With growing focus on the threat quantum computing poses to crucial and widely used forms of encryption, @filippo wants to make one thing perfectly clear: Contrary to popular mythology that refuses to die, AES 128 is perfectly fine in a post-quantum world

https://arstechnica.com/security/2026/04/contrary-to-popular-superstition-aes-128-is-just-fine-in-a-post-quantum-world/

RE: https://mastodon.social/@JenMsft/116306515557926926

For those wondering why this has always been a point of contention for us internally is because under specific circumstances it can lead to a privacy leak.

Apps in low-ish IL or have capability enforcement need to assert that they need to know user information like username or email address. We want to do our best to protect that info. On consumer devices this is especially critical to protect so if your profile path is firstlast87 there's a good chance that's your email and all you need is to guess the dozen or so common domains and now your email is leaked.

That's why we obscure the profile folder path in cases that don't require 20 years of back compat (enterprise join scenarios).

It was never a perfect solution because balancing user privacy and practical usability for a billion odd users is...complicated...but it did act as a useful speedbump.

New, by me: The Kimwolf Botnet is Stalking Your Local Network

Today's story is a long overdue series of scoops nestled inside a far more urgent Internet-wide security advisory. The vulnerability at issue has been exploited for months already, and it’s time for a broader awareness of the threat. The short version is that everything you thought you knew about the security of the internal network behind your Internet router probably is now dangerously out of date.

https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/

Part 8053 of eleventy billion on our path to killing NTLM: way way way way way better auditing.

https://support.microsoft.com/en-us/topic/overview-of-ntlm-auditing-enhancements-in-windows-11-version-24h2-and-windows-server-2025-b7ead732-6fc5-46a3-a943-27a4571d9e7b

AT&T widely launched its Wireless Account Lock feature Tuesday, aiming to strengthen customer protection against account takeovers and SIM-swapping attacks, Cyberscoop writes.

"The Wireless Account Lock, which had been rolling out in waves since earlier this year, is widely accessible for both individual and business customers. The feature follows similar options from competitors such as T-Mobile, Verizon, and Google Fi, which have already moved to bolster protections against SIM swapping and similar attacks."

"The feature is accessed exclusively via the company’s app on a device tied to the account. If the registered device is inaccessible or lost, users must undergo extra authentication steps via AT&T’s customer support to regain or restore control."

https://cyberscoop.com/att-wireless-account-lock-sim-swapping-protection/

About a decade ago, Apple and Google started updating iOS and Android, to make them less susceptible to “juice jacking,” a form of attack that could surreptitiously steal data or execute malicious code when users plug their phones into special-purpose charging hardware. Now, researchers are revealing that, for years, the mitigations have suffered from a fundamental defect that has made them trivial to bypass.

https://arstechnica.com/security/2025/04/ios-and-android-juice-jacking-defenses-have-been-trivial-to-bypass-for-years/

China-based purveyors of SMS phishing kits are enjoying remarkable success converting phished payment card data into mobile wallets from Apple and Google. Until recently, the so-called “Smishing Triad” mainly impersonated toll road operators and shipping companies. But experts say these groups are now directly targeting customers of international financial institutions, while dramatically expanding their cybercrime infrastructure and support staff.

The pace of innovation coming from these phishing groups is something to behold, as are their success rates. And thousands of US financial institutions are sitting ducks.

https://krebsonsecurity.com/2025/04/china-based-sms-phishing-triad-pivots-to-banks/

New, by me:

A Minnesota cybersecurity and computer forensics expert whose testimony has featured in thousands of courtroom trials over the past 30 years is facing questions about his credentials and an inquiry from the Federal Bureau of Investigation (FBI). Legal experts say the inquiry could be grounds to reopen a number of adjudicated cases in which the expert’s testimony may have been pivotal.

From the story:

In an interview this week, Harrington said court documents reveal that at least two of Lanterman’s previous clients complained CFS had held their data for ransom over billing disputes. In a declaration (PDF) dated August 2022, the co-founder of the law firm MoreLaw Minneapolis LLC said she hired Lanterman in 2014 to examine several electronic devices after learning that one of their paralegals had a criminal fraud history.

But the law firm said when it pushed back on a consulting bill that was far higher than expected, Lanterman told them CFS would “escalate” its collection efforts if they didn’t pay, including “a claim and lien against the data which will result in a public auction of your data.”

“All of us were flabbergasted by Mr. Lanterman’s email,” wrote MoreLaw co-founder Kimberly Hanlon. “I had never heard of any legitimate forensic company threatening to ‘auction’ off an attorney’s data, particularly knowing that the data is comprised of confidential client data, much of which is sensitive in nature.”

In 2009, a Wisconsin-based manufacturing company that had hired Lanterman for computer forensics balked at paying an $86,000 invoice from CFS, calling it “excessive and unsubstantiated.” The company told a Hennepin County court that on April 15, 2009, CFS conducted an auction of its trade secret information in violation of their confidentiality agreement.

“CFS noticed and conducted a Public Sale of electronic information that was entrusted to them pursuant to the terms of the engagement agreement,” the company wrote. “CFS submitted the highest bid at the Public Sale in the amount of $10,000.”

https://krebsonsecurity.com/2025/03/cyber-forensic-expert-in-2000-cases-faces-fbi-probe/