What Security and Privacy Transparency Users Need from Consumer-Facing Generative AI

Users increasingly rely on consumer-facing generative AI GenAI for tasks ranging from everyday needs to sensitive use cases. Yet, it remains unclear whether and how existing security and privacy S&P communications in GenAI tools shape users' adoption decisions and subsequent experiences...

CVE-2024-43705

creationtimestamp| type| source ---|---|--- 2024-12-28 05:05:29+00:00| seen| https://infosec.exchange/users/cve/statuses/113728705621374499 2024-12-28 05:15:24+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3ledqpdyndi2i 2024-12-28 07:04:43+00:00| seen|...

Change Healthcare Faces Another Ransomware Threat—and It Looks Credible

Change Healthcare ransomware hackers already received a $22 million payment. Now a second group is demanding money, and it has sent WIRED samples of what they claim is the company's stolen data...

SAP Marketing Input Validation Error Vulnerability

SAP Marketing is a marketing platform from SAP, a German company. SAP Marketing suffers from an input validation error vulnerability that stems from allowing a low-privileged attacker to trick a user into opening a malicious page, which could lead to a very credible phishing attack with minimal...

The Right Way to Enhance CTI with AI (Hint: It's the Data)

Cyber threat intelligence is an effective weapon in the ongoing battle to protect digital assets and infrastructure - especially when combined with AI. But AI is only as good as the data feeding it. Access to unique, underground sources is key. Threat Intelligence offers tremendous value to peopl...

Credible Handwriting Machine

In case you dont have enough to worry about, someone has built a credible handwriting machine: This is still a work in progress, but the project seeks to solve one of the biggest problems with other homework machines, such as this one that I covered a few months ago after it blew up on social...

NeedleDropper malware leverages a memory corruption flaw in Microsoft to disseminate

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new dropper strain dubbed NeedleDropper is used to distribute multiple malware families. The dropper attempts to obfuscate by dumping numerous useless, invalid files and storing critical data within...

Bomb Threat Bitcoin Demands Cause Disruption, Evacuations

UPDATE What looks to be an alarming email scam is making the rounds, with extortionists asking for Bitcoin payment in return for not detonating a set of bombs. Multiple law-enforcement agencies in cities across the U.S. responded to calls from recipients on Thursday, concluding that the threats a...

The Digital Security Exchange Is Live

Last year I wrote about the Digital Security Exchange. The project is live: The DSX works to strengthen the digital resilience of U.S. civil society groups by improving their understanding and mitigation of online threats. We do this by pairing civil society and social sector organizations with...