Long Article on NSO Group
Schneier on Security
APRIL 21, 2022
Ronan Farrow has a long article in The New Yorker on NSO Group, which includes the news that someone — probably Spain — used the software to spy on domestic Catalonian sepratists.
Article Related Topics 
Long Article on GM Spying on Its Cars’ Drivers
Schneier on Security
APRIL 26, 2024
Kashmir Hill has a really good article on how GM tricked its drivers into letting it spy on them—and then sold that data to insurance companies.
Insurance 
309
309 Join 28,000+
Insiders
Sign Up for our Newsletter
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Fooling an AI Article Writer
Schneier on Security
JULY 27, 2023
World of Warcraft players wrote about a fictional game element, “Glorbo,” on a subreddit for the game, trying to entice an AI bot to write an article about it. The article was left online for a while but has finally been taken down ( here’s a mirror, it’s hilarious ). It worked : And it…worked.
20 Most Popular TechRepublic Articles in 2023
Tech Republic Security
DECEMBER 22, 2023
Here's a list of the 20 most popular articles published by TechRepublic in 2023. Read articles about ChatGPT, Google Bard, Windows 11 and more
Hacking Scientific Citations
Schneier on Security
JULY 15, 2024
These details are stored as metadata, not visible in the article’s text directly, but assigned to a digital object identifier, or DOI—a unique identifier for each scientific publication. The result?
Hacking 345
345 Hacking 345
345 
On Executive Order 12333
Schneier on Security
SEPTEMBER 28, 2020
The Article pays particular attention to EO 12333’s designation of the National Security Agency as primarily responsible for conducting signals intelligence, which includes the installation of malware, the analysis of internet traffic traversing the telecommunications backbone, the hacking of U.S.
Surveillance 344
344 
Nearly 7% of Internet Traffic Is Malicious
Schneier on Security
JULY 31, 2024
News articles. Cloudflare reports on the state of applications security. It claims that 6.8% of Internet traffic is malicious. And that CVEs are exploited as quickly as 22 minutes after proof-of-concepts are published.
Internet 308
308 
Advice for Personal Digital Security
Schneier on Security
NOVEMBER 11, 2021
ArsTechnica’s Sean Gallagher has a two – part article on “securing your digital life.” ” It’s pretty good.
Risk 328
328 
The Present and Future of TV Surveillance
Schneier on Security
AUGUST 27, 2024
Ars Technica has a good article on what’s happening in the world of television surveillance. More than even I realized.
Surveillance 295
295 Surveillance 295
295 
New Images of Colossus Released
Schneier on Security
JANUARY 30, 2024
News article. GCHQ has released new images of the WWII Colossus code-breaking computer, celebrating the machine’s eightieth anniversary (birthday?).
295 
The Privacy Disaster of Modern Smart Cars
Schneier on Security
NOVEMBER 10, 2023
Article based on a Mozilla report.
308 
Car Thieves Hacking the CAN Bus
Schneier on Security
APRIL 11, 2023
News articles. Car thieves are injecting malicious software into a car’s network through wires in the headlights (or taillights) that fool the car into believing that the electronic key is nearby.
Hacking 331
331 
NSA Buying Bulk Surveillance Data on Americans without a Warrant
Schneier on Security
JANUARY 30, 2024
Some news articles. It finally admitted to buying bulk data on Americans from data brokers, in response to a query by Senator Weyden. This is almost certainly illegal, although the NSA maintains that it is legal until it’s told otherwise.
Surveillance 307
307 
Real-World Steganography
Schneier on Security
JANUARY 20, 2023
From an article about Zheng Xiaoqing, an American convicted of spying for China: According to a Department of Justice (DOJ) indictment, the US citizen hid confidential files stolen from his employers in the binary code of a digital photograph of a sunset, which Mr Zheng then mailed to himself.
340 
New Bluetooth Attack
Schneier on Security
DECEMBER 8, 2023
news articles. New attack breaks forward secrecy in Bluetooth. The vulnerability has been around for at least a decade.
Authentication 309
309 Authentication 309
309 
Zero-Click iMessage Exploit
Schneier on Security
SEPTEMBER 17, 2021
News articles on the exploit. Citizen Lab released a report on a zero-click iMessage exploit that is used in NSO Group’s Pegasus spyware. Apple patched the vulnerability; everyone needs to update their OS immediately.
Spyware 318
318 Spyware 318
318 
How the FBI Gets Location Information
Schneier on Security
OCTOBER 27, 2021
Vice has a detailed article about how the FBI gets data from cell phone providers like AT&T, T-Mobile, and Verizon, based on a leaked (I think) 2019 139-page presentation.
Mobile 314
314 
Hacking Gas Pumps via Bluetooth
Schneier on Security
OCTOBER 3, 2023
No details in the article, but it seems that it’s easy to take control of the pump and have it dispense gas without requiring payment. Turns out pumps at gas stations are controlled via Bluetooth, and that the connections are insecure. It’s a complicated crime to monetize, though.
Hacking 332
332 Hacking 332
332 
On the Zero-Day Market
Schneier on Security
MAY 24, 2024
This Article accounts for and critiques these failures, providing a socio-technical history since 2014, particularly focusing on the conversation about trade in zero-day vulnerabilities and exploits. Second, this Article applies lessons from these failures to guide regulatory efforts going forward.
Marketing 301
301 
No, The Chinese Have Not Broken Modern Encryption Systems with a Quantum Computer
Schneier on Security
OCTOBER 22, 2024
It all seems to have come from this news article , which wasn’t bad but was taken widely out of proportion. The headline is pretty scary: “ China’s Quantum Computer Scientists Crack Military-Grade Encryption.” ” No, it’s not true. This debunking saved me the trouble of writing one.
Encryption 299
299 Encryption 299
299 
Cellebrite Can Break Signal
Schneier on Security
DECEMBER 21, 2020
News article. Cellebrite announced that it can break Signal. Note that the company has heavily edited its blog post, but the original — with lots of technical details — was saved by the Wayback Machine.). Slashdot post. The whole story is puzzling.
Encryption 341
341 Encryption 341
341 
Tesla Remotely Hacked from a Drone
Schneier on Security
MAY 4, 2021
News article. It would be possible for an attacker to unlock the doors and trunk, change seat positions, both steering and acceleration modes — in short, pretty much what a driver pressing various buttons on the console can do. This attack does not yield drive control of the car though. That last sentence is important.
Hacking 359
359 
Surveillance of the Internet Backbone
Schneier on Security
AUGUST 25, 2021
Vice has an article about how data brokers sell access to the Internet backbone. This is netflow data. It’s useful for cybersecurity forensics, but can also be used for things like tracing VPN activity. At a high level, netflow data creates a picture of traffic flow and volume across a network.
Internet 362
362 
SMS Phishing Attacks are on the Rise
Schneier on Security
APRIL 25, 2022
I am not getting the “Fedex package delivered” messages the article talks about. SMS phishing attacks — annoyingly called “smishing” — are becoming more common. I know that I have been receiving a lot of phishing SMS messages over the past few months.
Phishing 320
320 Phishing 320
320 
FBI Advising People to Avoid Public Charging Stations
Schneier on Security
APRIL 12, 2023
News article. Carry your own charger and USB cord and use an electrical outlet instead. How much of a risk is this, really? I am unconvinced, although I do carry a USB condom for charging stations I find suspicious.
Malware 342
342 
Mexican Drug Cartels with High-Tech Spyware
Schneier on Security
DECEMBER 17, 2020
Lots of details in the article. The cyberweapons arms business is immoral in many ways. This is just one of them.
Spyware 341
341 
China Surveillance Company Hacked
Schneier on Security
FEBRUARY 27, 2024
Lots of details in the news articles. Last week, someone posted something like 570 files, images and chat logs from a Chinese company called I-Soon. I-Soon sells hacking and espionage services to Chinese national and local government. These aren’t details about the tools or techniques, more the inner workings of the company.
Surveillance 286
286 
Quantum Computing Skeptics
Schneier on Security
JANUARY 25, 2024
Interesting article. I am also skeptical that we are going to see useful quantum computers anytime soon. Since at least 2019, I have been saying that this is hard. And that we don’t know if it’s “land a person on the surface of the moon” hard, or “land a person on the surface of the sun” hard.
291 
Public Surveillance of Bars
Schneier on Security
JULY 2, 2024
This article about an app that lets people remotely view bars to see if they’re crowded or not is filled with commentary—on both sides—about privacy and openness.
Surveillance 263
263 Surveillance 263
263 
Dan Solove on Privacy Regulation
Schneier on Security
APRIL 24, 2024
Law professor Dan Solove has a new article on privacy regulation. In his email to me, he writes: “I’ve been pondering privacy consent for more than a decade, and I think I finally made a breakthrough with this article.” ” His mini-abstract: In this Article I argue that most of the time, privacy consent is fictitious.
Data collection 290
290 
Microsoft Zero-Days Sold and then Used
Schneier on Security
JULY 29, 2022
Yet another article about cyber-weapons arms manufacturers and their particular supply chain. This one is about Windows and Adobe Reader zero-day exploits sold by an Austrian company named DSIRF. There’s an entire industry devoted to undermining all of our security. It needs to be stopped.
Manufacturing 297
297 Manufacturing 297
297 
Using Machine Learning to Guess PINs from Video
Schneier on Security
OCTOBER 19, 2021
The article doesn’t contain a link to the original research. This works even if the person is covering the pad with their hands. If someone knows it, please put it in the comments. Slashdot thread.
321 
Using “Master Faces” to Bypass Face-Recognition Authenticating Systems
Schneier on Security
AUGUST 6, 2021
Two good articles. The results we present demonstrate that it is possible to obtain a high coverage of the population (over 40%) with less than 10 master faces, for three leading deep face recognition systems.
Authentication 363
363 Authentication 363
363 
Vulnerability in the Kaspersky Password Manager
Schneier on Security
JULY 6, 2021
This article explains how to securely generate passwords, why Kaspersky Password Manager failed, and how to exploit this flaw. The most critical one is that it used a PRNG not suited for cryptographic purposes. Its single source of entropy was the current time. All the passwords it created could be bruteforced in seconds.
Long Story on the Accused CIA Vault 7 Leaker
Schneier on Security
JUNE 6, 2022
Long article about Joshua Schulte, the accused leaker of the WikiLeaks Vault 7 and Vault 8 CIA data. Well worth reading.
268 
More Russian Hacking
Schneier on Security
JULY 2, 2021
News article. This, along with various techniques also detailed in the advisory, allowed the actors to evade defenses and collect and exfiltrate various information in the networks, including mailboxes.
Hacking 363
363 
Criminals Are Blowing up ATMs in Germany
Schneier on Security
OCTOBER 28, 2024
It has more ATMs than other European countries, and—if I read the article right—they have more money in them. It’s low tech , but effective. Why Germany?
Banking 247
247 Banking 247
247 
Symantec Reports on Cicada APT Attacks against Japan
Schneier on Security
NOVEMBER 20, 2020
News article. The attackers extensively use DLL side-loading in this campaign, and were also seen leveraging the ZeroLogon vulnerability that was patched in August 2020. Interesting details about the group’s tactics.
Malware 344
344 Malware 344
344 
Hacking Automobile Keyless Entry Systems
Schneier on Security
OCTOBER 17, 2022
The article doesn’t say how the hacking tool got installed into cars. A fraudulent tool—marketed as an automotive diagnostic solution, was used to replace the original software of the vehicles, allowing the doors to be opened and the ignition to be started without the actual key fob.
Hacking 353
353 
On Vulnerability-Adjacent Vulnerabilities
Schneier on Security
FEBRUARY 15, 2021
From a MIT Technology Review article : Soon after they were spotted, the researchers saw one exploit being used in the wild. Another article on the talk. At the virtual Engima Conference , Google’s Project Zero’s Maggie Stone gave a talk about zero-day exploits in the wild. This is an important insight.
Technology 339
339 
Hiding Malware in ML Models
Schneier on Security
JULY 27, 2021
News article. With the widespread application of artificial intelligence, utilizing neural networks becomes a forwarding trend of malware. We hope this work could provide a referenceable scenario for the defense on neural network-assisted attacks.
Malware 363
363 
RADIUS Vulnerability
Schneier on Security
JULY 10, 2024
News article. This forgery could give the attacker access to network devices and services without the attacker guessing or brute forcing passwords or shared secrets. The attacker does not learn user credentials. This is one of those vulnerabilities that comes with a cool name, its own website, and a logo. Research paper.
Authentication 276
276 
Textbook Rental Scam
Schneier on Security
OCTOBER 20, 2021
The article doesn’t link to the indictment, so I don’t know how they were discovered. They used gift cards and prepaid credit cards to buy the books, so there was no available balance when Amazon tried to charge them the buyout price for non-returned books. In all, they stole 14,000 textbooks worth over $1.5
Scams 308
308 Scams 308
308 
On Blockchain Voting
Schneier on Security
NOVEMBER 16, 2020
More importantly: given the current state of computer security, any turnout increase derived from with Internet- or blockchain-based voting would come at the cost of losing meaningful assurance that votes have been counted as they were cast, and not undetectably altered or discarded.
Let's personalize your content