Cybersecurity is the rickety scaffolding supporting everything you do online. For every new feature or app, there are a thousand different ways it can break – and a hundred of those can be exploited by criminals for data breaches, identity theft, or outright cyber heists. Staying ahead of those exploits is a full-time job, and one of the most lucrative and sought-after skills in the tech industry. All too often, it’s something up-and-coming companies decide to skip out on, only to pay the price later on.
On Monday, a report from 404Media found that a hacker obtained direct messages and CBP contact information from TeleMessage after Mike Waltz was spotted using the company’s modified version of Signal.
Customs and Border Protection spokesperson Rhonda Lawson told Wired that the agency “immediately disabled” TeleMessage in response to the attack and that its “investigation into the scope of the breach is ongoing.”
Donald Trump announced Thursday that he would remove Michael Waltz as National Security Advisor and appoint him as ambassador to the United Nations. CBS reported earlier that Trump did not want to explicitly fire Waltz, the person who accidentally added The Atlantic’s Jeffrey Goldberg to the group chat, but waited several weeks before he could spin the demotion as part of a reorganization strategy at the National Security Council.
The increase in AI tools, deepfake technology, and fully remote jobs following the covid pandemic has enabled a new kind of scam: workers who take jobs with US and European companies under false identities and send their salaries to the North Korean government.
The US government estimates that teams of pretenders can earn up to $3 million each year, and workers can go undetected at companies for many months.
Dutch right-wing activist Eva Vlaardingerbroek reported receiving a message from Apple, saying the company “detected a targeted mercenary spyware attack against your iPhone.” The message adds, “This attack is likely targeting you specifically because of who you are or what you do.”
Italian journalist Ciro Pellegrino reported receiving a similar message that indicated Apple had sent warnings to victims in 100 countries, as reported by TechCrunch. Apple last warned users about a spyware attack in July 2024.
Trump’s interview with The Atlantic editor in chief Jeffrey Goldberg (on purpose, this time) is now out. If you choose to use Signal, we have some advice on how, but here’s the president’s take:
Goldberg: But is there any policy lesson from that, that you’ve derived and have talked to Pete Hegseth about, and Mike Waltz?
Trump: I think we learned: Maybe don’t use Signal, okay? If you want to know the truth. I would frankly tell these people not to use Signal, although it’s been used by a lot of people. But, whatever it is, whoever has it, whoever owns it, I wouldn’t want to use it.
After posting to its blog for the first time in 8 years on Friday, 4chan published a new post explaining what took the site down on April 14th, as Engadget spotted. The social media site blames hackers uploading a “bogus PDF” that “exploited an out-of-date software package on one of 4chan’s servers.”
It’s back, but not all the way — as of this writing, images and the ability to post still haven’t returned.
[blog.4chan.org]
Google’s Scam Detection feature, which works on Pixel Watch 2 and 3 devices connected to a Pixel 9 and newer phone, will notify you if it thinks you’re talking to a scammer on a call, according to a support post.
Google Play services are also getting updates, including the ability to add a nickname to Wallet passes. And an Android security update addressed two issues that “may be under limited, targeted exploitation.”
Apple has won its first legal battle over the UK’s demand for a backdoor to encrypted data: the right to tell everyone it’s happening. The Investigatory Powers Tribunal has ruled on whether Apple’s claim should be kept secret on national security grounds, and Apple won.
That doesn’t bring it any closer to restoring ADP encryption in the UK, nor does it mean hearings will be public, but this open secret is a little more open.
[investigatorypowerstribunal.org.uk]
After years of providing breach notifications and useful advice about how to avoid getting hacked, Have I Been Pwned operator Troy Hunt’s personal blog mailing list has become the source of a breach after he fell for a fake spam alert phishing attack this week. He has notified subscribers, and is following up for people who unsubscribed but still had data stored by his provider, Mailchimp.
Read the blog post for details on how they got him (listen to your password manager), how it could’ve been avoided (passkeys!), and what else there is to learn.
The device helps you access your Google account without a password by connecting to your PC through a USB port or wirelessly with NFC. It’s now available for purchase in 11 more countries, including Ireland, Portugal, The Netherlands, Australia, New Zealand, Singapore, Puerto Rico, and others.
[security.googleblog.com]
CIA director John Ratcliffe, Director of National Intelligence Tulsi Gabbard, FBI Director Kash Patel, and others are testifying today before the House Intelligence Committee. Unsurprisingly, a good amount of the hearing is centered around Signalgate, with most questions coming from Democrats. Watch a recording below.
A day after The Atlantic EIC Jeffrey Goldberg revealed he’d been inadvertently included in a group message on Signal where Trump admin officials discussed details of an upcoming military strike, CBS News reports on an NSA warning from February that the app isn’t approved for “nonpublic unclassified” information. Despite testimony today that no classified material was shared, the NSA noted the danger posed by Russian phishing campaigns attempting to add a linked device and bypass Signal’s encryption for surveillance.
Later on Tuesday evening, Democratic Leader Hakeem Jeffries shared a letter he’d sent to the president saying Secretary of Defense Pete Hegseth “should be fired immediately” over the breach, and watchdog organization American Oversight said it’s filed a lawsuit against several of the officials in the chat.
The Citizen Lab just published its investigation into Paragon Solutions, an “ethical” cyber defense company recently linked to a spyware campaign targeting journalists on WhatsApp. Along with the Canadian Ontario Provincial Police, researchers found that governments in Australia, Cyprus, Denmark, Israel, and Singapore may also be potential Paragon customers.
That’s how much Google’s parent company will pay if its $32 billion acquisition of the cloud security startup falls apart, sources tell the Financial Times. The deal reportedly wouldn’t have proceeded without such a high termination fee, which the FT calls “among the largest of all time.”
