Rust Dependencies scare Me

Removing Jeff Bezos From My Bed ◆ Truffle Security Co.

Eight Sleep smart bed found to contain an exposed AWS key and a likely backdoor that allowed engineers to remotely access users' beds

Avoid ISP Routers - RouterSecurity.org

Avoid ISP routers

Data Exfiltration from Slack AI via indirect prompt injection

Authors: PromptArmor

Phishing scammers impersonate Andreessen Horowitz employee to drain crypto wallets

Attentive phishers noticed when Andreessen Horowitz partner Peter Lauten changed his Twitter username from @peter_lauten to @lauten, and snapped up the previous username. They then began contacting various targets in the cryptocurrency world, asking to set up meetings to arrange appearances on the venture capital firm's crypto podcast.The scammers followed a familiar playbook in which they asked their targets to download video call software called "Vortax", which was actually wallet draining malware. However, these scammers had a leg up on some others who have been running that scheme: the Andreessen Horowitz website still listed Lauten's old username on their website, giving even skeptical victims some reassurance that the account was legitimate.According to crypto sleuth zachxbt, who first reported on this incident, one victim lost $245,000 when his wallets were drained by the malware.

China air routes panned as safety risk

An Empirical Study of Malicious Code In PyPI Ecosystem | Wenbo Guo

We conducted an empirical study to understand the characteristics and current state of the malicious code lifecycle in the PyPI ecosystem. We first built an automated data collection framework and collated a multi-source malicious code dataset containing 4,669 malicious package files. We preliminarily classified these malicious code into five categories based on malicious behaviour characteristics. Our research found that over 50% of malicious code exhibits multiple malicious behaviours, with information stealing and command execution being particularly prevalent. In addition, we observed several novel attack vectors and anti-detection techniques. Our analysis revealed that 74.81% of all malicious packages successfully entered end-user projects through source code installation, thereby increasing security risks. A real-world investigation showed that many reported malicious packages persist in PyPI mirror servers globally, with over 72% remaining for an extended period after being discovered. Finally, we sketched a portrait of the malicious code lifecycle in the PyPI ecosystem, effectively reflecting the characteristics of malicious code at different stages. We also present some suggested mitigations to improve the security of the Python open-source ecosystem.

India’s sex workers turn to WhatsApp, Instagram to find clients safely

While these spaces help sex workers gauge their clients before agreeing to meet them, going digital comes with risks.

The Trillion-Gallon Question: What if California’s Dams Fail?

One superstorm could send walls of water sweeping through populated areas. There’s not much time to act.