The payments platform, Zelle, will now refund victims of imposter fraud, which cost Americans $2.6 billion in losses across the industry last year.Zelle, a payments app owned by seven of America’s largest banks, began reimbursing victims of imposter scams on the platform, according to an emailed statement from the company. Early Warning Services, the network operator of Zelle, says it will process refunds for scams dating back to June, which is a change of attitude by American bankers.

Zelle has always reimbursed certain victims, like if a hacker gets into your Zelle account and steals your money. This new reimbursement policy announced Monday, however, is a different category of fraud involving imposter scams, where users are duped into sending money to a fraudulent Zelle account claiming to be someone else. America’s largest banks have long tried to escape responsibility on this front.

…

*BONUS Article 1 * https://gizmodo.com/paypal-scams-crypto-bitcoin-customer-service-fraud-tax-1849556838

*BONUS Article 2 * https://gizmodo.com/old-bitcoin-wallets-security-flaws-randstorm-unciphered-1851020470

According to Unciphered, a cryptocurrency recovery company, an untold number of crypto wallets were designed with baked-in flaws that leave a backdoor in the code that hackers could easily break open. Encrypted software systems like crypto wallets often rely on random number generators, but the company found that a significant number of wallets were built on open-source software that used numbers that aren’t nearly random enough. These vulnerable wallets use keys with numbers that are one in several thousand instead of one in a trillion, making them susceptible to brute-force attacks.

Social Links, a surveillance company that had thousands of accounts banned after Meta accused it of mass-scraping Facebook and Instagram, is now using ChatGPT to make sense of data its software grabs from social media.Most people use ChatGPT to answer simple queries, draft emails, or produce useful (and useless) code. But spyware companies are now exploring how to use it and other emerging AI tools to surveil people on social media.

In a presentation at the Milipol homeland security conference in Paris on Tuesday, online surveillance company Social Links demonstrated ChatGPT performing “sentiment analysis,” where the AI assesses the mood of social media users or can highlight commonly-discussed topics amongst a group. That can then help predict whether online activity will spill over into physical violence and require law enforcement action.

…

That’s a problem not just because this kind of technological eavesdropping could amplify inaccuracies or biases. It could also chill online discourse because everyone feels “that they’re being watched, not necessarily by humans, but by AI agents that have the ability to report things to humans who can bring consequences down on your head,” Stanley added.

ChatGPT maker OpenAI didn’t respond to requests for comment. Its usage policy says it does not allow “activity that violates people’s privacy,” including “tracking or monitoring an individual without their consent.”

…

He warned, however, that law enforcement must be transparent with its use of AI because of its reliability and bias issues. “There is never going to be a way of making AI unbiased,” he said, noting, as have others, that technologies programmed by humans reflect human fallibility.

Interesting article about a surprisingly common vulnerability: programmers leaving authentication credentials and other secrets in publicly accessible software code: Researchers from security firm GitGuardian this week reported finding almost 4,000 unique secrets stashed inside a total of 450,000 projects submitted to PyPI, the official code repository for the Python programming language. Nearly 3,000 projects contained at least one unique secret. Many secrets were leaked more than once, bringing the total number of exposed secrets to almost 57,000.

[…]

The credentials exposed provided access to a range of resources, including Microsoft Active Directory servers that provision and manage accounts in enterprise networks, OAuth servers allowing single sign-on, SSH servers, and third-party services for customer communications and cryptocurrencies. Examples included:

…

Site RSS feed: https://www.schneier.com/feed/

(AP) – Advertisers are fleeing social media platform X over concerns about their ads showing up next to pro-Nazi content and hate speech on the site in general, with billionaire owner Elon Musk inflaming tensions with his own tweets endorsing an antisemitic conspiracy theory.IBM said this week that it stopped advertising on X after a report said its ads were appearing alongside material praising Nazis — a fresh setback as the platform formerly known as Twitter tries to win back big brands and their ad dollars, X’s main source of revenue.

The liberal advocacy group Media Matters said in a report Thursday that ads from Apple, Oracle, NBCUniversal’s Bravo network and Comcast also were placed next to antisemitic material on X.

“IBM has zero tolerance for hate speech and discrimination and we have immediately suspended all advertising on X while we investigate this entirely unacceptable situation,” the company said in a statement.

Apple, Oracle, NBCUniversal and Comcast didn’t respond immediately to requests seeking comment on their next steps.

The Federal Communications Commission (FCC) has revealed new rules to shield consumers from criminals who hijack their phone numbers in SIM swapping attacks and port-out fraud. FCC’s Privacy and Data Protection Task Force introduced the new regulations in July. They are geared toward thwarting scammers who seek to access personal data and information by swapping SIM cards or transferring phone numbers to different carriers without obtaining physical control of their targets’ devices.

In SIM swapping attacks, criminals trick a victim’s wireless carrier into redirecting their service to a device controlled by the fraudster. Conversely, in port-out fraud or mobile number porting fraud, scammers transfer the victim’s phone number from one service provider to another without the owner’s authorization.

They both cause significant financial losses, identity theft, and distress for the victim, as they lead to unauthorized access to personal accounts and sensitive information.

“These scams – SIM swap and port-out fraud – don’t just put wireless account access and details at risk,” said Commissioner Geoffrey Starks.

“Because we so frequently use our phone numbers for two-factor authentication, a bad actor who takes control of a phone can also take control of financial accounts, social media accounts, the list goes on.”

…

Filed: https://www.bleepingcomputer.com/news/security/

Topics:

Commercial air crews are reporting something “unthinkable” in the skies above the Middle East: novel “spoofing” attacks have caused navigation systems to fail in dozens of incidents since September.

In late September, multiple commercial flights near Iran went astray after navigation systems went blind. The planes first received spoofed GPS signals, meaning signals designed to fool planes’ systems into thinking they are flying miles away from their real location. One of the aircraft almost flew into Iranian airspace without permission. Since then, air crews discussing the problem online have said it’s only gotten worse, and experts are racing to establish who is behind it.

…
While GPS spoofing is not new, the specific vector of these new attacks was previously “unthinkable,” according to OPSGROUP, which described them as exposing a “fundamental flaw in avionics design.” The spoofing corrupts the Inertial Reference System, a piece of equipment often described as the “brain” of an aircraft that uses gyroscopes, accelerometers, and other tech to help planes navigate. One expert Motherboard spoke to said this was “highly significant.”

…

There is currently no solution to this problem, with its potentially disastrous effects and unclear cause. According to OPSGROUP’s November update, “The industry has been slow to come to terms with the issue, leaving flight crews alone to find ways of detecting and mitigating GPS spoofing.”

…

Humphreys and others have been sounding the alarm about an attack like this occurring for the past 15 years. In 2012, he testified by Congress about the need to protect GNSS from spoofing. “GPS spoofing acts like a zero-day exploit against aviation systems,” he told Motherboard. “They’re completely unprepared for it and powerless against it.”

…

PLANES
SPOOFING
ISRAEL
IRAN
GPS