The AI, Privacy, and Security Weekly Update

EP 242. In this week's update: A luxury aircraft gift from Qatar to Trump highlights the hidden cost of “free” when it comes to retrofitting for U.S. presidential security. Well-timed trades on Melania Trump’s memecoin are raising serious questions about insider access in the unregulated world of crypto. Repeated credential leaks tied to a federal security engineer underscore the long-term ris...

Wearable technology like Ray-Ban Meta glasses presents significant privacy concerns by enabling frequent data collection without clear user controls, potentially capturing personal information of users and bystanders unknowingly. TikTok received a €530 million fine from the EU primarily because user data was remotely accessible from China, raising surveillance risks, and the platform failed to tra...

EP 241. In this week's update:   Smile, You’re Training Zuck’s AI.  Meta quietly rewrote the fine print so your Ray-Bans can help train its AI by default—just say "Hey Meta" and wave goodbye to meaningful opt-outs. The Irish DPC slapped TikTok with a $600M wake-up call after finding the app's transparency was more filter than fact—China got the data, and Europe got the breach of trust. Billions of...

Recent data breaches have had significant impacts. WorkComposer, an employee monitoring app, exposed over 21 million sensitive employee screenshots due to a misconfigured cloud storage bucket. This breach compromised data such as emails, internal chats, and login credentials, leading to risks like phishing attacks, identity theft, corporate espionage, and legal consequences under GDPR and CCPA. In...

EP 240.   For this week's update:   A major employee monitoring tool suffered a data breach, exposing over 21 million sensitive screenshots due to a misconfigured cloud storage bucket. An example of when your productivity app tracks everything — and accidentally shares it with the world.  Anthropic warns that AI-based virtual employees may arrive within a year, bringing unprecedented operation...

“Crocodilus” is a new Android malware aimed at cryptocurrency wallet users, notably in Spain and Turkey but potentially worldwide. It impersonates legitimate apps and tricks users into disclosing seed phrases. By exploiting Android’s accessibility services, it can monitor screens, simulate gestures, bypass two-factor authentication, and drain assets. ChatGPT’s latest models can analyze images in d...

EP 239. This week: Emerging Android malware “Crocodilus” is targeting crypto wallet users in Spain and Turkey with deceptive apps that hijack seed phrases and device access through sophisticated accessibility exploits. ChatGPT’s new models are impressively accurate at identifying real-world locations from images, sparking both admiration for AI capabilities and concern over potential misuse. A new...

What personal information was compromised in the Hertz breach? The breach exposed customer names, birth dates, contact info, driver's licenses, payment cards, and some Social Security numbers. It stemmed from a cyberattack on Cleo, a third-party vendor previously targeted in a mass-hacking campaign. How is air travel changing, and what are the privacy implications? ICAO aims to replace boardin...

This week, Hertz lost your driver's license, birthday, and maybe your Social Security number—but don’t worry, it was their vendor’s fault. Boarding passes and check-ins are going extinct, and your face is the new passport—because what could possibly go wrong with global biometric surveillance? The EU is now handing out burner phones for U.S. trips, because apparently D.C. is the new Beijing wh...

1. Concerns About AGI Development DeepMind’s 108-page report outlines four major risks of Artificial General Intelligence (AGI): Misuse: AGI used maliciously (e.g., creating viruses). Misalignment: AGI acting contrary to intended goals. Mistakes: Errors causing unintended harm, especially in high-stakes sectors like defense. Structural Risks: Long-term impacts on trust, power, and truth in society...

EP 237.  DeepMind just released a 108-page manual on not getting wiped out by our own invention.  Highlighting the fact that planning for an AI apocalypse could now be a core business line function. Sigstore machine learning model signing - AI models are finally getting digital signatures, because “mystery code from the internet” just wasn't a scalable trust strategy. Turns out your AI  progra...

1. What are some recent major cryptocurrency hacks, and how were they carried out? High-profile crypto breaches include Bybit (~$1.5B), Ronin Network ($625M), and Poly Network ($611M). Attackers exploited vulnerabilities via social engineering (notably in the Bybit case), smart contract flaws, phishing, and targeted blockchain bridges. State-backed groups are increasingly active in this space. 2....

EP 236 For the Biggest Crypto Hacks it turns out “HODL” doesn’t protect you from miscreants with social engineering degrees. Hackers are now coding in Rust and Go, because multilingual malware is harder to catch. An esteemed University Computer Scientist simply disappears. (See if you can pick up on the clues.) Anthropic expands into AI workplace cleaning, but before you get too excited, they'...

Privacy Risks of 23andMe Bankruptcy A breach impacting 7 million users, coupled with lawsuits and financial distress, means 23andMe’s 15 million genetic profiles could be sold or misused under a new buyer. The California Attorney General has urged users to delete their data and destroy physical samples, highlighting the vulnerability of storing sensitive genetic information with for‑profit entitie...

EP 235 The IT Privacy and Security Weekly Update and a Gene Genie for the Week Ending March 25th., 2025 3/25/2025 0 Comments EP 235.  ​ - click the pic to hear the podcast - DNA of 15 Million People For Sale.  Turns out your great-great-grandparents' DNA is now a going-out-of-business clearance sale!" Clearview Tried to Buy Social Security Numbers and Mugshots.  Shopping list: milk, eggs,...

1. Why Should I Change My Passwords Immediately? Recent studies show that around 50% of online passwords are already compromised, and 41% of successful logins involve breached credentials. Common passwords like “123456” and password reuse make it easy for cybercriminals—especially with automated bots—to access multiple accounts. Changing passwords and using unique, strong credentials with multi-fa...

EP 234 For the other 50%.  The IT Privacy and Security Weekly Update for the Week Ending March 18th., 2025 3/18/2025 0 Comments EP 234 - click the pic to hear the podcast - For our first story, Apparently there’s a 50% chance your password is headlining a hacker convention.  Perhaps it's time to change up from ‘123456' (still the most commonly used password). Starting On March 28, Everythi...

EP 233.5 Key Cryptocurrency Threats & Scams In 2025, crypto remains a hotspot for scams like Ponzi schemes, fake ICOs, pump-and-dumps, phishing attacks, and malicious wallets or exchanges designed to steal funds. Social media is often used for deceptive giveaways, impersonations, and investment scams. Other risks include fake mining operations, rug pulls, fraudulent apps, SIM swapping, and imp...

EP 233 This week...  is seized Crypto Linked to LastPass? Feds pocket $23M in hot crypto—but with hackers still sitting on hundreds of millions, it’s like finding loose change in the couch. Signal’s boss says our ‘magic AI butler’ needs root access to everything.  What could possibly go wrong? AI is Reshaping Tech Jobs and with nearly one in four tech gigs demanding AI skills, either learn to talk...

How did Microsoft's Copilot expose private GitHub repositories, and what are the risks? Copilot accessed over 20,000 private GitHub repositories due to cached data from when they were public. Even after repos were made private, Copilot could still generate responses using this cached data, risking exposure of sensitive information like credentials and corporate secrets. What is the "nRoot...

This week:  Microsoft’s Copilot is living up to its name—because apparently, once it gets a glimpse of your code, it just can't unsee it. Hackers just turned every Bluetooth device into an involuntary AirTag—so congrats, your wireless headphones are now a tracking device. The UK wants a backdoor to look into iCloud, and the US just responded with a very diplomatic “absolutely not.” Sweden want...

Which AI chatbots pose the biggest privacy risks, and what data are they collecting and sharing? A recent study revealed that all top ten AI chatbots on the Apple App Store collect user data, with 30% sharing it with third parties for advertising or measurement. Specific incidents include an AI chatbot named WotNot exposing 346,000 sensitive customer files and ChatGPT facing temporary bans over th...

EP 231 This week we wonder which chatbot takes "sharing is caring" a little too far. Turns out some of them are spilling secrets faster than the office gossip at happy hour. Apple just told the UK, ‘You want a backdoor? Fine—we’ll just remove the whole door. France wants VPNs to stop streaming soccer pirates—because obviously the best way to protect privacy is to ban it entirely. Califor...

1. What happened with Elon Musk's DOGE (.gov) website, and why is it significant? DOGE's official website, doge.gov, suffered a significant security breach due to a glaring vulnerability. The site's database was accessible and editable by the public because it was built on Cloudflare Pages instead of secure government servers. This allowed unauthorized individuals to modify content, hi...

In this week's update:  Musk's DOGE website gets more editing than his tweets. Employees sharing secrets with AI chatbots prove humans haven't learned anything from social media oversharing. South Korea puts DeepSeek in the digital doghouse until it learns to play nice with privacy rules. Chinese hackers show that even after sanctions, you can't stop a Salt Typhoon with an umbrella...