A researcher demonstrated a proof-of-concept attack chain that provided C2-style influence over ChatGPT's isolated sandbox during a session at Black Hat USA 2026.

Two former chief security officers of the Democratic National Committee explain that a strong security-first mindset requires executive support — and a dose of absurdity.

A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers.

The U.S. Justice Department said between February and October 2024, Moucka and co-conspirators used stolen login credentials to steal cloud-hosted data belonging to at least 165 customers of a U.S.-based software-as-a-service company.

The hackers targeted stolen credentials for Snowflake customer accounts that did not enforce multi-factor authentication, and extorted or attempted to extort a host of well-known companies, including TicketMaster, Lending Tree, Advance Auto Parts and Neiman Marcus. Snowflake responded to the data thefts by increasing password complexity requirements and enforcing multi-factor authentication.

Moucka adopted new nicknames frequently — sometimes operating multiple identities concurrently — but two of his best-known monikers were “Judische” and “Waifu.” Judische’s admitted role in the Snowflake data thefts was first documented by KrebsOnSecurity in a September 2024 story about the overlap between Western, English-speaking cybercriminals and extremist groups that harass and extort minors into harming themselves or others.

That September 2024 story identified Judische as a software engineer from Ontario who has been involved in numerous data breaches and voice phishing attacks against U.S. companies since at least 2020. A little more than a month later, Canadian authorities arrested Moucka on a provisional warrant from the United States.

The government says Moucka and others used their unauthorized access to steal billions of sensitive customer records and download terabytes of information, “including individuals’ non-content call and text history records, banking and other financial information, payroll records, Drug Enforcement Administration (DEA) registration numbers, driver’s license numbers, passport numbers, social security numbers and other personally identifiable information. They then extorted victims by threatening to publish data online.”

Moucka also threatened and harassed government officials and security researchers who were helping to track him down. The Justice Department said the conspirators made over $2.5 million in ransom payments, and that in at least one instance, Moucka re-extorted a victim with threats of further disclosure of the victim’s stolen data.

“Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt,” reads a statement from the Justice Department.

One of Moucka’s admitted co-conspirators is Cameron “Kiberphant0m” Wagenius, a U.S. Army soldier who pleaded guilty in July 2025 to extorting AT&T and Verizon for their customer account data. Less than a month before Wagenius’s arrest, KrebsOnSecurity published a deep dive into Kiberphant0m’s various Telegram and Discord identities over the years, revealing how the owner of the accounts told others they were in the Army and stationed in South Korea.

Kiberphant0m also re-extorted victims. Immediately following Moucka’s arrest, Kiberphant0m posted on hacker forums what he claimed were the AT&T call logs for then President-elect Donald Trump and for then Vice President Kamala Harris, as well schematics allegedly stolen from the U.S. National Security Agency (NSA).

Wagenius is set to be sentenced on September 3, 2026. The government says he faces a maximum penalty of 20 years in prison for conspiracy to commit wire fraud, a maximum penalty of five years in prison for extortion in relation to computer fraud, and a mandatory two-year sentence consecutive to any other prison time for aggravated identity theft.

The third alleged co-conspirator is John Erin Binns, 26, an elusive American man who fled the United States after being indicted for his admitted role in a 2021 breach at T-Mobile that exposed the personal information of at least 76 million customers.

Sources close to the investigation said Binns, also known as “IRDev” and “IntelSecrets,” was until recently incarcerated in a Turkish prison, but that he has since been released and has resurfaced online. Those sources said Binns also recently obtained Turkish citizenship, and under Turkish law a citizen cannot be extradited to a foreign country.

Moucka pleaded guilty to four criminal counts, including computer fraud, wire fraud, aggravated identity theft, and conspiracy. He is slated to be sentenced on Oct. 27 and faces a mandatory minimum penalty of two years in prison on the aggravated identity theft count, as well as a maximum penalty of 30 years in prison on the remaining counts. Ultimately, it will be up the federal judge how much time Moucka actually serves for his extensive cybercriminal rap sheet.

For an interview with Moucka prior to his arrest and a deeper look at Binns, see our original report on Moucka’s arrest.

Rilasciati aggiornamenti di sicurezza per Flowise, piattaforma open source per la realizzazione di workflow basati su modelli linguistici.

Rilevate tre nuove vulnerabilità, di cui due con gravità “alta”, in prodotti Zyxel. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di eseguire codice arbitrario e/o eludere i meccanismi di sicurezza sul sistema interessato.

Rilasciati aggiornamenti di sicurezza che risolvono una vulnerabilità, con gravità “alta”, in GitHub Enterprise Server, edizione on‑premises della piattaforma GitHub, progettata per ambienti aziendali con requisiti avanzati di sicurezza e conformità. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di eliminare file arbitrari dal filesystem dei sistemi interessati.

Utilisez-vous d'autres services que #PeerTube pour héberger vos vidéos ?

Saviez-vous que vous pouvez synchroniser automatiquement votre contenu sur ces autres services vers PeerTube ?

👉 https://docs.joinpeertube.org/use/channel-sync#how-to-program-a-new-import-automation-synchronization

#PeerTubeTipOfTheWeek

Cisco ha rilasciato aggiornamenti di sicurezza che risolvono molteplici vulnerabilità, tra cui 5 con gravità "critica" e 11 con gravità “alta”, riguardanti vari prodotti. In particolare si evidenziano la CVE-2026-20316 che risulta attivamente sfruttata in rete e la CVE-2026-20200 per la quale è disponibile un Proof of Concept (PoC).

Elvis Brooks thought he had an airtight case when he applied for compensation from the state of Louisiana after he was wrongfully convicted in a fatal bar shooting that kept him in prison for more than four decades.

The 69-year-old New Orleans native has never wavered in his claims of innocence, insisting since his 1977 arrest that the cops had the wrong guy. But it would take nearly 45 years and a prosecutor admitting he failed to turn over key fingerprint evidence before the courts threw out Brooks’ conviction.

That decision made Brooks eligible for up to $480,000 under a program created by Louisiana lawmakers to pay those wrongfully convicted in a state with one of the highest rates of overturned guilty verdicts. But Louisiana Attorney General Liz Murrill, the top prosecutor in the state, has vigorously fought Brooks’ compensation claim, asserting in court filings that he is still guilty and therefore should not receive any money at all.

And it isn’t just Brooks: Since taking office two years ago, Murrill has opposed all but one of 23 compensation claims brought by people whose convictions have been vacated by the courts. These include cases in which the men were exonerated through DNA or blood evidence and others in which police are accused of fabricating evidence. Once, Murrill even threatened to block an exoneree’s ability to obtain a license to practice law if he didn’t drop his claim.

Civil rights attorneys say Brooks’ case is one of the most egregious examples of a wrongful conviction in recent years. Murrill has been pushing the court since September 2024 to reject his compensation claim and also to reinstate a manslaughter charge against him. The case is pending before a district court judge in New Orleans; attorneys are scheduled to appear for the next hearing Monday.

When Brooks heard what Murrill was trying to do, five months after he’d filed his claim, he said he was flooded with anger and disbelief. Once again, he said, the state was trying to rip away his good name and falsely brand him a killer.

“She knows people are innocent but she doesn’t care,” Brooks said of Murrill during a recent interview, his voice rising with frustration. “She wouldn’t want nobody to do this to one of her loved ones.”

Some states that have more recently created compensation funds have experienced startup problems. In Michigan, narrow criteria and confusion over eligibility have prevented exonerees from getting paid. But in Louisiana, conservative politicians who oppose the very existence of a compensation fund and therefore fight nearly every claim have proven to be the biggest obstacle.

Gov. Jeff Landry, a Republican who served as attorney general for eight years, during which time he hired Murrill as the state’s solicitor general, opposed 10 of 12 compensation claims during his tenure. Both have staked their political careers on a tough-on-crime agenda. By contrast, Murrill’s more moderate Republican predecessor, Buddy Caldwell, who served as attorney general from 2008 to 2015, opposed just 33% of all claims.

Murrill’s hard-line tactics, particularly in Brooks’ case, stand out among her peers in other states, said Jeffrey Gutman, a professor emeritus at the George Washington University Law School and a national expert on compensation funds.

“I can’t think of an attorney general who has been quite as aggressive in trying to prevent people from getting compensation,” Gutman said.

Murrill, through her spokesperson, declined interview requests and did not answer questions regarding her opposition to the compensation fund. Both she and Landry have made their views on the fund clear during recent legislative sessions. Murrill told lawmakers last year that defending the state against these claims consumes an enormous amount of time and resources and that the fund should be abolished altogether. And in June, Landry vetoed a bill passed unanimously by the Republican-controlled Legislature that would have increased the amount paid to the wrongfully convicted. In his veto statement, Landry painted many of the exonerees as “convicted criminals” whose only interest is money.

Murrill’s opposition doesn’t necessarily mean that Brooks and other exonerees won’t eventually be compensated. The claims are ultimately decided by one of a number of district court judges, whose approach to this issue may vary. But it ensures that a process the law says should take no more than five months could instead drag on for years, exacting financial hardship and emotional pain on people who have already endured decades of both, said Herbert Larson, an attorney representing exonerees and a senior professor at the Tulane University Law School.

“If they’ve got DNA evidence that points at somebody else, if they’ve got fingerprints that point at somebody else, if it looks like sloppy police work, then we should pay the money and not spend the next two years litigating it,” Larson said. “That’s not a very effective use of time and money on the part of the attorney general.”

Brooks filed his application in 2024, but more than two years later, his case has yet to be heard by a district court judge. After having 42 years of his life stolen — missing his son’s childhood and losing his parents and three siblings while he was behind bars — Brooks said he shouldn’t continue to suffer at the hands of the state.

“It’s miserable and it’s frustrating, the games they play,” he said. “But if they think I’m going to give up, wave the white flag, they got me wrong.”

Conflicting Evidence and a One-Day Trial

On most days, Brooks can be found riding his bicycle down to Tricou and Douglas streets in New Orleans’ Lower 9th Ward, where he was raised, or through the French Quarter, where as teens, he and his friends would go to meet girls.

But there is one place he avoids: a vacant lot at the intersection of Dauphine and Alabo streets. That’s where the Welcome Inn once stood, and where a murder took place that would change his life.

In July 1977, a man named Cecil Lloyd was seated at the bar in the local dive when he was shot to death during an armed robbery. Less than three weeks later, police arrested 19-year-old Brooks.

There was no physical evidence tying him to the killing, and a dozen people testified that Brooks was at a family party at the time of the shooting. But three white witnesses said they saw the perpetrators in the dimly lit room and picked Brooks, who is Black, out of a photographic lineup. Although studies have shown that witnesses often have difficulty correctly identifying suspects of another race, and despite the fact that the three witnesses gave conflicting descriptions, the jury found him guilty of first-degree murder after a one-day trial.

What the jurors weren’t told is that fingerprints lifted from beer cans held by the robbers did not match Brooks’, or that police suspected the same men had robbed several people less than a block away just before the Welcome Inn robbery, according to prosecutor records discovered by Brooks’ attorneys 40 years later. The victims of the earlier crime were shown a photo of Brooks and ruled him out as a suspect.

After his conviction, Brooks was sent to the Louisiana State Penitentiary at Angola at a time when the maximum-security prison was considered one of the most violent in the country. Three years after Brooks arrived, his brother Errol, who was serving a 99-year sentence there for armed robbery, was stabbed to death.

“Angola was a madhouse,” Brooks said. “A hellhole.”

While Brooks served his life sentence, the criminal justice system was being revolutionized through the introduction of DNA evidence and, with it, proof that innocent people had been convicted. This led to a deeper look into other factors contributing to wrongful convictions, including prosecutorial misconduct and mistaken eyewitness identifications, especially those made by witnesses with different racial backgrounds from the suspects.

As a result, the number of exonerations nationwide increased from 25 in 1989 to 259 in 2022, according to the National Registry of Exonerations, a project operated by universities in Michigan and California. By 2025, Orleans Parish, where Brooks was convicted, had the highest rate of exonerations among U.S. counties with more than 300,000 residents, according to the registry.

Many states reacted to the rise in exonerations by creating funds to compensate those who were wrongly convicted. Louisiana established its fund in 2005 and today is one of 39 states, in addition to the District of Columbia, that compensate the wrongfully incarcerated. But it is far from a rubber-stamp process.

“It’s miserable and it’s frustrating, the games they play. But if they think I’m going to give up, wave the white flag, they got me wrong.”

Elvis Brooks, exoneree

To be eligible, a person has to have been imprisoned as a result of a conviction that was later vacated by a court. Applicants, like in all states with these funds, must then prove their innocence. Having a conviction thrown out is not enough to do so: A court can vacate someone’s conviction for a number of reasons, including an ineffective attorney or significant errors committed by the judge or prosecution. But that only means there were problems with the original trial. It is up to the person applying for compensation to present evidence that they did not commit the crime.

In many states, innocence in the compensation process is proven by a “preponderance of evidence,” which attorneys understand to mean that there is more than a 50% chance that the person is innocent. This is the standard used in civil cases. The threshold is higher in Louisiana and some other states, where applicants are required to prove they are innocent by “clear and convincing” evidence. This is supposed to leave little doubt in the judge’s eyes that they did not commit the crime.

That’s the hurdle Brooks must clear to receive any money from the state.

Exonerated but Not Paid

Brooks filed for compensation in April 2024, just a few months after Murrill and Landry took office. He didn’t know much about the process, he said, except that it was meant to help people like himself get back on their feet after a wrongful conviction. Brooks assumed it wouldn’t take long at all, maybe a few months. But like nearly all the others, his request was met with fierce opposition from the attorney general’s office.

Murrill, seen by many as a future candidate for governor, has earned the reputation as a fighter unapologetic about the methods she is willing to use to enact a conservative agenda, both in the political world and the courtroom.

Verite News and ProPublica interviewed the attorneys of 17 of the people whose compensation claims Murrill opposed. The majority expressed shock at her tactics. When Landry was attorney general, his office regularly spoke with defense attorneys and assured them that the attorney general would not stand in the way of compensation in the rare times the office agreed that a former prisoner was innocent, according to two of the attorneys. Landry did not respond to a request for comment.

Those conversations no longer happen under Murrill, the attorneys said. In nearly every case, Murrill’s office has insisted that the exoneree either is guilty or has failed to sufficiently prove his innocence.

Of the 23 people who have had active claims under Murrill, four so far have been awarded compensation. The rest are pending. Of the successful claims, two of the men were cleared by DNA evidence, while blood serum evidence was used to prove innocence in the third. Yet Murrill opposed all three, delaying their compensation for nearly two years. (In the fourth case, Murrill dropped her opposition to Patrick Brown’s claim after the victim testified that the exoneree was innocent).

Jarvis Ballard is one of the four. He spent 23 years in prison before his 1999 rape conviction was vacated after his DNA was not detected in any of the blood or semen samples found at the scene. In addition, the victim reported two men committed the crime; however, three men, including Ballard, were prosecuted and convicted. The other two men testified that Ballard was not involved.

The St. Bernard Parish district attorney’s office admitted in a 2021 statement that the office had made a mistake in prosecuting him. “DNA evidence, witnesses recanting their prior statements and polygraph testing all supported the ‘actual innocence’ claims of Jarvis Ballard,” district attorney Perry Nicosia wrote.

In another case, Darrill Henry was sentenced to life in prison in 2011 for a double homicide. Nine years later, New Orleans Criminal District Court Judge Dennis Waldron threw out his conviction after DNA evidence found under the fingernails of one of the victims cleared him, saying there was “clear and convincing evidence that he is indeed factually innocent of the crime.”

And in a third case, Sullivan Walter was sentenced to 40 years in prison in 1986 for burglary and rape, among other charges. He was only 17 at the time but was tried as an adult. His conviction was overturned in 2022 when blood evidence ruled him out as the perpetrator.

“This is horrible,” Criminal District Judge Darryl Derbigny said to Walter as he ordered his release from prison, according to news reports. “I’m at a loss of words to express the sorrow and the anger I have at the treatment you’ve been dealt by the system.”

But in all three cases, Murrill told the courts that despite the DNA or blood evidence, the men did not sufficiently prove their innocence.

“They’re taking a position that is inconsistent with what many prosecutors argue every day in seeking conviction,” Zac Crawford, staff attorney at Innocence & Justice Louisiana, a nonprofit law firm specializing in wrongful convictions, said about Murrill’s office. “Prosecutors frequently use DNA testing to match someone to a crime as a means of getting a guilty verdict, and they are not willing to concede that that same evidence also proves innocence.”

Murrill hasn’t confined her fight against compensation claims to the courts, having used threats to prevent at least one exoneree, Calvin Duncan, from even pursuing a claim. After serving 28 years of a life sentence for murder, he accepted a plea deal to secure his release in 2011. Ten years later, a district court judge ruled that he was factually innocent and threw out his conviction, citing the suppression of exonerating evidence by police, among other factors.

When Duncan filed for compensation in 2023, Murrill issued a threat, Duncan said during a recent legislative hearing: drop the claim or she would charge him with perjury for falsely saying he was exonerated. At the time, Duncan was pursuing a law license. He said Murrill added a second warning: If he didn’t drop the claim, she would report him to the bar association to prevent him from getting his license.

Duncan said he reluctantly agreed to withdraw his compensation application, with the understanding that Murrill would then drop the matter. But she didn’t keep her word, Duncan told legislators. During Duncan’s campaign last year for New Orleans criminal court clerk, Murrill sent him a letter threatening “further action from this office” if he didn’t stop referring to himself as being exonerated. “You have not proven you were actually innocent,” she told him.

She then used his plea deal against him, saying, “You knowingly and voluntarily pled guilty to manslaughter and armed robbery.”

Duncan, who declined to comment, won his election but was stripped of his office after legislators, with Landry’s support, eliminated his position. His campaign manager said Duncan has paused his pursuit of a law license in part because of his race for court clerk and Murrill’s persistent threats.

Malcolm Alexander spent nearly 38 years in prison before being exonerated through DNA evidence in 2018. Despite the opposition of Landry, then attorney general, Alexander was later awarded compensation, though he said these claims aren’t all about money. Even more important is that when a judge awards an exoneree compensation, it comes with a definitive ruling that the person is, in fact, innocent.

So while Murrill’s desire to deprive exonerees of money is terrible, Alexander said, her efforts to prevent them from having their names officially cleared are truly reprehensible.

“It Wasn’t Right From Day One”

Brooks was 60 years old and had been in Angola prison for nearly two-thirds of his life when his legal team discovered a wealth of new evidence that appeared to conclusively prove his innocence. Among these items were fingerprints lifted from beer cans held by the shooters during the Welcome Inn bar robbery and fatal shooting. And those fingerprints did not match Brooks’.

In January 2019, Brooks’ legal team filed a motion to overturn his murder conviction. Leon Cannizzaro, the New Orleans district attorney at the time, objected, telling the court that his office did not purposefully withhold any evidence.

Brooks said he was ready to wage a lengthy legal battle to prove he was not a murderer. But five months later, Cannizzaro approached Brooks with an unexpected offer: If he agreed to plead guilty to manslaughter, his life sentence would be reduced to 42 years and he would be allowed to walk out of Angola prison. Brooks agonized over the decision. The idea of standing up in court and saying he had killed someone was unimaginable. But he also didn’t want to die an old man on a rusted prison cot. So he took the deal.

Two years later, as Brooks was struggling to adjust to life outside of prison and still strapped with a felony record, his legal team found a memo in a pile of records they had requested from the district attorney’s office that detailed a 2019 internal meeting with one of the prosecutors at Brooks’ murder trial. He admitted that they didn’t turn over the fingerprint evidence and that it would have been helpful to Brooks’ case, according to the memo.

The meeting had occurred just two weeks before Cannizzaro offered Brooks the plea deal. If Brooks had known about the prosecutor’s admission, he said, he never would have accepted the plea.

“It wasn’t right from day one,” Brooks said.

In 2022, when presented with this new information, the district court agreed. It ruled that the district attorney withheld crucial evidence when offering the plea deal and threw it out along with Brooks’ conviction. Current New Orleans District Attorney Jason Williams declined to retry the case, clearing the way for Brooks to file his compensation claim two years later.

Cannizzaro could not be reached for comment. In a statement issued after Brooks’ 2019 release from prison, the former district attorney said he offered Brooks the plea deal because his office believed he was “rehabilitated and will not go out and reoffend.” Cannizzaro rejected the idea that Brooks was wrongfully convicted, saying at the time that if he were innocent, Brooks and his attorneys would have turned down the deal. “Notably, they did not,” he said.

Murrill is now using that discredited plea deal against Brooks, just as she did in Duncan’s case, in an attempt to quash his compensation claim. In a September 2024 motion, Murrill claimed that by vacating Brooks’ manslaughter conviction while he was a free man and not a prisoner, the court essentially pardoned him. And under the state constitution, only the governor has the power to issue pardons. As a result, she has asked that the court reinstate the manslaughter charge against Brooks.

Murrill did not, however, address the fact that the court vacated the deal because prosecutors intentionally withheld key information, according to court records.

In her motion, Murrill said she only learned the plea deal had been thrown out when Brooks filed his claim. And that, said attorney Harry Daniels, who represents Brooks, is when she started the effort to reinstate charges against him. “It’s only when he started demanding what he’s entitled to for being wrongfully convicted that this even became an issue,” Daniels said.

Brooks has described applying for compensation as torturous, a barricade that is constantly preventing him from being able to move forward. And life has been difficult: His only source of income is his $994-a-month Social Security payment, enough to rent a one-bedroom apartment in a low-income senior center.

There are moments, though, he said, when he allows himself to dream about what he would do with the money. The first would be to buy a bigger headstone for his family gravesite, where his parents, four siblings and a nephew are buried in a single plot in the Green Street Cemetery. All but one died while he was wrongfully imprisoned. There is room on the headstone for only three of the seven names.

“I want to put all our names on there,” he said. “Give them some respect, especially my momma.”

The post He’s Eligible for Up to $480,000 After Being Wrongly Imprisoned for 42 Years. The State Says No. appeared first on ProPublica.

Recenti scoperte sollevano dubbi sulla sicurezza di iCloud Private Relay, evidenziando una falla che potrebbe portare a delle perdite di IP, esponendolo nonostante le protezioni. Molti utenti si affidano a questo servizio Apple per navigare in modo più privato su Safari, convinti di mascherare la propria posizione e le attività online. Tuttavia, un'interazione apparentemente innocua con un sito web potrebbe vanificare tutto.

Analizziamo insieme cosa sta succedendo, quali sono i rischi concreti e, soprattutto, come puoi proteggerti.

Cos'è l'iCloud Private Relay e come proteggerti?

Prima di entrare nel vivo del problema, facciamo un passo indietro. L'iCloud Private Relay, incluso negli abbonamenti iCloud+, non è una vera e propria VPN. È un servizio intelligente progettato per aumentare la tua privacy durante la navigazione con Safari.

Il suo funzionamento si basa su un'architettura a due server separati (o "hop"). Infatti il primo server, gestito da Apple, cifra le tue richieste DNS e nasconde il tuo indirizzo IP a chiunque, tranne che al tuo provider di rete. Il secondo server, gestito da un partner esterno, genera un indirizzo IP temporaneo e ti connette al sito di destinazione.

In questo modo, né Apple né il sito web che visiti possono avere un quadro completo di chi sei e cosa stai facendo. Una soluzione elegante ed efficace, almeno in teoria.

Se ti interessa conoscere diversi tipi di VPN, leggi il nostro approfondimento.

La falla in WebKit: il tallone d'Achille della privacy Apple

Il problema non risiede direttamente nell' iCloud Private Relay, ma in qualcosa di molto più profondo: il WebKit. Si tratta del motore di rendering che, per le policy sulla privacy di Apple, deve essere utilizzato da tutti i browser su iOS, incluso Safari.

Una recente analisi dei ricercatori Tommy Mysk e Talal Haj Bakry ha svelato una vulnerabilità preoccupante. In pratica, quando un sito web supporta l'autenticazione tramite passkey, il sistema può avviare una richiesta di rete separata. Questa richiesta, purtroppo, non passa attraverso il tunnel protetto dall' iCloud Private Relay. Di conseguenza, il server di destinazione riceve il tuo indirizzo IP reale, bypassando completamente la protezione che pensavi di avere.

Già in precedenza sono state scoperte delle vulnerabilità su WebKit. Approfondisci con il nostro articolo.

Come i passkey possono causare la perdita di dati

L'aspetto più insidioso è che non è richiesta alcuna azione complessa. È sufficiente interagire con una funzione di passkey su un sito malevolo per innescare la perdita di dati. Infatti non è necessario installare software, aprire allegati o cedere password. La falla sfrutta un comportamento del sistema operativo legato allo standard WebAuthn, rendendo la protezione a livello di browser meno efficace del previsto.

Questa debolezza non riguarda solo Safari: poiché tutti i browser su iOS usano WebKit, anche app focalizzate sulla privacy come OnionBrowser possono essere vulnerabili.

Quali sono i rischi reali? Panico o semplice cautela?

Prima di tutto, niente panico. È fondamentale capire la portata del rischio.

Non si tratta di un furto di account o dell'installazione di malware, ma di una fuga di informazioni che compromette il tuo anonimato. Un indirizzo IP esposto può rivelare:

• La tua localizzazione geografica approssimativa.
• Il tuo provider di servizi internet.
• Dati utili per la profilazione da parte di inserzionisti o malintenzionati.

Sebbene non sia un attacco diretto, questa informazione può essere il primo passo per azioni più mirate o per raccogliere dati su di te senza consenso.

Come puoi difendere il tuo l'iCloud Private Relay?

Apple ha dichiarato di essere al lavoro per investigare il problema.

Nell'attesa di una patch ufficiale, cosa puoi fare per navigare con maggiore sicurezza?

• Fai attenzione ai passkey: sii molto cauto quando interagisci con questa funzione su siti web che non conosci o di cui non ti fidi pienamente. La prudenza è la tua prima linea di difesa.
• Mantieni tutto aggiornato: sembra scontato, ma installare tempestivamente gli aggiornamenti di sistema non appena vengono rilasciati è cruciale. La soluzione arriverà quasi certamente tramite un update.
• Usa strumenti dedicati per l'anonimato: se hai bisogno della massima anonimità, iCloud Private Relay non è lo strumento giusto. Affidati a soluzioni più complete come il Tor Browser ufficiale, che non è affetto da questa specifica vulnerabilità.

In conclusione, iCloud Private Relay rimane un ottimo strumento per la privacy quotidiana, ma non è infallibile. Comprendere i suoi limiti è il primo passo per usarlo in modo consapevole e proteggere davvero i tuoi dati personali online.

L'articolo iCloud Private Relay e la falla di sicurezza con perdite di IP proviene da sicurezza.net.

AI browsers from top vendors remain vulnerable to prompt injection attacks despite multiple security guardrails, according to new research.

Attackers can take control of agents through malicious instructions hidden in content supplied to AI browsers, and there's no simple fix for the threat.