Oneironaut

@Oneironaut@infosec.exchange
13 Followers
95 Following
1.4K Posts
GRC advocate. Cyber adjacent. Celine Dion fan

Holy #surveillance hell, Batman.

Let me get this straight:

First, they feed your video, which is already stored in their cloud, into an #AI transformer to write descriptions.

Then they feed your descriptions into a pattern learning system (ML, maybe?) to figure out your patterns and habits.

All of this is stored in the cloud. So they not only have your video, but a narrative about your habits, ready to be exfiltrated, monetized, and shared with law enforcement.

#ai #enshittification #RingCamera

https://www.theregister.com/2025/06/25/amazons_ring_ai_video_description/

Amazon's Ring can now use AI to 'learn the routines of your residence'

: It's meant to cut down on false positives but could be a trove for mischief-makers

The Register
Hate to say it but running a live service game already requires putting on the big boy pants and if you're not ready for something as mild as "please have a sunsetting plan" then you're definitely not ready for the realities of running a live service game
@pluralistic In The USA they should make USPS an ISP, call all fibre "post roads" with all the protections and rights this gives them under the constitution (US Art 1 Sec 8), and start building… :D

So the UK Met Office is inviting people to suggest up to 5 names for storms. And apparently lots of people have been suggesting "Storm Bigoil", along with BP, Equinor, Exxon & Shell... This is obviously appalling & definitely not to be emulated via this link:

https://www.metoffice.gov.uk/forms/name-our-storms-call-for-names

Stop feeding the hand that bites you. 🦈

"Trapping AI" – Slight Update! 🌀

Activity in the "Trapping AI" project is accelerating: in just under a month, over 26 million requests have hit our tarpit URLs 🕳️. Vast volumes of meaningless content were devoured by AI crawlers — ruthless digital leeches that relentlessly scour and pillage the web, leaving no data untouched.

In the coming days, we’ll roll out a new layer of complexity — amplifying both the intensity and offensiveness of our approach. This escalation builds on fakejpeg, a tool developed by @pengfold.

🖼️ fakejpeg generates fake JPEGs on the fly. You "train" it with a collection of existing JPEGs, and once trained, it can produce an arbitrary number of things that look like real JPEGs — perfect for feeding aggressive web crawlers junk 🗑️.

Explore fakejpeg: https://github.com/gw1urf/fakejpeg

Learn more about "Trapping AI": https://algorithmic-sabotage.github.io/asrg/trapping-ai/#expanding-the-offensiveness

See the tarpit in action: https://content.asrg.site/

Latest Marks and Spencer update is pretty crazy.

M&S haven't been able to supply sales data - so the British Retail Consortium (BRC) - used by the UK government as as economic indicator - basically made up figures for M&S and didn't tell people they had done this.

https://www.telegraph.co.uk/business/2025/06/24/retail-lobby-group-accused-of-ms-cyber-cover-up/

Retail lobby group accused of M&S cyber cover-up

British Retail Consortium published ‘made-up’ sales figures following attack on high street giant

The Telegraph
Worth noting that every write up says this vuln applies to the management interface - but that isn’t true, it’s because the initial CVE entry was wrong, and nobody does CVE entry updates in write ups.

I think what makes me so incredibly angry about AI is that it’s not there to reduce *your* work. It’s there to reduce the amount of labor that CEOs have to pay for.

There’s no world in which doing *your* job a little faster is worth the trillions of dollars in investment; this is entirely predicated on eliminating working class jobs.

And *no one* should be excited about that, except for billionaires.

@campuscodi

Apparently, the issue that led to the certificate revocation is ScreenConnect storing configuration data in an available area of the installer that is not signed.

Attackers are changing the configuration data to suit their needs, without affecting the signature.

It's been happening for months, it seems.

https://www.helpnetsecurity.com/2025/06/11/connectwise-is-rotating-code-signing-certificates-what-happened/

Connectwise is rotating code signing certificates. What happened? - Help Net Security

Connectwise is updating the digital signing certificates used in ScreenConnect, Automate, ConnectWise RMM due to security concerns.

Help Net Security
×
Worth noting that every write up says this vuln applies to the management interface - but that isn’t true, it’s because the initial CVE entry was wrong, and nobody does CVE entry updates in write ups.
Don't panic, but it's only a matter of time before critical 'CitrixBleed 2' is under attack

: Why are you even reading this story? Patch now!

The Register

Citrix on this one:

"At this time, there have been no reports or indications that the vulnerabilities described in CTX693420 (CVE-2025-5349 and CVE-2025-5777) are being actively exploited in the wild. However, due to the critical severity of these issues (CVSS scores of 8.7 and 9.3), We strongly recommends that affected customers apply the updated patches immediately to mitigate any potential risks."

NHS Digital's cyber alert database has been updated too. https://digital.nhs.uk/cyber-alerts/2025/cc-4670

I highly recommend bookmarking this site for the alerts, they're really good at filtering noise:

https://digital.nhs.uk/cyber-alerts

E.g. if you select 'high' category, there's only one a month on average

@GossiTheDog

As a heads up to those that are affected, there's strong indicators that this is now live and dangerous / being exploited.

@GossiTheDog I hope nobody is still misled by the pre-correction CVE into thinking that this is just a 'mitigate by controlling access to management interface like you should probably do anyway' thing that they can just defer to lower priority maintenance.

Relatively severe either way; but that teensy little correction was not loud enough for how dramatically an otherwise plausible mitigation turned out to be useless.

@GossiTheDog I read "appeals to the management" and it rang truer