Infosec.Pub

Most free Android VPNs track users, request dangerous permissions, and connect to risky servers, privacy comes at a hidden cost. Free VPN apps are some of the most popular downloads on Android, promising privacy at no cost. But the reality is far from what they advertise. Most users tap “install” without a second thought, unaware […]

Trois acteurs majeurs du tourisme ont signalé un piratage en quelques jours. Homair, Vacancéole et Belambra ont-ils un prestataire commun, possiblement lié à Septeo/Resalys ?

C’est une bourde qui devrait rester dans les mémoires. Aujourd’hui, le code source de Claude Code, l’assistant IA de codage d’Anthropic, a fuité complètement. Chez Anthropic, on a aujourd’hui un gros problème avec les autorités américaines, qui souhaitent pouvoir utiliser militairement les outils IA Claude sans aucune restriction - ce qui pousse aujourd’hui l’entreprise à mener un combat judiciaire. Mais la liste des soucis ne s’arrête pas là pour la firme de Dario Amodei, avec aujourd'hui une fuite historique du code source de Claude Code.

Le code source de Claude Code se retrouve soudainement à l’air libre ! Il y a des fuites qui portent préjudice. Et nul doute que celle qui vient d’avoir lieu ce 31 mars va marquer. Le spécialiste de la sécurité Chaofan Shou vient en effet de découvrir l’ensemble du code de Claude Code dans un fichier source map de 60 Mo, publié par erreur sur le registre npm.

Pour rappel, un fichier source map est un fichier qui permet de retrouver un code lisible, à des fins notamment de débogage - et qui n’est pas censé être proposé au public. Évidemment, le code a très vite intéressé des nuées d’internautes, et une copie s’est retrouvée sur GitHub, où elle est déjà extrêmement populaire.

Machine learning models built to catch malware on Windows systems are typically evaluated on data that closely resembles their training set. In practice, the malware arriving on enterprise endpoints looks different, comes from different sources, and in many cases has been deliberately obfuscated to evade detection. A study from researchers at the Polytechnic of Porto tests what happens when that gap is made explicit, and the results have direct implications for organizations relying on static … More → The post Malware detectors trained on one dataset often stumble on another appeared first on Help Net Security.

A number of Baidu Inc.’s Apollo Go robotaxis suddenly stopped on the streets of China’s Wuhan city on Tuesday, leaving passengers stranded and raising concerns about the safety and reliability of autonomous driving technology.

L'un des piliers de l'écosystème JavaScript, la bibliothèque Axios, a été compromise pour diffuser un malware. En piratant le compte d'un mainteneur, des attaquants ont injecté une dépendance malveillante dans deux versions officielles, exposant serveurs et postes de travail au vol de données.

No, the sky isn't falling, but Q Day is coming, and it won't be as expensive as thought.

Cisco has suffered a cyberattack after threat actors used stolen credentials from the recent Trivy supply chain attack to breach its internal development environment and steal source code belonging to the company and its customers. [...]

Researchers say some targets correlate with cities hit by Iranian missile strikes Suspected Iran-linked threat actors are conducting password-spraying attacks against hundreds of organizations, primarily Middle Eastern municipalities, in campaigns that security researchers believe may have been aimed at supporting bomb-damage assessment following missile strikes.…

With ever increasing sizes of various programs (video games being notorious for this), the question of size optimization comes up more and more often. [Nathan Otterness] shows us how it’s …read more

When Apple discovers trending popular emojis, or when Google reports traffic at a busy restaurant, they're analyzing large datasets made up of individual people. Those people's personal information is systematically protected thanks in large part to research by Harvard computer scientists. Now, after two decades of work on the cryptography-adjacent mathematical framework known as differential privacy, researchers in the John A. Paulson School of Engineering and Applied Sciences have reached a key milestone in moving privacy best practices from academia into real-world applications.