Eyeglass Reflections Can Leak Information During Video Calls
A group of academic researchers have devised a method of reconstructing text exposed via participants’ eyeglasses and other reflective objects during video conferences. Zoom and other video conferencing tools, which have been widely adopted over the past couple of years as a result of the Covid-19 pandemic, may be used by attackers to leak information unintentionally reflected in objects such as eyeglasses, the researchers say. “Using mathematical modeling and human subjects experiments, this research explores the extent to which emerging webcams might leak recognizable textual and graphical information gleaming from eyeglass reflections captured by webcams,” the academics note in their research paper.
White House: U.S. agencies have 90 days to create inventory of all software
The White House released new guidance this week ordering federal agencies to create a full inventory of the software they use within 90 days. In a letter to all heads of executive departments and agencies, White House Office of Management and Budget (OMB) director Shalanda Young said a wide-ranging cybersecurity executive order handed down last May by President Joe Biden directed the National Institute of Standards and Technology (NIST) to publish guidance on how the agencies can better protect government systems through more secure software. Now that NIST has finished creating its guidance, the OMB wants all agencies to implement it for any third-party software used with an organization’s computer systems. The rules do not apply to software developed by agencies themselves.
The Pentagon has ordered a review of US psyops on social media
Pentagon officials have ordered a sweeping review of US information warfare operations conducted through social media platforms, The Washington Post reports, after Twitter and Meta both identified networks of fake accounts believed to be connected to the US military. Citing interviews with unnamed defense officials, The Post states that Colin Kahl, undersecretary for policy within the Department of Defense, instructed all branches of the military that conduct online influence campaigns to provide a full account of their operations by next month.
Cybercrime Forum Admins Steal from Site Users
Security researchers have uncovered evidence of administrators on cybercrime forums scamming their own customers. Threat intelligence firm Digital Shadows was sent a tip-off leading it to a cross-site scripting (XSS) forum thread. It contained direct messages between the moderator and administrator of the Altenen forum, and one unlucky user. Altenen is an English-language cybercrime forum that has been around for nine years. Like many similar sites, it processes payments via an escrow system – with the site admins managing the escrow account. In this case, a customer bought a laptop from another Altenen user, and then messaged the moderator asking them for a confirmation receipt that the money had been received. Instead, they were sent a demand for an additional ‘escrow fee’ of $120.
OpenAI begins allowing users to edit faces with DALL-E 2
After initially disabling the capability, OpenAI today announced that customers with access to DALL-E 2 can upload people’s faces to edit them using the AI-powered image-generating system. Previously, OpenAI only allowed users to work with and share photorealistic faces and banned the uploading of any photo that might depict a real person, including photos of prominent celebrities and public figures. OpenAI claims that improvements to its safety system made the face-editing feature possible by “minimizing the potential of harm” from deepfakes as well as attempts to create sexual, political and violent content.
American Airlines Breach Exposes Customer and Staff Information
American Airlines has become the latest big-name brand to announce a data breach in recent days, after an unauthorized actor compromised employee inboxes. The aerospace giant confirmed in a statement that the source of the incident was a phishing attack which “led to the unauthorized access to a limited number of team-member mailboxes.” The airline said that “a very small number of customers’ and employees’ personal information” was contained in the accessed emails, suggesting that its attackers were not able to pivot to corporate data stores. A breach notification letter sent to customers by American Airlines on Friday and seen by Infosecurity, noted that the incident actually took place in July this year.
