BuzzSec

In the short time since their inception, ChatGPT and other generative AI platforms have rightfully gained the reputation of ultimate productivity boosters. However, the very same technology that enables rapid production of high-quality text on demand, can at the same time expose sensitive corporate data. A recent incident, in which Samsung software engineers pasted proprietary code into ChatGPT, from The Hacker News https://thehackernews.com/2023/04/chatgpts-data-protection-blind-spots.html

Telecommunication services providers in Africa are the target of a new campaign orchestrated by a China-linked threat actor at least since November 2022. The intrusions have been pinned on a hacking crew tracked by Symantec as Daggerfly, and which is also tracked by the broader cybersecurity community as Bronze Highland and Evasive Panda. The campaign makes use of "previously unseen plugins from from The Hacker News https://thehackernews.com/2023/04/daggerfly-cyberattack-campaign-hits.html

CitizenLab has identified three zero-click exploits against iOS 15 and 16. These were used by NSO Group’s Pegasus spyware in 2022, and deployed by Mexico against human rights defenders. These vulnerabilities have all been patched. One interesting bit is that Apple’s Lockdown Mode (part of iOS 16) seems to have worked to prevent infection. News article . from Schneier on Security https://www.schneier.com/blog/archives/2023/04/new-zero-click-exploits-against-ios.html

Israeli spyware maker NSO Group deployed at least three novel "zero-click" exploits against iPhones in 2022 to infiltrate defenses erected by Apple and deploy Pegasus, according to the latest findings from Citizen Lab. "NSO Group customers widely deployed at least three iOS 15 and iOS 16 zero-click exploit chains against civil society targets around the world," the interdisciplinary laboratory from The Hacker News https://thehackernews.com/2023/04/nso-group-used-3-zero-click-iphone.html

Earlier this month, state employees in the US state of New Jersey began receiving emails that falsely represented themselves as originating with the state’s attorney general. from KnowBe4 Security Awareness Training Blog https://blog.knowbe4.com/email-isnt-from-nj-attorney-general

U.K. and U.S. cybersecurity and intelligence agencies have warned of Russian nation-state actors exploiting now-patched flaws in networking equipment from Cisco to conduct reconnaissance and deploy malware against targets. The intrusions, per the authorities, took place in 2021 and targeted a small number of entities in Europe, U.S. government institutions, and about 250 Ukrainian victims. The from The Hacker News https://thehackernews.com/2023/04/us-and-uk-warn-of-russian-hackers.html

EFF has a good explainer on the problems with the new UN Cybercrime Treaty, currently being negotiated in Vienna. The draft treaty has the potential to rewrite criminal laws around the world, possibly adding over 30 criminal offenses and new expansive police powers for both domestic and international criminal investigations. […] While we don’t think the U.N. Cybercrime Treaty is necessary, we’ve been closely scrutinizing the process and providing constructive analysis. We’ve made clear that human rights must be baked into the proposed treaty so that it doesn’t become a tool to stifle freedom of expression , infringe on privacy and data protection , or endanger vulnerable people and communities . from Schneier on Security https://www.schneier.com/blog/archives/2023/04/eff-on-the-un-cybercrime-treaty.html