Pete Recommends – Weekly highlights on cyber security issues, December 20, 2025

Subject: The USA’s Censorship and Surveillance Plot is Working
Source: Privacy Guides
https://www.bespacific.com/the-usas-censorship-and-surveillance-plot-is-working/

Privacy Guides sits down with technology journalist Taylor Lorenz to decipher a slate of bills – including KOSA, the SCREEN Act, the App Store Accountability Act, and ongoing efforts to repeal Section 230 – being fast-tracked through Congress which threaten free speech, privacy, and your right to freely access information on the internet. There are more resources put together by ‪@FightfortheFuture‬ at https://www.badinternetbills.com covering these bills. Check out their site and contact your representatives while you listen to this interview! Guest: Taylor Lorenz ‪@TaylorLorenz‬ (she/her) Hosts: Nate Bartram (he/him), Jonah Aragon (he/him) Writer: Nate Bartram Editors: Nate Bartram, Jordan Warne (they/them) Executive Producer: Jonah Aragon



Abstracted from beSpacific
Copyright © 2025 beSpacific, All rights reserved.


Subject: Medicare.gov to deploy ID.me for beneficiary verification
Source: Fedscoop
https://fedscoop.com/medicare-gov-deploy-id-me-beneficiary-verification/

ID.me will be used to verify Medicare beneficiaries online starting in 2026, according to releases from the companies. Medicare will also deploy CLEAR.

The Centers for Medicare & Medicaid Services has tapped ID.me to verify the identities of beneficiaries on Medicare.gov, according to a Tuesday announcement from the identity-proofing company.

ID.me will be available as an option for identity verification and sign-in on Medicare.gov starting in early 2026, per the release. The deal adds to the growing number of federal programs opting to use the digital identity service that leverages facial recognition technology and has been the subject of some controversy in the past.

Already, ID.me is used at 21 federal agencies, including the Social Security Administration and Department of Veterans Affairs, per the release. Opting in means an ID.me user could sign in with the same credentials at any of the other federal, state or private-sector entities that use the service, the company said in a statement to FedScoop.

In 2022, then-Democratic leaders on the House Oversight Committee said ID.me had downplayed wait times for users applying for unemployment benefits with the IRS. The same year, civil rights organizations called on state and federal entities to halt use of ID.me, citing concerns that facial recognition technology disproportionately impacts people of color and marginalized communities.


Subject: FBI Couldn’t Read Data Pointing to Pipe Bomb Suspect
Source: Newser
https://www.newser.com/story/380465/fbi-couldnt-read-data-pointing-to-pipe-bomb-suspect.html

Wall Street Journal reports cellphone location data held for 4 years was only recently deciphered.

Cellphone data that proved crucial in the arrest of the suspect accused of planting pipe bombs on the eve of the Jan. 6 Capitol riot sat disregarded for four years, the Wall Street Journal reports, “because investigators couldn’t figure out how to read it.” That changed only recently, when a technically adept law-enforcement officer wrote custom software to decode the location data provided by T-Mobile, unlocking the trail that led to 30-year-old Brian Cole Jr. in Northern Virginia. After Dan Bongino became FBI deputy director in March and ordered a review of the case he had once declared an “inside job,” agents reexamined old material, including the dormant T-Mobile data, per the Journal.


Subject: Most Parked Domains Now Serving Malicious Content
Source: Krebs on Security
https://krebsonsecurity.com/2025/12/most-parked-domains-now-serving-malicious-content/

Direct navigation — the act of visiting a website by manually typing a domain name in a web browser — has never been riskier: A new study finds the vast majority of “parked” domains — mostly expired or dormant domain names, or common misspellings of popular websites — are now configured to redirect visitors to sites that foist scams and malware.

When Internet users try to visit expired domain names or accidentally navigate to a lookalike “typosquatting” domain, they are typically brought to a placeholder page at a domain parking company that tries to monetize the wayward traffic by displaying links to a number of third-party websites that have paid to have their links shown.

A decade ago, ending up at one of these parked domains came with a relatively small chance of being redirected to a malicious destination: In 2014, researchers found (PDF) that parked domains redirected users to malicious sites less than five percent of the time — regardless of whether the visitor clicked on any links at the parked page.

But in a series of experiments over the past few months, researchers at the security firm Infoblox say they discovered the situation is now reversed, and that malicious content is by far the norm now for parked websites.

“In large scale experiments, we found that over 90% of the time, visitors to a parked domain would be directed to illegal content, scams, scareware and anti-virus software subscriptions, or malware, as the ‘click’ was sold from the parking company to advertisers, who often resold that traffic to yet another party,” Infoblox researchers wrote in a paper published today.

[…]

This entry was posted on Tuesday 16th of December 2025 09:14 AM

David Brundson direct navigation domain parking google Google AdSense Infoblox Internet Crime Complaint Center typosquatting


Subject: Home Depot exposed access to internal systems for a year, says researcher
Source: TechCrunch
https://techcrunch.com/2025/12/12/home-depot-exposed-access-to-internal-systems-for-a-year-says-researcher/

[Via beSpacific … ] Security researcher Ben Zimmermann discovered an exposed GitHub access token belonging to a Home Depot employee that granted access to hundreds of private source code repositories, cloud infrastructure, and critical systems, including order fulfillment and inventory management, for approximately one year. Despite multiple attempts to privately disclose the issue via email and LinkedIn to Home Depot’s CISO, Zimmermann received no response until TechCrunch contacted the company, highlighting the absence of a vulnerability disclosure or bug bounty program. Home Depot revoked the token’s access following media outreach, but has not confirmed whether logging capabilities exist to determine if unauthorized parties accessed internal systems during the exposure period.

Topics


Subject: Online Shoppers Beware — Study Finds Fake Delivery Sites Exploding Ahead of Holiday Rush
Source: Cord Cutters News
https://cordcuttersnews.com/online-shoppers-beware-study-finds-fake-delivery-sites-exploding-ahead-of-holiday-rush/

Holiday shipping season is officially here, and so are the scammers. With more people shopping online, cybercriminals are finding unique ways to target personal information. A new NordVPN study shows an 86% surge in malicious postal service websites, with cyber attackers targeting shoppers who are tracking gifts, checking delivery updates, and clicking anything that looks like a carrier alert.

NordVPN explains that these scams are a form of social engineering as attackers impersonate real delivery carriers and lure victims to fake tracking or payment pages. The goal isn’t just a missing package; it’s collecting login credentials, billing or payment data, and sensitive personal info. If users provide that data, they’re not just out of the fee, they’ve helped attackers harvest credentials that can be reused in future fraud…

Why These Scams Work So Well – NordVPN warns that package-tracking messages are the perfect bait. They hit during the busiest season, when people are expecting deliveries and willing to click without thinking. The post explains what scammers also know…


Subject: How to spot videos created by artificial intelligence
Source: WESH — Orlando FL
https://www.wesh.com/article/how-to-spot-ai-videos/69690374

It is becoming easier and cheaper to make videos generated by artificial intelligence. OpenAI offers the ability through the app Sora and Google has Gemini.WESH 2 tried Sora which required the user to take a couple pictures of the person’s face and say a few words. Then you prompt the app on what kind of video you want to be in and within seconds you have something.”It’s easier, quicker and cheaper than it’s ever been to make really convincing videos. That’s not necessarily a problem if you just want to use Sora to create funny memes to share with your friends, but bad actors are able to take this technology and use it for potentially illegal and abusive purposes,” Chedraoui explained.In the case of Sora, they add visible, moving watermarks but not everyone does.Chedraoui said, “There’s no legal requirement that AI companies watermark their stuff, but it is a good ethical practice that a lot of companies have opted into. Some of them are visible, like in Sora, and some of them are invisible behind the scenes. There’s a coalition of tech companies working to sort of standardize that invisible watermark. But right now, there’s no federal mandate or law requiring that AI companies or us as users disclose when we’re sharing AI content.”

…NB *BONUS LINK* This news source also has a SPONSORED section about law from an attorney: https://www.wesh.com/article/lawchat-todd-miner/64074078


Subject: Report: The Death of Charlie Kirk Led to a New Age of Bosses Policing Social Media
Source: Gizmodo
https://gizmodo.com/report-the-death-of-charlie-kirk-led-to-a-new-age-of-bosses-policing-social-media-2000699486

Now months after the September 10 assassination of conservative activist and Turning Point USA co-founder Charlie Kirk, there’s been a sort of paradigm shift among employers emboldened to snoop on their employees’ social media activity and discipline or fire them, according to a Washington Post story by corporate culture reporter Taylor Telford.

As Telford put it: “Workers are increasingly being disciplined over posts on social or political issues that companies may view as a source of reputational risk, employment experts say, as companies tighten policies and step up surveillance of online activity.”

A human resources expert named Jim Link explained to Telford that the response from right-wing groups furious about people’s nasty Charlie Kirk posts has given way to aggressive policing behavior from bosses, and a free speech activist named Adam Goldstein of the Foundation for Individual Rights and Expression claimed that once upon a time, “the risk of your employee saying something completely nonwork-related becoming a problem for the business were just lower.”

“Now there’s more tension around the fear of how the public will react,” Goldstein told the Post.

Posted in: AI, Civil Liberties, Congress, Cybercrime, Cybersecurity, E-Commerce, E-Government, Economy, Healthcare, Privacy, Social Media, United States Law