Connect with us

Technology

Subaru Security Flaws Exposed Its System for Tracking Millions of Cars

Published

on

Subaru Security Flaws Exposed Its System for Tracking Millions of Cars

Curry and Shah reported their findings to Subaru in late November, and Subaru quickly patched its Starlink security flaws. But the researchers warn that the Subaru web vulnerabilities are just the latest in a long series of similar web-based flaws they and other security researchers working with them have found that have affected well over a dozen carmakers, including Acura, Genesis, Honda, Hyundai, Infiniti, Kia, Toyota, and many others. There’s little doubt, they say, that similarly serious hackable bugs exist in other auto companies’ web tools that have yet to be discovered.

In Subaru’s case, in particular, they also point out that their discovery hints at how pervasively those with access to Subaru’s portal can track its customers’ movements, a privacy issue that will last far longer than the web vulnerabilities that exposed it. “The thing is, even though this is patched, this functionality is still going to exist for Subaru employees,” Curry says. “It’s just normal functionality that an employee can pull up a year’s worth of your location history.”

When WIRED reached out to Subaru for comment on Curry and Shah’s findings, a spokesperson responded in a statement that “after being notified by independent security researchers, [Subaru] discovered a vulnerability in its Starlink service that could potentially allow a third party to access Starlink accounts. The vulnerability was immediately closed and no customer information was ever accessed without authorization.”

The Subaru spokesperson also confirmed to WIRED that “there are employees at Subaru of America, based on their job relevancy, who can access location data.” The company offered as an example that employees have that access to share a vehicle’s location with first responders in the case when a collision is detected. “All these individuals receive proper training and are required to sign appropriate privacy, security, and NDA agreements as needed,” Subaru’s statement added. “These systems have security monitoring solutions in place which are continually evolving to meet modern cyber threats.”

Advertisement

Responding to Subaru’s example of notifying first responders about a collision, Curry notes that would hardly require a year’s worth of location history. The company didn’t respond to WIRED asking how far back it keeps customers’ location histories and makes them available to employees.

Shah and Curry’s research that led them to the discovery of Subaru’s vulnerabilities began when they found that Curry’s mother’s Starlink app connected to the domain SubaruCS.com, which they realized was an administrative domain for employees. Scouring that site for security flaws, they found that they could reset employees’ passwords simply by guessing their email address, which gave them the ability to take over any employee’s account whose email they could find. The password reset functionality did ask for answers to two security questions, but they found that those answers were checked with code that ran locally in a user’s browser, not on Subaru’s server, allowing the safeguard to be easily bypassed. “There were really multiple systemic failures that led to this,” Shah says.

The two researchers say they found the email address for a Subaru Starlink developer on LinkedIn, took over the employee’s account, and immediately found that they could use that staffer’s access to look up any Subaru owner by last name, zip code, email address, phone number, or license plate to access their Starlink configurations. In seconds, they could then reassign control of the Starlink features of that user’s vehicle, including the ability to remotely unlock the car, honk its horn, start its ignition, or locate it, as shown in the video below.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Technology

Substack is spending $20 million to court TikTokers

Published

on

TikTok ban: Sen. Markey tries to give a 270 day extension

Meta and YouTube aren’t the only platforms looking to benefit from TikTok potentially disappearing — Substack wants in on the action, too.

The company announced Thursday it’s launching a $20 million “creator accelerator fund,” promising content creators they won’t lose revenue by jumping ship to Substack. Creators in the program also get “strategic and business support” from Substack, and early access to new features.

“We established this fund because we’ve seen creators who specialize in video, audio, and text expand their audience, revenue, and influence on Substack, where the platform’s network effects amplify the quality and impact of the work they’re doing,” the company said in a blog post.

This pivot on Substack’s part has been in the works for a while — for months, the company has been marketing itself not as a newsletter delivery service but as a creator platform similar to Patreon.

Advertisement

“On Substack, [creators] can build their own home on the internet: one where creators, not platform executives or advertisers, own their work and their audience,” the blog post reads. The post also cites “bans, backlash, and policies that change with the political winds” as a reason creators can’t depend on traditional social media services.

That’s all fine (we at The Verge have been saying this for a while). But creators focusing on Substack are also subject to ebbs and flows depending on what the company is prioritizing: first, it was newsletters, then it was tweet-like micro blogs, followed by full-on websites and livestreaming. For some, Substack’s initial stated mission of giving more freedom to independent writers is fading. And TikTok creators looking to move to Substack will need to rebuild their following all over again — you obviously can’t export your TikTok followers.

The $20 million fund isn’t the first time Substack has offered a pool of money meant to entice creators. Under a program called Substack Pro, the company poached top media talent from traditional newsrooms with higher pay, health insurance, and other perks. That program ended in 2022, with Substack cofounder Hamish McKenzie saying the deals weren’t employment arrangements but “seed funding deals to remove the financial risk for a writer in starting their own business.” In other words, welcome to Substack. Now that you’re here, you’re on your own — which is more or less the deal other platforms offer.

Source link

Advertisement
Continue Reading

Technology

Anthropic’s new Citations feature aims to reduce AI errors

Published

on

Anthropic's new Citations feature aims to reduce AI errors

In an announcement perhaps timed to divert attention away from OpenAI’s Operator, Anthropic Thursday unveiled a new feature for its developer API called Citations, which lets devs “ground” answers from its Claude family of AI in source documents such as emails.

Anthropic says Citations allows its AI models to provide detailed references to “the exact sentences and passages” from docs they use to generate responses. As of Thursday afternoon, Citations is available in both Anthropic’s API and Google’s Vertex AI platform.

As Anthropic explains in a blog post with Citations, devs can add source files to have models automatically cite claims that they inferred from those files. Citations is particularly useful in document summarization, Q&A, and customer support applications, Anthropic says, where the feature can nudge models to insert source citations.

Citations isn’t available for all of Anthropic’s models — only Claude 3.5 Sonnet and Claude 3.5 Haiku. Also, the feature isn’t free. Anthropic notes that Citations may incur charges depending on the length and number of the source documents.

Advertisement

Based on Anthropic’s standard API pricing, which Citations uses, a roughly-100-page source doc would cost around $0.30 with Claude 3.5 Sonnet, or $0.08 with Claude 3.5 Haiku. That may well be worth it for devs looking to cut down on hallucinations and other AI-induced errors.

Source link

Continue Reading

Technology

New wave of sextortion scams uses personal details and images to intimidate targets while bypassing traditional security measures

Published

on

Shopping scams


  • Sextortion scams evolve with personalized tactics and heightened intimidation.
  • Threat actors exploit invoicing platforms to bypass email security filters.
  • Robust email filters and training help counter sextortion threats effectively.

Sextortion scams are becoming more complex and personal as the scams now frequently target individuals across different sectors with greater precision creating a sense of immediate threat.

Cofense Phish Defense Center (PDC) recently observed a notable evolution in sextortion scams, which unlike earlier versions, which relied primarily on generic scare tactics, now use more sophisticated strategies, often bypassing traditional security measures.

Source link

Advertisement
Continue Reading

Technology

Bill Gates’ nuclear energy startup inks new data center deal

Published

on

Bill Gates’ nuclear energy startup inks new data center deal

TerraPower, a nuclear energy startup founded by Bill Gates, struck a deal this week with one of the largest data center developers in the US to deploy advanced nuclear reactors. TerraPower and Sabey Data Centers (SDC) are working together on a plan to run existing and future facilities on nuclear energy from small reactors.

Tech companies are scrambling to determine where to get all the electricity they’ll need for energy-hungry AI data centers that are putting growing pressure on power grids. They’re increasingly turning to nuclear energy, including next-generation reactors that startups like TerraPower are developing.

“The energy sector is transforming at an unprecedented pace.”

“The energy sector is transforming at an unprecedented pace after decades of business as usual, and meaningful progress will require strategic collaboration across industries,” TerraPower President and CEO Chris Levesque said in a press release.

Advertisement

A memorandum of understanding signed by the two companies establishes a “strategic collaboration” that’ll initially look into the potential for new nuclear power plants in Texas and the Rocky Mountain region that would power SDC’s data centers.

There’s still a long road ahead before that can become a reality. The technology TerraPower and similar nuclear energy startups are developing still have to make it through regulatory hurdles and prove that they can be commercially viable.

Compared to older, larger nuclear power plants, the next generation of reactors are supposed to be smaller and easier to site. Nuclear energy is seen as an alternative to fossil fuels that are causing climate change. But it still faces opposition from some advocates concerned about the impact of uranium mining and storing radioactive waste near communities.

“I’m a big believer that nuclear energy can help us solve the climate problem, which is very, very important. There are designs that, in terms of their safety or fuel use or how they handle waste, I think, minimize those problems,” Gates told The Verge last year.

Advertisement

TerraPower’s reactor design for this collaboration, Natrium, is the only advanced technology of its kind with a construction permit application for a commercial reactor pending with the U.S. Nuclear Regulatory Commission, according to the company. The company just broke ground on a demonstration project in Wyoming last year, and expects it to come online in 2030.

Microsoft made a deal in September to help restart a retired reactor at Three Mile Island. Both Google and Amazon, meanwhile, announced plans last year to support the development of advanced reactors to power their data centers.

Source link

Advertisement
Continue Reading

Technology

Threads rolls out a post scheduler, ‘markup’ feature, and more

Published

on

Threads on App Store is seen in this illustration photo.

While Meta lures TikTok creators to Instagram and Facebook with cash bonuses, its X competitor Instagram Threads is now making things easier for creators, brands, and others who need more professional tools to manage their presence on the app. On Thursday, Instagram head Adam Mosseri announced a small handful of new features coming to Threads, including a way to schedule posts and view more metrics within Insights.

In a post on the social network, Mosseri shared that users would now be able to schedule posts on Threads and view the metrics for individual posts within the Insights dashboard which offers a way for Threads users to track trends including their views, number of followers and geographic demographics, number and type of interactions, and more, for a given time period.

In addition, he said that Threads is adding a new feature that allows users to “markup” a post they’re resharing so they include their own creative take. While Mosseri didn’t elaborate on what that means or share an example, earlier findings from tech enthusiast Chris Messina indicate that Threads will add a new icon next to the buttons for adding photos, GIFs, voice, hashtags, and more that provide access to this feature.

The squiggle icon, when clicked, takes users to a screen where they can choose between tools like a highlighter pen or arrow tool, that would allow them to draw directly on a Thread post. This feature was also spotted last week by Lindsey Gamble, who posted on Threads to show the feature in action.

Advertisement
Image Credits:screenshot from Lindey Gamble on Threads (opens in a new window)

It’s an odd sort of addition for Threads, given that users are more often sharing something clipped from the web, like a news article, where they’ve added a highlight or underline in a screenshot. There hasn’t been much consumer demand for a tool to mark up Threads’ posts directly.

However, the feature does offer Threads users something unique, when compared with social networking rivals like X, Bluesky, and Mastodon — and that could be the point.

Source link

Continue Reading

Technology

This AI tool helps content creators block unauthorized scraping and manage bot interactions

Published

on

The AI lie: how trillion-dollar hype is killing humanity


  • Cloudflare AI Audit offers analytics to track and monetize content usage
  • Creators regain control with automated tools and fair compensation
  • Cloudflare bridges creators and AI firms for balanced content use

As artificial intelligence use cases continue to evolve, there is a growing concern from website owners and content creators over the unauthorized use of their content by AI bots.

Many websites, ranging from large media corporations to small personal blogs, are being scanned by AI models without the creators’ knowledge or compensation, not only affecting businesses but also diminishing the value of online content.

Source link

Continue Reading

Technology

Perplexity now has a mobile assistant on Android

Published

on

Perplexity now has a mobile assistant on Android

Perplexity has turned its AI “answer engine” into a mobile assistant on Android. The new assistant can answer general questions and perform tasks on your behalf, such as writing an email, setting a reminder, booking dinners, and more.

It’s also multimodal, meaning you can ask it questions about what’s on your screen as well as have it open your camera and “see” what’s in front of you. In an example shared by Perplexity, a user asks the assistant to “get me a ride.” Once it learns where the user wants to go, the assistant automatically opens Uber with available rides to that destination.

I tried it out for myself, and it is kind of neat. When I asked it to “open up a good podcast,” my phone started playing the latest episode of The Joe Rogan Experience on YouTube. It worked rather quickly, even though its taste may be questionable.

Perplexity gave me the rundown on these promotional Pokémon cards.
Screenshots: The Verge
Advertisement

Using my phone’s camera, Perplexity’s assistant successfully identified the promotional Pokémon pack I got in a McDonald’s Happy Meal (don’t judge), which I found impressive since the promotion only started a couple of days ago. It also helped me write and send a text to a family member using the information in my contacts.

Alongside Samsung’s announcement of the Gemini-equipped Galaxy S25, Google revealed that its AI assistant can now complete tasks across multiple apps, as well as complete multimodal requests.

But Perplexity’s assistant doesn’t work across every app and with every feature. It’s not able to access Slack or Reddit, for example, and I also couldn’t use it to leave a comment on a YouTube video. Right now, the assistant supports Spotify, YouTube, and Uber, along with email, messaging, and clock apps, according to Perplexity spokesperson Sara Platick. “We’re continuing to add support for more apps and more functionality though, so this is just the starting point,” Platnick adds.

You can enable the assistant through the Perplexity app, which prompts you to replace your phone’s default assistant with Perplexity. From there, you can swipe up on the left corner of your screen or hold down your home button to access the assistant.

Advertisement

It’s currently not available on the iPhone, however. “If Apple gives us the right permissions, we’ll make it happen,” Platnick says.

Source link

Continue Reading

Technology

Bedrock Energy wants geothermal to make data centers cooler and offices more comfortable

Published

on

Looking up at Skyscrapers in San Francisco

Oil and gas isn’t the only source of energy lurking under our feet. Drill deep enough and the Earth’s temperature stays consistent enough that it can be a source of heating and cooling for homes, offices, and data centers.

But in many regions, geothermal wells today bottom out at around 500 feet, a limitation that is largely dictated by the sort of drilling equipment that’s typically used. 

“It’s pretty shallow, and you’re going to need two or three times the amount of space if you only go to those depths,” Joselyn Lai, co-founder and CEO of Bedrock Energy, told TechCrunch. 

To minimize geothermal’s footprint, Bedrock drills deeper.

Advertisement

“In a cooling dominant location that can very well be 800 to 1,000 feet, which is three times more space efficient. And in a heating dominant location, that can very well be 1,000 to 1,200 feet or even more, which is two times more space efficient,” Lai said.

Because it doesn’t need as much land, Bedrock has been targeting commercial buildings where land tends to be at a premium. It completed its first two installations last year, one at an office building in Austin, Texas, and another at a resort in Utah. For installations like these, Lai said that the company expects to be profitable on a project basis in the next year.

Bedrock has also started to explore applying geothermal cooling to data centers. Last fall, the startup partnered with Dominion Energy to study the space.

One of the main challenges is that data centers are one-way users of geothermal energy. Since servers generate heat 24/7, data centers would be dumping heat into the ground year round. Contrast that with other users like office buildings, which tend to cool in the summer and heat in the winter, leading to a more balanced annual energy budget.

Advertisement

Still, it’s looking promising, Lai said. What’s underground can make a difference: fast flowing ground water, for example, can cool things off more quickly. The boreholes would need to be spread out compared with other installations, raising overall costs. But Bedrock’s data analysis, developed with experience gleaned from the oil and gas sector, suggests that geothermal would be a good fit for data centers, especially when paired with solar farms, which also need large tracts of land.

“Broadly speaking, cooling with geothermal is about twice as efficient as cooling with water and air, especially at the hottest times of the day when it’s very, very humid, which is what happens in a lot of states that have data centers,” Lai said.

Geothermal’s other benefit is how consistently it uses electricity. Because the Earth’s temperature is relatively stable, the heat pumps that transfer energy to or from a geothermal reservoir don’t have to ramp up or down to compensate for changes in air temperature, as air-source heat pumps do. For large electricity users like office buildings and data centers, that can be a boon to the bottom line since utilities typically charge heavy users more when their demand spikes.

Lai said that the outlook for geothermal remains promising enough that the company continues to invest in expanding operations and research and development, focusing on automation to speed installations. To support that growth, Bedrock recently raised a $12 million Series A led by Titanium Ventures. Energy Impact Partners, and Sustainable Future Ventures with participation from Cantos, Elemental Capital, First Star Ventures, Overture Ventures, Toba Capital, and Wireframe Ventures.

Advertisement

Source link

Continue Reading

Technology

Phishing Emails in Australia Rise by 30%

Published

on

Phishing Emails in Australia Rise by 30%

The number of phishing emails received by Australians surged by 30% last year, new research by security firm Abnormal Security has found. Cybercriminals have increasingly targeted the Asia-Pacific region, partly because it is becoming a larger player in critical industries like data centres and telecoms.

For APAC as a whole, credential phishing attacks rose by 30.5% between 2023 and 2024, according to the research. New Zealand saw a 30% rise, while for Japan and Singapore, it was 37%. Out of all the types of advanced email attacks, including business email compromise and malware deployment, phishing saw the biggest increase.

“The surge in attack volume across the APAC region can likely be attributed to several factors, including the strategic significance of its countries as epicentres for trade, finance, and defence,” said Tim Bentley, Vice President of APJ at Abnormal Security said in a press release.

“This makes organisations in the region attractive targets for complex email campaigns designed to exploit economic dynamics, disrupt essential industries, and steal sensitive data.”

Advertisement

SEE: 80% of Critical National Infrastructure Companies Experienced an Email Security Breach in Last Year

Between 2023 and 2024, the median monthly rate of all advanced email attacks rose by 26.9% across all of APAC, including Australia, New Zealand, Japan, and Singapore. This encompassed a 16% increase from Q1 to Q2 2024, and a 20% increase from Q2 to Q3.

While phishing was the dominant attack type, BEC attacks — including executive impersonation and payment fraud — also grew by 6% year-over-year in APAC. According to Abnormal Security, the average cost associated with one successful BEC attack exceeded USD $137,000 in 2023.

Australia’s cyber immaturity and the AI boom are causing a perfect storm

The news that Australia is prone to cyber attack is not entirely new. A Rubrik survey from last year found that Australian organisations reported the highest rate of data breaches compared with global markets in 2023.

Advertisement

Antoine Le Tard, vice president – of Asia-Pacific and Japan at Rubrik, said at the time that Australia was a favourite target partly because the country “is a mature market and early adopter of cloud and enterprise security technologies,” and therefore may have prioritised rapid deployment over comprehensive security.

At a national level, the approach to cyber security has been a bit slow off the mark. The Australian Signals Directorate reported that only 15% of government agencies achieved the minimum level of cyber security in 2024 — a sharp decline from 25% in 2023. Such entities have also proven reluctant to adopt passkey authentication methods, stemming from cyber security maturity in the public sector and the perception that implementing it is complex.

There is also the AI factor, which is influencing the security landscape globally. The ease of access to chatbots, both regular and jailbroken for nefarious purposes, makes it faster to generate material for phishing emails and lowers the barrier to entry, as no technical knowledge is required to use them. AI-powered chatbots were named one of 2025’s top AI threats for Australian cyber professionals, for that reason.

SEE: Impacts of AI on Cyber Security Landscape

Advertisement

The number of BEC attacks detected by security firm Vipre in the second quarter of 2024 was 20% higher than the same period in 2023 — and two-fifths of them were generated by AI. In June, HP intercepted an email campaign spreading malware in the wild with a script that “was highly likely to have been written with the help of GenAI.”

Furthermore, adversaries have begun using AI chatbots to build trust with victims and ultimately scam them. The technique mimics how an enterprise may use AI to combine human-driven interaction with the AI chatbot to engage and “convert” a person.

Source link

Advertisement
Continue Reading

Technology

I’ve used an iPhone for 15 years, but Samsung Galaxy S25’s new AI briefing feature makes me want to give Android a try

Published

on

Samsung Galaxy S25 showing Now Briefing or whatever screen saying Have a good day

A day on from Samsung’s Galaxy Unpacked, I’m genuinely impressed with a Samsung event for the first time in my life. You see, I’ve been an iPhone user since 2010, when I was 15 years old, and while I write about tech for a living, the most I’ve come to using Android daily is a week or so for an experiment.

After watching Galaxy Unpacked and the unveiling of Samsung’s Galaxy S25 lineup of smartphones, I’m not only intrigued by the Android phones on offer, but I’m starting to think I should really give the South Korean tech giant’s flagship a try.

Source link

Advertisement
Continue Reading

Trending

Copyright © 2025 WordupNews