The proposed settlement would amount to roughly $20 per Apple product that has Siri enabled, for each plaintiff.

Source: Bjanka Kadic via Alamy Stock Photo

NEWS BRIEF

Apple has agreed to pay a $95 million cash settlement to wrap up a proposed class action lawsuit, Lopez v. Apple, Inc., involving mobile device owners reporting that the tech company has routinely recorded conversations after unintentionally activating Siri.

The class action lawsuit period spans from Sept. 17, 2014, to Dec. 31 of last year, the time period Apple was implementing the "Hey, Siri" feature, which the plaintiffs allege made unauthorized recordings.

Two of the plaintiffs note of their personal issues with the feature, stating that by mentioning things such as Air Jordan sneakers and Olive Garden restaurants, ads were then triggered for these products. Another plaintiff began receiving ads for a surgical procedure they had only privately discussed with their health provider.

The plaintiffs may seek up to $28.5 million in fees as well as $1.1 million for expenses in this case. The members of the suit, estimated to be in the tens of millions, would likely receive up to $20 per Siri-enabled Apple device, should the settlement be agreed upon.

In agreeing to settle, however, Apple has denied any wrongdoing on its part.

This preliminary settlement was filed just this Tuesday and will require approval from US District Judge Jeffrey White before any steps forward can be taken.

**About the Author**

Skilled writer and editor covering cybersecurity for Dark Reading.

Apple Offers $95M to Settle Siri Privacy Lawsuit

The growing complexity of cyber threats, paired with limited resources, makes it essential for companies to adopt a more comprehensive approach that combines human vigilance with AI's capabilities.

COMMENTARY

As cybersecurity threats continue to surge, it has become crucial for small businesses to adopt proactive strategies to ensure they are protected. While artificial intelligence (AI) is starting to provide value to security organizations, it also has enabled more sophisticated attacks, leaving too much room for hackers to slip through.

The very nature of our workplaces is intensifying the cybersecurity challenges small businesses face, with remote and hybrid work models still popular, despite the push for a return to office. This massive increase in remote work has created a broader attack surface that's difficult to manage for businesses when they are already lacking time and resources. Accenture's Cybercrime Study revealed that nearly 43% of cyberattacks are on small businesses, and 95% of them can be attributed to human error. These businesses agree, as 60% of small-business owners said in the US Chamber of Commerce's Q1 2024 Small Business Index that they are concerned about cybersecurity threats.

Employees now operate in a space where their activities are less regulated, making cybersecurity vigilance more crucial than ever. Companies must not only implement robust security measures but also empower their teams to recognize potential threats. One significant risk comes from the allure of public Wi-Fi networks — incredibly convenient but fraught with danger, especially as "work from home" can also be "work from anywhere." These networks can easily be mimicked by malicious actors eager to intercept sensitive data.

As workers navigate this new environment, a blend of proactive security measures and individual awareness becomes essential for safeguarding both personal and organizational information.

Here are two of the most common cybersecurity myths or misconceptions business owners will encounter, and how they can avoid falling into these traps:

*   Myth No. 1: Antivirus software is enough. Many small businesses are relying on antivirus software alone to protect against cyber threats. This is not an effective long-term solution. Modern security threats, especially social engineering attacks, demand more robust defenses, such as multifactor authentication (MFA) and ongoing employee education to withstand these threats.
    

*   Myth No. 2: Your business is immune to threats because of size or location. Small businesses should never assume they are immune due to their size or location. Fostering a culture of cybersecurity awareness among employees is vital, despite the size or capacity of your small business. When individual employees are armed with the right knowledge and they recognize that cybersecurity is a collective responsibility, simple actions like reporting suspicious activities and ensuring devices are securely managed can significantly mitigate the risk of breaches.
    

**Strategies for Small Businesses**

AI needs to be used as a supplement, not a replacement for human analysis and decision-making. Small businesses should identify and prioritize their most critical functions and software. AI can process vast amounts of data and improve efficiency, but it still requires human oversight. Small businesses, which often lack dedicated information security teams, need to adopt proactive strategies to protect themselves.

While small businesses may lack the resources needed for complex simulations, they can use checklists and resources provided by local or federal cybersecurity agencies to evaluate their preparedness and make sure they are covering all of their bases. Leveraging resources that are readily available can give small businesses the additional support they need in a time where threats have become unmanageable.

**Maintaining Customer Trust**

Small businesses often depend on third-party providers for critical services like payment processing, payroll, customer support, and more. Again, because their resources are limited, it's vital for them to verify that the providers they choose uphold stringent security standards, such as PCI certification, to protect both their operations and their customers. In that same vein, these businesses need to communicate clearly with customers about how their data is being protected by these third-party platforms. As much as people don't want to hear it, reading and understanding terms of service and data privacy policies is essential and will show customers your commitment to securing their data.

The workplace will continue to see growing use of AI, and small businesses that adopt these solutions need to ensure customer data is protected. According to Pipedrive's 2024 "State of AI in Business Report," knowledge and trust are the main blockers in AI adoption, with 48% citing a lack of knowledge as the main blocker to adoption, followed by lack of trust (40%). When there is already a lack of trust in AI solutions, it makes it even more important that small businesses prioritize gaining the trust of their customers when using AI to enhance their offerings.

AI offers valuable tools to enhance cybersecurity, but small businesses cannot afford to rely on it as a standalone solution. The growing complexity of cyber threats, paired with limited resources, makes it essential for companies to adopt a more comprehensive approach that combines human vigilance with AI's capabilities. Building a culture of cybersecurity awareness among employees, ensuring the use of advanced security measures like multifactor authentication, and fostering transparent communication with customers about data protection are all critical steps. As businesses navigate an increasingly digital landscape, their long-term success will depend on how well they can balance technological solutions with human insight and proactive planning.

**About the Author**

CISO, Pipedrive

John Mutuski is chief information security officer (CISO) at Pipedrive, the easy and effective sales CRM for small businesses. Mutuski is responsible for developing and leading the information security program, managing technology risk, driving cybersecurity operations, and implementing and managing the cyber governance, risk, and compliance (GRC) process.

With over 20 years of experience spanning both agile startups and large global enterprises, he has consistently demonstrated a unique blend of strategic leadership and technical expertise. His career is marked by a deep commitment to continuous learning, always embracing the unfamiliar and turning challenges into opportunities for growth. His passion for building diverse, cross-functional teams has allowed him to foster innovation and resilience in the face of rapidly evolving security threats. As a collaborative leader, he actively seeks out new experiences and relationships, enabling him to stay at the forefront of cybersecurity trends and deliver impactful, long-term solutions.

Why Small Businesses Can't Rely Solely on AI to Combat Threats

The Christmas Eve compromise of data-security firm Cyberhaven's Chrome extension spotlights the challenges in shoring up third-party software supply chains.

Source: Tada Images via Shutterstock

On Christmas Eve, developers at data detection and response firm Cyberhaven received a troubling email that seemed to come from Google, threatening to remove access to the company's Chrome extension for violation of excessive metadata.

One employee clicked on the "Go To Policy" link, they were taken to Google's authorization application for adding privileges to a third-party application — in this case, a seemingly innocuous application named "Privacy Policy Extension" — and granted the software rights to see, edit, update, and publish to the Chrome Web Store. Once granted access, however, the attacker quickly uploaded a new Chrome extension modifying Cyberhaven's browser add-on to exfiltrate Facebook access tokens saved in the browser and install a mouse-click listener to possibly bypass captchas, according to a preliminary analysis of the breach by the firm's engineering team.

The malicious Chrome extension was only active for about a day before discovery, Howard Ting, CEO of Cyberhaven said in a statement.

"For browsers running the compromised extension during this period, the malicious code could have exfiltrated cookies and authenticated sessions for certain targeted websites," he said. "While the investigation is ongoing, our initial findings show the attacker was targeting logins to specific social media advertising and AI platforms."

Cyberhaven is not alone, but rather appears to be one of the first victims to detect the attack. So far, 36 different extensions — used by as many as 2.6 million people — appear to be linked in some way to the attack, the techniques, or to the infrastructure used by the attackers, according to an analysis by John Tuckner, founder of Secure Annex, a browser-extension management service. Until Cyberhaven detected the attack on its Chrome extensions, developers at other companies and independent programmers largely failed to detect similar compromises using the supply-chain attack.

**Attackers Focus on Supply Chain**

The attacks underscore the problems that companies have in securing their software supply chains. Most companies do not have visibility into much of the software — and cloud services replacing some software — that their employees are using on a daily basis, says Jaime Blasco, chief technology officer and cofounder at Nudge Security, a cloud application security service provider.

"Modern shadow IT is not just software," he says. "Every SaaS application that your employees are using, they grant access to tons of resources that no one knows about — that includes Chrome extensions and extensions in your IDEs. There's a lot of new attack surface that people are not paying attention to in the SaaS ecosystem."

Many companies do not pay attention to the potential for compromise through plug-ins that extend software applications, such as the Chrome browser and its extensions.

Yet, despite Google's updated security and privacy standards for Google Chrome extensions, attackers and researchers continue to find ways to inject malicious code into victims' browsers through the extension ecosystem. In 2021, for example, Google removed a Chrome extension that helped users shut down old tabs and their processes, after a cybercriminal group bought the extension from the original developer and used it to install malicious code on the systems of its approximately 2 million users. University researchers have also found ways to circumvent Google's security process to publish malicious Chrome extensions to the Chrome Web Store.

Overall, hundreds of millions of Chrome users have security-noteworthy extensions (SNEs) — those that contain malware, a vulnerability, or violate Google's policies — installed in their browsers, according to one study published Stanford University researchers.

**Gaining Access Rights Through Social Engineering**

In the case of the developer phishing campaigns, attackers are collecting developer email addresses from the information published on the Chrome Web Store, sending phishing attacks aimed at those developers, and then compromising the code of any developers who fall prey to the attacks.

The attack does not need to steal a developer's credentials, but just convince the developer to grant the necessary permissions, says Secure Annex's Tuckner.

"The OAuth phishing attack used \[by the attacker\] is very scary and even worked around Cyberhaven's implementation of Advanced Protection, one of the most sophisticated authentication systems," he says. "I think developers need to be aware that an email address will be tied to the Chrome web store publicly and will be used as a primary method of contact, increasing its exposure."

Because attackers can layer a number of privileges into a single OAuth permissions request, quite a few suspicious behaviors can be stacked on top of each other in a single extension, he says.

"There are a handful of extensions that are quite susceptible to compromise, monetization, ownership transfers, and lack of hygiene, which I believe some threat actors have identified," he says. "For many I talk to, managing browser extensions can be a lower priority item in their security program. Folks know they can present a threat, but nothing has ever happened to make them a priority."

**Time to Shore Up Extensions**

In the coming year, Tuckner hopes that will change.

"I hope that the Chrome web store can become more transparent in how it operates before something worse happens," he says, adding: "The suspicious extension reporting process, while likely overwhelmed, is often met with silence, inaction, and no documentation trail."

Any developer with major browser extensions should not rely on the specific store provider to detect the attack, but regularly monitor their software deployments, he recommends. Because compromising an extension requires a new version of the code to be released, a peer-review and approval process for software releases can catch unusual deployments. In addition, developers should have an email security service that detects phishing attacks, separate their general-use emails from their development accounts, and require administrator approval of new access attempts.

For its part, Cyberhaven released a collection of scripts designed to help investigate the extent to which their own machines were impacted by the attack.

"As Cyberhaven assisted our customers in responding to the attack, it became apparent that limited tooling was available to quickly and accurately evaluate the spread of the impact," the company said in a December 31 blog post on the release of the tools, adding that "\[t\]hese scripts search for entries indicating that a malicious extension has exfiltrated data."

Companies should expect attacks using extensions of all sorts — for browsers, for integrated development environments (IDEs), and other extensible software platforms — to increase in the future, says Nudge Security's Blasco.

"Attackers know that companies have spent enough dollars to protect their endpoints," he says. "But, in other places — like SaaS applications and Chrome, for instance — you don't have enough visibility, and there is not enough security controls in place. So this \[Chrome security issue\] is just an evolution of what we are going to see happening more often."

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Chrome Extension Compromises Highlight Software Supply Challenges

The changes to the healthcare privacy regulation with technical controls such as network segmentation, multi-factor authentication, and encryption. The changes would strengthen cybersecurity protections for electronic health information and address evolving threats against healthcare entities.

Source: Zoonar GmbH via Alamy Stock Photo

The U.S. Department of Health and Human Services is planning a massive overhaul of the Health Insurance Portability and Accountability Act security rule to strengthen baseline cybersecurity requirements for protecting electronic protected health information (PHI). The proposed amendments, which will be published in the Federal Register on Jan. 6, would require healthcare organizations and other covered entities to implement security controls such as multi-factor authentication and enhanced encryption requirements.

The proposal describes the most substantive changes to HIPAA to date. The security rule was last revised in 2013. The threat landscape is different now than it was over a decade ago, and breaches against healthcare organizations have increased by 102% between 2018 and 2023, the HHS Office  for Civil Rights said in a statement. In 2023, over 167 million people had their health information compromised, a 1,002% increase from 2018.

**Proposed Changes to HIPAA**

The amendments will apply to health plans, healthcare clearinghouses, health providers, healthcare facilities, insurance companies, and business associates.

Everything in Writing: All policies, procedures, plans, and analyses will need to be in writing. This also applies to developing stronger incident response procedures, such as having written incident response plans and testing plans, as well as written procedures to be able to restore information systems and data within 72 hours.

Asset Inventory: Healthcare organizations will need to develop and regular maintain an up-to-date technology asset inventory and network map to track the movement of protected health information (PHI) through the various systems.

Risk Analysis: Healthcare organizations are not all that good at security risk analysis. The proposed changes include more specifics on how to conduct security risk analysis, such as written assessments that include a review of the technology asset inventory and network map, identify all potential threats to PHI, and assess the risk level for each threat and vulnerability.

Implement Security Controls: Healthcare organizations will be required to employ multifactor authentication and network segmentation to make it harder for healthcare systems to be compromised or data breaches. All PHI will need to be encrypted both during rest and in transit, reflecting the consensus that encryption is no longer optional. For systems that process PHI, security teams will need to scan for vulnerabilities every six months, run penetration tests at least once a year, deploy antimalware defenses, and remove extraneous software from systems. These requirements show how these are moving from recommended activities to minimum security baseline every entity must meet.

Organizations will need to conduct a compliance audit at least once every 12 months to ensure these technical controls are in place, and prove the safeguards have been implemented at least once every 12 months via a written certification.

**Next Steps After Comments**

Anne Neuberger, deputy national security adviser for cyber and emerging technology, said during a Dec. 27 press briefing that the changes to the security rule will cost approximately $9 billion in the first year, and $6 billion for years two to five. “The cost of not acting is not only high, it also endangers critical infrastructure and patient safety, and it carries other harmful consequences,” Neuberger said.

Stakeholders have 60 days after the nearly 400-page proposal is published to submit comments (early March 2025). HHS will issue the final version of the rule afterwards, although a specific date has not yet been set followed by a compliance date of 180 days. It is also not clear if the work on the changes to the security rule will continue under the new presidential administration. Even so, healthcare organizations should review proposed requirements and evaluate their existing security programs to prepare for potential changes.

**About the Author**

Managing Editor, Features, Dark Reading

As Dark Reading’s managing editor for features, Fahmida Y Rashid focuses on stories that provide security professionals with the information they need to do their jobs. She has spent over a decade analyzing news events and demystifying security technology for IT professionals and business managers. Prior to specializing in information security, Fahmida wrote about enterprise IT, especially networking, open source, and core internet infrastructure. Before becoming a journalist, she spent over 10 years as an IT professional -- and has experience as a network administrator, software developer, management consultant, and product manager. Her work has appeared in various business and test trade publications, including VentureBeat, CSO Online, InfoWorld, eWEEK, CRN, PC Magazine, and Tom’s Guide.

Proposed HIPAA Amendments Will Close Healthcare Security Gaps

PRESS RELEASE

The Chief Digital and Artificial Intelligence Office (CDAO) has successfully concluded a Crowdsourced AI Red-Teaming (CAIRT) Assurance Program pilot focused on the use of Large-Language Model (LLM) chatbots in the context of military medicine. The CAIRT program supports the Department of Defense (DoD) in generating grassroots, crowdsourced approaches to AI Assurance and AI Risk Mitigation. Through crowdsourcing, projects are able to elicit a large volume of data and involve a wide variety of stakeholders.

This CAIRT LLM pilot was conducted by Humane Intelligence, a tech company building a community of practice around algorithmic evaluations, in collaboration with the Defense Health Agency (DHA) and the Program Executive Office, Defense Healthcare Management Systems (PEO DHMS). Through red-teaming methodology―using adversarial techniques to internally test system robustness―Humane Intelligence was able to effectively detect specific system vulnerabilities. Additionally, red-teaming attracts participants who want to engage with new technologies and, as possible future beneficiaries, gain the opportunity to contribute to improving the systems. Previously, in the spring of 2024, the CDAO held a valuable red-teaming CAIRT exercise utilizing a financial bounty.

In the latest pilot program, Humane Intelligence utilized crowdsourced red-teaming for two prospective use cases in the context of military medicine:  clinical note summarization and a medical advisory chatbot. Over 200 participants, including clinical providers and healthcare analysts from DHA, the Uniformed Services University of the Health Sciences, and the Services, participated in the exercise, which compared three popular LLMs. The exercise uncovered over 800 findings of potential vulnerabilities and biases related to employing these capabilities in these prospective use cases. This exercise will result in repeatable and scalable output via the development of benchmark datasets, which can be used to evaluate future vendors and tools for alignment with performance expectations. Furthermore, these findings will play a crucial role in shaping DoD policies and best practices for responsible use of Generative AI (GenAI), ultimately improving military medical care. If, when fielded, these prospective use cases comprise covered AI defined in OMB M-24-10, they will adhere to all required risk management practices.

“Since applying GenAI for such purposes within the DoD is in earlier stages of piloting and experimentation, this program acts as an essential pathfinder for generating a mass of testing data, surfacing areas for consideration, and validating mitigation options that will shape future research, development, and assurance of GenAI systems that may be deployed in the future,” remarked CDAO’s lead for this initiative, Dr. Matthew Johnson.

As the recent pilot and others have revealed, continued testing of LLMs and AI systems through the CAIRT Assurance Program will be critical to accelerating the CDAO’s AI Rapid Capabilities Cell, improving GenAI mission effectiveness, and contributing to justified confidence across DoD use cases.

**About the CDAO**

The CDAO became operational in June 2022 and is dedicated to integrating and optimizing AI capabilities across the DoD. The office is responsible for accelerating the DoD’s adoption of data, analytics, and AI, enabling the Department’s digital infrastructure and policy adoption to deliver scalable AI-driven solutions for enterprise and joint use cases, safeguarding the nation against current and emerging threats.

For more information about the CDAO, please visit our website at ai.mil. You can also connect with the CDAO on LinkedIn (@ DoD Chief Digital and Artificial Intelligence Office) and X, formally known as Twitter (@dodcdao). Additional updates and news can be found on the CDAO Unit Page on DVIDS.

You May Also Like

CDAO Sponsors Crowdsourced AI Assurance Pilot in the Context of Military Medicine

Windows servers are vulnerable to a dangerous LDAP vulnerability that could be used to crash multiple servers at once and should be patched immediately.

Source: Andriy Popov via Alamy Stock Photo

One of two critical Active Directory Domain Controller vulnerabilities patched by Microsoft last month goes beyond the original denial-of-service (DoS) attack chain and can be used to crash multiple, unpatched Windows servers at once. And experts are concerned many organizations remain vulnerable.

Researchers at SafeBreach have put together an analysis of the DoS bug, tracked as CVE-2024-49113. This vulnerability, along with a similar remote control execution (RCE) bug, tracked as CVE-2024-49112, with a CVSS score of 9.8, was discovered in Active Directory's Lightweight Directory Access Protocol (LDAP) used to search the databases. Both were patched in December's Microsoft security update.

Microsoft hasn't provided many details about the LDAP flaws, despite their severity and potential impact, which is why SafeBreach said it decided to dig deeper and find out more.

"LDAP is the protocol that workstations and servers in Microsoft's Active Directory use to access and maintain directory services information," the SafeBreach report explained.

Additional analysis of the DoS LDAP bug showed the attack chain could also be used by a threat actor to achieve RCE but, worse yet, could be exploited to crash any Windows server, as long as the target system's domain controller has a DNS server connected to the Internet.

**Why The Microsoft LDAP Flaw Is So Dangerous**

Prior to December's Patch Tuesday update, every single organization running Windows Servers was vulnerable to the flaw, Tal Be'ery, chief technology officer and co-founder of Zengo Wallet, explains.

"So the question is, how many of these organizations patched all of their systems and mainly domain controllers?" he adds.

There's no indication yet the vulnerability is being exploited in the wild, but Be'ery points to PatchPoint's release of exploit code as a signal to threat actors.

"We assume that such code is already being used, but we don't have any positive evidence for it yet," he adds.

Threat actors typically have to work their way from a single, hacked device through what Be'ery compares to a Chutes and Ladders game-like maze, ultimately hopping their way from one compromise to the big prize — the domain controller stuffed full of credentials. It's the time these hackers spend trying to work their way deeper into the system that affords defenders opportunities to stop the cyberattack before it escalates.

"With this LDAP vulnerability hackers can go immediately straight from square 1 to 100 \[domain controllers\] before defenders can respond," he adds.

The SafeBreach research also confirmed Microsoft's December 2024 patches are effective, so administrators are urged to patch Windows Servers and all domain controllers immediately.

If servers can't be patched, Be'ery recommends defenders "use compensating controls such as LDAP and RPC firewalls to block the exploit of this vulnerability."

**About the Author**

Dark Reading

Becky Bracken is a veteran multimedia journalist covering cybersecurity for Dark Reading.

Unpatched Active Directory Flaw Can Crash Any Microsoft Server

PRESS RELEASE

The agreement on the legally binding treaty marked the culmination of a five-year effort by UN Member States, with inputs from civil society, information security experts, academia and the private sector.

UN Secretary-General António Guterres welcomed the adoption of the Convention – the first international criminal justice treaty to have been negotiated in over 20 years.

“This treaty is a demonstration of multilateralism succeeding during difficult times and reflects the collective will of Member States to promote international cooperation to prevent and combat cybercrime,” his spokesperson said in a statement.

The statement added that the Convention “creates an unprecedented platform for collaboration” in the exchange of evidence, protection for victims and prevention, while safeguarding human rights online.

“The Secretary-General trusts that the new treaty will promote a safe cyberspace and calls on all States to join the Convention and to implement it in cooperation with relevant stakeholders.”

New tool to protect people

Philémon Yang, President of the General Assembly, highlighted the importance of the new Convention.

“We live in a digital world, one where information and communications technologies have enormous potential for the development of societies, but also increases the potential threat of cybercrime,” he said.

“With the adoption of this Convention, Member States have at hand the tools and means to strengthen international cooperation in preventing and combating cybercrime, protecting people and their rights online.”

The resolution containing the Convention was adopted without a vote by the 193-member General Assembly.

A victory for multilateralism

Ghada Waly, Executive Director of the UN Office on Drugs and Crime (UNODC) also described the adoption of the treaty as a “major victory” for multilateralism.

“It is a crucial step forward in our efforts to address crimes like online child sexual abuse, sophisticated online scams and money laundering,” she said.

Ms. Waly reiterated the UN agency’s commitment to support all nations in signing, ratifying and implementing the new treaty, as well as providing them with the tools and support they need to protect their economies and safeguard the digital sphere from cybercrime.

The Convention

The Convention against Cybercrime acknowledges the significant risks posed by the misuse of information and communications technologies (ICT), which enable criminal activities on an unprecedented scale, speed, and scope.

It highlights the adverse impacts such crimes can have on States, enterprises, and the well-being of individuals and society, and focuses on protecting them from offenses such as terrorism, human trafficking, drug smuggling and online financial crimes.

It also recognises the growing impact of cybercrime on victims and prioritises justice, especially for vulnerable groups. It further underscores the need for technical assistance, capacity-building and collaboration among States and other stakeholders.

Read more about why the Convention against Cybercrime matters in this explainer.

Next steps

The Convention against Cybercrime will open for signature at a formal ceremony to be hosted in Hanoi, Viet Nam, in 2025. It will enter into force 90 days after being ratified by the 40th signatory.

UN General Assembly Adopts Cybercrime Treaty

PRESS RELEASE

DETROIT & TOKYO--(BUSINESS WIRE)-- VicOne, a leading automotive cybersecurity solutions provider, announced today it will co-host the zero-day vulnerability discovery contest, "Pwn2Own Automotive 2025," with Zero Day Initiative (ZDI). The event will take place from Wednesday, January 22 to Friday, January 24, 2025, at Tokyo Big Sight, West Hall, as part of the “17th AUTOMOTIVE WORLD 2025 – Advanced Automotive Technology Expo.” This will be the second Pwn2Own Automotive contest, following its highly successful debut in January 2024 where 49 zero-day vulnerabilities were discovered.

Pwn2Own Automotive helps build a foundation for automotive cybersecurity by strengthening cybersecurity measures and promoting the prevention of cyber incidents through the discovery of zero-day vulnerabilities. This event addresses growing concerns about vulnerabilities and increased attack risks with the growing adoption of software-defined vehicles (SDVs).

Through ZDI, the contest enables world-class security researchers to conduct real-world testing of the latest automotive technologies. By identifying zero-day vulnerabilities before they can circulate and become real-world cyber-attacks, the event facilitates swift countermeasures, helping prevent cyber threats and enhancing the overall security of automotive vehicles and products.

Additionally, the contest fosters innovation by recognizing the achievements of security researchers and offering over $1 million USD in total prizes. This incentivizes further research and development while providing hands-on experience that nurtures talent in the cybersecurity industry, ultimately contributing to an improved global cybersecurity landscape.

About Pwn2Own 2025 Automotive

Participants in "Pwn2Own Automotive 2025" will compete by earning points in four categories:

*   In-vehicle infotainment (IVI) systems
    
*   Electric vehicle (EV) chargers, and
    

Each contestant must demonstrate the ability to execute arbitrary code on the target devices or OS in their chosen category. They are allowed up to three attempts per target during the contest. Successful challenges earn points, and the participant or team with the highest points at the end of the contest is awarded the prestigious title of "Master of Pwn."

To qualify, the vulnerabilities targeted must be previously unknown, undisclosed, and unreported (according to the contest rules). Only the first participant to successfully complete a challenge in each category is eligible for a monetary reward. The order of the challenges is determined randomly through a draw.

“Through ZDI, we conduct research to address real-world cyberattack scenarios in the automotive sector. Hosting this contest in collaboration with VicOne, who has unmatched expertise and experience in automotive cybersecurity, is a key step in demonstrating our security research expertise within the automotive industry and the research community,” said

Brian Gorenc, VP of Threat Research at VicOne’s parent company, Trend Micro.

“Together with ZDI, VicOne is contributing to building a safer future for software-defined vehicles (SDVs). By discovering zero-day vulnerabilities, this event enables security researchers to uncover unknown, unpublished, and unreported vulnerabilities, facilitating early risk identification and mitigation within the automotive industry. Such efforts are critically important for the global automotive sector, especially as the evolution of SDVs accelerates,” said Max Cheng, CEO of VicOne

Registration Deadline

The deadline to register for the contest is 5:00 PM (JST) on January 16, 2025.

To complete registration, participants must submit a white paper detailing the vulnerability testing procedures and execution methods. Remote participation online is also available.

For more information about Pwn2Own Automotive and the contest rules, visit: https://www.zerodayinitiative.com/Pwn2OwnAuto2025Rules.html

VicOne and Partners at CES 2025

In addition, VicOne will be showcasing its award-winning comprehensive portfolio of cutting edge cybersecurity software and services for the whole automotive industry at the Las Vegas Consumer Electronics Show (CES), one of the most powerful tech events in the world (7-10 January 2025). Together with partners like P3 digital services, a leading provider of In-Vehicle Infotainment (IVI) systems, VicOne offers a safe and secure IVI environment for Android Automotive OS, with content protection for driver and all the vehicle’s passengers.

For more information about VicOne’s automotive cyber security portfolio please visit https://vicone.com/.

About VicOne

With a vision to secure the vehicles of tomorrow, VicOne delivers a broad portfolio of cybersecurity software and services for the automotive industry. Purpose-built to address the rigorous needs of automotive manufacturers, VicOne solutions are designed to secure and scale with the specialized demands of the modern vehicle. As a Trend Micro subsidiary, VicOne is powered by a solid foundation in cybersecurity drawn from Trend Micro's 30+ years in the industry, delivering unparalleled automotive protection and deep security insights that enable our customers to build secure as well as smart vehicles. For more information, visit: www.vicone.com.

VicOne and Zero Day Initiative (ZDI) to Lead Pwn2Own Automotive

Wagenius posted about hacking more than 15 telecom providers on the Telegram messaging service.

Source: Gregg Vignal via Alamy Stock Photo

NEWS BRIEF

A US Army soldier was reportedly arrested Dec. 20 in Texas and charged with two counts of unlawful transfer of confidential phone records.  

Cameron John Wagenius, 20, is suspected of leaking presidential call logs belonging to AT&T and Verizon under an online alias of "Kiberphant0m."

Wagenius was initially flagged as being involved in the Snowflake hacking campaign along with Connor Riley Moucka, also known as "Judische," who was arrested last October as part of the Snowflake account hacking.

Kiberphant0m reportedly published stolen call logs for former President Donald Trump and Vice President Kamala Harris after Moucka was arrested, as well as offered data schema from the National Security Agency, call logs from US government agencies, and a SIM-swapping Verizon service.

He also posted on Telegram about hacking more than 15 telecom providers and maintaining a distributed denial-of-service botnet.

An indictment alleges that Wagenius was involved in the sale and transmission of confidential phone records; no further details have been released regarding his connection to the Snowflake attacks.

**About the Author**

Skilled writer and editor covering cybersecurity for Dark Reading.

US Soldier Arrested in Verizon, AT&amp;T Hacks

Ethical hacking group Chaos Computer Club uncovered exposed data of electrical vehicle owners across the company's VW, Audi, Seat, and Skoda brands.

Source: Anatoly Vartanov via Alamy Stock Photo

NEWS BRIEF

Volkswagen Group experienced a data breach last month, exposing sensitive personal information of roughly 800,000 electrical vehicle owners across its brands, including Volkswagen, Audi, Seat, and Skoda.

Initially reported by German publication Speigel, the breach has been attributed to an Amazon cloud storage system misconfiguration, which is managed by software subsidiary Cariad. The group reportedly left personal and location data openly accessible online for months on end, prompting the breach.

The anonymous hacker who discovered the breach reported it to Chaos Computer Club (CCC), a well known organization of ethical hackers in Europe. The CCC tested the open, insecure access before informing Cariad and Volkswagen.

The data exposed in the breach includes vehicle location information such as when EVs were switched on and off, along with location data, email addresses, phone numbers, and home addresses of car owners.

A wide variety of individuals have been affected by this breach, including at least two German politicians and the Hamburg police. While most affected vehicles were located in Germany, Spiegel's hired researchers found details about cars in Norway, Sweden, the UK, the Netherlands, France, Belgium, and Denmark.

Cariad reports that it acted quickly to solve the issue and closed off access the same day CCC contacted them. 

**About the Author**

Skilled writer and editor covering cybersecurity for Dark Reading.

Source

DARKReading