Trump Signs Controversial Law Targeting Nonconsensual Sexual Content

The Take It Down Act requires platforms to remove instances of “intimate visual depiction” within two days. Free speech advocates warn it could be weaponized to fuel censorship...

A week in security (March 31 – April 6)

Last week on Malwarebytes Labs: Why we’re no longer doing April Fools’ Day Intimate images from kink and LGBTQ+ dating apps left exposed online "Urgent reminder" tax scam wants to phish your Microsoft credentials "Nudify" deepfakes stored unprotected online Location, name, and photos of random ki...

Intimate images from kink and LGBTQ+ dating apps left exposed online

A researcher found millions of pictures from specialized dating apps for iOS stored online without any kind of password protection. The pictures, some of which are explicit, stem from dating apps that all have a specific audience. The five platforms, all developed by M.A.D. Mobile are kink sites...

AirTags Are Used for Stalking Far More than Previously Reported

Ever since Apple introduced AirTags, security people have warned that they could be used for stalking. But while there have been a bunch of anecdotal stories, this is the first vaguely scientific survey: Motherboard requested records mentioning AirTags in a recent eight month period from dozens o...

A week in security (January 10 – 16)

Last week on Malwarebytes Labs: Ransomware cyberattack forces New Mexico jail to lock down Some Android users can disable 2G now and why that is a good thing Phishers on the prowl with fake parking meter QR codes Update now: Microsoft patches 97 bugs including 6 zero-days and a wormable one...

Intimate photo hacker spared from jail, said he “liked the detective work”

Michael Grime, a British games programmer, has escaped jail after using stolen credentials to access several womens personal email accounts and social media accounts in order to steal their private and intimate photos. Grime was caught by the National Crime Agency NCA as part of an operation...

Intimate Payments <= 1.3.1 - CSRF Bypass

The plugin does not properly check for CSRF in its handleselectcurrency and handleupdatetrx AJAX actions, allowing attacker to make logged in admin call them them via CSRF attacks...

New Research: "Privacy Threats in Intimate Relationships"

I just published a new paper with Karen Levy of Cornell: "Privacy Threats in Intimate Relationships." Abstract: This article provides an overview of intimate threats: a class of privacy threats that can arise within our families, romantic partnerships, close friendships, and caregiving...

File Upload Vulnerability in Multiple Versions of Intimate Home Care Intimate Cat (imcat)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. File upload vulnerability exists in several versions of Sticky Home Sticky Cat imcat. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

Arbitrary Code Execution Vulnerability in Multiple Versions of Intimate Home Care Intimate Cat (imcat)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. Arbitrary code execution vulnerability exists in several versions of Intimate Home Care Intimate Cat imcat. An attacker can exploit the vulnerability to execute arbitrary code and gain server privileges...

SQL Injection Vulnerability in Multiple Versions of Intimate Home Care Intimate Cat (imcat)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. SQL injection vulnerability exists in several versions of imcat. An attacker can exploit this vulnerability to obtain sensitive database information...

Code Execution Vulnerability in Intimate Home Care Intimate Cat (imcat) (CNVD-2020-29218)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. A code execution vulnerability exists in Intimate Home Care Intimate Cat imcat, which can be exploited by attackers to execute malicious code...

Information Disclosure Vulnerability in Intimate Home Care Intimate Cat (imcat)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. Attentive Home Attentive Cat imcat suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Code Execution Vulnerability in Attentive Home Attentive Cat (imcat)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. A code execution vulnerability exists in Intimate Home Care Intimate Cat imcat, which can be exploited by attackers to execute malicious code...

File Upload Vulnerability in Intimate Home Care Intimate Cat (imcat)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. A file upload vulnerability exists in Intimate Cat imcat, which can be exploited by an attacker to upload a malicious file and then getshell it...

Information Disclosure Vulnerability in Intimate Home Care Intimate Cat (imcat) (CNVD-2020-29222)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. Attentive Home Attentive Cat imcat suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Information Disclosure Vulnerability in Intimate Home Care Intimate Cat (imcat) (CNVD-2020-29221)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. Attentive Home Attentive Cat imcat suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Apple Suspends Siri Program After Privacy Backlash

Apple is suspending a program that lets contractors listen in on Siri voice recordings after facing a rain of backlash regarding the privacy implications of the program. The suspension comes after a report in The Guardian last week outlining how contractors regularly listen to intimate voice...

Interview of Me in Taiwan

Business Weekly in Taiwan interviewed me. Here's a translation courtesy of Google. It was a surprisingly intimate interview. I hope the Chinese reads better than the translation...

Facebook Fingerprinting Photos to Prevent Revenge Porn

This is a pilot project in Australia: Individuals who have shared intimate, nude or sexual images with partners and are worried that the partner or ex-partner might distribute them without their consent can use Messenger to send the images to be "hashed." This means that the company converts the...