Debian Linux Security Advisory 5682-2 - The update for glib2.0 released as DSA 5682-1 caused a regression in ibus affecting text entry with non-trivial input methods. Updated glib2.0 packages are available to correct this issue.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5682-2                   security@debian.org  
https://www.debian.org/security/                     Salvatore Bonaccorso  
May 09, 2024                          https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : glib2.0  
Debian Bug     : 1070730 1070736 1070743 1070745 1070749 1070752

The update for glib2.0 released as DSA 5682-1 caused a regression in  
ibus affecting text entry with non-trivial input methods. Updated  
glib2.0 packages are available to correct this issue.

For the oldstable distribution (bullseye), this problem has been fixed  
in version 2.66.8-1+deb11u3.

For the stable distribution (bookworm), this problem has been fixed in  
version 2.74.6-2+deb12u2.

We recommend that you upgrade your glib2.0 packages.

For the detailed security status of glib2.0 please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/glib2.0

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmY8V7JfFIAAAAAALgAo  
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2  
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND  
z0RJGA/+IOsDXWcvXMOYEueKNZ+pIFVXLbT4GVMBvUIBf0wqJFbnmwaTXaEojqNR  
HKFcCLIBKzhHkJvCmhaEsaZXj05GxI0jIKV0CULuEl1PeYpXaypIF0BIbtH7Jd0j  
Q7/3qQgafewuJgqwn7e3CG9mF8oZv/QfwH4VPaJMkMd7cdRNytKOiJosg2ZEl3FK  
ycO/t58SMPxApzY5eebAU/u37UKAzI7PeCIz9FaCUQdwMUFuUeJvsYD21PwxYN/R  
LK79UsnHiw6sr3cpNirOhm7F3HXSh7WFBqQdcLGrTaix3X+RKW7NymNhIW8m7qWg  
kJ7w6JArMuvxj2Y2RiBF0eqVVkYcTHOe964+nvDHjzFIUkLU0yhw2GLhK4GzbWjl  
VpXc/+Rv1I9OsFF4SiKNSbi728NM4GUS3ziew//1l9EPM281UrCDoFRkwi1FP2jT  
KVWB0CZacqLmo62cT49HBb1rSxDXSEi0qc0yMKus+Jk+NT8H1k+cpjrK5hy0flJt  
JJWTOJMJ2Ph7LvLbrfsVoeuxeIz+taoLz6JW5dkpk1/LkxSmZkIKztdolirONMqF  
vBCTyz7IvBxqro5+vRsBnSFPJdw4pCVxhfgI/BFIUe8dA2Sh8bE+o69wTgcGDst5  
ZHf28D3hClhMSc/SgotNTUf8KycA15VjxhvNtAeFL0HpOvAKiKI=T+EA  
-----END PGP SIGNATURE-----

Debian Security Advisory 5682-2

By Waqas
Discover the future of phishing email training, including personalized simulations, gamification, AI, and realistic scenarios. Empower your employees to combat evolving cyber threats and protect your organization.
This is a post from HackRead.com Read the original post: The Future of Phishing Email Training for Employees in Cybersecurity

In today’s world, cybersecurity is a worry for businesses across various sectors. As technology progresses, cybercriminals also refine their strategies. One common method they use is through phishing emails. These deceptive messages aim to deceive recipients into disclosing details or downloading files, and their complexity continues to grow.

To counter this changing threat, companies must give importance to providing phishing email training for employees on identifying and responding properly to phishing attempts. So, what lies ahead for training employees on recognizing phishing emails?

****1\. Personalized and Precise Simulations****

Standard training methods no longer suffice in the fight against phishing attacks. Each company confronts obstacles and needs tailored remedies. In the future, we can anticipate simulations that target employee training.

By assessing a company’s weaknesses and developing phishing operations that mirror the tactics likely used against them, businesses can offer employees experience in a controlled setting. This strategy enables employees to hone their ability to detect signs of phishing emails to their sector or role.

****2\. Incorporation of Game Elements and Interactive Teaching****

Conventional teaching techniques often lack engagement and fail to captivate employees. To tackle this problem, incorporating gamification and interactive learning components is likely to become more common in phishing email training.

Gamification involves integrating game features into the training process, making it more engaging and enjoyable for participants. By incorporating exercises, quizzes, competitions, and reward systems, employees can enhance their awareness of phishing attacks while also having time during the learning process.

****3\. Continuous Training Initiatives****

Given that phishing attacks are constantly evolving, it makes sense for employee training to be a process rather than a one-time event. The future of cybersecurity awareness lies in training programs.

Rather than just holding classroom sessions or online tutorials, organizations will shift towards providing ongoing educational programs that offer regular updates on emerging threats and reinforce the best practices for identifying email scams.

Continuous training helps foster a culture of cybersecurity vigilance where employees are informed, alert, and ready to detect and report phishing attempts promptly.

****4\. Integration of Artificial Intelligence (AI)****

Advancements in artificial intelligence (AI) promise to transform phishing email training. AI algorithms can recognize patterns, analyze amounts of data, and pinpoint phishing emails with greater accuracy compared to traditional tools.

Looking ahead, we can anticipate the incorporation of AI-driven solutions into employee training initiatives. These smart systems will keep an eye on emails and offer immediate feedback, flag any suspicious messages, and guide employees on how to handle them.

****5\. Practice with Realistic Scenarios****

Simulated real-world attacks are beneficial for employees as they can hone their response skills in a controlled setting. It’s equally important for them to draw lessons from situations.

In the future, training sessions might involve simulated attacks that replicate breaches or recent phishing incidents. By examining case studies and analyzing phishing emails circulated within the organization or industry, employees gain hands-on experience in dealing with emerging threats.

By staying informed about the evolving tactics used by cybercriminals, organizations can equip their employees to navigate the shifting landscape of security.

****6\. Using Behavioral Analysis and Machine Learning****

Apart from the advancements, behavioral analysis, and machine learning will be pivotal in training employees in cybersecurity to recognize phishing emails. By studying employee behaviour patterns like email interactions, browsing habits, and response times, machine learning algorithms can pinpoint irregularities that could signal a phishing attempt. This proactive strategy enables organizations to pinpoint weaknesses before they become targets.

By including analysis in training sessions, workers can enhance their awareness of their actions and learn to spot changes that may signal potential security threats. Moreover, the incorporation of machine learning allows systems to adjust and develop in response to emerging attack methods, enhancing the effectiveness of training over time.

****Conclusion** **

As the risk of cyber threats grows, companies must prioritize offering comprehensive email phishing training to their staff. The future holds prospects such as tailored simulations, interactive gaming features for engagement, training efforts, AI-supported monitoring tools, and immersive learning scenarios based on real-world situations.

Empower your team with the knowledge and capabilities needed to counter these threats. Remember- ensuring defence against phishing attacks begins with having informed human resources who seamlessly integrate secure practices into their daily routines!

1.  Phishing Scam Drops Byakugan Malware via Fake PDF
2.  Dropbox Abused in Phishing, Malspam Scam to Steal SaaS Logins
3.  Employee Duped by AI-Generated CFO in $25.6M Deepfake Scam
4.  Nespresso Domain Hacked in Phishing Attack for Microsoft Logins
5.  HiBoB Experts Reveal: Top Cybersecurity Threats for Employee Data

The Future of Phishing Email Training for Employees in Cybersecurity

Two vulnerabilities in this group — one in the Tinyroxy HTTP proxy daemon and another in the stb_vorbis.c file library — could lead to arbitrary code execution, earning both issues a CVSS score of 9.8 out of 10.

Wednesday, May 8, 2024 12:00

Cisco Talos’ Vulnerability Research team recently disclosed three zero-day vulnerabilities that are still unpatched as of Wednesday, May 8. 

Two vulnerabilities in this group — one in the Tinyroxy HTTP proxy daemon and another in the stb\_vorbis.c file library — could lead to arbitrary code execution, earning both issues a CVSS score of 9.8 out of 10. While we were unable to reach the maintainers, the Tinyroxy maintainers have since patched the issue.  

Another zero-day exists in the Milesight UR32L wireless router. 

These vulnerabilities have all been disclosed in adherence to Cisco’s third-party vulnerability disclosure timeline after the associated vendors did not meet the 90-day deadline for a patch or communication.  

For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerability Advisories are always posted on Talos Intelligence’s website.  

**Use-after-free vulnerability in Tinyproxy daemon **

_Discovered by Dimitrios Tatsis._ 

The Tinyproxy HTTP proxy daemon contains a vulnerability that could lead to arbitrary code execution. 

Tinyproxy is meant to be used in smaller networking environments. It was originally released more than a dozen years ago.  

A use-after-free vulnerability, TALOS-2023-1889 (CVE-2023-49606), exists in the \`Connection\` header provided by the client. An adversary could make an unauthenticated HTTP request to trigger this vulnerability, setting off the reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. This issue has been patched, though Talos initially released it as a zero-day when no patch was available.

**Milesight UR32L firmware update vulnerability **

_Discovered by Francesco Benvenuto._ 

The Milesight UR32L wireless router contains a vulnerability that could force the device to implement any firmware update, regardless of its legitimacy.  

TALOS-2023-1852 (CVE-2023-47166) exists because the UR32L, an industrial cellular router, never checks the validity of the uploaded firmware. This could allow an adversary to upgrade the router with arbitrary firmware they created. 

Talos has previously covered how an adversary could chain together several other vulnerabilities in the UR32L to completely take over the device. Talos released 22 security advisories in July 2023, nine of which have a CVSS score greater than 8. 

_Discovered by Emmanuel Tacheau._ 

A heap-based buffer overflow vulnerability exists in the comment functionality of stb \_vorbis.c, an open-source, single-header file library used to decode Ogg Vorbis non-proprietary audio files. Ogg Vorbis is an open-source, patent- and royalty-free, general-purpose compressed audio format. 

TALOS-2023-1846 (CVE-2023-47212) is triggered if an adversary sends the target a specially crafted .ogg file, which can lead to an out-of-bounds write. With enough heap grooming, an adversary could use this vulnerability to achieve arbitrary code execution.

Talos discloses multiple zero-day vulnerabilities, two of which could lead to code execution

The iPhone maker has detected spyware attacks against people in more than 150 countries. Knowing if your device is infected can be tricky—but there are a few steps you can take to protect yourself.

All that needs to happen is, the victim receives an iMessage with an attachment containing a zero-click exploit. “Without any further interaction, the message triggers a vulnerability, leading to code execution for privilege escalation and providing full control over the infected device,” says Boris Larin, principal security researcher at Kaspersky's Global Research & Analysis Team.

Once the attacker establishes their presence on the device, he says, the message is automatically deleted.

**Rise of Pegasus**

The most prominent and well-known spyware is Pegasus, made by Israeli firm NSO Group to target vulnerabilities in iOS and Android software.

Spyware only exists because of vendors such as NSO Group, which claims it sells exploits to governments only to hunt criminals and terrorists. “Any customers, including governments in Europe and North America, agree not to disclose those vulnerabilities,” says Richard Werner, cybersecurity advisor at Trend Micro.

Despite NSO Group’s claims, spyware has continued to target journalists, dissidents, and protesters. Saudi journalist and dissident Jamal Khashoggi’s wife, Hanan Elatr, was allegedly targeted with Pegasus before his death. In 2021, _New York Times_ reporter Ben Hubbard learned his phone had been targeted twice with Pegasus.

Pegasus was silently implanted onto the iPhone of Claude Magnin, the wife of the political activist Naama Asfari, who was jailed and allegedly tortured in Morocco. Pegasus has also been used to target pro-democracy protesters in Thailand, Russian journalist Galina Timchenko, and UK government officials.

In 2021, Apple filed a lawsuit against NSO Group and its parent company to hold it accountable for “the surveillance and targeting of Apple users.”

The case is still ongoing, with NSO Group attempting to dismiss the lawsuit, but experts say the problem is not going to go away as long as spyware vendors are able to operate.

David Ruiz, senior privacy advocate at security firm Malwarebytes, blames “the obsessive and oppressive operators behind spyware, who compound its danger to society.”

**The Spyware Drain**

If you think you may be targeted by spyware, there are only a few useful things you can do. First, enable Apple's Lockdown Mode, which disables certain features but is surprisingly usable and can protect your iPhone from getting infected in the first place. Second, if you suspect your device is already infected, helplines are available to aid you in removing spyware, such as Access Now’s Digital Security Helpline and Amnesty International’s Security Lab.

Detecting spyware can be extremely challenging—and for sophisticated spyware like Pegasus, discovering an infection on your own is all but impossible. There are less-sophisticated types of spyware that can cause unusual behavior, such as your battery draining quickly, unexpected shutdowns, or high data usage could be indicative of some types of infections, says Javvad Malik, lead security awareness advocate at security training organization KnowBe4. While specific apps claim to spot spyware, their effectiveness can vary, and professional assistance is often necessary for reliable detection, he says.

Apple’s iPhone Spyware Problem Is Getting Worse. Here’s What You Should Know

By Uzair Amir
Remember Minesweeper? It's not just a game - it's a hidden training ground for work skills! Sharpen your decision-making, focus, and strategic thinking with every click.
This is a post from HackRead.com Read the original post: A Mind at Play: Rediscovering Minesweeper in the Professional Arena

Do you remember the first time you stumbled upon Minesweeper online? It could be during a lazy afternoon at a school computer lab or a quick break at your first job. Something about that grid of grey squares beckons like a puzzle waiting to be solved—a momentary escape that, surprisingly, could be one of your best tools for professional growth today.

****The Puzzle of Decision-Making****

Imagine you’re back in that chair, the mouse under your fingertips. Each click in Minesweeper isn’t just a guess; it’s a decision with risks and rewards that are not unlike the choices you face in your career.

Like navigating through a particularly tricky business dilemma, each square you uncover on the Minesweeper grid teaches you more about the landscape, helping you make the next decision more informed. It’s a dance of logic and anticipation—skills that, when refined, translate into a sharp acumen for analyzing complex professional scenarios.

Remember that feeling when you correctly predict a mine’s location? That’s your analytical skills growing more strong, one click at a time.

****A Masterclass in Focus****

Now, think about the intense concentration Minesweeper demands. Each square could mean triumph or game over, akin to the high stakes of missing a critical detail in a client report or a coding error in a software launch.

This game hones your ability to focus and pay attention to the minutiae—skills that elevate the quality of your work and your productivity. The game’s grid challenges you to spot inconsistencies and patterns, just as in a complex dataset or a crucial project blueprint.

****Strategizing Several Steps Ahead****

Strategic foresight in Minesweeper involves planning several moves, assessing potential outcomes, and managing risks—essential for effective project management and long-term planning in the professional realm. Playing Minesweeper cultivates a mindset that values strategic preparation and adaptability, preparing you to steer projects and negotiations toward success.

****Unwind and Adapt****

Beyond sharpening your technical skills, Minesweeper is a refuge from the daily grind. The familiar grid offers a structured yet soothing distraction that can help clear your mind, akin to meditation. It’s not just about escaping stress but about adapting to it and managing it—key for sustaining performance during crunch times at work.

Moreover, the mental flexibility needed to toggle between strategies in the game mirrors the rapid switching between tasks that’s common in today’s workplace, enhancing your cognitive agility.

****Ready at Your Fingertips****

One of the most significant benefits of Minesweeper is its accessibility. Whether you have a ten-minute break or just a few moments between meetings, it can engage your brain without a substantial time investment. These short bursts of cognitive exercise can strengthen mental agility, fostering a strong cognitive reserve that enhances career longevity and success.

****Conclusion: More Than Just a Game****

As you integrate Minesweeper into your daily routine, you’ll find it’s more than nostalgic play; it’s a deliberate practice in cognitive enhancement. Each game is a step towards becoming a sharper, more attentive, and strategic professional. So, next time you need a break, consider spending it with Minesweeper—not just for fun but also for your professional development.

Rediscovering Minesweeper in this light might change how you view every click—as clearing mines and planting seeds for a more robust professional future.

1.  4 Best War Games You Should Play
2.  12 Classic Games You Can Play on Your Smartphone
3.  The Best FPS Games on Android: Popular by Demand
4.  5 Casual Games You Can Play on Your Mobile Browser Now
5.  Run Windows 95 on your Mac, Linux and Windows 10 devices

A Mind at Play: Rediscovering Minesweeper in the Professional Arena

Plus: An assassination plot, an AI security bill, a Project Nimbus revelation, and more of the week’s top security news.

This week, WIRED reported that a group of prolific scammers known as the Yahoo Boys are openly operating on major platforms like Facebook, WhatsApp, TikTok, and Telegram. Evading content moderation systems, the group organizes and engages in criminal activities that range from scams to sextortion schemes.

On Wednesday, researchers published a paper detailing a new AI-based methodology to detect the “shape” of suspected money laundering activity on a blockchain. The researchers—composed of scientists from the cryptocurrency tracing firm Elliptic, MIT, and IBM—collected patterns of bitcoin transactions from known scammers to an exchange where dirty crypto could get turned into cash. They used this data to train an AI model to detect similar patterns.

Governments and industry experts are sounding the alarm about the potential for major airline disasters due to increasing attacks against GPS systems in the Baltic region since the start of the war in Ukraine. The attacks can jam or spoof GPS signals, and can result in serious navigation issues. Officials in Estonia, Latvia, and Lithuania blame Russia for the GPS issues in the Baltics. Meanwhile, WIRED went inside Ukraine’s scrappy and burgeoning drone industry, where about 200 companies are racing to build deadlier and more efficient autonomous weapons.

An Australian firm that provided facial recognition kiosks for bars and clubs appears to have exposed the data of more than 1 million records of patrons. The episode highlights the dangers of giving companies your biometric data. In the United States, the Biden administration is asking tech companies to sign a voluntary pledge to make “good-faith” efforts to implement critical cybersecurity improvements. This week we also reported that the administration is updating its plan for protecting the country’s critical infrastructure from hackers, terrorists, and natural disasters.

And there’s more. Each week, we highlight the news we didn’t cover in depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

**How Israeli Weapons Firms Use Amazon and Google**

A government procurement document unearthed by The Intercept reveals that two major Israeli weapons manufacturers are required to use Google and Amazon if they need any cloud-based services. The reporting calls into question repeated claims from Google that the technology it sells to Israel is not used for military purposes—including the ongoing bombardment of Gaza that has killed more than 34,000 Palestinians. The document contains a list of Israeli companies and government offices “required to purchase” any cloud services from Amazon and Google. The list includes Israel Aerospace Industries and Rafael Advanced Defense Systems, the latter being the manufacturer of the infamous “Spike” missile, reportedly used in the April drone strike that killed seven World Central Kitchen aid workers.

In 2021, Amazon and Google entered into a contract with the Israeli government in a joint venture known as Project Nimbus. Under the arrangement, the tech giants provide the Israeli government, including its Israel Defense Forces, with cloud services. In April, Google employees protested Project Nimbus by staging sit-ins at offices in Silicon Valley, New York City, and Seattle. The company fired nearly 30 employees in response.

A mass surveillance tool that eavesdrops on wireless signals emitted from smartwatches, earbuds, and cars is currently being deployed at the border to track people’s location in real time, a report from Notus revealed on Monday. According to its manufacturer, the tool, TraffiCatch, associates wireless signals broadcast by commonly used devices with vehicles identified by license plate readers in the area. A captain from the sheriff’s office in Webb County, Texas—whose jurisdiction includes the border city of Laredo—told the publication that the agency uses TraffiCatch to detect devices in areas where they shouldn’t be, for instance, to find trespassers.

Several states require law enforcement agencies to obtain warrants before deploying devices that mimic cell towers to obtain data from the devices tricked into connecting to it. But in the case of TraffiCatch, a technology that passively siphons ambient wireless signals out of the air, the courts haven’t yet weighed in. The report highlights how signals intelligence technology, once exclusive to the military, is now available for purchase by both local governments and the general public.

**An Indian Assassination Plot in America**

_The Washington Post_ reports that an officer in India's intelligence service, the Research and Analysis Wing, was allegedly involved in a botched plan to assassinate one of Indian prime minister Narendra Modi's top critics in the United States. The White House said Monday that it was taking the matter "very, very seriously," while India's foreign ministry blasted the _Post_ report as "unwarranted" and "not helpful." The alleged plot to murder the Sikh separatist, Gurpatwant Singh Pannun, a dual citizen of the United States and Canada, was first disclosed by US authorities in November.

Canadian authorities previously announced having obtained "credible" intel allegedly linking the Indian government to the death of another separatist leader, Hardeep Singh Nijjar, who was shot to death outside a Sikh temple in a Vancouver suburb last summer.

**An AI Security Bill Emerges**

US lawmakers have introduced a bill aimed at establishing a new wing of the National Security Agency dedicated to investigating threats aimed at AI systems—or "counter-AI." The bipartisan bill, introduced by Mark Warner and Thom Tillis, a Senate Democrat and Republican, respectively, would further require agencies including the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) to track breaches of AI systems, whether successful or not. (The NIST currently maintains the National Vulnerability Database, a repository for vulnerability data, while the CISA oversees the Common Vulnerabilities and Exposures Program, which similarly identifies and catalogues publicly disclosed malware and other threats.)

The Senate bill, known as the Secure Artificial Intelligence Act, aims to expand the government's threat monitoring to include "adversarial machine learning"—a term that is essentially synonymous with "counter-AI"—which serves to subvert AI systems and “poison” their data using techniques vastly dissimilar to traditional modes of cyberwarfare.

A New Surveillance Tool Invades Border Towns

Microsoft is rolling out passkey support for all devices. Here's a quick guide on how to create one.

Microsoft is rolling out passkey support for all consumer accounts.

Passkeys are a very secure replacement for passwords that can’t be cracked, guessed or phished, and let you log in easily, without having to type a password every time.

After enabling them in Windows 11 last year, Microsoft account owners can now generate passkeys across multiple platforms including Windows, Android, and iOS. You can create passkeys for your Microsoft account, and you can choose your face, fingerprint, PIN, or a security key to secure it.

**How to set up a passkey**

To create a passkey for your Microsoft account, follow these steps on the device where you’d like to create a passkey:

*   Sign in to your Microsoft account.
*   Navigate to **Security**  > **Advanced Security Options**.

*   Click on **Get started**.
*   Choose **Add a new way to sign in or verify**.

Note: Under certain circumstances, somewhere along the way you may end up in this screen which basically offers you the same choices in a prompt.

*   To create a passkey: Select **Face, fingerprint, PIN, or security key**.
*   Follow the instructions on your device.
*   During this process, you can choose to save the passkey to different devices like your Android, iPad, or iPhone, or a hardware key.
*   You’ll be presented with a QR code to scan with the selected device.
*   On the selected device you’ll be asked to authenticate.
*   When the procedure is successful, you’ll be asked to provide a name for the passkey. A good choice is to use a name that gives away the location where you stored the passkey.

Where is you passkey saved? Give this passkey a name to easily manage it later.

*   After confirming the name you’ll see this confirmation.

Passkey added. You can now use this passkey to sign in to your account.

**Removing a passkey**

Should you have second thoughts and want to remove a passkey, follow these steps:

*   Visit the **Advanced Security Options**.
*   From the list under **Ways to prove who you are**, select the passkey you’d like to remove.
*   Choose **Remove**.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 You get a passkey, you get a passkey, everyone should get a passkey 

Outabox, an Australian firm that scanned faces for bars and clubs, suffered a breach that shows the problems with giving companies your biometric data.

Police and federal agencies are responding to a massive breach of personal data linked to a facial recognition scheme that was implemented in bars and clubs across Australia. The incident highlights emerging privacy concerns as AI-powered facial recognition becomes more widely used everywhere from shopping malls to sporting events.

The affected company is Australia-based Outabox, which also has offices in the United States and the Philippines. In response to the Covid-19 pandemic, Outabox debuted a facial recognition kiosk that scans visitors and checks their temperature. The kiosks can also be used to identify problem gamblers who enrolled in a self-exclusion initiative. This week, a website called “Have I Been Outaboxed” emerged, claiming to be set up by former Outabox developers in the Philippines. The website asks visitors to enter their name to check whether their information had been included in a database of Outabox data, which the site alleges had lax internal controls and was shared in an unsecured spreadsheet. It claims to have more than 1 million records.

The incident has rankled privacy experts who have long set off alarm bells over the creep of facial recognition systems in public spaces such as clubs and casinos.

“Sadly, this is a horrible example of what can happen as a result of implementing privacy-invasive facial recognition systems,” Samantha Floreani, head of policy for Australia-based privacy and security nonprofit Digital Rights Watch, tells WIRED. “When privacy advocates warn of the risks associated with surveillance-based systems like this, data breaches are one of them.”

According to the Have I Been Outaboxed website, the data includes “facial recognition biometric, driver licence \[sic\] scan, signature, club membership data, address, birthday, phone number, club visit timestamps, slot machine usage.” It claims Outabox exported the “entire membership data” of IGT, a supplier of gambling machines. IGT vice president of global communications Phil O’Shaughnessy tells WIRED that “the data affected by this incident has not been obtained from IGT,” and that the firm would work with Outabox and law enforcement.

The website’s owners posted a photo, signature, and redacted driver license belonging to one of Outabox’s founders, as well as a redacted screenshot of the alleged internal spreadsheet. WIRED was unable to independently verify the identity of the website’s owners or the authenticity of the data they claimed to have. An email sent to an address on the website was not returned.

"Outabox is aware and responding to a cyber incident potentially involving some personal information,” an Outabox spokesperson tells WIRED. “We have been in communication with a group of our clients to inform them and outline our strategy to respond. Due to the ongoing Australian police investigation, we are not able to provide further information at this time.”

The New South Wales police force confirmed to WIRED that it was investigating a data breach on Wednesday, but a spokesperson declined to share further details. On Thursday, the force announced that it, working alongside federal and state agencies, had arrested an unnamed 46-year-old man in a Sydney suburb. He is expected to be charged with blackmail.

Clubs that used Outabox’s technology posted announcements about the incident and notified clients this week. One person who posted a breach notification from a club they visited recounted their experience with the facial recognition system. “My fondest memory of this system is visiting a club and having it confidently match my face to a member that was clearly 20+ years older than me, and looked nothing like me,” they wrote in a post on X. The club did not respond to a request for comment.

The Have I Been Outaboxed website, which is still online at the time of writing, alleges that Outabox stopped paying its developers in the Philippines. AI companies frequently employ low-cost overseas labor, including in the Philippines, to power their systems. The website encourages anybody whose data is included in the breach to contact venues and ask that they remove Outabox’s system. The site, which was set up last week according to online records, lists 19 venues. WIRED searched the database for prominent Australians including politicians, and it returned redacted results listing their name and the venues they allegedly attended.

“We are aware of a malicious website carrying a number of false statements designed to harm our business and defame our senior staff,” the Outabox spokesperson says. “We believe this is linked and urge people not to repeat false and reputationally damaging misinformation.” Outabox declined to specify which statements are false, citing the police investigation.

It’s unclear how much of the story told on the website is true, or whether the perpetrators even have the claimed biometric data. Australian cybersecurity expert Troy Hunt, founder of the breach notification website Have I Been Pwned, tells WIRED that there is little reason to doubt it at this time.

“I haven’t seen any reason not to take this at face value, which means they have exactly what they say they have,” he says. In posts on X, Hunt speculated that the website’s posting may have been preceded by demands that were not met, and that the perpetrators’ actions now “clearly land” in the realm of criminality.

“Offshoring is a messy discussion between the legalities of data sovereignty, perceived shortcomings of foreign labor, and frankly, a big dose of xenophobia,” Hunt says. “It’s not like Aussie developers doing exactly the same thing would have made this OK.”

Floreani of Digital Rights Watch says that the incident illustrates the “significant negative consequences” that can arise from collecting sensitive biometric data. “We need bold privacy reform and strict limitations on facial recognition technology,” she says. “As always, surveillance isn’t safety.”

The Breach of a Face Recognition Firm Reveals a Hidden Danger of Biometrics

Ukraine needs small drones to combat Russian forces—and is bootstrapping its own industry at home.

Inside Ukraine’s Killer-Drone Startup Industry

### Summary
If directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like `<img src=x onerror=alert(1)>.txt` will allow JavaScript code execution in the context of the web server’s domain.

### Details
SWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least `file_name` and `current_path` could contain malicious data however. `file_uri` could also be malicious but the relevant scenarios seem to be all caught by hyper.

### Impact
For any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability.

Skip to content

**Navigation Menu**

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   Pricing

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2024-32966

**static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names**

**Package**

cargo static-web-server (Rust)

**Affected versions**

< 2.30.0

**Description**

**Summary**

If directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like <img src=x onerror=alert(1)>.txt will allow JavaScript code execution in the context of the web server’s domain.

**Details**

SWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least file_name and current_path could contain malicious data however. file_uri could also be malicious but the relevant scenarios seem to be all caught by hyper.

**Impact**

For any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability.

**References**

*   GHSA-rwfq-v4hq-h7fg
*   https://nvd.nist.gov/vuln/detail/CVE-2024-32966
*   https://github.com/static-web-server/static-web-server/releases/tag/v2.30.0

Published to the GitHub Advisory Database

May 1, 2024

Tag

#ios