Reading list
Shortform reading
This is an incomplete list of the shortform reading (and listening and watching) I’ve been doing lately.
AI Is Changing Everything About Hacking. No One Knows What Happens Next
So much is happening, and so quickly, that it has been difficult for me — someone who has been reporting and editing stories on security and hacking for a decade — to fully understand what’s going on, to have a sense of what could happen next, or predict where this is going. And I think that that is largely where we are at the moment, as I am writing this.
But it has become clear that AI, broadly defined, has fundamentally changed both offensive hacking and defensive cybersecurity. This is not because AI has become sentient or because human beings have lost control of it or because of “swarms” of “rogue agents,” but because AI is proving something that we have always known: much of the software that runs the internet, our devices, our accounts, and our lives is vulnerable, or out of date, or has security flaws that human beings never noticed, or was installed by someone at a company who left the company six years ago and has been replaced four times and no one knows how to find them now or how to update it.
Jack Dorsey says his 'secure' new Bitchat app has not been tested for security
Dorsey admitted that his new messaging app had not been reviewed or tested for security issues prior to its launch.
Hackers abused API to verify millions of Authy MFA phone numbers
Twilio has confirmed that an unsecured API endpoint allowed threat actors to verify the phone numbers of millions of Authy multi-factor authentication users, potentially making them vulnerable to SMS phishing and SIM swapping attacks.
Polyfill supply chain attack hits 100K+ sites
If your website uses polyfill.io, remove it IMMEDIATELY.
Nothing's iMessage app was a security catastrophe, taken down in 24 hours
Nothing promised end-to-end encryption, then stored texts publicly in plain text.