I rented a car, and within hours, my driver’s license was for sale - Ars Technica - I rented an SUV from a well-known car rental company. Within hours of an employee scanning my driver’s license, a high-resolution scan of my ID was available for sale on the dark web.
Apple rescues Hide My Email feature from the privacy scrap heap | TechCrunch - The company confirmed an update on Monday that Hide My Email addresses “will remain” on @icloud.com, after previously saying it would move users to @private.icloud.com which would have made it easier for companies to reject at sign-up.
Frontier AI labs still won’t say how they’d contain a rogue model | TechCrunch - Guidelight’s assessment was based on publicly available plans from Anthropic, Google, OpenAI, Meta, and xAI, graded across a range of metrics, including how well each company logs and monitors what its AI systems are doing internally, whether it halts systems after a surge of flagged misbehavior, whether independent third parties audit its controls and publish findings, and what its exact plan is for containing a model that goes off the rails.
DEF CON hackers add new muscle to water utility protection - On Friday, at the annual hacker’s conference, DEF CON Franklin and the National Rural Water Association (NRWA) announced a new program called the Water Watch Center. It will initially fund five providers - Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies - to help small water utilities serving fewer than 10,000 people detect and mitigate breaches.
Today was a fun but sad day. New friends, new fascinations, and like kid summer camp, sweet goodbyes, and promises to write just as soon as you get home.
Regardless, the day was packed with great talks and fun. The day started with another talk on PLCs (I really like PLCs and ICS) from Matt Caldwell over at Tophat security who showed how Ironmap had scanned some 7.5+ million devices. Its as bad as you think, and possibly worse.
Author's Note: I was hesitant at best to make this post, but after several conversations with others, I am a disabled vet, and attended DefCon with another disabled vet. I was embarassed to have made use of the accomadations available and so neglected to write about day 2. This is my correction to that.
Day 2 resulted in us rolling in to the Convention center and heading to badge pick-up, and despite everyone’s warnings, the badge line was literally non-existent. I headed to the registration room and someone yelled at me to open my qr code before entering the room. Opening up the qr code from the registration email, I walked to a registration worker who booped my phone and sent me on my way.
Today started like most other defcon days, up, eat, rush to the conference center with tons of other people, and see what you can see.
This morning started off with an interesting talk from Samet Can Tasci who presented on Shadow Webhooks:Hunting for Dangling Event Listeners in Enterprise Workspaces. This talk offered a structured way to review Slack, Teams, Jira, et al. For previously configured web hooks that were no longer replying securely and may or may not operate with proper authentication/authorization.
Today was finally the day. 22 years in the making and I was finally going to be a DefCon attendee. I woke up around 0630 and took care of my biological requirements, got dressed, and laid back down in the bed, fully clothed, and ready to surprise xRichless. I must have been an unwelcome surprise as he rolled over and winced his eyes against the light only to see me leap violently from the covers fully dressed while shouting, “Good morning StarShine! The Earth says, ‘Hello!’” He told the Earth a few choice words of his own before rolling back over.
After boarding our flights from Chattanooga at zero-dark-thirty, @xRichless and I were finally on our way to Hacker Summer Camp.
For two men in their late 30’s I’m sure we couldn’t have looked more like excited children as Haileyeliah dropped us off with our Hak5 gear, graphic tee’s and Faraday bags at the municipal airport. A misspelled name, a broken lavatory, and a damaged zipper were the name of the game. Undeterred our intrepid heroes made the journey from Chattanooga to the desert heat of Las Vegas Nevada.
FTC sues Hims & Hers for allegedly sharing patients’ medical data with advertisers Meta and Snap | TechCrunch - In its complaint filed in a California federal court, the FTC alleged that Hims & Hers placed pixel-sized trackers provided by Meta, Snap, and other tech and advertising giants, including Microsoft, Pinterest, Reddit, and X. These trackers, the FTC said, “captured and shared users’ health information,” contrary to Hims & Hers’ own privacy policy. The FTC alleges the company also used Meta’s tools to track users’ clicks and other actions that users took on its website. The FTC also accused Hims & Hers of deceptive billing, and drawing up policies that allegedly made it difficult for customers to cancel, in violation of federal consumer protection laws.