Lowyat.NET: Latest topics in Security & Privacy

Telegram Desktop One Click Account Takeover,

JLA — Thu, 15 Oct 2026 10:42:19 +0800

It starts with an invite. Someone you do not know adds you to a Telegram group, and under Telegram’s default settings that needs no agreement from you. Sitting in that group are a few small text files, and you never open them, but they are already on your disk, because Telegram Desktop downloads files up to 8 MiB in a group on its own, the moment you look at the chat.

Then a normal looking link appears, you click it, and three files that together are your Telegram login leave your machine and land in the attacker’s group. There is no password prompt and no warning, and the second Telegram window that does the work opens and closes too fast to see.

That is the attack from end to end.

Start with what happens when you click a link that belongs to Telegram. Windows sees the tg: in front and looks for the app that registered it. Telegram did, so Telegram gets the link.

If the app is still closed, it starts up, reads the link, and handles it. One process, nothing to pass around.

If Telegram is already open, Windows does not check. It starts a second copy anyway. That second copy has to work out that it is the spare, and it does so by reaching for the first one over a local channel between the two programs on the same machine. That channel has a name, inter-process communication, or IPC.

https://hackingpassion.com/telegram-desktop...count-takeover/

Microsoft confirms every Windows PC is trackable,

JLA — Fri, 24 Jul 2026 18:58:13 +0800

Microsoft confirmed that every Windows machine has a device identifier it can give to authorities to track your behavior and, eventually, lead to arrests.

For example, the cybercriminal was a 19-year-old who arrived at Helsinki airport in April 2026, where he was trying to board a plane to Japan. Before he could board the flight, he was stopped by Finnish police, and US prosecutors later revealed he was Peter Stokes, an alleged member of the Scattered Spider hacking group responsible for an $8 million ransom. Microsoft assisted the FBI in tracing Stokes, providing the authorities with a means of tracking Stokes' Windows PC across VPNs, proxy servers, and three countries - GDID.

https://www.tweaktown.com/news/112810/micro...rest/index.html

microsoft banned wireguard,

Moogle Stiltzkin — Fri, 10 Apr 2026 15:43:43 +0800

[YOUTUBE]fTui3CQuL9I[/YOUTUBE]

if u use windows os, or some vpn that use these vpn protocols, then u r affected

i guess the fallback is openvpn? but still, why wireguard? this is an attack on encryption

no vpn does not make u invisible. because there is fingerprinting that knows what device u use, or what social media ur currently logged into but what it can do, is let you get around geo blocks.

or maybe u need to go into your network over the internet, so you setup a vpn for that purpose. so there is legit uses for vpns, even for businesses.

Axios npm package hacked,

Moogle Stiltzkin — Wed, 01 Apr 2026 17:28:23 +0800

[YOUTUBE]AT7x16mqGMc[/YOUTUBE]

QUOTE

In late March and early April 2026, the Axios npm package was the victim of a high-impact supply chain attack, while the npm registry itself was not "hacked" in the traditional sense. Instead, an attacker gained control of a lead maintainer's account to publish malicious versions of the library.

QUOTE

Safe versions: Anything 1.14.0 or lower, or 0.30.3 or lower.

Malicious versions: 1.14.1 or 0.30.4

in my case, i don't have npm container running, but it does auto update image.....

QUOTE

If a Docker image containing the malicious Axios versions (1.14.1 or 0.30.4) was downloaded but never run as a container, you are likely safe from the Remote Access Trojan (RAT) that triggers during the package's execution. However, the presence of the image on your system is a significant risk that must be addressed immediately to prevent accidental activation.

Why You Are Likely Safe (For Now)

Execution-Based Trigger: The 2026 npm hack involving Axios relies on a postinstall script in the plain-crypto-js@4.2.1 dependency. This script only runs when npm install is executed—typically during a docker build or when a container starts if it's configured to install dependencies at runtime.
Dormant Threat: If the image was pulled (downloaded) rather than built locally, and the container was never started, the malicious code remains dormant as a static file in your Docker storage.

Immediate Actions to Take
Even if the container hasn't run, you must sanitize your environment to ensure no one accidentally deploys it.

using truenas

so what i did was, go to truenas shell...

CODE

Grep Search: If you have a long list of images, you can search for a specific ID:

summary

CODE

Find the Container ID:
docker ps -a | grep <IMAGE_ID_OR_NAME>

Remove the Container:
docker rm <CONTAINER_ID>

Now Delete the Image:
docker rmi <IMAGE_ID>

because i use dockge, i just click stop, inactivate. this releases it.

then i can do the

CODE

docker rmi -f <IMAGE_ID>

then

CODE

docker image prune -a

This removes all images that are not currently associated with a running container.

for safest,

Option 3: Nuclear Cleanup (Best for Security)
Since you are dealing with a potential npm hack, it is safer to wipe all stopped containers and unused images at once:

CODE

docker system prune -a

(This will ask for confirmation and then delete all stopped containers and all images not currently running.)

lastly, for my docker compose, since i use watch towerr for auto updates, just add this to stop watch towerr from auto updating npm.

3. Use Environment Variables (Docker Compose)
If you use Docker Compose, add this environment variable to your Watchtower service to stop all automatic updates globally:
yaml

CODE

services:
watchtower:
image: containrrr/watchtower
volumes:
- /var/run/docker.sock:/var/run/docker.sock
environment:
- WATCHTOWER_MONITOR_ONLY=true

can remove later once this issues dies down (or not). Or set watchtowerr to not update daily, and defer updates to every 2-3 weeks to avoid a situation like this the next time.

if you are a homelabber and u use npm for your docker container, take action NOW if you haven't already

In my situation, i didn't have the container actively running, so dodged a bullet narrowly. but it did make me rethink the auto update for npm that has been targeted more than once. so either a longer deferred update, or not auto update might be in order

Also this is another reminder, WHY, you need to pay close attention to how you deploy your docker containers. so it's not running as root. so create a docker user, then use that for docker containers for deployment. hopefully that will limit any issues.

[YOUTUBE]RxxYESQ7rW0[/YOUTUBE]

android removing ability to install apk?,

Moogle Stiltzkin — Tue, 10 Mar 2026 08:29:27 +0800

[YOUTUBE]Qfo6xdVMFmM[/YOUTUBE]

install apk aka sideload (i call this installing.....) seems like google will be removing the ability to install apks manually if i am not mistaken? watch the youtube.

that is crazy if true. then what is the point of going android if you can't do that? may as well go ios (which was one of the main reasons people went android to begin with).

so why is this bad?

ok, imagine u have a project on github to install an apk. Sounds like you may not be able to use something like obtainium to install an apk from your favourite android app project. cause they are removing the ability to do so

i hope i am misunderstanding, but i dont think i am. watch the youtube.

if u r an android user, you should be very concerned. not all good apps are on googleplay. this is anti competition by forcing people to be locked into googleplay ecosystem.

MY Internet Ads Are Hacking Your Phone Now,

Moogle Stiltzkin — Sat, 07 Mar 2026 09:20:40 +0800

[YOUTUBE]lnaZ6bRyTF8[/YOUTUBE]

malvertising was always a thing... where ads load up, and u get malware. they said ads are harmless and needed to keep sites up, but at user expense.

use adblockers. pfsense blocker at router better.

QUOTE

Yes, pfBlockerNG is a powerful tool for network-wide ad blocking on the pfSense firewall. It functions by preventing your devices from connecting to known ad-serving domains and IP addresses.

How it Blocks Ads

DNSBL (DNS Blackhole List): This feature intercepts DNS requests for ad-serving domains. If a device on your network tries to load an ad from a domain on a blocklist, pfBlockerNG prevents the connection.

IP Filtering: It can block entire ranges of IP addresses associated with malicious activity, trackers, or specific geographical regions (GeoIP).

Feeds and Lists: You can subscribe to popular, community-maintained blocklists like EasyList or The Firebog to keep your protections up to date.

Key Limitations

Encrypted Traffic (DoH/DoT): Some modern devices and browsers use DNS over HTTPS (DoH) to bypass local DNS filters. You may need to manually block known DoH servers within pfBlockerNG to ensure its effectiveness.

Same-Domain Ads (YouTube/Hulu): pfBlockerNG struggle to block ads served from the same domain as the content (e.g., YouTube video ads), as blocking the ad would also block the video itself.

Visual Layout: Unlike browser-based extensions (e.g., uBlock Origin), pfBlockerNG cannot "hide" the empty space left behind by a blocked ad; it simply prevents the content from loading.

For the most comprehensive protection, many users combine pfBlockerNG with a browser-based extension for a "layered" approach.

or router where you can use an ad filter list.

also if possible, use ublock origin on firefox for browser.

QUOTE

Yes, uBlock Origin prevents ads from being downloaded to your hard drive.

Unlike "cosmetic" blockers that merely hide an ad once it arrives, uBlock Origin is a network request blocker. It intercepts and cancels the request for an ad before it leaves your browser, meaning the ad data never reaches your network or your computer's storage.

How it Protects Your Storage

Network Request Blocking: When a website tries to fetch an ad, tracker, or malware from a remote server, uBlock Origin identifies that server on its blocklists and "nips the request in the bud". This saves both bandwidth and disk space.

Preventing Local Caching: Because the ad content (images, video files, scripts) is never downloaded, it cannot be stored in your browser's temporary cache files on your hard drive.

Efficiency: It is designed to be lightweight, using less CPU and memory than other blockers while preventing the accumulation of "junk" data from advertising scripts.

Important Distinction

While uBlock Origin stops the ad data from being written to your disk, the extension itself and its filter lists do occupy a small amount of space on your hard drive to function. However, this is negligible compared to the amount of data saved by blocking video ads and heavy tracking scripts over time.

some good filterlists are like Hagezi ultimate. this is more than enough for most things

for ads on youtube on android, you may need to use something like newpipepipe where the ads wont load at all but you can still use youtube.

Which Malaysia website support PASSKEY login?,

Skylinestar — Tue, 03 Mar 2026 17:11:13 +0800

I can only think of AirAsia

7zip Malware: Beware 7zip.com,

Moogle Stiltzkin — Sat, 14 Feb 2026 06:32:34 +0800

[YOUTUBE]bpLxXH37Hs8[/YOUTUBE]

So how do you know whats the actual og site?

well, you can go to wikipedia and search for the app, then there is the actual site linked there.

And once you know the actual site, go there then ADD a bookmark star e.g. firefox. So whenever u visit the sites you verified, it would have that star to indicate it's bookmarked. meaning at a glimpse you can check if it's bookmarked, then you know you are at the correct site. If you don't see it, be on your toes as you may have simply googled then it brought you to a fake site due to careless web browsing

also in google search, the other trick is the search results at top usually will be shown as a google ad, and that usually points to some malware site which uses the same name as the app site. google doesn't seem to care about that apparently so just because something appears at the very top don't be too trusting. check if it's an advert firstly, because that is the most sus.

Or what i would suggest instead for installing apps, is to use unigetui which can download apps using winget
https://github.com/marticliment/UniGetUI

QUOTE

How Signature & Integrity Checking Works

Because UniGetUI is a "manager of managers," it inherits the security protocols of whichever tool is actually downloading the software:

WinGet (Microsoft): Primarily uses SHA256 hash validation. When a package is submitted, Microsoft runs automated scans (including SmartScreen and static analysis) to ensure the file's hash matches the one in the verified manifest. While WinGet does not strictly require every package to be digitally signed by the developer, it validates that the file has not been tampered with since its official review.

Chocolatey: Uses checksums (hashes) to verify that the installer you download is exactly what was intended. It does not mandate digital signatures for all packages but relies on maintainers to provide correct hashes.

UniGetUI Internal Integrity: Recent updates (version 3.3.1+) added self-healing mechanisms. If UniGetUI’s own executable files are corrupted or show integrity violations, the app will prompt you to reinstall itself to ensure its own safety.

Security Caveats

Third-Party Risk: UniGetUI, Microsoft, and Scoop do not host the software themselves; they provide the scripts to download them from third parties. Theoretically, if a third-party server is compromised, a package could be at risk if the hash isn't updated accordingly.

Official Signature Check: The UniGetUI tool itself is digitally signed by its developer (Martí Climent). You can verify this by right-clicking the installer and checking the Digital Signatures tab to ensure it is authentic.

Summary: UniGetUI uses checksum/hash verification via its package managers to ensure you get the correct, untampered file, but it doesn't always mandate a "digital signature" from the software publisher unless that specific package manager requires it.

So rather than go to the app site, just use unigetui, download via the winget (or the other options). That seems to be safest. It also makes updating apps easier as well. Because it will notify you on updates, and with few clicks you can immediately update all your apps on windows.

well you could always go direct to the app site as long as you properly verified it's the actual one. but updating for so many apps can be annoying since you have to do this for ALL the apps you installed. this is why i use unigetui it makes things much easier, and safer while at it.

[YOUTUBE]_tLDcyMWWmQ[/YOUTUBE]

And just another reminder, even if you regularly update, doesn't always mean you are safe. take the notepad++ issue i recently posted here
https://forum.lowyat.net/topic/5554168

in that scenario, the app update mechanism was hacked into and went undetected for 6 months or so. so people who updated thinking they were safe, were not necessarily so. welcome to the insane world of the internet in 2026 if you use the internet you have to be on-guard and read the tech news regularly least you realize too late that something is wrong.

popular notepad++ got hacked for 6months,

Moogle Stiltzkin — Tue, 03 Feb 2026 08:59:51 +0800

[YOUTUBE]uz3s401d42E[/YOUTUBE]

https://arstechnica.com/security/2026/02/no...ly-chain-attack

so the popular notepad++ got hacked for 6 months. so if you use this app, you may want to do something about it.

the dev said, update directly from the website using the latest version.

other things you may want to do is kaspersky removal tool, scan. malwarebytes, scan. windows defender offline scan.

in the most extreme, a clean reinstall of windows 11 (the nuclear option. why? rather than finding a needle in a hay stack, just nuke it all. then you can be sure it's fixed)

do you really need to go that far? it's up to you. just know that notepad++ got compromised.

usually the signs of a compromised system

- system feels sluggish even when not doing much
- high cpu usage? when not doing much
- lots of network traffic
- and other signs

Sh0pee i am not a robot,

JLA — Thu, 01 Jan 2026 07:31:39 +0800

IF shopee AI abuse security protection system keep showing up anti robot, that is u web browser behaviour are like a robot

Until it give up

and just blocked you

problem solve

ha ha ha

vpn
randomised mac address
privacy web browser
blocked tracker ads
IPv6 EUI-64 (Extended Unique Identifier)

You can't fully sign out Outlook email,

Skylinestar — Fri, 12 Dec 2025 08:15:21 +0800

UPDATE:
Day6 - still receive new mail notification

==========

TLDR:
1. hacker got your email login info & signed into his/her device.
2. you change password and sign out everywhere.
3. hacker still receives your emails, including new ones.

I just found out this Microsoft Outlook email security risk. you can't fully "sign out everywhere else". if someone have signed in your email on his/her devices, you are basically phucked forever.

this is how you can test/reproduce:

1. install outlook app on your phone (I'm on Android) and sign in. mail is now downloaded into the phone.

2. open web browser, go to outlook website, sign in.

3. in outlook web, go to your security settings and "sign out everywhere".

4. wait for 24 hours (that's what Ms said). I've tried checking new emails in the mobile app within 6 hours and everything still works like normal (not being signed out yet ).

5. after 24 hours, check outlook app again. it will tell you to sign in (this is actually false hope by Ms). of course, you can still view previously cached email. I wonder how many mails are downloaded by default.

6. on the outlook web, send a mail to yourself.

7. outlook app (despite already "signed out") will receive this new mail, and you get notification popup. this popup shows the sender name, the email title, and the content. this is the phuck up part.

many websites login send a 2FA code to email. some have titles like "Use code 123456 for website XX". this is just plain stupid.

is there any sysadmin or email expert here who can confirm when will the outlook app fully disconnect from the server (therefore stop receiving new email)?

inb4 use 2FA TOTP via authenticator app but that is different discussion.
inb4 old story but never fixed:
https://learn.microsoft.com/en-us/answers/q...tions-despite-s

Privacy connections manager,

JLA — Thu, 15 May 2025 14:30:02 +0800

random mac address
ipv6 EU164

private dns
https://dnscheck.tools/

New PC Cannot Open Certain Websites, Websites

tkyong1 — Thu, 21 Nov 2024 08:28:01 +0800

Hi guys,

I have just bought a new PC, I have tried Edge and Chrome, I could not open certain webistes (such as crypto exchange, movie site, japan av site). I can open all of these in my old PC no issue.

May I know what would be the problem? Security Setting?

Any solution?

The error message = hmmm......can't reach this page

Enable Password-less for your Windows Account ASAP,

1024kbps — Sun, 15 Sep 2024 01:12:45 +0800

Just checked my mail and received ransom attempt to expose me,
wanted me to pay 1700 USD in lite coin lol...

then i got curious and checked my account login attempt, welp, they tried to bruteforce login
just dont be lazy and enable password -less sign in now,

Best VPN For Streaming, Security and Privacy

MattSally — Sun, 28 Apr 2024 19:47:53 +0800

I am looking to subscribe to a decent VPN. I have used a couple of free VPNs but they throttle the speed so much that I can’t stream. Nord VPN and Express have been recommended to me but I can’t get their sign up processes to work for me. I keep getting error messages. Can anyone recommend a good, reliable VPN that is good for streaming please?

if u buying sercurity app and dont wanna use card,

Kravo — Mon, 02 Oct 2023 15:57:42 +0800

when my bitdefender sub is about end soon, i looking for new security software and definitely not that shit.

initially decided on getting fsecure, but online payment keep failed, call bank tell me card security code fail, which i verify is not.

at the end, bought eset, no need using card, online bank transfer, no need worry fucking auto-renewal.

New hacking forum leaks data of 478,000, RaidForums members

daisiesdontdoit92 — Wed, 31 May 2023 10:13:14 +0800

QUOTE

A database for the notorious RaidForums hacking forums has been leaked online, allowing threat actors and security researchers insight into the people who frequented the forum.

RaidForums was a very popular and notorious hacking and data leak forum known for hosting, leaking, and selling data stolen from breached organizations.

Threat actors who frequented the forum would hack into websites or access exposed database servers to steal customer information. The threat actors then attempted to sell the data to other threat actors, who use it for their campaigns, such as phishing attacks, cryptocurrency scams, or distributing malware.

In many cases, if data was not sold or some time had passed, the stolen data would be leaked for free on RaidForums to gain a reputation among the community.

In April 2022, the RaidForums website and infrastructure were seized in an international law enforcement operation, with the site's administrator, Omnipotent, and two accomplices arrested.

After Raidforums closed, users flocked to a new forum called Breached to continue trading stolen databases. However, Breached shut down in March 2023 after its founder and owner, Pompompurin, was arrested by the FBI, and the site's other admin became concerned that law enforcement had access to their servers.

RaidForums database leaked online

Earlier this month, a forum called 'Exposed' was launched, aiming to fill the void left behind by the closure of Breached, and it has quickly become popular.

Today, one of the site's admins, 'Impotent,' leaked the RaidForums member database, exposing a wealth of information to other threat actors, researchers, and, potentially, law enforcement.

BleepingComputer has seen the leaked data, and it consists of a single SQL file for the 'mybb_users' table used by RaidForums' forum software to store registration information.

This table contains the registration information for 478,870 RaidForums members, including their usernames, email addresses, hashed passwords, registration dates, and a variety of other information related to the forum software.

The leaked table contains member information for users who registered between March 20th, 2015, and September 24th, 2020, likely when the database was dumped.

Impotent says that some RaidForums members have been removed from the database and that it is unknown when and why the dump was originally created.

BleepingComputer has confirmed that the information for numerous accounts in the database contain known registration information. Additionally, members of the Exposed forum have also confirmed that their information is in the MySQL table, indicating that the leaked table is legitimate.

While it's likely that the database is already in the hands of law enforcement after the forum was seized, this data could still be useful for security researchers who commonly build profiles of threat actors.

Using the leaked registration information, researchers can learn more about the threat actors and potentially link them to other malicious activities.

Update 5/30/23: Exposed's admin, Impotent, told BleepingComputer that the RaidForums data dump was originally not meant to be public, but they decided to leak it yesterday.

However, while the admin states they know where the data came from, they promised not to disclose any details about the source.

Impotent says the member database table still contains 99% of the original lines, with some removed to "cause no drama."

https://www.bleepingcomputer.com/news/secur...forums-members/

Sirius XM flaw could’ve let hackers, remotely unlock and start cars

daisiesdontdoit92 — Thu, 08 Dec 2022 06:22:03 +0800

QUOTE

A vulnerability affecting Sirius XM’s connected vehicle services could’ve let hackers remotely start, unlock, locate, flash the lights, and honk the horn on cars. Sam Curry, a security engineer at Yuga Labs, worked with a group of security researchers to discover the flaw and outlined their findings in a thread on Twitter.

In addition to providing a satellite radio subscription, Sirius XM also powers the telematics and infotainment systems used by a number of auto manufacturers, including Acura, BMW, Honda, Infiniti, Jaguar, Land Rover, Lexus, Nissan, Subaru, and Toyota. These systems collect a whole lot of information about your car that’s easy to overlook — and could pose potential privacy implications. Last year, a report from Vice called attention to a spy firm, called Ulysses, which collected and planned to sell over 15 billion telematics-based car locations to the US government.

While telematics systems obtain data about your car’s GPS location, speed, turn-by-turn navigation, and maintenance requirements, certain infotainment setups might track call logs, voice commands, text messages, and more. All of this data allows vehicles to provide “smart” features, like automatic crash detection, remote engine start, stolen vehicle alerts, navigation, and the ability to remotely lock or unlock your car. Sirius XM offers all these features and more, and says over 12 million vehicles on the road use its connected vehicle systems.

However, as Curry demonstrates, bad actors can take advantage of this system if the proper safeguards aren’t in place. In a statement to Gizmodo, Curry says Sirius XM “built infrastructure around the sending/receiving of this data and allowed customers to authenticate to it using some form of mobile app,” like MyHonda or Nissan Connected. Users can log into their accounts on these apps, which are linked to their vehicle’s VIN number, to execute commands and obtain information about their cars.

It’s this system that could give bad actors access to someone’s car, Curry explains, as Sirius XM uses the VIN number linked with a person’s account to relay information and commands between the app and its servers. By creating an HTTP request to fetch a user’s profile with the VIN, Curry says he was able to obtain the vehicle owner’s name, phone number, address, and car details. He then tried executing commands using the VIN and discovered that he could remotely control the vehicle, allowing him to lock or unlock it, start the car, and perform other functions.

Curry says he alerted Sirius XM of the flaw and that the company quickly patched it. In a statement to The Verge, company spokesperson Lynnsey Ross said the vulnerability “was resolved within 24 hours after the report was submitted,” adding that “at no point was any subscriber or other data compromised nor was any unauthorized account modified using this method.”

Separately, Curry uncovered another flaw within the MyHyundai and MyGenesis apps that could also potentially let hackers remotely hijack a vehicle, but says he worked with the automaker to fix the issue. In a statement shared with The Verge by Hyundai spokesperson Ira Gabriel, the company confirmed that “Hyundai worked diligently with third-party consultants to investigate the purported vulnerability as soon as the researchers brought it to our attention.” It also notes that “no customer vehicles or accounts — for either Hyundai or Genesis — were accessed by others as a result of the issues raised by the researchers,” and makes it clear that its vehicles weren’t affected by the Sirius XM vulnerability.

White hat hackers have found similar exploits in the past. In 2015, a security researcher uncovered an OnStar hack that could’ve let bad actors locate a vehicle remotely, unlock its doors, or start the car. Around the same time, a report from Wired showed how a Jeep Cherokee could be remotely hacked and controlled with someone at the wheel.

https://www.theverge.com/2022/12/3/23491259...lock-start-cars

Beijing people’s facial recognition was broken, Taiwan hackers stole 1.9 million deposit

FlierMate1 — Tue, 19 Jul 2022 19:14:26 +0800

Source: https://taiwan.postsen.com/world/10810/Beij...ology-News.html (and several other multiple sources)

QUOTE

If the face recognition system can be unlocked with photos, it may indicate a huge hidden worry in the current situation where cameras are all over the place.

Face recognition technology is widely used by the Bank of China, and various drawbacks have emerged. The facial recognition of some people in Beijing was breached, and nearly 430,000 RMB (about NT$1.892 million) was withdrawn from the bank account, but the IP of the registrant was displayed in Taiwan.

The latest report from China News Weekly describes what happened to Li Hong (pseudonym). The incident happened on June 19. She fell into the trap of fraudsters, her mobile phone text messages were intercepted, and her mobile phone number was set to call forwarding, so that her verification code fell into the hands of others, and she was unable to answer the bank’s confirmation call.

More seriously, her “face recognition” was broken. The backstage of the China Bank of Communications system shows that when resetting the password and transferring large amounts of money, “Li Hong” performed 6 face recognition comparisons, all of which showed “successful biopsy”.

But in fact, these face recognitions were not operated by Li Hong who was in Beijing. After investigation by the police, the IP address of the registrant was displayed in Taiwan, and the mobile phone model used was Motorola XT1686, which was also different from the Xiaomi Mi 8 used by Li Hong.

» Click to show Spoiler - click again to hide... «

Li Hong doubted the security of the Bank of Communications’ facial recognition system, and took the Bank of Communications to court on the grounds of a “debit card dispute”, demanding compensation. However, on June 30 this year, the Fengtai District People’s Court in Beijing rejected all Li Hong’s claims in the first instance. She is going to continue to appeal.

Banks believe that they have done their due diligence. Bank of Communications Beijing Changxindian Branch stated in court that “transaction passwords, dynamic passwords and customer authentication modes that assist face recognition” meet regulatory requirements, and they are in the process of Li Hong’s transfer. , the bank gave her a risk warning. After the big data analysis of the internal system found an abnormality, it called Li Hong’s mobile phone to verify the identity of the transferor and the transfer situation.

But Li Hong said that the bank claimed to have sent 22 SMS passwords and SMS risk alerts, but she only received 11 of them, and she did not receive the bank’s call. The reason behind this is that her text messages were intercepted by the scammers, and the calls were also transferred to the scammers’ mobile phones.

The report quoted Lao Dongyan, an expert who has long been concerned about personal information protection and a professor at the Law School of Tsinghua University in Beijing, who pointed out, “Facial recognition was introduced by banks as a participant in risk creation, and banks benefit more from this method. , should bear the risk responsibility proportional to the benefit it receives.”

She also pointed out that with the development of artificial intelligence, fraudulent methods are more high-tech, and banks should keep pace with the times so that their security technology exceeds that of criminal methods. If banks are held accountable for vulnerabilities in facial recognition technology, it will help urge banks to plug technical security loopholes and prevent possible fraud.

The report also pointed out that the difficulty of cracking facial recognition technology is sometimes unexpectedly simple. In 2019, several primary school students in Zhejiang used photos to crack the express cabinets in residential areas and easily take other people’s express delivery. In October 2021, a team of students from Tsinghua University successfully unlocked 20 mobile phones using only face photos.

Guo Bing, an associate professor at the School of Law and Politics of Zhejiang Sci-Tech University, believes that “photos of human faces are too easy to obtain.” If the face recognition system can be unlocked with photos, it may indicate a huge hidden worry in the current situation where cameras are all over the place.

QNAP Deadbolt, QNAP Deadbolt

Vanessatan97 — Fri, 15 Jul 2022 12:56:40 +0800

Hi , My company QNAP got deadbolt. May i know if paying the ransom 0.05 bitcoin will help us to retrieve back all the files? or is there any ways to solve the issue? thank you