Mir Ali Masood, PhD student at the University of Illinois Chicago, co-presents a paper titled "Unbundle-Rewrite-Rebundle: Runtime Detection and Rewriting of Privacy-Harming Code in JavaScript Bundles" at the 2024 ACM Computer and Communication Security (CCS) conference. The paper presents a tool developed by a team of researchers looking to improve web browsing privacy. Their tool unbundles code that tracks users from code used for website functionality. The team found a way to break down scripts, check each component, and fix privacy-harming or tracking code.

Researchers at the University of Texas at San Antonio (UTSA) have developed a proprietary attack named "AlphaDog" to study how hackers can exploit an oversight in Artificial Intelligence (AI) image recognition tools. AI can help people process and understand large amounts of data with precision. However, the new study points out that the modern image recognition platforms and computer vision models built into AI often overlook the "alpha channel," an essential back-end feature that controls the transparency of images.

A team of researchers has concluded that limiting public access to the underlying structures of Artificial Intelligence (AI) systems could have several consequences. They have gone into detail about the threats posed by the misuse of AI systems in areas such as disinformation, hacking, and more. The researchers assessed each risk and delved into whether there are more effective ways to combat it than restricting access to AI models.

Security researchers at Google's Threat Analysis Group recently discovered a zero-day vulnerability in Samsung's mobile processors that has been leveraged as part of an exploit chain for arbitrary code execution.  Tracked as CVE-2024-44068 (CVSS score of 8.1) and patched as part of Samsung's October 2024 set of security fixes, the issue is described as a use-after-free bug that could be abused to escalate privileges on a vulnerable Android device.

A new report by security researchers at Red Shift claims that nearly 75% of US Senate campaign websites lack Domain-based Message Authentication, Reporting, and Conformance (DMARC) protections, leaving them vulnerable to cyberattacks.  The researchers noted that there is an urgent need for campaigns to strengthen cybersecurity, especially with the critical role email communications play in coordinating with voters, donors, and staff.  DMARC is a key tool in preventing phishing and spoofing attacks by ensuring emails sent from a domain are authenticated.

Insurance company Johnson & Johnson has recently disclosed a data breach possibly impacting the personal information of thousands of people.

According to security researchers at Imperva, in the last six months, retailers experienced over half a million (569,884) AI-driven attacks per day.  These attacks originate from AI tools like ChatGPT, Claude, and Gemini, alongside specialized bots designed to scrape websites for LLM training data.  The researchers observed a range of AI-driven threats, including bots, distributed denial of service (DDoS) attacks, API violations, and business logic abuse.

Transak, a fiat-to-crypto payment gateway provider, recently reported a security incident that has impacted 92,554 of its users. According to Transak, attackers gained unauthorized access to one of their employee laptops through a sophisticated phishing attack. The firm noted that the attacker used compromised credentials to log in to the system of a third-party KYC vendor that the company uses for document scanning and verification services. The attacker then gained access to user information stored within the vendor's dashboard.

The U.S. government has recently announced a reward of up to $10 million for information about the Russian media organization Rybar and its employees amid allegations it's involved in spreading propaganda aimed at influencing the upcoming U.S. presidential election.  According to the State Department, Rybar has been accused of using its extensive social media reach, with over 1.3 million followers on various channels, to promote pro-Russian and anti-Western sentiments.

According to security researchers at Netskope, the Bumblebee malware loader could have re-emerged months after Europol-led Operation Endgame disrupted it in May 2024.  Researchers have uncovered a new infection chain that deploys Bumblebee malware.  The researchers noted that this was the first occurrence of a Bumblebee campaign since Operation Endgame, a law enforcement operation performed by Europol and partners in May 2024 that disrupted major malware botnets.