The AI, Privacy, and Security Weekly Update

This week takes us from blueteeth to AI emotional support Jack Dorsey’s innovative Bitchat app pioneers secure, internet-free messaging via Bluetooth, redefining decentralized communication. Google’s Gemini AI introduces context-aware assistance on Android, sparking privacy debates with its opt-out data access model. A major breach exposes Catwatchful’s invasive stalkerware, compromising thousands...

North Korean IT Worker Fraud Scheme: The U.S. Department of Justice uncovered a covert North Korean operation involving IT workers fraudulently securing remote jobs at over 100 American tech companies using stolen or fake identities. These workers operated within U.S.-based "laptop farms" and created shell companies to obscure over $5 million in illicit earnings. Funds were funneled to t...

This week we've got loads of news and loadsa money! North Korean IT workers secretly landed remote jobs at over 100 U.S. tech companies, funneling millions to fund Kim Jong Un’s weapons program.  The operation ran for years undetected—until the FBI knocked on the wrong contractor’s door. Android 16 is getting a stealthy new feature that alerts users when their phone connects to suspicious cell...

What are the latest trends in large-scale cyberattacks, and how can individuals help prevent them? Large-scale cyberattacks, especially Distributed Denial of Service (DDoS), are growing in both scale and sophistication. One recent attack hit 7.3 Tbps, unleashing 37.4 TB of junk traffic in 45 seconds. These attacks often harness botnets made up of compromised Internet of Things (IoT) devices—like h...

In this week's update: A massive 7.3Tbps DDoS attack overwhelmed a Cloudflare customer’s site with 37.4 terabytes of junk traffic in just 45 seconds, highlighting the growing scale of cyber threats. Smart TVs equipped with Automatic Content Recognition (ACR) technology track viewing habits across devices, raising significant privacy concerns due to extensive data collection. Then the UK’s Info...

Windows Hello's Facial Authentication Update Microsoft updated Windows Hello to require both infrared and color cameras for facial authentication, addressing a spoofing vulnerability. This enhances security but disables functionality in low-light settings, potentially inconveniencing users and pushing some toward alternatives like Linux for flexible authentication. EchoLeak and AI Security &#3...

EP 247. ... and in this update, Microsoft has updated Windows Hello to require both infrared and color cameras for facial authentication, improving security by addressing a spoofing vulnerability, though it now requires visible lighting. This increases biometric reliability and inconvenience to users in low-light settings. Consider exploring alternative operating systems like Linux for flexible au...

Meta and Yandex covertly tracked Android users through their apps, which listened silently on local ports to intercept browsing data and link online activities to user identities, evading common privacy measures like cookie deletion or Incognito Mode. Users can protect themselves by uninstalling these apps, switching to privacy-focused browsers (e.g., Firefox, Brave, DuckDuckGo), and closely manag...

EP 246 ...And in this update, the subject of overreach.  Just last week, Meta and Yandex ceased covert tracking practices on Android apps that exploited localhost communications to collect user data, prompting recommendations to use privacy-focused browsers like Firefox, Brave, or DuckDuckGo.   The ACLU filed a lawsuit against Sonoma County, California, alleging its drone program, initially for tr...

Recent digital developments show a growing gap between technological innovation and the protections needed to safeguard privacy, autonomy, and society at large. A string of high-profile incidents showcases the systemic vulnerabilities across sectors. Data breaches remain rampant. LexisNexis Risk Solutions, a leading data broker, suffered a breach via a third-party vendor, compromising the PII of o...

EP 245 In this week's update:  A trove of sensitive Russian nuclear facility documents was unintentionally published through a government procurement site, revealing critical infrastructure details, raising global security concerns and providing your child's science class with a new talking point. A new study shows that large language models struggle to manage even simple long-term busines...

Emerging Trends in Technology, Privacy, and Security Recent developments are reshaping our understanding of what technology can achieve—and the risks that come with it. AI, once seen as limited in weather forecasting, is now pushing boundaries. Google's GraphCast, tested by the University of Washington, has demonstrated surprising accuracy forecasting weather up to 33 days out, challenging the...

EP 244.  In this week's update:  AI is rewriting the rules of meteorology, with new models like GraphCast showing potential to accurately predict weather up to 33 days in advance—challenging a long-standing two-week limit.  But today's weather could remain a challenge As global temperatures rise, invasive and deadly fungi like Aspergillus are spreading into new regions—posing increasing ri...

What physical security measures are recommended for protecting high-value wallet signers' homes? Recommendations include implementing a high-security safe (like a TL-30 rated safe) for storing hardware wallets and seed phrases, reinforcing doors and using strong locks such as deadbolts and smart locks with biometric access. Inside, security cameras with remote monitoring are advised for critical a...

Cybersecurity Evolution: Cybersecurity has evolved from early academic and hobbyist roots—like 1970s viruses and 1980s ransomware—to defending against today's state-sponsored attacks, data breaches, and AI-driven threats. Each decade brought new challenges: the 1990s saw internet threats prompting firewalls and encryption; the 2000s introduced mass-scale DDoS and data theft; and the 2010s brou...

EP 243. In this week's update:   A History of Cybersecurity From Cold War codebreakers to cloud-native firewalls, the story of cybersecurity is a decades-long arms race between innovation and intrusion. Rogue Communication Devices in Chinese Inverters When your solar panels start phoning home to places you didn’t authorize, it’s time to rethink who you trust with your grid. Microsoft Teams Cap...

The evolving digital and geopolitical landscape reveals mounting tensions between innovation, privacy, and national security. A proposed $400 million private jet gift to Donald Trump from Qatar exemplifies this collision of interests. Though offered at no cost, the aircraft would require extensive and costly retrofitting to meet U.S. presidential security standards—ranging from secure communicatio...

EP 242. In this week's update: A luxury aircraft gift from Qatar to Trump highlights the hidden cost of “free” when it comes to retrofitting for U.S. presidential security. Well-timed trades on Melania Trump’s memecoin are raising serious questions about insider access in the unregulated world of crypto. Repeated credential leaks tied to a federal security engineer underscore the long-term ris...

Wearable technology like Ray-Ban Meta glasses presents significant privacy concerns by enabling frequent data collection without clear user controls, potentially capturing personal information of users and bystanders unknowingly. TikTok received a €530 million fine from the EU primarily because user data was remotely accessible from China, raising surveillance risks, and the platform failed to tra...

EP 241. In this week's update:   Smile, You’re Training Zuck’s AI.  Meta quietly rewrote the fine print so your Ray-Bans can help train its AI by default—just say "Hey Meta" and wave goodbye to meaningful opt-outs. The Irish DPC slapped TikTok with a $600M wake-up call after finding the app's transparency was more filter than fact—China got the data, and Europe got the breach of trust. Billions of...

Recent data breaches have had significant impacts. WorkComposer, an employee monitoring app, exposed over 21 million sensitive employee screenshots due to a misconfigured cloud storage bucket. This breach compromised data such as emails, internal chats, and login credentials, leading to risks like phishing attacks, identity theft, corporate espionage, and legal consequences under GDPR and CCPA. In...

EP 240.   For this week's update:   A major employee monitoring tool suffered a data breach, exposing over 21 million sensitive screenshots due to a misconfigured cloud storage bucket. An example of when your productivity app tracks everything — and accidentally shares it with the world.  Anthropic warns that AI-based virtual employees may arrive within a year, bringing unprecedented operation...

“Crocodilus” is a new Android malware aimed at cryptocurrency wallet users, notably in Spain and Turkey but potentially worldwide. It impersonates legitimate apps and tricks users into disclosing seed phrases. By exploiting Android’s accessibility services, it can monitor screens, simulate gestures, bypass two-factor authentication, and drain assets. ChatGPT’s latest models can analyze images in d...

EP 239. This week: Emerging Android malware “Crocodilus” is targeting crypto wallet users in Spain and Turkey with deceptive apps that hijack seed phrases and device access through sophisticated accessibility exploits. ChatGPT’s new models are impressively accurate at identifying real-world locations from images, sparking both admiration for AI capabilities and concern over potential misuse. A new...

What personal information was compromised in the Hertz breach? The breach exposed customer names, birth dates, contact info, driver's licenses, payment cards, and some Social Security numbers. It stemmed from a cyberattack on Cleo, a third-party vendor previously targeted in a mass-hacking campaign. How is air travel changing, and what are the privacy implications? ICAO aims to replace boardin...