Cybercriminals threaten to leak all 5 million records from stolen database of high-risk individuals
The World-Check database used by businesses to verify the trustworthiness of users has fallen into the hands of cybercriminals. The Register was contacted by a member of the GhostR group on Thursday, claiming responsibility for the theft. The authenticity of the claims was later verified by a spokesperson for the London Stock Exchange Group (LSEG), which maintains the database. A spokesperson said the breach was genuine, but occurred at an unnamed third party, and work is underway to further protect data. “This was not a security breach of LSEG/our systems,” said an LSEG spokesperson. “The incident involves a third party’s data set, which includes a copy of the World-Check data file.
Microsoft’s VASA-1 can deepfake a person with one photo and one audio track
On Tuesday, Microsoft Research Asia unveiled VASA-1, an AI model that can create a synchronized animated video of a person talking or singing from a single photo and an existing audio track. In the future, it could power virtual avatars that render locally and don’t require video feeds—or allow anyone with similar tools to take a photo of a person found online and make them appear to say whatever they want. “It paves the way for real-time engagements with lifelike avatars that emulate human conversational behaviors,” reads the abstract of the accompanying research paper titled, “VASA-1: Lifelike Audio-Driven Talking Faces Generated in Real Time.” It’s the work of Sicheng Xu, Guojun Chen, Yu-Xiao Guo, Jiaolong Yang, Chong Li, Zhenyu Zang, Yizhong Zhang, Xin Tong, and Baining Guo.
WhatsApp, Threads, more banished from Apple App Store in China
Apple has removed four apps from its China-regional app store, including Meta’s WhatsApp and Threads, after it was ordered to do so by Beijing for security reasons. The Chinese government also ordered the removal of Telegram and Signal, making it clear that the directive was targeted at communications apps in particular. With the exception of Threads, all apps boast strong encryption technologies, which may have irritated the Middle Kingdom as encryption makes it much harder for it to keep an eye on its citizens. It’s conspicuous that the ban comes soon after the China-based social media app TikTok received heavy scrutiny in the US and the EU. Congress is on the path to banning TikTok entirely, while the EU is probing the new TikTok Lite app launched earlier this month. It’s possible that banning Western apps is a form of retaliation.
MITRE was breached through Ivanti zero-day vulnerabilities
The MITRE Corporation, a non-profit overseeing federally funded research, was breached by nation-state hackers in January through two zero-day vulnerabilities in products from IT vendor Ivanti. The company explained in a blog post on Friday that unidentified threat actors performed reconnaissance on its networks by exploiting one of its VPNs through two vulnerabilities in Ivanti Connect Secure. At the time, Ivanti said the two vulnerabilities — CVE-2023-46805 and CVE-2024-21887 — were used in attacks on at least 10 of its customers.
Cops can force suspect to unlock phone with thumbprint, US court rules
The US Constitution’s Fifth Amendment protection against self-incrimination does not prohibit police officers from forcing a suspect to unlock a phone with a thumbprint scan, a federal appeals court ruled yesterday. The ruling does not apply to all cases in which biometrics are used to unlock an electronic device but is a significant decision in an unsettled area of the law. The US Court of Appeals for the 9th Circuit had to grapple with the question of “whether the compelled use of Payne’s thumb to unlock his phone was testimonial,” the ruling in United States v. Jeremy Travis Payne said. “To date, neither the Supreme Court nor any of our sister circuits have addressed whether the compelled use of a biometric to unlock an electronic device is testimonial.”
Researchers find dozens of fake E-ZPass toll websites after FBI warning
Cybersecurity researchers have found almost 30 phishing websites spoofing the electronic toll collection service E-ZPass following an FBI warning last week. The FBI said in an alert that since early March the Internet Crime Complaint Center (IC3) has received over 2,000 complaints reporting smishing texts impersonating road toll collection services from at least three states. Smishing is a social engineering attack using fake text messages to trick people into downloading malware, sharing sensitive information, or sending money. The complaints seen by the FBI indicate “the scam may be moving from state-to-state,” they said.
