"A human who conducted such a hack would be facing years in prison. For a machine, criminal liability is harder to determine."
https://www.newyorker.com/news/the-lede/inside-openai-hack-of-hugging-face
Remote
Dan Goodin
@dangoodin@infosec.exchange
mastodon 4.8.0-alpha.3+glitchReporter covering security at Ars Technica. DM me on Signal: DanArs.82.
0 Followers
1163 Following
50 Posts
Joined November 22, 2022
If it wasn't already, 2FA spraying is now a thing
A quantum-resistant cryptography algorithm that was under consideration to become an official US standard has been taken out of the running after an Anthropic security model helped find a flaw that rendered it broken.
https://arstechnica.com/security/2026/07/mythos-uncovers-crypto-weaknesses-that-went-unknown-for-years/
Mozilla has provided behind-the-scenes details on the 271 vulnerabilities it discovered with the help of Mythos. Those details include full Bugzilla reports on 12 of the vulnerabilities. I'd be curious for people to look at the reports and hear what they think.
https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/
TV sticks that offer free streaming services are turning people's tnternet connections into vehicles for fraud.
https://krebsonsecurity.com/2026/07/read-this-before-you-buy-that-tv-streaming-stick/
With growing focus on the threat quantum computing poses to crucial and widely used forms of encryption, @filippo@abyssdomain.expert wants to make one thing perfectly clear: Contrary to popular mythology that refuses to die, AES 128 is perfectly fine in a post-quantum world
Are MP3 players even a thing these days? What are some good brands/models?
There's so much I don't understand in Dashlane's disclosure that an attack on its user accounts resulted in the threat actor obtaining 20 encrypted vaults.
What does it mean to brute force 2fa? Are we talking about TOTPs? That doesn't make sense because TOTPs change every 30-90 seconds, so there's no way for an attacker to meaningfully exhaust key space before it resets all over -- unless the attacker has the ability to pump all 7,700 combinations in <90 seconds, and DL doesn't have any sort of rate limiting.
Also, if the attacker is brute forcing 2fa, doesn't that by necessity mean the attacker already defeated the first factor? How did that occur?
I don't know if my confusion is the result of me not knowing the how the Dashlane product works or if it's just Dashlane being opaque.
Can anyone help me read the tea leaves?
You too can turn a Bluetooth device into a PC-pwning proxy
Google is dramatically shortening its deadline readiness for the arrival of Q Day, the point at which existing quantum computers can break public-key cryptography algorithms that secure decades’ worth of secrets belonging to militaries, banks, governments, and nearly every individual on earth.
Does anybody with a STRONG BACKGROUND IN WEBSITE PRIVACY have time to vet this research? Are TikTok and Meta pixels REALLY doing the things claimed? I'm concerned it may be overstating things in an attempt to sell its tag monitoring tools.
https://jscrambler.com/blog/beyond-analytics-tiktok-meta-ad-pixels
There's a ton of skepticism over the true value of AI-assisted vulnerability discovery, and with good reason. Maybe the new details Mozilla has revealed don't tip the scales in favor of it being beneficial, but people should at least sift through them in good faith and with an open mind before declaring all of them bullshit.
Dear readers. If you're not willing to support the families of those you want to read then we regretfully will be preventing you from obtaining our work for free.
Would this move by Debian, requiring byte-for-byte reproducible builds, have caught any real-world supply chain attacks seen in the past?
https://itsfoss.com/news/debian-makes-reproducible-builds-mandatory/
Can’t make sense of Dashlane’s vault theft notification? You’re not alone.
I was lucky enough to cover Cindy Cohn's trailblazing work BEFORE she joined @eff@mastodon.social . Here's one of several stories I wrote about her when she was still an associate attorney in private practice.
Replying to
If I hear one more person say that Beyonce isn't a real country singer/song writer and should stay in her own RnB/hip-hop lane I'm going to lose it.
Have any distributors/vendors released versions that fix CopyFail? If so, can someone help me compile with distributors and versions?
Transitioning the Internet to post-quantum, especially for digital signatures, is a massive undertaking. By setting a 2029 goal, they are giving themselves some slack. If they target 2035 and miss by 2 years, we are getting uncomfortably close to the danger zone.”
I'm trying to understand a bit more about CVE-2026-33579, the critical vulnerability in OpenClaw. To exploit, an attacker needs low-level paring privilege permissions. How does one acquire such privileges? Can anyone do it? I'm asking because I want to understand what's required for an attacker to exploit.
Feel free to ping me at DanArs.82, or drop an answer here.
Can someone explain @filippo@abyssdomain.expert's post to me like I'm a 5-year-old?
If you could ask any question to Mozilla concerning last month's The Zero-days are Numbered post, what would it be?
https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/
Replying to
@paco
I just asked Mozilla about this. Someone responded that internally found bugs like the 271 go into “roll-up” advisories with, each rollup providing a link to the bug list covered.
The 3 rollups are:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/#CVE-2026-6784
https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/#CVE-2026-6785
https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/#CVE-2026-6786
When you look at these rollups they say that "Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code."
With no way of knowing how many vulnerabilities were truly severe and exploitable, I think Mozilla, like others gushing ab out LLM-assisted vuln finding, is denying us the data to assess the true value of Mythos.
Anybody know of any Linux distributions that have released fixes for Dirty Frag?
Replying to
@drs1969@mstdn.social
Is this your opinion on how the law should work, or do you know the law already makes this distinction clear?
Replying to
@wdormann@infosec.exchange @drs1969@mstdn.social @glyph@mastodon.social
I think you're all misreading the 2 sentences I quoted. I think the writer is, correctly, saying that this issue is novel and the law has yet to establish that such events are crimes, and that anyone charged would surely make this argument in trial. Contrary to your readings, the author isn't saying this is how things should be.
Now everyone is jumping on me for a single quote. It's fine for people to say the law shouldn't give AI-generated crimes a free pass, but non-lawyers arguing how the law currently treats such events is a real drag.
I've stayed off Mastodon for a while, because this behavior is all too common. I'm inclined to remain off the platform.
Can anyone help me find my AirTag attached keys? The FindMy app shows me their general location, which is a large public building where I last had them. When I go on site, my app is mostly unable to see them at all. Occasionally my app seems to be able to see a very weak signal but I can't seem to zero in on it. This is driving me nuts. I've looking now for two weeks. Anybody got tips?
Replying to
@ekari@mementomori.social
That's a consideration I regret not thinking of during the interview. (I've sent an email seeing if I can get it answered now.) That said, if deep-pocketed threat actors pay whatever the cost is and get a ton of useful results, it seems like devs will have to incur the same cost if their users are to stay safe.
Replying to
@dubbel
Yes, you're right, of course. Rotating creds at an atomic level would be quite a thing, no?
Replying to
@cR0w@infosec.exchange
If I could just have a Nano iPod I'd have everything I need. Yes, definitely offline music playing. No streaming, just play old fashioned mp3s. I'm not seeing anything carried by Best Buy et al.
Replying to
@siliconshecky
Thanks a million! So when Tenable says SUSE et al. are "patching" and Debian et al. are "not patched," what's the difference? Are there downloads for the former or just mitigation guidance?
Replying to
@Niklas
yes, agreed. I run into this predicament multiple times per day. Interesting that micro payments has been one of the Internet's longest running unsolved problems.
Replying to
@notyourfanboy
The statement is racist AF. No one ever says that about white country performers.
Replying to
Replying to
@WPalant@infosec.exchange @paco@infosec.exchange @zbrown@floss.social
Thanks so much for looking. I'm a big proponent of skepticism, but not when it's an excuse for not keeping an open mind.
Replying to
@esoteric_programmer
Do you have a link? Quantum computing doesn't break hash algorithms, although I think it may help create collisions. Maybe @sophieschmieg knows.
Replying to
@paulehoffman
Their estimate from last June of 1 million noisy qubits? That's the most recent estimate.
Replying to
@passocacornio@tech.lgbt @michaelh@fosstodon.org
OK, assuming that's true, what's the quality of them?
Replying to
@michaelh@fosstodon.org @passocacornio@tech.lgbt
Yes, that's true. What I want to know is, what's the quality of the 12?
Replying to
@BalooUriza
fair enough. Sounds like you and legitimate publishers trying to support workers families are at a impasse. still it's a decision people like the OP choose to make and hence blaming them on social media is waste of energy.
Replying to
@esoteric_programmer
Well, for starters, did you read the Google research from last June? It's linked in the article.
Replying to
@kboyd
yep. exactly.
another person replying said "Beyonce is not real country" and used the hashtag #shesnotreal
Unless there's some joke or irony i'm missing that's racist AF.
Replying to
@keithzg@fediverse.keithzg.ca
So why should anyone listen to your take if you're NOT going in with an open mind?
Replying to
@Epic_Null@infosec.exchange
Maybe, but if there is true advantage, threat actors will no doubt use them. That, in turn, will put developers who don't at a disadvantage. That's why I think it's important we keep an open mind at this early stage.