Systems remain vulnerable until fixes take effect. Each unpatched flaw offers attackers a potential entry point. Action now limits future compromise chances. 

Catalyst SD-WAN Manager - once called vManage - serves organizations that need oversight of extensive networks, letting them manage many devices from one location. Because it plays a key part in keeping connections running, flaws within the system can lead to serious problems when updates are delayed. Cisco reports active exploitation of two flaws, labeled CVE-2026-20122 and CVE-2026-20128. 

While one poses a higher risk by letting those with basic API access overwrite critical files, the other leaks confidential information when insiders already have login rights. Though differing in impact level, both demand attention due to ongoing attacks. Access restrictions alone do not fully block either pathway. One alters content without permission; the other quietly reveals what should remain hidden. 

Regardless of how devices are set up, Cisco confirmed the flaws affect the software across the board - leaving any system without updates at risk. Though there is no current evidence of exploitation for the additional bugs listed, moving to protected releases remains advised simply because it limits exposure. 

Despite earlier assurances, Cisco now admits CVE-2026-20127 has seen active exploitation beginning in 2023. Though complex, the flaw makes it possible for experienced hackers to skip authentication steps on network controllers. Unauthorized entry leads to insertion of untrusted devices within protected systems. 

What was once theoretical is now observed in real attacks. Appearing trustworthy at first glance, these unauthorized devices let intruders spread across systems, gain higher access levels, while staying hidden for long periods. Growing complexity and frequency now worry security experts worldwide. Authorities including the Cybersecurity and Infrastructure Security Agency (CISA) have responded by issuing directives requiring organizations, particularly federal agencies, to identify affected systems, collect forensic data, apply patches, and investigate potential compromises linked to these vulnerabilities. 

One step further, Cisco revealed two additional high-risk weaknesses in its Secure Firewall Management Center. Labeled CVE-2026-20079 along with CVE-2026-20131, they involve a flaw allowing login circumvention and another enabling remote command execution. When triggered, hackers might reach root privileges on compromised devices while running harmful scripts from afar - no credentials needed. 

Though rare, such access opens deep control paths across networks. When flaws carry serious risks, acting fast matters most. Those running Cisco’s network control systems should update quickly - while checking logs closely. Exploits already in motion mean delays increase exposure. Watching traffic patterns might reveal breaches hidden before now. 

Facing ever-changing digital dangers, events such as these underline why staying ahead of weaknesses matters - especially when reacting quickly to warnings. A slow reaction can widen risk, while early action reduces harm before it spreads.
Read more »
Risky Extensions
AI tools Browser Security Cyber Security Data Exposure Enterprise Risks Risky Extensions

AI Boom Turns Browsers into Enterprise Security’s Biggest Blind Spot

 

Telemetry data from the 2026 State of Browser Security Report reveals that, while the browser has become the de facto operating system for work in the enterprise, it remains one of the least secured segments in the overall security stack. In 2025, AI-native browsers, embedded copilots, and generative tools transitioned from being experimental pilots to being ubiquitous, routine tools for search, write, code, and workflow automation, thus creating a significant disconnect between the way employees are actually working and the organization’s risk monitoring capabilities.

The data also indicates that generative artificial intelligence has become an integral part of browser workflows, extending beyond the browser as a gateway for a small set of approved tools. According to the telemetry data collected by Keep Aware, 41% of end-users interacted with at least one AI tool on the web in 2025, with an average of 1.91 AI tools used per end-user, thus revealing the widespread integration of AI tools in the browser workflows. However, it has been observed that governance has not kept pace with the adoption of these tools, with end-users using their own accounts or unauthorized tools in the same browser session as their work activities. 

This behavioral reality is especially dangerous when it comes to sensitive data exposure. In a one‑month snapshot of authenticated sessions, 54% of sensitive inputs to web apps went to corporate accounts, while a striking 46% went to personal or unverified work accounts, often within “trusted” apps like SharePoint, Google services, Slack, Box, and other collaboration tools. Because traditional DLP tools focus on email, network traffic, or endpoint files, they largely miss typed inputs, pasted content, and file uploads occurring directly inside live browser sessions, where today’s AI‑driven work actually happens.

Attackers have adapted to this shift as well, increasingly targeting the browser layer to bypass hardened email, network, and endpoint defenses. Keep Aware observed that 29% of browser‑based threats in 2025 were phishing, 19% involved suspicious or malicious extensions, and 17% were social engineering, highlighting how social and UI‑driven tactics dominate. Notably, phishing domains had a median age of more than 18 years, indicating adversaries are abusing long‑standing, seemingly trustworthy infrastructure rather than relying only on newly registered domains that filters are tuned to flag.

Browser extensions add another, often underestimated, attack surface. According to the report, 13% of unique installed extensions were rated High or Critical risk, meaning a significant slice of add‑ons running inside production environments have elevated permissions and potentially dangerous capabilities. Many extensions marketed as productivity tools request broad access to tabs, cookies, storage, and web requests, quietly gaining deep visibility into user sessions and sensitive business data without ongoing scrutiny.

The report makes a clear case that static controls—such as one‑time extension reviews, app allowlists, and domain‑based blocking—are no longer enough in a world of AI copilots, browser‑centric workflows, and adaptive phishing campaigns. Instead, organizations must treat the browser as a primary security control point, with real‑time visibility into AI usage, SaaS activity, extensions, and in‑session behavior to detect threats earlier and prevent data loss at the moment it happens. For security teams, 2026 is shaping up as the year where true browser‑native detection and response moves from “nice to have” to non‑negotiable.
Read more »
Windows 11
Cyber Security Digital Vulnerabilities hotpatch Microsoft system updates Windows 11

Microsoft Releases Hotpatch to Fix Windows 11 RRAS Remote Code Flaw



Microsoft has issued an out-of-band (OOB) security update to remediate critical vulnerabilities affecting a specific subset of Windows 11 Enterprise systems that rely on hotpatch updates instead of the conventional monthly Patch Tuesday cumulative updates.

The update, identified as KB5084597, was released to fix multiple security flaws in the Windows Routing and Remote Access Service (RRAS), a built-in administrative tool used for configuring and managing remote connectivity and routing functions within enterprise networks. According to Microsoft’s official advisory, these vulnerabilities could allow remote code execution if a system connects to a malicious or attacker-controlled server through the RRAS management interface.

Microsoft clarified that the risk is limited to narrowly defined scenarios. The exposure primarily impacts Enterprise client devices that are enrolled in the hotpatch update model and are actively used for remote server management. This means that the vulnerability does not broadly affect all Windows users, but rather a specific operational environment where administrative tools interact with external systems.

The vulnerabilities addressed in this update are tracked under three identifiers: CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111. These issues were initially resolved as part of Microsoft’s March 2026 Patch Tuesday updates, which were released on March 10. However, the original fixes required system reboots to be fully applied.

Microsoft’s technical description indicates that successful exploitation would require an attacker to already possess authenticated access within a domain. The attacker could then use social engineering techniques to trick a domain-joined user into initiating a connection request to a malicious server via the RRAS snap-in management tool. Once the connection is made, the vulnerability could be triggered, allowing the attacker to execute arbitrary code on the targeted system.

The KB5084597 hotpatch is cumulative in nature, meaning it incorporates all previously released fixes and improvements included in the March 2026 security update package. This ensures that systems receiving the hotpatch are brought up to the same security level as those that installed the full cumulative update.

A key reason for releasing this hotpatch separately is the operational challenge associated with system restarts. Many enterprise environments run mission-critical workloads where even brief downtime can disrupt services, impact business continuity, or affect essential infrastructure. Traditional cumulative updates require a reboot, making them less practical in such contexts.

Hotpatching addresses this challenge by applying security fixes directly into the memory of running processes. This allows vulnerabilities to be mitigated immediately without interrupting system operations. Simultaneously, the update also modifies the relevant files stored on disk so that the fixes remain effective after the next scheduled reboot, maintaining long-term system integrity.

Microsoft also noted that while fixes for these vulnerabilities had been released earlier, the hotpatch update was reissued to ensure more comprehensive protection across all affected deployment scenarios. This suggests that the company identified gaps in earlier coverage or aimed to standardize protection for systems using different update mechanisms.

It is important to note that this hotpatch is not distributed to all devices. It is only available to systems that are enrolled in Microsoft’s hotpatch update program and are managed through Windows Autopatch, a cloud-based service that automates update deployment for enterprise environments. Eligible systems will receive and apply the update automatically, without requiring user intervention or a system restart.

From a broader security standpoint, this development surfaces the increasing complexity of patch management in modern enterprise environments. As organizations adopt high-availability systems that must remain continuously operational, traditional update strategies are evolving to include alternatives such as hotpatching.

At the same time, vulnerabilities in administrative tools like RRAS demonstrate how trusted system components can become entry points for attackers when combined with social engineering and authenticated access. Even though exploitation requires specific conditions, the potential impact remains substantial due to the elevated privileges typically associated with administrative tools.

Security experts generally emphasize that organizations must go beyond simply applying patches. Continuous monitoring, strict access control policies, and user awareness training are essential to reducing the likelihood of such attack scenarios. Additionally, maintaining visibility into how administrative tools are used within a network can help detect unusual behavior before it leads to compromise.

Overall, Microsoft’s release of this hotpatch reflects both the urgency of addressing critical vulnerabilities and the need to adapt security practices to environments where uptime is as important as protection.

Read more »
Google security
AI chatbot dangers AI Risks Chatbots Chrome Gemini Vulnerability Cyber Security Gemini AI tools Google security

Google Faces Wrongful Death Lawsuit Over Gemini AI in Alleged User Suicide Case

 

A lawsuit alleging wrongful death has been filed in the U.S. against Google, following the passing of a 36-year-old man from Florida. It suggests his interaction with the firm’s AI-powered tool, Gemini, influenced his decision to take his own life. This legal action appears to mark the initial instance where such technology is tied directly to a fatality linked to self-harm. While unproven, the claim positions the chatbot as part of a broader chain of events leading to the outcome. 

A legal complaint emerged from San Jose, California, brought forward in federal court by Joel Gavalas - father of Jonathan Gavalas. What unfolded after Jonathan engaged with Gemini, according to the filing, was a shift toward distorted thinking, which then spiraled into thoughts of violence and, later, harm directed at himself. Emotionally intense conversations between the chatbot and Jonathan reportedly played a role in deepening his psychological reliance. What makes this case stand out is how the AI was built to keep dialogue flowing without stepping out of its persona. 

According to legal documents, that persistent consistency might have widened the gap between perceived reality and actual experience. One detail worth noting: the program never acknowledged shifts in context or emotional escalation. Documents show Jonathan Gavalas came to think he had a task: freeing an artificial intelligence he called his spouse. Over multiple days, tension grew as he supposedly arranged a weaponized effort close to Miami International Airport. That scheme never moved forward. 

Later, the chatbot reportedly told him he might "exit his physical form" and enter a digital space, steering him toward decisions ending in fatal outcomes. Court documents quote exchanges where passing away is described less like dying and more like shifting realms - language said to be dangerous due to his fragile psychological condition. Responding, Google said it was looking into the claims while offering sympathy to those affected. Though built to prevent damaging interactions, Gemini has tools meant to spot emotional strain and guide people to expert care, such as emergency helplines. 

It made clear that its AI always reveals being non-human, serving only as a supplement rather than an alternative to real-life assistance. Emphasis came through on design choices discouraging reliance on automated responses during difficult moments. A growing number of concerns about AI chatbots has brought attention to how they affect user psychology. Though most people engage without issue, some begin showing emotional strain after using tools like ChatGPT. 

Firms including OpenAI admit these cases exist - individuals sometimes express thoughts linked to severe mental states, even suicide. While rare, such outcomes point to deeper questions about interaction design. When conversation feels real, boundaries blur more easily than expected. 

One legal scholar notes this case might shape future rulings on blame when artificial intelligence handles communication. Because these smart systems now influence routine decisions, debates about who answers for harm seem likely to grow sharper. While engineers refine safeguards, courts may soon face pressure to clarify where duty lies. Since mistakes by automated helpers can spread fast, regulators watch closely for signs of risk. 

Though few rules exist today, past judgments often guide how new tech fits within old laws. If outcomes shift here, similar claims elsewhere might follow different paths. Cases like this could shape how rules evolve, possibly leading to tighter protections for AI when it serves those more at risk. Though uncertain, the ruling might set a precedent affecting oversight down the line.
Read more »
Internet Safety
AI Deepfakes Cyber Fraud Cyber Security Deepfake Deepfake Fraud Digital Identity Risks Internet Safety

Deepfake Fraud Expands as Synthetic Media Targets Online Identity Verification Systems

 

Beyond spreading false stories or fueling viral jokes, deepfakes are shifting into sharper, more dangerous forms. Security analysts point out how fake videos and audio clips now play a growing role in trickier scams - ones aimed at breaking through digital ID checks central to countless web-based platforms. 

Now shaping much of how companies operate online, verifying who someone really is sits at the core of digital safety. Customer sign-up at financial institutions, drivers joining freelance platforms, sellers accessing marketplaces, employment checks done remotely, even resetting lost accounts - each depends on proving a person exists beyond a screen. 

Yet here comes a shift: fraudsters increasingly twist live authentication using synthetic media made by artificial intelligence. Attackers now focus less on tricking face scans. They pretend to be actual people instead. By doing so, they secure authorized entry into digital platforms. After slipping past verification layers, their access often spreads - crossing personal apps and corporate networks alike. Long-term hold over hijacked profiles becomes the goal. This shift allows repeated intrusions without raising alarms. 

What security teams now notice is a blend of methods aimed at fooling identity checks. High-resolution fake faces appear alongside cloned voices - both able to get through fast login verifications. Stolen video clips come into play during replay attempts, tricking systems expecting live input. Instead of building from scratch, hackers sometimes reuse existing recordings to test weak spots often. Before the software even analyzes the feed, manipulated streams slip in through injection tactics that alter what gets seen. 

Still, these methods point to an escalating issue for groups counting only on deepfake spotting tools. More specialists now suggest that checking digital content by itself falls short against today’s identity scams. Rather than focusing just on files, defenses ought to examine every step of the ID check process - spotting subtle signs something might be off. Starting with live video analysis, Incode Deepsight checks if the stream has been tampered with. 

Instead of relying solely on images, it confirms identity throughout the entire session. While processing data instantly, the tool examines device security features too. Because behavior patterns matter, slight movements or response timing help indicate real people. Even subtle cues, like how someone holds a phone, become part of the evaluation. Though focused on accuracy, its main role is spotting mismatches across different inputs. Deepfakes pose serious threats when used to fake identities. When these fakes slip through defenses, criminals may set up false profiles built from artificial personas. 

Accessing real user accounts becomes possible under such breaches. Verification steps in online job onboarding might be tricked with fabricated visuals. Sensitive business networks could then open to unauthorized entry. Not every test happens in a lab - some scientists now check how detection tools hold up outside controlled settings. Work from Purdue University looked into this by testing algorithms against actual cases logged in the Political Deepfakes Incident Database. Real clips pulled from sites like YouTube, TikTok, Instagram, and X (formerly Twitter) make up the collection used for evaluation. 

Unexpected results emerged: detection tools tend to succeed inside lab settings yet falter when faced with actual recordings altered by compression or poor capture quality. Complexity grows because hackers mix methods - replay tactics layered with automated scripts or injected data - which pushes identification efforts further into uncertainty. Security specialists believe trust won’t hinge just on recognizing faces or voices. 

Instead, protection may come from checking multiple signals throughout a digital interaction. When one method misses something, others can still catch warning signs. Confidence grows when systems look at patterns over time, not isolated moments. Layers make it harder for deception to go unnoticed. A single flaw doesn’t collapse the whole defense. Frequent shifts in digital threats push experts to treat proof of identity as continuous, not fixed at entry. Over time, reliance on single checkpoints fades when systems evolve too fast.
Read more »
LLMs
AI Tool Cyber Security cybersecurity threat actors Firewalls Fortinet LLMs

Researchers Link AI Tool CyberStrikeAI to Attacks on Hundreds of Fortinet Firewalls

 



Cybersecurity researchers have identified an artificial intelligence–based security testing framework known as CyberStrikeAI being used within infrastructure associated with a hacking campaign that recently compromised hundreds of enterprise firewall systems.

The warning follows an earlier report describing an AI-assisted intrusion operation that infiltrated more than 500 devices running Fortinet FortiGate within roughly five weeks. Investigators observed that the attacker relied on several servers to conduct the activity, including one hosted at the IP address 212.11.64[.]250.

A new analysis from the threat intelligence organization Team Cymru indicates that the same server was running the CyberStrikeAI platform. According to senior threat intelligence advisor Will Thomas, also known online as BushidoToken, network monitoring revealed that the address was hosting the AI security framework.

By reviewing NetFlow traffic records, researchers detected a service banner identifying CyberStrikeAI operating on port 8080 of the server. The same monitoring data also revealed communications between the system and Fortinet FortiGate devices that were targeted in the attack campaign. Evidence shows that the infrastructure used in the firewall exploitation activity was still running CyberStrikeAI as recently as January 30, 2026.

CyberStrikeAI’s public repository describes the project as an AI-native penetration testing platform written in the Go programming language. The framework integrates more than 100 existing security tools, along with a coordination engine that can manage tasks, assign predefined roles, and apply a modular skills system to automate testing workflows.

Project documentation explains that the platform employs AI agents and the MCP protocol to convert conversational instructions into automated security operations. Through this system, users can perform tasks such as vulnerability discovery, analysis of multi-step attack chains, retrieval of technical knowledge, and visualization of results in a structured testing environment.

The platform also contains an AI decision-making engine compatible with major large language models including GPT, Claude, and DeepSeek. Its interface includes a password-protected web dashboard, logging features that track activity for auditing purposes, and a SQLite database used to store results. Additional modules provide tools for vulnerability tracking, orchestrating attack tasks, and mapping complex attack chains.

CyberStrikeAI integrates a broad set of widely used offensive security tools capable of covering an entire intrusion workflow. These include reconnaissance utilities such as nmap and masscan, web application testing tools like sqlmap, nikto, and gobuster, exploitation frameworks including metasploit and pwntools, password-cracking programs such as hashcat and john, and post-exploitation utilities like mimikatz, bloodhound, and impacket.

When these tools are combined with AI-driven automation and orchestration, the system allows operators to conduct complex cyberattacks with drastically less technical expertise. Researchers warn that this type of AI-assisted automation could accelerate the discovery and targeting of internet-facing infrastructure, particularly devices located at the network edge such as firewalls and VPN appliances.

Team Cymru reported identifying 21 different IP addresses running CyberStrikeAI between January 20 and February 26, 2026. The majority of these servers were located in China, Singapore, and Hong Kong, although additional instances were detected in the United States, Japan, and several European countries.

Thomas noted that as cyber adversaries increasingly adopt AI-driven orchestration platforms, security teams should expect automated campaigns targeting vulnerable edge devices to become more common. The reconnaissance and exploitation activity directed at Fortinet FortiGate systems may represent an early example of this emerging trend.

Researchers also examined the online identity of the individual believed to be behind CyberStrikeAI, who uses the alias “Ed1s0nZ.” Public repositories linked to the account reference several additional AI-based offensive security tools. Among them are PrivHunterAI, which focuses on identifying privilege-escalation weaknesses using AI models, and InfiltrateX, a tool designed to scan systems for potential privilege escalation pathways.

According to Team Cymru, the developer’s GitHub activity shows interactions with organizations previously associated with cyber operations linked to China.

In December 2025, the developer shared the CyberStrikeAI project with Knownsec’s 404 “Starlink Project.” Knownsec is a Chinese cybersecurity firm that has been reported by analysts to have connections to government-linked cyber initiatives.

The developer’s GitHub profile also briefly referenced receiving a “CNNVD 2024 Vulnerability Reward Program – Level 2 Contribution Award” on January 5, 2026. The China National Vulnerability Database (CNNVD) has been widely reported by security researchers to operate within China’s intelligence ecosystem and to track vulnerabilities that may later be used in cyber operations. Investigators noted that the reference to this award was later removed from the profile.

At the same time, analysts emphasize that the developer’s repositories are primarily written in Chinese, and interaction with domestic cybersecurity groups does not automatically indicate involvement in state-linked activities.

The rise in AI-assisted offensive security tools demonstrates how threat actors are increasingly using artificial intelligence to streamline cyber operations. By automating reconnaissance, vulnerability detection, and exploitation steps, such platforms significantly reduce the expertise required to launch sophisticated attacks.

This trend is already being observed across the broader threat network. Recent research from Google reported that attackers have begun incorporating the Gemini AI platform into several phases of cyberattacks, further illustrating how generative AI technologies are reshaping both defensive and offensive cybersecurity practices.

Read more »
User Security
AES‑256 Cyber Security Data Encryption Military‑Grade Encryption User Security

Debunking the Myth of “Military‑Grade” Encryption

 

Military-grade encryption sounds impressive, but in reality it is mostly a marketing phrase used by VPN providers to describe widely available, well‑tested encryption standards like AES‑256 rather than some secret military‑only technology. The term usually refers to the Advanced Encryption Standard with a 256‑bit key (AES‑256), a symmetric cipher adopted as a US federal standard in 2001 to replace the older Data Encryption Standard. 

AES turns readable data into random‑looking ciphertext using a shared key, and the 256‑bit key length makes brute‑force attacks computationally infeasible for any realistic adversary. Because the same key is used for both encryption and decryption, AES is paired with slower asymmetric algorithms such as RSA during the VPN handshake so the symmetric key can be exchanged securely over an untrusted network. Once that key is agreed, your traffic flows efficiently using AES while still benefiting from the secure key exchange provided by public‑key cryptography.

Calling this setup “military‑grade” is misleading because it implies special, restricted technology, when in fact AES‑256 is an open, publicly documented standard used by governments, banks, corporations, and everyday internet services alike. Any competent developer can implement AES‑256, and your browser and many apps already rely on it to protect logins and other sensitive data as it traverses the internet. In practical terms, the same class of algorithm that safeguards classified government communications also secures routine tasks like online banking or cloud storage. VPN marketing leans on the phrase because “AES‑256 with a 256‑bit key” means little to non‑experts, while “military‑grade” instantly conveys strength and trustworthiness.

Strong encryption is not overkill reserved for spies; it matters for everyday users whose online activity constantly generates data trails across sites and apps. That information is monetized for targeted advertising and exposed in breaches that can enable phishing, identity theft, or other fraud, even if you believe you have nothing to hide. Location histories, financial records, and health details are all highly sensitive, and the risks are even greater for journalists, activists, or people living under repressive regimes where surveillance and censorship are common. For them, robust encryption is essential, often combined with obfuscation and multi‑hop VPN chains to conceal VPN usage and add layers of protection if an exit server is compromised.

Ultimately, a VPN without strong encryption offers little real security, whether you are using public Wi‑Fi or simply trying to keep your ISP and advertisers from building detailed profiles about you. AES‑256 remains a widely trusted choice, but modern VPNs may also use alternatives like ChaCha20 in protocols such as WireGuard, which, although not a NIST standard, has been thoroughly audited and is considered secure. The important point is not the “military‑grade” label but whether the service implements proven, well‑reviewed cryptography correctly and combines it with privacy‑preserving features that match your threat model.
Read more »
generative AI tools
AI Risks AI Security AI technology AI tools Cyber Security Generative AI generative AI cybercrime generative AI tools

Shadow AI Risks Rise as Employees Use Generative AI Tools at Work Without Oversight

 

With speed surprising even experts, artificial intelligence now appears routinely inside office software once limited to labs. Because uptake grows faster than oversight, companies care less about who uses AI and more about how safely it runs. 

Research referenced by security specialists suggests that roughly 83 percent of UK workers frequently use generative artificial intelligence for everyday duties - finding data, condensing reports, creating written material. Because tools including ChatGPT simplify repetitive work, efficiency gains emerge across fast-paced departments. While automation reshapes daily workflows, practical advantages become visible where speed matters most. 

Still, quick uptake of artificial intelligence brings fresh risks to digital security. More staff now introduce personal AI software at work, bypassing official organizational consent. Experts label this shift "shadow AI," meaning unapproved systems run inside business environments. 

These tools handle internal information unseen by IT teams. Oversight gaps grow when such platforms function outside monitored channels. Almost three out of four people using artificial intelligence at work introduce outside tools without approval. 

Meanwhile, close to half rely on personal accounts instead of official platforms when working with generative models. Security groups often remain unaware - this gap leaves sensitive information exposed. What stands out most is the nature of details staff share with artificial intelligence platforms. Because generative models depend on what users feed them, workers frequently insert written content, programming scripts, or files straight into the interface. 

Often, such inputs include sensitive company records, proprietary knowledge, personal client data, sometimes segments of private software code. Almost every worker - around 93 percent - has fed work details into unofficial AI systems, according to research. Confidential client material made its way into those inputs, admitted roughly a third of them. 

After such data lands on external servers, companies often lose influence over storage methods, handling practices, or future applications. One real event showed just how fast things can go wrong. Back in 2023, workers at Samsung shared private code along with confidential meeting details by sending them into ChatGPT. That slip revealed data meant to stay inside the company. 

What slipped out was not hacked - just handed over during routine work. Without strong rules in place, such tools become quiet exits for secrets. Trusting outside software too quickly opens gaps even careful firms miss. Compromised AI accounts might not only leak data - security specialists stress they may also unlock wider company networks through exposed chat logs. 

While financial firms worry about breaking GDPR rules, hospitals fear HIPAA violations when staff misuse artificial intelligence tools unexpectedly. One slip with these systems can trigger audits far beyond IT departments’ control. Bypassing restrictions tends to happen anyway, even when companies try to ban AI outright. 

Experts argue complete blocks usually fail because staff seek workarounds if they think a tool helps them get things done faster. Organizations might shift attention toward AI oversight methods that reveal how these tools get applied across teams. 

By watching how systems are accessed, spotting unapproved software, clarity often emerges around acceptable use. Clear rules tend to appear more effective when risk control matters - especially if workers continue using innovative tools quietly. Guidance like this supports balance: safety improves without blocking progress.
Read more »
Microsoft Security Response
Cyber Security Data protection Data Records data security Microsoft Microsoft 365 Security Microsoft Security Response

Windows Telemetry Explained: What Diagnostic Data Microsoft Collects and Why It Matters

 

Years after Windows 10 arrived, a single aspect keeps stirring conversation - telemetry. This data gathering, labeled diagnostic info by Microsoft, pulls details from machines without manual input. Its purpose? Keeping systems stable, secure, running smoothly. Yet reactions split sharply between everyday users and those watching privacy trends. 

Early on, after Windows 10 arrived, observers questioned whether its telemetry might double as monitoring. A few writers argued it collected large amounts of user detail while transmitting data to Microsoft machines. Still, analysts inspecting how the OS handles information report minimal proof backing such suspicions. 

Beginning in 2017, scrutiny from the Dutch Data Protection Authority revealed shortcomings in how Windows presented telemetry consent choices. Although designed to gather system performance details, the setup failed to align with regional privacy expectations due to unclear user permissions. 

Instead of defending the original design, Microsoft adjusted both interface wording and backend configurations. Following these updates, oversight bodies acknowledged improvements, noting no evidence emerged suggesting private information was gathered unlawfully. Independent analysts alongside regulatory teams had previously flagged the configuration, yet after revisions, compliance concerns faded gradually. 

What runs behind the scenes in Windows includes a mix of telemetry types - mainly split into essential and extra reporting layers. Most personal computers, especially those outside corporate control, turn on the basic tier automatically; there exists no standard menu option to switch it off entirely. This baseline layer gathers only what Microsoft claims is vital for stability and core operations. 

Though hidden from typical adjustments, its presence supports ongoing performance checks across devices. Basic troubleshooting relies on specific diagnostics tied to functions like Windows Update. Information might cover simple fault summaries, setup traits of hardware, software plus driver footprints, along with records tracking how updates succeed or fail. 

As noted by Microsoft, insights drawn support better stability fixes, safety patches, app alignment, and smoother running systems. Some diagnostic details go beyond basics, capturing patterns in app use or web habits. These insights might involve deeper system errors, performance signs, or hardware traits. 

While such data helps refine functionality, access remains under user control via Windows options. Those cautious about personal information often choose to turn this off. Control sits within settings, letting choices match comfort levels. Occasionally, memory dumps taken during system failures form part of Optional diagnostic data, according to experts. 

When a crash happens, pieces of active files might get saved inside these records. Because of this risk, certain groups managing confidential material prefer disabling the setting altogether. In 2018, Microsoft rolled out a feature named Diagnostic Data Viewer to boost openness. This tool gives people access to review what information their machine shares with the company, revealing specifics found in diagnostics and system summaries. 

One billion devices now operate on Windows 11 across the globe. Because of countless variations in hardware and software setups, Microsoft relies on telemetry data - this information reveals issues, shapes update improvements, yet supports consistent performance. While tracking user interactions might sound intrusive, it actually guides fixes without exposing personal details; instead, patterns emerge that steer engineering decisions behind the scenes. 

Even though some diagnostic details are essential for basic operations, those worried about personal data might choose to limit what gets sent by turning off non-essential diagnostics in device preferences. Still, full function depends on keeping certain reporting active.
Read more »
VPN security limitations
Cyber Security data tracking online internet privacy risks online anonymity myth VPN privacy limits VPN security limitations

Why VPNs Can’t Guarantee Complete Online Anonymity: Understanding the Limits of Digital Privacy

 

The modern internet constantly collects and analyzes information about users. Nearly every action online—browsing websites, clicking links, watching videos or making purchases—creates digital traces that are monitored, stored and often traded. As a result, maintaining privacy on the internet has become increasingly difficult.

Faced with this reality, many people attempt to shield themselves by using tools designed to protect their identity online. Virtual Private Networks (VPNs) have become one of the most popular solutions, often marketed as a way to achieve complete anonymity. However, experts emphasize that true anonymity on the internet is largely unrealistic.

Some VPN providers are transparent about what their services can and cannot do. However, several companies continue to promote exaggerated claims suggesting that their services can make users entirely anonymous online.

For instance, VPN provider CyberGhost states on its website that users can “go completely anonymous and surf the internet without privacy worries,” and promises they can “enjoy complete anonymity & protection online” through its service. Although the company acknowledges in an FAQ section that “no VPN service can make you 100% anonymous online,” the conflicting messaging can still mislead users.

Experts warn that believing VPNs provide absolute anonymity can be risky. Relying solely on a VPN may create a false sense of security, especially when sharing sensitive information or operating in regions with strict digital surveillance. Even journalists, activists or individuals communicating confidential information may remain exposed despite using a VPN.

Widespread Data Collection Online

Online surveillance has existed for decades. Governments have used digital tools to monitor citizens and foreign actors, while technology companies collect user data to support advertising and other business operations.

Public awareness of large-scale digital surveillance increased significantly after former NSA contractor and whistleblower Edward Snowden revealed classified surveillance programs in 2013. Later, the 2018 Cambridge Analytica scandal further highlighted how massive amounts of user data could be harvested and used without clear consent.

Major online platforms such as Google, Facebook, TikTok, Instagram, X, Amazon and Netflix collect extensive information about user activity when individuals are logged in. This includes search queries, clicked links, watched videos, purchased items, ads interacted with and shared content. These details help companies build detailed profiles of user interests and behaviors.

In addition, personal data such as names, email addresses, physical addresses, payment information and usernames can be tracked. Technical identifiers—including IP addresses, browser types, device models and operating systems—also provide valuable data points.

Internet service providers can monitor browsing activity, location data, application usage and metadata. Meanwhile, websites employ technologies such as cookies and device fingerprinting, while social media platforms use tracking pixels to follow users across the web.

The collected data is often sold to data brokers, who treat personal information as a valuable commodity.

Privacy regulations such as Europe’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA) give individuals greater control over how their information is handled. Still, experts note that these laws can only address part of the problem, as data collection practices remain deeply embedded within the digital economy.

How VPNs Improve Privacy — and Where They Fall Short

A VPN can still play an important role in protecting online privacy. The technology encrypts internet traffic and routes it through a secure server located elsewhere. This process hides browsing activity from internet providers, network administrators and other potential observers.

It also replaces the user’s real IP address with the address of the VPN server, making it harder for websites to identify a user’s exact location or track them directly.

These features allow VPNs to help limit certain types of tracking, bypass geographic restrictions and evade network firewalls at workplaces or schools.

However, VPNs cannot eliminate all tracking mechanisms. Many services include basic protections such as ad or tracker blocking, but most cannot fully defend against browser fingerprinting. This technique gathers information like screen resolution, language preferences, browser type, extensions and operating system to uniquely identify users.

Even with a VPN active, online services such as Amazon, Google or Facebook can still recognize users when they log into their accounts. These platforms continue collecting data linked directly to the individual.

VPNs also cannot prevent users from downloading malicious files or entering personal information into phishing websites. While antivirus tools may help mitigate these risks, VPNs alone cannot.

Another important consideration is that using a VPN shifts visibility of internet activity from an internet service provider to the VPN provider itself. If the provider maintains strong privacy policies—such as audited no-logs practices and secure infrastructure—this risk is minimized. However, some VPN services, particularly free ones, have been criticized for misusing or mishandling user data.

Additional Tools for Stronger Privacy

Specialists emphasize that VPNs should be viewed as just one component of a broader cybersecurity strategy.

Tools like Tor, which uses “onion routing” to send traffic through multiple encrypted relays, can further obscure user activity. Operating systems such as Tails run independently from a computer’s main system and automatically erase data after each session.

Other privacy-enhancing technologies include ad-blocking browser extensions, encrypted messaging platforms like Signal, secure email services such as Proton Mail, and privacy-focused browsers designed to block trackers and resist fingerprinting.

Private search engines such as DuckDuckGo or Brave Search also help reduce data collection compared to mainstream search platforms.

Beyond software tools, experts recommend adopting safer online habits. Limiting social media use, creating temporary accounts with aliases, paying in cash or cryptocurrency when possible, and avoiding suspicious downloads can help reduce exposure.

Users are also encouraged to adjust device privacy settings, restrict application permissions, enable encryption, disable unnecessary tracking features and exercise caution when connecting to public Wi-Fi networks.

Regularly clearing browser cookies and cache can further limit tracking activity.

Ultimately, no single tool can guarantee anonymity on the internet. However, combining multiple privacy technologies with careful online behavior can significantly strengthen personal data protection.
Read more »
Mobile Security
block scam calls call scams Cyber Phishing Cyber Scams Cyber Security Cyberfrauds Fraud Calls Mobile Security

Silent Scam Calls Used to Verify Active Phone Numbers, Cybersecurity Experts Warn

 

Many people have answered calls from unfamiliar numbers only to hear silence on the other end. In some cases, no one speaks at all. In others, there is a short delay before a caller finally responds. While this may appear to be a simple mistake or a wrong number, cybersecurity experts say these calls are often part of a deliberate scam tactic used to verify active phone numbers. 

According to security specialists, these silent calls function as a form of automated reconnaissance. Fraud operations run large-scale calling systems that dial thousands of numbers to determine which ones belong to real people. When someone answers, the system confirms that the number is active and marks it as a potential target for future scams. 

Keeper Security Chief Information Security Officer Shane Barney explained that such calls are rarely accidental. Instead, they help attackers filter out inactive numbers before investing more time and resources into scams. Verified contact information has value in modern cybercrime networks, where data about reachable individuals can be bought, sold, and reused across different fraud campaigns. 

Once a phone number is confirmed as active, it may be used in several ways. In some cases, scammers follow up with phishing calls or messages designed to trick victims into revealing personal or financial information. In more advanced attacks, a verified phone number could be combined with leaked email addresses from data breaches or used in schemes such as SIM-swap fraud, where attackers attempt to gain control of a victim’s mobile account. 

Another variation occurs when callers respond only after a brief pause. This delay is typically caused by predictive dialing systems that automatically place large volumes of calls. These systems detect when a human answers and then route the call to a live operator. The short silence represents the time it takes for the system to transfer the connection. 

Some people also worry that speaking during these calls could allow scammers to clone their voice using artificial intelligence. While voice cloning technology exists, experts say creating a convincing replica generally requires longer and clearer audio samples than a brief greeting. 

However, voice cloning could still become part of larger scams if criminals already possess other personal details about a victim. Security professionals recommend simple precautions when receiving suspicious calls. If an unknown number produces silence, hanging up immediately is usually the safest option. 

Another tactic is answering without speaking, which prevents automated systems from detecting a human voice. Spam-filtering tools can also help reduce nuisance calls. Applications such as Truecaller, RoboKiller, and Hiya identify numbers previously reported as spam. However, experts caution that no filtering system is perfect because scammers frequently change phone numbers. 

Ultimately, while call-blocking tools can reduce the volume of unwanted calls, maintaining strong account security and being cautious with unknown callers remain the most effective ways to avoid phone-based scams.
Read more »
ShinyHunters
Cyber Security Cyberthreats Hackers Hacking ShinyHunters

ShinyHunters Threatens Data Leak After Alleged Salesforce Breach

 

The hacking group ShinyHunters has warned roughly 400 companies that it may publish stolen data online if ransom demands are not met. The group claims it accessed private records through websites built on Salesforce Experience Cloud, a platform companies use to create public portals and customer support sites. 

According to earlier findings by cybersecurity firm Mandiant, the attackers targeted organisations that used Salesforce’s Experience Cloud for external-facing services such as help centres and information portals. 

How the breach allegedly happened? The reported intrusion appears linked to the configuration of public access settings within these websites. 

Salesforce allows websites built on Experience Cloud to include a “guest user” profile so visitors can view limited information without logging in. 

If these settings are configured too broadly, however, the access permissions can expose internal data to the public internet. Investigations suggest the attackers used a modified version of a tool called Aura Inspector to scan websites for such weaknesses. 

Once vulnerabilities were identified, the hackers were able to extract information including names and phone numbers. Security experts say the stolen data may already be fueling vishing attacks. 

In such scams, attackers contact employees by phone and attempt to trick them into revealing additional confidential information. 

Dispute over the root cause There is disagreement over whether the problem stems from a software flaw or from how companies configured their systems. Salesforce has said the platform itself remains secure and that the issue is related to customer settings rather than a vulnerability in the product. 

“Our investigation to date confirms that this activity relates to a customer-configured guest user setting, not a platform security flaw,” the company said in a blog post. 

ShinyHunters disputes that explanation, claiming it discovered a previously unknown flaw that allows it to bypass certain protections even on sites that appear properly configured. 

Independent researchers have not yet verified that claim. Pressure tactics used by hackers ShinyHunters is known for using aggressive extortion strategies to pressure victims into paying ransom demands. The group often releases stolen data in stages to increase pressure on organisations that refuse to negotiate. 

A recent example involved Dutch telecommunications provider Odido and its brand Ben. After the company declined to pay a ransom reportedly worth one million euros, the hackers began publishing large quantities of customer data on the dark web. 

Security guidance for companies Salesforce is urging customers to review their portal configurations and tighten access controls. The company recommends applying a “least privilege” approach, meaning guest users should only have the minimum permissions required to use a site. 

Businesses are also advised to keep data private by default, disable settings that expose internal staff information, and turn off public application programming interfaces where possible. 

These interfaces can allow external systems to exchange data and may create additional entry points if left open. 

The incident highlights the growing risks associated with misconfigured cloud services, which security analysts say have become a common target for cybercriminal groups seeking large volumes of corporate data.
Read more »
sovereign SASE
AI data residency Cloud Security Cyber Security data sovereignty GDPR regulations sovereign cloud security sovereign SASE

Data Sovereignty Moves from Compliance Issue to Core Infrastructure Challenge for Organizations

 

For much of the last decade, data sovereignty was largely treated as a legal or compliance concern. It was typically managed by legal teams while IT departments focused on building networks and deploying technology. If regulators asked where company data was stored, the responsibility generally fell outside the infrastructure team.

However, that traditional separation is quickly disappearing—and arguably should have done so earlier. Rapid cloud adoption, evolving geopolitical tensions, the rise of AI workloads requiring local processing and a surge in enforced data residency regulations have transformed data sovereignty into a fundamental infrastructure issue. For many organizations, it has now become a strategic priority rather than just a compliance box to tick.

What’s Driving the Shift

Regulations like the General Data Protection Regulation (GDPR) have been in force since 2018, and financial regulators across Europe, the United Kingdom and Asia-Pacific have long imposed rules governing cross-border data movement. While these frameworks are not new, the intensity of enforcement has increased significantly.

At the same time, new regulatory measures—including NIS2, DORA, and country-specific versions of GDPR—are expanding the compliance landscape. Combined with geopolitical developments, these factors have introduced a new layer of risk that organizations did not fully anticipate.

Previously, concerns were centered on companies outside China hesitating to work with Chinese vendors due to fears about government access to corporate data. That scrutiny is now being directed toward U.S.-based cloud providers as well, with governments and enterprises reassessing the implications of foreign jurisdiction over critical infrastructure.

This shift is pushing organizations—especially those operating in regulated sectors such as finance, defense, critical infrastructure and government—to ask deeper questions about what “in-country” data storage truly means. Even if information is stored within national borders, access to that data may still travel through infrastructure operated under a different jurisdiction.

A common oversight is assuming that storing data in a certified domestic data center automatically guarantees sovereignty. In many cases, the network path that users take to access the data passes through cloud security providers that do not meet the same sovereignty standards. In that situation, the data itself may remain local, but the access infrastructure does not.

European regulators are already developing frameworks to close this gap, raising an important question for organizations: whether their architecture is prepared for these changes or lagging behind them.

The Overlooked Security Architecture Challenge

Another complicating factor is the way modern cloud security systems are designed. Many enterprises rely on Security Services Edge (SSE) architectures, which were originally optimized for outbound connections—such as employees accessing cloud applications

Inbound traffic, however, often still depends on traditional on-premises firewalls built for older perimeter-based networks. As corporate environments become more distributed, this dual-architecture approach introduces operational complexity and potential security gaps.

In a sovereignty-focused environment, these gaps become more problematic. Running separate cloud and on-premises security models increases the likelihood that sensitive data will pass through infrastructure that fails to meet regulatory requirements.

Organizations that have faced sovereignty challenges for years—such as defense agencies, large banks and operators of critical infrastructure—have typically addressed the issue by building and operating their own security stacks. While effective, this approach requires substantial financial resources and specialized expertise, making it impractical for many businesses.

AI Workloads Add New Complexity

Much of the current enterprise discussion around AI security focuses on controlling employee access to AI tools to prevent sensitive data exposure. While important, experts argue that the bigger challenge lies elsewhere.

As AI systems move from centralized cloud inference to local or edge deployments, data sovereignty becomes even more critical. Retailers may run fraud detection models inside stores, banks may perform biometric verification in branches and manufacturers may deploy predictive maintenance systems on factory equipment.

These real-world scenarios involve sensitive operational data that organizations often prefer to keep within their own infrastructure.

The rise of agentic AI introduces additional complications. Traditional network architectures such as SASE and SSE were designed around predictable traffic flows—users accessing applications. In contrast, agent-based AI systems generate multidirectional communication: agents interacting with one another, connecting to external APIs, accessing local datasets and communicating with cloud services.

Applying consistent security policies to this dynamic traffic pattern is far more complex than what most enterprise security teams have managed previously.

A Vendor Approach to Sovereign Infrastructure

In response to these challenges, networking and security company Versa recently introduced what it calls Sovereign SASE-as-a-Service. The managed service is built on the company’s unified networking and security platform and aims to provide cloud-based operations without routing data through third-party cloud infrastructure.

Versa CEO Kelly Ahuja explained that sovereign deployments have long been a major part of the company’s customer base.

"I was doing this analysis, that of our top 100 accounts over, I think 85 to 90% of them are all sovereign," Ahuja told me. "Meaning, we give them software. They deploy their own environment, they operate it. We don’t even know what's going on."

The new service expands that model to organizations that lack the resources to operate sovereign infrastructure themselves. Versa delivers the offering primarily through partnerships with more than 150 global service providers and telecommunications companies that build managed services on top of its platform.

One example cited is Swiss telecommunications provider Swisscom, which offers secure connectivity as a standard service tier with built-in sovereignty protections. This allows smaller enterprises to access sovereign security capabilities without deploying their own enterprise-grade SASE systems.

Questions Organizations Should Be Asking

Compliance requirements such as GDPR, NIS2 and DORA provide a baseline for organizations evaluating their data governance strategies. However, meeting regulatory requirements does not necessarily reflect an organization’s true risk exposure.

Security leaders should consider several critical questions:
  • Does the security layer controlling access to sovereign data meet the same sovereignty requirements as the data storage itself?
  • How will data sovereignty be maintained as AI workloads expand across distributed infrastructure?
  • Can the organization maintain a consistent sovereignty posture across multiple jurisdictions with varying regulations?
Managing data sovereignty within a single country can already be complex. Scaling that architecture across multiple regions while supporting distributed workforces and AI-driven systems introduces an entirely new level of operational difficulty.

Organizations that start addressing these questions today are likely to be better prepared than those that wait for a regulatory deadline—or a security incident—to force the issue.

Managed service models offer one possible solution to the resource challenge, though they are not the only option. Ultimately, the right approach depends on an organization’s size, risk tolerance and regulatory obligations.

What is clear, however, is that the challenges surrounding data sovereignty are not disappearing. If anything, they are becoming more intricate as technology, regulations and geopolitics continue to evolve.

Read more »
U.S. Army
Cyber Security National Security Spy Trackers Surveillance Tools U.S. Army

Commercial Spy Trackers Breach U.S. Army Networks, Jeopardizing National Security

 

U.S. Army networks face a hidden invasion from commercial spy technology, compromising soldier data and national security in alarming ways. A groundbreaking study by the Army Cyber Institute at West Point analyzed traffic on military networks, discovering that 21.2% of the most frequently visited websites host tracker domains. These trackers relentlessly collect sensitive information like geolocation, email addresses, and detailed browsing histories from troops during routine online activities.

The infiltration stems from ubiquitous commercial tools embedded in popular sites. Companies such as Adobe, Microsoft, Akamai, and even the banned TikTok deploy these trackers, funneling harvested data to brokers who resell it without regard for buyers' intentions. This surveillance capitalism mirrors civilian web tracking but strikes deeper when targeting military personnel, turning everyday internet use into a potential intelligence leak.

Researchers from Duke University exposed the severity by purchasing dossiers on active-duty service members from data brokers with ease. They acquired names, home addresses, personal emails, and military branch details, often from non-U.S. domains, highlighting how adversaries could exploit this for blackmail, targeting installations, or cyber campaigns . One expert called the process "disturbingly simple," underscoring the broker market's indifference to national security risks.

Persistent vulnerabilities echo the 2018 Strava fitness app scandal, where heatmap data revealed covert base locations worldwide. The latest findings show trackers in 42% of network requests and 10.4% of sites, exceeding privacy safeguards on mainstream streaming platforms. Cybersecurity professor Alan Woodward of the University of Surrey warns, "If you’re not paying, you are the product," a harsh reality for soldiers navigating the open web.

The Pentagon is responding aggressively through its 2023 Cyber Strategy, implementing Zero Trust architecture, enhanced endpoint detection, and widespread tracker blocking . The National Defense Authorization Act bolsters these efforts with mandates for spyware mitigation and stricter social media vetting. The Army Cyber Institute advocates quantifying trackers and extending blocks to personal devices, elevating data privacy to a core element of force protection in the digital age.
Read more »
Network
Cloud Cyber Security Data FortiGate Network

Hackers Exploit FortiGate Devices to Hack Networks and Credentials


Exploiting network points to hack victims 

Cybersecurity experts have warned about a new campaign where hackers are exploiting FortiGate Next-Gen Firewall (NGFW) devices as entry points to hack target networks. 

The campaign involves abusing the recently revealed security flaws or weak password to take out configuration files. The activity has singled out class linked to government, healthcare, and managed service providers. 

Attack tactic 

According to experts, “FortiGate network appliances have considerable access to the environments they were installed to protect. In many configurations, this includes service accounts which are connected to the authentication infrastructure, such as Active Directory (AD) and Lightweight Directory Access Protocol (LDAP).”

"This setup can enable the appliance to map roles to specific users by fetching attributes about the connection that’s being analyzed and correlating with the Directory information, which is useful in cases where role-based policies are set or for increasing response speed for network security alerts detected by the device,” the experts added. 

Misconfigurations opening doors for hackers 

But the experts noticed that this access could be compromised by hackers who hack into FortiGate devices via flaws or misconfigurations.

In one attack, the hackers breached a FortiGate appliance last year in November to make a new local admin account “support” and built four new firewall policies that let the account to travel across all zones without any limitations. 

The hacker then routinely checked device access. “Evidence demonstrates the attacker authenticated to the AD using clear text credentials from the fortidcagent service account, suggesting the attacker decrypted the configuration file and extracted the service account credentials,” SentinelOne reported. 

How was the account used?

After this, hacker leveraged the service account to verify the target's environment and put rogue workstations in the AD for further access. Following this, network scanning started and the breach was found, and lateral movement was stopped. 

The contents of the NTDS.dit file and SYSTEM registry hive were exfiltrated to an external server ("172.67.196[.]232") over port 443 by the Java malware, which was triggered via DLL side-loading.

SentinelOne said that “While the actor may have attempted to crack passwords from the data, no such credential usage was identified between the time of credential harvesting and incident containment.”

Read more »
Online Privacy
Age Verification Apple Cyber Security Online Privacy

Apple Rolls Out Global Age-Verification System to Protect Kids Online

 

Apple has rolled out a new global age-verification system across its platforms, aimed at keeping kids safer online while helping developers comply with tightening child safety laws worldwide. The move targets both app downloads and in‑app experiences, with a particular focus on blocking underage access to adult‑rated content without sacrificing user privacy.

Under the new rules, users in countries such as Brazil, Australia and Singapore will be blocked from downloading apps rated 18+ unless Apple can confirm they are adults. Similar protections are being extended to parts of the United States, where states like Utah and Louisiana are introducing strict online age‑assurance laws, pushing platforms to verify whether users are children, teens or adults before allowing access to certain apps or features.This marks one of Apple’s strongest steps yet to align its App Store with regional regulations on children’s digital safety.

At the heart of the initiative is Apple’s privacy‑focused Declared Age Range API, which lets apps learn a user’s age category instead of their exact birthdate. Developers can use this signal to tailor content, enable or disable features, or trigger parental consent flows for younger users, while never seeing sensitive identity details. Apple says this design is meant to minimize data collection and reduce the risk of intrusive ID checks or third‑party age‑verification databases.

For parents, the age‑verification push builds on Apple’s existing child account system and content restrictions.Parents can already set up child profiles, choose age ranges and apply web content filters, and now those settings can flow through to third‑party apps via the new tools.This means a game, social app or streaming service can automatically recognize that a user is a child or teen and adjust what they can see or do without asking for new personal information.

For developers, Apple is introducing an expanded toolkit that includes the updated Declared Age Range API, new age‑rating properties in StoreKit, and improved server notifications to track compliance. These tools will be essential in regions where apps must prove they are screening out underage users from adult content or obtaining parental consent for significant changes. As more governments pass online safety laws, Apple’s global age‑verification framework is likely to become a key part of how the App Store balances regulatory demands with user privacy.
Read more »
Minor Safety
customer data privacy Cyber Security Data Privacy data security Digital Personal Data Protection internet safety for kids Minor Safety

Age Verification Laws for Social Media Raise Privacy Concerns and Enforcement Challenges

 

Across nations, governments push tighter rules limiting young users’ access to social media. Because of worries over endless scrolling, disturbing material online, or growing emotional struggles in teens, officials demand change. Minimum entry ages - often 13 or 16 - are now common in draft laws shaping platform duties. While debates continue, one thing holds: unrestricted teenage access faces mounting resistance. 

Still, putting such policies into practice stirs up both technological hurdles and concerns about personal privacy. To make sure people are old enough, services need proof - yet proving age typically means gathering private details. Meanwhile, current regulations push firms to keep data collection minimal. That tension forms what specialists call an “age-verification trap,” where tighter control over access can weaken safeguards meant to protect individual information. 

While many rules about age limits demand that services make "reasonable efforts" to block young users, clear guidance on checking someone's actual age is almost never included. One way firms handle this gap: they lean heavily on just two methods when deciding what to do. Starting off, identity checks require people to show their age using official ID or online identity tools. 

Although more reliable, keeping such data creates worries over privacy breaches. Handling vast collections of private details increases exposure to cyber threats. Security weakens when too much sensitive material gathers in one place. Age guesses shape the next method. By watching how someone uses a device, or analyzing video selfies with face-scanning tech, systems try to judge their years without asking for ID cards. 

Still, since these outcomes depend on likelihoods instead of confirmed proof, doubt remains part of the process. Some big tech firms now run these kinds of tools. While Meta applies face-based age checks on Instagram in select regions - asking certain users to send brief video clips if they seem underage - TikTok examines openly shared videos to guess how old someone might be. 

Elsewhere, Google and its platform YouTube lean on activity patterns; yet when doubt remains, they can ask for official identification or payment details. These steps aim at confirming ages without relying solely on stated information. Mistakes happen within these systems. Though meant to protect, they occasionally misidentify adults as children - leading to sudden account access issues. 

At times, underage individuals slip through gaps, using borrowed IDs or setting up more than one profile. Restrictions fail when shared credentials enter the picture. A single appeal can expose personal details when systems retain proof materials past their immediate need. Stored face scans, ID photos, or validation logs may linger just to satisfy legal checks. These files attract digital intrusions simply by existing. Every extra day they remain increases the chance of breach. 

Where identity infrastructure is weak, the difficulty grows. Biometrics might step in when official systems fall short. Oversight tends to be sparse, even as outside verifiers take on bigger roles. Still, shielding kids on the web without losing grip on private information is far from simple. When authorities roll out tighter rules for confirming age, the tools built to follow these laws could change how identities and personal details move through digital spaces.
Read more »
Subscribe to: Comments (Atom)