Content by Mathew J. Schwartz

Police Probe Honeytrap Sexting Scam Targeting British MPs

Mathew J. Schwartz  •  April 8, 2024

British police are investigating attempts to target Members of Parliament, their advisers and other Conservative and Labour insiders via spear-phishing messages as part of an apparent honeytrap sexting scam. Experts say low-tech attacks based on social engineering remain difficult to detect.

China Is Using AI to Influence Elections, Microsoft Warns

Mathew J. Schwartz  •  April 5, 2024

China-backed attackers are continuing to refine their use of content generated using artificial intelligence tools, including audio deepfakes and video news anchors, to sow disruption and influence elections in the U.S., Taiwan, India and beyond, security researchers at Microsoft warn.

'Many-Shot Jailbreaking' Defeats Gen AI Security Guardrails

Mathew J. Schwartz  •  April 4, 2024

After testing safety features built into generative artificial intelligence tools developed by the likes of Anthropic, OpenAI and Google DeepMind, researchers have discovered that a technique called "many-shot jailbreaking" can be used to defeat safety guardrails and obtain prohibited content.

After Ransomware Hits, County Declares State of Emergency

Mathew J. Schwartz  •  April 3, 2024

The Missouri county of Jackson has declared a state of emergency after being hit by ransomware on the day of a special election. Officials said attackers didn't appear to have stolen any data and that as a cybersecurity measure, the county doesn't store any residents' sensitive financial data.

Feds Ask Telcos: How Are You Combating Location Tracking?

Mathew J. Schwartz  •  April 2, 2024

How are U.S. telecommunications firms combating illicit location tracking being used by bad actors at home and abroad against their subscribers? That's the focus of a new call for comment from the Federal Communications Commission, which wants to know whether or not existing defenses are working.

Backdoor Found and Defused in Widely Used Linux Utility XZ

Mathew J. Schwartz  •  April 1, 2024

Nation-state attackers apparently backdoored widely used, open-source data compression software as part of a supply chain attack. Malicious code inserted into recent versions of XZ Utils was designed to facilitate full, remote access to an infected system.

UK Nuclear Cleanup Site Faces Criminal Cybersecurity Charges

Mathew J. Schwartz  •  March 29, 2024

Britain's nuclear power watchdog said it plans to prosecute the country's "largest and most hazardous nuclear site," Sellafield, for violating nuclear industry cybersecurity regulations from 2019 to 2023. Both Russian and Chinese nation-state hackers reportedly infiltrated the site's networks.

Feds Seek Secure-by-Design Armageddon for SQL Injection Bugs

Mathew J. Schwartz  •  March 28, 2024

What will it take to rid the world of SQL injection vulnerabilities, which remain too easily exploitable by attackers for ransacking databases and worse, despite having been classified as "unforgivable" for nearly two decades? U.S. government cybersecurity officials have thoughts.

On the Increase: Zero-Days Being Exploited in the Wild

Mathew J. Schwartz  •  March 27, 2024

Fresh zero-day vulnerabilities continue to be actively exploited in the wild by attackers, often for surveillance and espionage purposes, according to the latest annual review of in-the-wild exploits published by Google. In 2023, 97 new zero-days came to light, up from 62 in 2022.

Alert: Hackers Hit High-Risk Individuals' Personal Accounts

Mathew J. Schwartz  •  March 26, 2024

Calling all high-risk individuals: Ensure you're taking adequate steps to secure your personal devices and accounts, as criminals and nation-state hackers increasingly target them instead of grappling with corporate defenses, warned the U.K.'s National Cyber Security Center.

Data Protection Fines: UK Privacy Watchdog Updates Guidance

Mathew J. Schwartz  •  March 25, 2024

After suffering a data breach, organizations that work closely with regulators and cybersecurity officials will be treated with greater leniency if their case results in penalties and a fine, says new guidance on data protection fines published by the U.K. Information Commissioner's Office.

Experts Warn of Cyber Risk Due to Rapid AI Tool Evolution

Mathew J. Schwartz  •  March 22, 2024

Ongoing, rapid advances in generative artificial intelligence tools and large language models, including fewer barriers to illicit use, presage their increased use by cybercriminal and nation-state cyber operators to bolster sophisticated operations, cybersecurity officials and insurers warn.

Tactics for Battling Attacks by Russia's Midnight Blizzard

Mathew J. Schwartz  •  March 20, 2024

Major technology vendors keep being hacked by the nation-state hacking group Midnight Blizzard. Essential defenses to combat such attacks begin with implementing log monitoring across multiple platforms to find red flags, said John Fokker, head of threat intelligence at Trellix.

Cybersecurity in the UK: Government Sees Improvements Slow

Mathew J. Schwartz  •  March 20, 2024

The pace of cybersecurity improvements has stagnated at many Britain organizations over the past year, driven in part by budget and staffing challenges, according to a new U.K. government report designed to assess domestic business resilience and the country's collective cybersecurity posture.

After 70M Individuals' Data Leaks, AT&T Denies Being Source

Mathew J. Schwartz  •  March 19, 2024

Data breach blast from the past: Data pertaining to 70 million individuals that the ShinyHunters gang claimed were AT&T customers has been leaked via a hacking forum, three years after criminals first offered it for sale. AT&T said the information didn't appear to have been stolen from its systems.