This week's surveillance report covers Dashlane, the password manager,
who has confirmed that hackers stole some customers'
password vaults.
We're going to talk about what's happened.
The Pentagon has come forward and has admitted that U.S. troops are targeted with commercial location data,
which is the same problems we talk about, hitting the people that supposedly don't have to deal with this.
And there are some broader implications there I want to touch on.
Europe is accelerating its move away from U.S. technology with Nextcloud's EuroOffice launching,
as well as Tuda, the email provider joining as well.
And then there's a wild meta AI account takeover story where hackers literally just asked AI chatbots to get access to Instagram accounts.
And the AI said, sure,
why not?
Hello,
everybody,
and welcome to the Techlore Surveillance Report hosted by yours truly,
Henry.
And this is your essential weekly tech news delivering deep analysis on the latest threats to security,
privacy,
and digital freedom and empowering you to reclaim control and defend your rights.
All right, we had some juicy,
juicy,
juicy stories this week,
starting with what we never
want to hear back here, right, which is a password manager that gets in some way potentially
compromised.
Now,
this has a lot of asterisks on it, but it is quite reminiscent of that last pass
data breach that we dealt with a few years ago.
So Dashlane is a password manager.
Theoretically on paper,
one of the better ones,
they actually started pivoting towards
doing some more open source stuff, which I really liked when they started doing that.
Now,
pretty much they came forward yesterday at the time of recording and said that hackers
obtained at least a dozen encrypted vaults used for storing customer passwords during
a week in cyber attack.
Now, if you're newer to the concept of password managers, the idea is you have a vault that
is synced over the cloud with all of your passwords.
But ideally,
everything you do in that vault is encrypted on your device before it touches
their servers.
and so they can't actually see inside of the vault.
Now, before we get into the repercussions of this
and what it means,
just to target what might have happened first,
Dashlane came forward and said
there was no evidence of compromise on its own systems,
but it has not yet said how the hackers
were able to defeat its two-factor protections
in order to access customer accounts.
You can read their original announcement if you want to,
but it is very light on details.
They say that they brute-forced
the company's two-factor authentication system,
and it granted the hackers access to about 20 customer accounts.
So then they were able to download a copy of their encrypted vaults.
They did say they've taken steps to mitigate the risk of future incidents.
And like TechCrunch says here in the article,
without saying what those were.
The spokespeople for Dashlane,
as of yesterday,
did not respond to a request for comment.
They did not say if it knows who targeted its customers
or if the hackers contacted Dashlane with demands like a ransom.
Now, there's an Ars Technica article that came out today with a few more details.
And when I say few, I'm being a little bit generous there because there's still a lot that's not really clear.
Now, the reason why there's confusion is because Dashlane isn't being very specific on what's going on.
Pretty much the Ars Technica article speculates,
you know,
are they trying to brute force the accounts directly by trying different codes?
Are they trying to do something called 2FA fatigue?
When you spam somebody over and over,
eventually they click approve and let the attacker in anyway.
But it's also plausible that the attack exploited features that allow Dashlane users to enroll new devices in their accounts.
pretty much we have no idea why there were all these prompts.
These are just small little nuggets
of information we have,
and everything beyond that is a bit of speculation.
Now, there are a few things
that are confirmed that I think we can already start to form reasonable kind of takeaways about.
So the first thing,
you know, a lot of people are going to point to, and I know Dashlane is going to
point to the fact, especially in marketing and PR,
that these were encrypted vaults. Now,
this is a
good step,
right? We saw this sort of as well with LastPass,
where at least the most sensitive data
was, you know, part of an encrypted vault.
But what we learned is because of the security of
their master password and the amount of iterations required to break into the vault, all this
technical stuff, especially in combination with people using weak master passwords,
we have seen
millions of dollars that have been drained in things like cryptocurrencies tied to the LastPass
data breach,
all because originally encrypted vaults were taken.
But to this day, there are
people who are still trying to break into those vaults computationally.
And so that is my concern
with this one as well.
Yes, hackers stole, let's say,
20 encrypted vaults,
but now they can start
hitting that starting today and people with really,
really weak master passwords may be at risk.
So
no matter what password manager you're using, this is a good takeaway for you to make sure your master
password is as strong as it could possibly be.
Now, I think the second very clear takeaway that
is not polarizing is that Dashlane needs to step the hell up.
If they want in any way to retain
their reputation as being a trusted password manager, which is probably the most sensitive
piece of software anybody can use.
This is people's access to literally their life,
everything in their life.
Dashlane needs to step the hell up or else they're going to end up like
LastPass and be a literal laughingstock of the password manager industry, which is a bummer because
I think Dashlane has actually tried to really fix their reputation in the last several years.
So I would love to see Dashleen step forward and at least say,
hey,
we don't know what's going on yet. We're doing investigations.
Here's what we do know.
And instead,
they're kind of just ignoring everything.
My optimistic side is saying,
hey,
you know, there's a lot going on. They probably need to investigate what's going on. It's going to take them a few days. They want to make sure they get all the details right.
All those things can be true,
but I still think even with that optimistic lens,
there's no reason they can't be reaching out to people who are legitimately concerned about this if they're dashling customers and letting those customers know directly what they're doing,
not just saying generic,
vague stuff that doesn't really mean anything that's leaving everybody to have to guess what's going on.
I think this is the worst case scenario.
These are always quite juicy stories,
and we see a lot develop really quickly.
And so I'm watching this quite closely, so make sure to stay subscribed.
I'm sure we'll have more updates on this one.
It's a pretty big story,
and I know it always gets people concerned
when there's a new password manager data breach.
All right, coming soon, we still have Europe,
who's trying to pull away from U.S. big tech with some really interesting initiatives.
We have hackers who hijacked Instagram celebrity accounts
by just asking AI to do it, and it said sure.
But before we get there, we have this really interesting story.
So before I even touch on the story directly,
a little bit of context.
And this is a recurring pattern in the privacy digital rights space,
which is you can't only give good things to good people.
We need to make things universal,
and that is just the reality of how this all works.
If we want people to have access to encryption,
everybody needs access to encryption.
So if we want law enforcement,
if we want military,
etc., to have access to encryption,
that also means regular people like you and I should also have access to encryption.
This is something that I like to consider, oh, a basic human right, right?
We think privacy is a basic human right.
Access to security can in some ways be justified as a basic human right.
And I would say digital rights are human rights,
right?
Now, a lot of times those in power like to fight this narrative.
But then we have these fun moments where it actually switches and we actually can say,
You see,
look what happens when you don't take these problems seriously and it actually ends up impacting you.
We had the Salt Typhoon hacks not too long ago,
which pretty much was created because of a backdoor.
Those same backdoors that they're trying to implement into everybody's messages and everybody's web traffic all around the world right now.
People seem to be proposing backdoors,
but then we see the big guys who have a backdoor and it gets exploited and they deal with one of the worst hacks ever.
And now we continue this trend because U.S. troops were targeted with location data.
Now, this came from Senator Ron Wyden, who has a history of covering a lot of these privacy-based
problems.
And he pretty much said that the U.S. Department of Defense has confirmed that adversaries
have targeted and surveilled serving military personnel on the battlefield using commercial
location data,
the latest demonstration of how information collected from phones and
computers can be abused to track and target individuals.
We talk about this a lot on the podcast.
Pretty much law enforcement,
the FBI,
and other government agencies in the U.S., they need
to normally get a warrant to just, you know, access information about you.
There needs to be a reasonable cause to have to investigate people.
They need a judge to say that makes sense.
Now you can go ahead and pursue them.
I don't think many people who listen to this podcast,
nor myself,
think that law enforcement
shouldn't be allowed to pursue people that they think are doing something wrong.
But there should be some layer of accountability.
Typically, they have to get a warrant to search things like your house or anything in your physical life.
They can't just walk all over you without a judge saying that's okay.
Now, the problem with the digital space is that even though those laws technically are kind of supposed to exist,
they just get around them by purchasing data from other people who collected it legally.
Because there is no privacy regulation in the U.S.
especially,
What happens is you download an app for a calculator,
Duolingo,
whatever.
I'm just using random apps.
I'm not saying these specific apps do this, but pretty much any app you download from the
app store probably comes with third-party trackers and SDKs inside of that app.
And what happens is that these actually secretly collect lots of data on your phones and your
devices.
It sends it to these weird industries,
and these industries collect all of this data
about you, this massive surveillance economy.
And then the FBI and law enforcement,
because they can't get data about individuals without a warrant,
say,
you know what, let's just skip the whole process and let's just purchase the data from these data brokers that are actually allowed to collect the data because there's nothing stopping them from collecting that data.
So for years,
all of us have been screaming that this needs to be fixed. This is a massive loophole,
not only for basic democracy,
but why?
Why would anybody want this?
Why is it okay for when you download an app for now everywhere you go throughout your life to be sent to some random data brokers who don't care about you or your privacy or your safety?
And then from there, they can just give it to anyone who wants to pay them for it.
That's pretty messed up.
Politicians have ignored this problem.
And you know what? Politicians
themselves are now starting to finally deal with these consequences.
The reality is that the
Minnesota assassin who assassinated those politicians in Minnesota found their addresses
from people searching websites that were free and accessible.
It was on his notepad, and it's how he
found those people.
So I finally get to my point I'm trying to make here, which is we have this
history of things just impacting us mere mortals who just want to live and exist and not be
exploited.
But now it's starting to hit those in power too.
It hit politicians,
it hit people like
cellular companies as part of Salt Typhoon,
and now it's hitting military personnel.
Because
military personnel are not immune to this problem,
they're not able to opt out either.
The reality is
nobody is probably reasonably able to 100% opt out of this system because no one actually cares about
dealing with the root system.
So I wanted to shed light on this story because to me,
it's a demonstration of how these problems are so out of control now in 2026 that even people that
you think should get exceptions to it, which I don't agree with, but even the people you think
should be exempted from these problems are not.
They can't get around them either.
I just really
hope that this wakes people up. I'm really happy that Senator Ron Wyden is calling this out,
and he constantly does these call-outs to try to draw attention to these problems.
I'm really glad there's coverage for this.
And those are at least my two cents on it.
I'd love to hear what you guys think in the comments
because I think this is ridiculous.
It's getting out of control.
Oh, and one more thing I forgot to mention about this story.
Senator Ron Wyden actually called this whole location
data tracking industry slash the whole data broker industry
a national security threat.
And for the first time in a long time,
I actually agree with how that word is utilized.
For context, we have platforms like TikTok
that have been called a national security threat
because they collect sensitive data and send it to China.
But really what that was, in my view,
is it's China that had a platform that was used by almost every American.
And that was a huge power shift towards China big tech companies.
But we don't care if Meta,
if Google,
if Facebook or Facebook is Meta, but you guys get what I'm saying.
We don't care if US big tech companies collect that data.
And I think that this is really more proof to that sentiment that I have,
which is these data brokers that collect all this data and then they might sell it to Chinese companies anyway.
Why is that not a national security risk?
So I think that this word national security risk is being thrown around a lot in the digital space, but it's being used to justify really crappy things.
And I actually really appreciate how Senator Ron Wyden used this specific threat as a truly genuine national security threat, which I think it is.
All right, coming soon, we have a lot of European updates,
and we also have Meta, who did something crazy with their AI agents that just granted people access to other people's accounts.
Ridiculous, but nothing we wouldn't expect from Meta. But I quickly wanted to shout out our sponsor first,
which today is Easy Opt-Out. If you haven't heard of Easy Opt-Out before,
they are an automated service that tries to remove your information from people searching websites.
It's actually quite related to that story that we just talked about.
There's two main methods to remove your information from these people search websites.
There's the manual one, which works very well,
but you have to continually do it yourself.
And it isn't just a one-time thing.
You have to always do the maintenance,
or you can just pay for an automated service to take care of it for you.
And that's personally what I like to do as well.
Because it's only $20 a year, it does the opt-outs for me.
I don't have to think about it.
I just get an email every few months that says they opted me out, and then I kind of just move on with my life.
It's just run by a couple guys who realized that they could offer the same service for a lot cheaper.
They were verified by Consumer Reports Independent Research,
and they actually tied with Optory
in terms of the best kind of performance,
but Optory has a much higher price tag.
And a lot of people in our community actually like combining the two tools.
They use free Optory to scan to see which sites they're on, and then they just have easy
opt-outs do the removals, and then they can compare the difference.
When people in my life find their name, their home addresses,
and information about themselves
and their family online on these people-searching websites,
and they ask me what to do about it,
I just tell them to go with easy opt-outs.
That is the number one recommendation I have, and it's who I still personally use to this day.
I want to thank Easy Optouts for all of their support over the years.
We couldn't do this podcast without them.
So go check them out down in the description if you want to get started today.
And now let's go back into the stories.
All right, so now we're going to talk about Europe.
And we have two core stories that are quite different,
but the first story has a ton of stories within it, and it has to do with the Euro office.
The idea is that Microsoft Office is a centralized big tech company,
in addition to all these
other ecosystems that exist as Microsoft Office alternatives,
also being from big tech companies.
Many of those big tech companies happen to be US-based.
And so as you can tell, there's a bit of a geopolitical angle to this as well.
But pretty much Europe has come forward and said, we don't want big tech companies running
our entire tech stack,
especially from a government perspective.
But also,
we don't really want all of our businesses and all the things that are happening in Europe to be running through U.S. big tech companies.
I'm sure this is a privacy thing.
It's a digital sovereignty thing.
They want data to be flowing through their own channels.
The idea behind EuroOffice is exactly what it sounds like.
They are coming forward and saying we want a European-based alternative to Microsoft,
Google,
big tech,
etc.
Now, the people who are making this happen is essentially a collaboration between tons of different projects.
I'm not even going to get into the whole drama because there was a ton of drama around OnlyOffice
because OnlyOffice has a license that they didn't agree with.
I'm just, I'm not going to get into it.
I'm about to explain it.
I'm not going to explain it because I'm just not going to get into it.
If you care about reading about licenses and open source drama, you can do that.
All those resources exist online.
So I'm at least making you aware of them.
So if adopted,
the package will direct money towards products that contribute to Europe's
economy,
and independence from foreign firms,
cut red tape for data transfers,
beef up research and
innovation through leadership initiatives,
incentivize countries to share digital capacities
in new Euro Cloud Forum,
and require EU governments to come up with national strategies to boost the
adoption of cutting-edge tech,
including AI.
The package will also seek to ramp up the bloc's
demand for advanced chips,
a response to criticism by the industry with a series of industrial
initiatives to revise the 2023 CHIPS law.
The Commission's President Ursula von der Leyen,
I hope I said that correctly, said,
we cannot afford to depend on others for the technologies that keep our hospitals running,
our energy grids stable,
and our services secure.
This is about protecting our citizens,
defending our interests,
and making our own choices.
So yeah, they've replaced Google with French search engine Quant,
which I know a lot of you in the audience actually know about.
We have Nextcloud,
who has pretty much come forward and has embraced this as well.
And then we have Tuda,
the email provider who's also a part of this.
A lot of people might be wondering, Proton.
Now, my understanding is that Proton is Swiss-based,
so they're not technically in the EU.
That's my assumption on why that's happening.
But again, this is all kind of unfolding.
It's kind of hard to make sense of what's going on here.
This is a bit messy to read about,
and I'm kind of waiting for a more formal united front
on this because it seems like day by day,
this is looking a little bit different.
So I'll keep you all updated.
Stay subscribed to the podcast,
and I'll try my best to update you all as more information
comes to light.
All right, now there's a second story from Europe,
which is France-specific.
And this is a French article translated into English, which has, I don't think, any English
article written on the internet about it.
Actually, it's even paywalled.
So I don't have the full primary information, which normally doesn't mean I cover it on
this podcast.
The only reason I'm going to cover it on this podcast with all of those asterisks is because
there's a person named Nelian who's on the podcast called Comfort Zone, and they actually
talked about this problem.
And I have a lot of trust in how they communicated the problem.
And so I'm going to relay more or less what they shared.
And so if anything is wrong, blame them.
But pretty much.
So a bit of context.
We talked recently about how RCS is now getting end-to-end encryption between iOS and Android devices.
This means that those green messages between iOS and Android can now be supported with end-to-end encryption.
It's not going to have signal level protections on metadata or anything like that.
But this is huge for keeping out just basic people from your messages.
Now,
the technology is there.
It's fully supported.
It's available in tons of countries.
I think it's still technically in beta,
but this works.
But not in France.
So,
Neil Leon in the podcast,
not me,
I believe what this article goes on to claim,
but I have to relay through what I heard,
was that the technology is actually fully there
and embraced by cellular companies,
or at least it's possible to be embraced by the cellular companies in France,
But they aren't doing it because of government pressure.
And this is another weird political situation because apparently there are some cell carriers in France right now that want to do certain mergers and they want to stay on the good side of the government.
But the government doesn't really want RCS to be rolled out yet because they still want to continue looking at everybody's messages via SMS without end-to-end encryption.
So we have this really interesting dynamic in France right now where we have politics getting in the way of basic security going out to every single French citizen.
So I wanted to at least put this on your radar.
I'm not even going to add commentary on it yet.
I'm mostly reeling what they said on their podcast.
So at least it puts it on our radar.
And I'll try to update you guys as I learn more about this. And there's more primary sources.
If you are French and you do have better resources to share with me regarding that,
I always appreciate those. A lot of stories actually come from you all who submit them.
So I really appreciate it.
All right,
and now we continue the series of Meta just doing Meta things.
I can't stand Meta.
I can't stand Facebook.
I can't stand Mark Zuckerberg.
So I'm going to do my best not to get too angry at this.
But this is just embarrassing.
I mean,
so Meta has AI support chatbots now.
And apparently hackers literally just asked it for the ability to access different accounts.
This hacked the Barack Obama White House account and the chief master sergeant of Space Force's account.
Literally all the attackers had to do to break into these accounts was they used a VPN to approximately match the location to their target Instagram accounts region.
They began a password reset process and then they asked Meta AI support chatbot to change the email address associated with the account.
That is it.
Now, Henry,
luckily this wasn't available to the public for very long.
Oh,
no, you're wrong about that.
It was active in the wild for months,
going as far back as February of this year with
hackers compromising thousands of accounts.
The only difference is that they finally compromised high profile accounts.
So people actually figured out what was going on.
This is the same company that's trying to install, you know, tracking software on all
their employees'
cursors.
This is the same person who doesn't want their own children on their platforms.
Mark Zuckerberg doesn't let his children go on these platforms.
This is the same platform that's been investing heavily in trying to duplicate their CEO as an AI clone.
This is the same company that tried that whole metaverse thing.
This is the same company that is coming forward and trying to get everybody to use meta Ray-Bans so that they can start enabling facial recognition software and be able to easily find people all around them.
It's unbelievable just how freaking dystopian this company tries to be, like,
intentionally.
I cannot stand them.
Now,
you know,
get away from that.
Pretty much some actionable things.
Luckily,
people who had stronger MFA methods enabled weren't actually impacted by this.
So this also means that all these people that were hit by this literally didn't have basic 2FA enabled,
which is also a problem. And that's equally embarrassing,
especially for something as, you know, mainstream as some of these people,
right?
these people you think would have proper security on their social media accounts like Barack Obama
and the Space Force,
you know, Chief Master Sergeant.
I don't know how high that is, but that
sounds high to me. When I zoom out, I just think about all the work that I put into my digital
safety as well as probably a lot of you who listen to this podcast.
And then I remember how much Meta
actually cares about keeping you safe and how they're willing to just throw that away just for
whatever,
whatever they're prioritizing next to try to keep investors interested and not realize
that everything that Meta's done the last 10 years isn't original,
nor does it probably deserve
the massive amount of money that they generate based on just exploiting people.
Those are my
strong opinions that are really leaking here.
I'm getting carried away.
My point that I'm trying to
make here is that we put a lot of effort into this and some people clearly don't. And I think
it's a good reminder that as long as you're doing quite a bit more than maybe what the regular worst
case scenario is doing,
you're probably going to stay pretty far ahead of most of these attacks.
So even if you enabled SMS 2FA or email 2FA,
if you just did some more basic stuff and you maybe weren't trusting Facebook along the way, you're probably going to avoid most privacy and security problems on the internet.
So I think it's always a good reminder that even when we go far and beyond with these things,
a lot of times it's the basics that can really keep us safe.
So I saw this as a good reminder of that.
One final update is that Instagram is actually starting to alert users who were targeted by those hackers during those AI chatbot attacks.
so ideally you're going to be alerted if this hits you and you can see screenshots in the video as
well of what that looks like and you can learn more by checking out the show notes in the description
all right everybody we are now going to get into the defense bulletin this is split up into three
sections the first section is the data breaches we're just going to rip through these and these are
the data breaches.
The next thing is the threats,
which is the things that you should be watching
out for because they could hit you or they maybe already did hit you and what you can do about them.
And then we have the open source updates. To start with data breaches, we have the Carnival
Cruise.
That's confirmed a data breach affecting nearly 6 million people.
And so if you have used
them or you intend to use them,
this is a good thing to look into and you can find more information
in the show notes.
We also have Charter Communications that had a data breach affecting
almost 5 million accounts. The thing that kind of upsets me about this is that it actually happened
in early April,
but they only confirmed the breach earlier this week.
So very lame of them to not have
very much discussion about this. And they just started revealing formal details now,
but there
are details now. So you can see if you're affected,
you can learn more in the show notes.
All right,
this next story is just a quick update.
It's not quite a data breach.
It's an update to one,
But California Attorney General is suing 23andMe over that 2023 breach exposing health data.
If you were listening to the podcast back then, it's something we covered extensively,
but they are now trying to hold them a bit more accountable.
I don't want to do too much coverage for it because there's still a lot to be
seen as to what this is going to look like.
But if you stay subscribed,
I'm sure we're going to cover updates once this finally comes to fruition.
All right, this is a wearable health tech startup called UltraHuman.
I have not heard of this company before, but they said that hackers access customers'
wellness data via an internal tool.
And so if you use this tool,
look into this in the show notes.
It's pretty important stuff.
Next up, we have a prison calling service called Paytel, P-A-Y space T-E-L.
And they have finally secured a publicly exposed cloud server that stored hundreds of thousands of driver's licenses and other sensitive information about people who used its service.
This is really geared towards devices in prisons across much of the U.S. for inmates to receive calls.
I don't know how many of our listeners this directly applies to, but if you know anyone who might have used this service,
I suppose that's something to dig into if you want to learn more.
This one was fascinating.
So Grand Theft Auto V has a cheat service that got hacked exposing thousands of gamers.
So it's called Atlas Menu.
And if you think I know what the hell any of this is,
that would be quite an assumption on your end
because I've never heard of these things.
So if you're a pro gamer like me,
you're going to know what Atlas Menu is.
So the stolen data included users'
email addresses,
usernames, scrambled passwords,
IP addresses,
and support tickets.
And that's all on how I've been pwned.
And you can read a lot more about this
and you'll probably learn more from it
than you will from me in the show notes.
This isn't really a data breach,
but I still wanted to put it on your radar.
just a quick little recap story on TechCrunch.
That's the worst hacks and breaches of 2026 so far.
And it kind of just recaps all the main ones.
I'm not going to get into it too much in this episode.
We don't have enough time,
but I wanted to at least put it on your radar.
All right, now we're going to get into the threats.
These are things that may impact the software you use on a daily basis
that you should be very aware of.
The only thing is we have a lot of stories this week.
And so I do want to go through them pretty quickly
so I don't waste too much of your time.
So the first one is that Google has fixed one actively exploited Android zero-day flaw.
So make sure you're getting up to date and you're still ideally getting software updates
at minimum on your Android devices so you get these kind of patches.
And if you want to learn more about the zero-day, you can check it out in the show notes.
We also have Google Chrome that's adding session cookie theft protection for all users.
Now, this is a very common attack that impacts especially people like YouTubers and people
in public positions,
where essentially,
you know, you have a logged in browser that you're
logged into your YouTube account with, your Twitter,
etc.
And someone hacks your computer and they
steal the cookies from your browser.
Google has rolled something out as a way to cryptographically
bind session cookies to a specific device,
which would prevent hackers from just stealing your
cookies.
This is rolling out to Google Workspace customers,
Workspace individual subscribers,
and users with personal Google accounts.
And it will be enabled by default for all Google
Workspace customers.
This is built into at minimum Chrome.
And I guess it's to be seen,
I haven't heard yet how this applies to other Chromium-based browsers, and so I need to do
more research on this,
and I'll try to report those updates in future episodes.
Acer has confirmed that they are looking to address two maximum severity zero-day vulnerabilities
affecting their Wave 7 mesh routers, and so if you have this router, this is a strong story to
follow to see if you're impacted by this.
There's a service called GOGS, which is a self-hosted
Git service,
and there was a zero-day flaw that let hackers get remote code execution. And so if
you use this service,
definitely look into this story.
There's a new denial-of-service attack
called HTTP2 bomb,
which can be launched from a single machine to take down web servers within
seconds.
The attack is actually quite interesting, and I think it was actually discovered. Yes,
it was discovered by OpenAI's Codex software agent,
which is fascinating.
Now, the really
important thing here is that systems running behind CDNs or reverse proxies do not expose
vulnerable HTTP 2 endpoint and are a lot more difficult to target.
And actually,
this problem
was already fixed in Nginx version 1.29.8.
And if you want to read more about this to see if you
have properly patched it, I would check it out in the show notes.
It's a fascinating attack.
This one is a pretty big story. It almost was a main story this week, but I had some other things
I wanted to focus on a bit more to put on your radar.
But there were dozens of Red Hat packages
that were backdoored through its official NPM channel.
Fortunately,
Red Hat did say they removed
malicious packages.
They said the packages are strictly limited to internal development,
and the malicious code was never published for customer consumption via the console.redhat.com
system.
All right, we have our new weekly tradition of some WordPress plugin attacks.
So the newest one is WPMapsPro,
which is a WordPress plugin,
has a bug that was exploited
to create admin accounts on WordPress websites.
So if you use that plugin, you need to look into this.
And up next, we have the next WordPress plugin, which is a critical kirky flaw,
K-I-R-K-I, kirky.
And there was a critical privilege escalation vulnerability that impacted that plugin so that you could take over any user account,
including those belonging to admins.
So if you use this plugin,
you need to look into that.
WordPress malware also had a campaign that hides payloads in Steam profiles.
So nearly 2,000 WordPress websites were infected with malware that relies on Steam community profile comments to hide command and control data.
You can defend against this by checking for references to Steam community URLs,
suspicious external JavaScript injections,
outbound connections from WordPress service to Steam,
and unexpected scripts loading from domains like hellomyworld.info.
There's other indicators as well.
So if you are a WordPress admin, this is a story to look into.
Okay, there were over 116,000 Minecraft systems
infected in Weed Hack malware campaign.
This is targeting Minecraft players
and has infected more than 116,000 systems since January.
It's distributed through Microsoft-related malicious mods,
clients,
cheats, and utilities
that are promoted all over YouTube and SEO poisoning.
So if you're a Minecraft player,
look into this
because it seems like this impacts a ton of things
in that ecosystem,
and I couldn't even begin to tell you
what some of these things are.
Like Donut Duper,
oh God, if you use Donut Duper, you got to check this out.
I don't know what it is,
but it's in the screenshot.
I'm not going to put too much time into this story as I'm doing for the others,
but this is just a PSA that hackers are trying to steal Signal users'
backups
in a new wave of widespread attacks.
The article covers more about this.
I would really recommend reading it if you are a Signal user,
but if you're not going to read the article and you're a Signal user,
just make sure you're aware that there are phishing attacks on Signal.
Signal has actually recently added a lot more warnings and confirmations to try to combat this
problem.
Another super quick PSA, the FBI's warning of fake FIFA websites running World Cup fraud
schemes.
Again,
this all just falls into the same bucket of phishing attacks.
So these are the
current things that are being targeted to try to trick people into thinking they're on real websites.
So if you're in any way engaging with the World Cup,
just make sure you're accessing official
websites and you can always read more by going to the show notes to see what these attacks actually
look like.
This is another story that we just don't have very much time to cover this week.
There's too many stories.
I think there was over 50 this week,
but websites can now spy on you through your hard drive.
We used to have a research section on surveillance report,
which is the perfect category for stories like this,
which is researchers find a really interesting way
to be able to spy on you in a very weird side channel attack
kind of movie-esque style of tracking people.
But rarely does that really directly translate
into what's possible on the internet.
And that's probably a pretty similar situation here.
Now, there is a full research paper that details this, but it actually does fingerprinting remotely using OFPS-based SSD timing.
So you can read this whole research article if you want.
There's no indications of these being performed in the wild.
And if you are super,
super,
I guess, concerned about this, you pretty much just have to close your tabs when you're done with them.
So this rewards all of you people like me who like to keep their browsers very neat and tidy.
And this is probably the real solution.
They propose ways for browsers to shut down all of these side channels.
So it's very likely if this is a serious enough problem,
browsers are going to patch it before it ever impacts you.
This is another update.
My gosh, this is a person we've been talking about the last several weeks now.
Nightmare Eclipse.
Pretty much Microsoft started making some vague legal threats against Nightmare Eclipse.
And the cybersecurity community has kind of stepped up
and for the most part has backed up Nightmare Eclipse
and is saying that Microsoft is being really unprofessional.
So if you want to learn more about this and learn more about Nightmare Eclipse
and this whole drama between Microsoft and Nightmare Eclipse,
check it out.
I think overall the InfoSec and cybersecurity community is leaning.
I don't know if they necessarily like Nightmare Eclipse,
but they disagree on how Microsoft is approaching all of this.
So check out the show notes if you want to learn more.
All right, everybody.
And now we're going to get into the open source news
where we just cover open source and open source adjacent news.
But I actually think this week we are 100% completely open source.
No debates, no questions asked.
So we're going to start with Tor browser with version 15.0.15,
which was released.
It seems like a pretty, pretty minor update.
It just updated some of the extensions and it fixed a few bugs.
So nothing too serious there, but make sure you get up to date if you're using the Tor
browser.
Mullvad had a security assessment of their Android app.
Mullvad is an open source VPN provider.
They're very well respected in the community.
It's pretty much like an audit.
So you can read the audit and see what they found.
They have an overview of findings.
And it's always good to see audits.
The reason why you want to do audits over time is that audits are a snapshot in time.
And so as of today,
this is what Mullvad might look like.
But starting next week, they're going to start pushing out more code.
And maybe it's not the same thing.
And so it's really cool how providers like Mullvad continually do more audits over time.
This one is really interesting.
Now,
I'm pretty far removed from Gmail.
I've been using Proton for a long time.
So I don't really quite envision exactly how this works, but I think I get the picture.
So Proton released this new feature,
which they're kind of marketing as a way to use Gmail a bit more privately.
So what you can do now is you can connect Gmail into your Proton account.
You connect them.
Connecting your Gmail does not give Google access to your Proton Mail inbox.
They make that very clear.
So this is supposed to be like a transition for people who aren't ready to leave Gmail overnight.
but they want to start using a privacy-first email provider.
So now you can actually send emails from your Gmail address
from directly inside of Proton.
This also includes importing your emails.
The idea here is if you're a Gmail customer,
you've been using Gmail for 10 years,
and you want to start dipping your toes in Proton,
it'll import all of your Gmail emails.
You can even still send emails through your Gmail address from Proton,
but you can kind of start transitioning things slowly.
Really, I think what this is doing is it's making it easier
for people to move to a privacy-first email provider.
And I think they're well aware of that.
They know that if they get people starting to use them,
it's probably likely that they'll move to it
permanently down the road.
I think this is great.
Obviously, it's great for Proton,
but I think really this is great
for just people who are new to this.
I know a lot of people have been using Gmail
for like 10 plus years,
and that is actually the main reason
they never are going to switch to a different provider.
The friction point is just too high.
And so the more that we can reduce
that friction point, the better.
And this is a place where I think I'd love to see
to also be able to step up and offer similar ability for people to quickly migrate from old
services.
I can't say I'm going to use this, and I'm sure a lot of you in our audience probably
won't use this either. But this is a good thing to recommend to friends and family in your life
that are already thinking about maybe leaving Gmail.
Now it's one less reason for them not to
do it.
Now we have just a few more Linux stories here.
Rocky Linux hit version 10.2, which brings
post-quantum cryptography and Flatpak default,
which is really awesome.
And that actually comes
right off of another big update from Rocky Linux
just a few days ago, which was 9.8,
which had major software updates
and a new image builder feature.
OpenSUSE Tumbleweed has updated their desktop environments,
their kernel,
and security fixes as well.
So you can learn more about that in the show notes.
And we also have NixOS that hit version 26.05.
So if you want to learn more about that,
there's also more information about that in the show notes.
And that, my friends, is going to conclude
this week's Techlore Surveillance Report.
If this analysis helped you reclaim control,
you can become a Techlorian by visiting the link in the show notes.
I absolutely love doing this,
and I couldn't do it without all of our community support.
And you'll also gain access to exclusive communities
like the private signal group.
You'll also get some perks like my private RSS feed,
which I'm updating throughout the week
to keep track of all these stories.
And so if you want to access my RSS feed as I'm collecting them,
that's how you can do it.
And if you don't want to support us via the paid method,
you can still do it for free by just leaving a rating.
You can also share the episode with people
in your life to help keep them safer as well.
Other than that, just keep enjoying the episodes
and I'll be happy to keep delivering them each week.
Thank you all for listening
and I'll see you in the next episode of Surveillance Support.
And also don't forget to check out Easy Opt Outs,
our sponsor from this week's episode in the description.
See you next week.