Last week, thousands of SamKnows routers were bricked after a government program ran its course.

In 2020, as part of a program conducted by the Australian Competition & Consumer Commission (ACCC), the Australian government’s chief competition regulator, thousands of volunteers received routers to help test and report on the typical speed and performance of broadband plans in Australia. (More specifically, the Measuring Broadband Australia (MBA) program targeted fixed-line broadband services provided over the NBN, Australia’s government-owned wholesale open-access broadband network, as well as services delivered over other access networks.)

According to the final report that the ACCC distributed, the routers are whiteboxes that were “supplied by SamKnows” and that “perform tests to measure internet performance using test servers maintained by SamKnows and hosted in Australia.”

Last month, the program concluded, and the ACCC released its final performance report (PDF). Subsequently, the routers used for the program were bricked after June 30.

Ars Technica reviewed a copy of an email that an MBA volunteer received in mid-June informing them that the program would end on June 30, 2026 and further stating:

Service Termination: Your whitebox will be disabled, and your SamKnows One account will be closed.

The email, signed by “The SamKnows Team (part of Cisco),” noted that after June 30, the devices would stop collecting data and that users’ “measurement and registration data will be deleted in accordance with our retention obligations under our end-user license agreement.”

However, as one MBA volunteer pointed out to Ars via email, the routers are still working, making the decision to disable the devices an avoidable e-waste risk.

When asked by Ars, the ACCC didn’t specify the number of SamKnows routers disabled last month. However, in a report about the MBA program released in December 2020 (PDF), the ACCC said it initially expected to release about 4,000 whiteboxes throughout the program’s duration and had distributed “over 2,600″ by December 2020. The report noted that the ACCC retained an “adequate pool of whiteboxes to allow for the expansion of our reporting to cover, for example, emerging [retail service providers] and new speed tier plans.”

Security

If people think you are doing a legitimate job, you can get away with anything

PWNED Welcome, once again, to PWNED, where each week we share the saga of an organization that couldn’t get out of its own way when it comes to security.

This week’s tale comes courtesy of Dahvid Schloss, a professional red teamer who was also involved (as a supervisor) in last week’s story about hackers shoveling snow in order to gain access to restricted areas. This time, it was Schloss himself who broke in, and he used the promise of better connectivity to do it.

On one assignment, Schloss was asked to test the physical and network security of a company that was near the top of the Fortune 500 and had a reputation for sponsoring and providing the trophy for an international sporting competition. According to him, there were three copies made of the trophy: one for the winner, one for the host nation itself, and one for the sponsor.

When Schloss was conducting his audit, the location he visited was undergoing construction, creating problems with the office Wi-Fi that all the employees noticed and hated. So when Schloss and his team invaded the place and started probing the wireless network, no one questioned them.

“So, you got three of us that are kind of walking through this campus with antennas sticking out of our laptops. We were not being secretive at all, but we figured this is California and there’s plenty of tech bros and nerds everywhere so antennas sticking out of a computer is not going to scare people,” Schloss said. “But everyone kept coming up to us – not to ask us if we were supposed to be there, but to ask us if we were going to fix the Wi-Fi.”

After wandering the building, Schloss and his team came to the marketing department where one of the trophies, which he estimates was worth at least $250,000 (or, perhaps, priceless as there are only three), was sitting in a case. Knowing that his job was to test overall security and not just network security, he opened up the case and proceeded to remove the trophy.

Someone from the marketing department saw Schloss pulling the trophy out of the case and talked to him while he was doing it. Their question: “Are you here to fix the Wi-Fi?” When he answered “yes,” the marketing people ignored him as he slipped the trophy into his backpack.

He took the trophy out of the building and held onto it for two and a half weeks, with no one saying anything about it. However, when it came time for him to give a presentation to the company executives, he brought the prize with him.

“We walked to the boardroom and the first thing I do in this boardroom is I pull out the trophy and I put it on the table,” Schloss told us. “And all these executives are sitting around there as we’re about to give this security report on where the maturity is at and that was like enough said, right? You could see the eyes just popping open.”

What we can learn from this story is that employees tend to trust people in the workplace, even outside contractors. If they think that someone belongs in the building, they won’t question that person’s motives, even if they see them doing wrong.

I’m reminded of a situation that took place at a job I was working at many years ago. It was around 6 pm and most people had left the office, but the cleaning lady was there sweeping up when I heard a commotion coming from my coworker’s cubicle. My colleague, who had been at the gym and left her wallet at her desk, returned to find the cleaner taking cash out of her wallet. 

At first I didn’t believe it and thought there must be a misunderstanding because the cleaning lady, unlike Schloss’ set of fake Wi-Fi repairmen, was legitimately supposed to be working that night. However, my coworker caught her red-handed and she later admitted stealing the money. 

So train your staff to question everyone, especially strangers who look like they belong in the building. ®

Japanese telecommunications giant KDDI revealed that millions of people had their email addresses and passwords exposed after attackers breached an email platform used by five internet service providers (ISPs) in the country.

KDDI is the second-largest mobile telecommunications provider in Japan, with 45,000 employees and annual revenue of $32.4 billion.

The company disclosed last month that it blocked the attackers’ access and implemented defensive measures after discovering the incident on June 17, and revealed that the breach impacted the STNet, JCOM, Chubu Telecommunications C, NIFTY Corporation, and BIGLOBE ISP operators.

KDDI added that the incident may have exposed the email addresses and passwords of up to 14,22 million current and former customers, as well as those belonging to inactive accounts. It also noted that some passwords were stored in hashed and/or encrypted form (making them harder to use for account hijacking), but did not specify how many accounts had passwords stored in plaintext or what type of encryption was used.

In a July 6 update, KDDI revealed that the attackers breached the platform on May 16 after exploiting a zero-day vulnerability in a third-party software.

“As a result of our investigation, as of June 17, 2026, the date of our confirmation, this vulnerability was not recognized by the software vendor,” KDDI said. “The software vendor has reported this vulnerability to public authorities and is working toward disclosing the information.”

Over 12 million email addresses exposed

The telecom giant is now working to secure affected email accounts after attackers gained access to the email addresses of 12,233,087 people and the passwords of 7,616,173 others.

“We are currently working to change the passwords of affected customers’ email accounts. To date, many customers, primarily those who regularly use email services, have already changed their passwords,” it said.

“In addition, to ensure the security of customers who do not frequently use email services, we are working to have ISP providers complete mandatory password changes within one or two days.”

Since the attack, KDDI has also deployed Endpoint Detection and Response (EDR) software to help detect future breach attempts and said that, on June 23, a forensic audit confirmed that the exploited vulnerability had been addressed and that the systems aren’t affected by other security issues.

KDDI also notified Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications after discovering the breach, and is currently working with affected ISPs to implement security measures to mitigate the risks arising from this exposure.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

from the you-own-nothing dept

Sony just gave the world another lesson in how they don’t actually own the content they’ve bought digitally generally, and particularly not through Sony’s digital storefronts. Instead, as readers here will largely know, what is actually being bought is a temporary license to download and play these games, movies, music, whatever. Sony has done this sort of thing before, disappearing bought items from people’s accounts when licensing agreements expire. Many are surprised to find their shit gone.

This doesn’t happen when you buy physical media, typically, unless it relies on backend servers to operate. But for movies on disc, books on pulp, music on physical media, and physical games this generally isn’t a concern.

But what if a major gaming console maker announced it simply isn’t going to support physical media any longer? Well, that’s precisely what Sony’s PlayStation just did.

Some gamers are concerned about the future of game ownership after Sony’s announcement today that it won’t produce physical discs for PlayStation games as of January 2028. On that date, “new games will be available on PlayStation Store and at retailers in digital formats only,” Sony said in a blog post.

Ditching discs is “a natural direction” for Sony “to adapt to consumer trends as the general preference for digital media significantly outpaces physical discs,” the post said.

Advertisement

Now, for some numbers to chew on. The reality is that nearly 80% of PlayStation games are bought digitally these days. This is pretty much a perfect example of companies following the 80/20 rule, where you plan and account for 80% of the reality you face and de-prioritize the 20% of the outliers. If you left it there, this plan might make some sense.

But in this case, that 20% of the market is both a sizable chunk of revenue and almost certainly made up in no small amount of people who will not move to digital purchases instead. There is a very passionate, vocal community who believes in ownership rights that you can’t get currently with digital purchases, or who believes in video game preservation efforts that can’t exist at the pleasure of gaming companies that haven’t shown a ton of interest in the topic.

If you needed proof of that, the backlash online to Sony’s announcement has been ferocious.

For example, the official Sony account on Twitter posted a simple tweet teasing the upcoming release of the next Spider-Man movie with a single spider emoji. Normally, this account gets a few hundred replies at most, but the Spider-Man tweet now has over 3,000 replies, and most of them are from people yelling at Sony for killing PlayStation game discs.

Similarly, over on the official PlayStation Instagram account where most posts get around 200 to 300 replies, the most recent video shared by the company has amassed over 2,000 comments. And once again, most of them are very angry about PlayStation abandoning physical media, begging the company to reconsider, or threatening to boycott future Sony products and games if it doesn’t.

Advertisement

The most recent video on the PlayStation YouTube account, a trailer for a World of Tanks update, has over 300 comments, most of them yelling at Sony over the news. Usually these videos, outside of the biggest trailers, get less than 50 comments.

This has been going on for a week. Somewhat amazingly, Sony has been running with a typical playbook of ignoring the backlash entirely and waiting for it to just go away. The PlayStation ExTwitter account went fully silent for nearly a week after the news broke, which is one more giant middle finger to its own customer base. At the time of this writing, July 7th, the account finally posted again… to pitch a new wireless flight stick. The reaction to that was, well…

In less than an hour, Sony’s fight stick video received over 12,000 negative comments and nearly 4,000 angry quote-tweets. If there is anyone in there defending the company’s move to all-digital, I couldn’t find it. “As was evident, PlayStation has followed the strategy of acting as if nothing had happened,” one fan wrote. “They think we’re going to forget it easily, but we can’t allow that. They’re trying to kill physical games with lies and using us players as an excuse. It’s shameful.”

The level of tone-deaf going on at Sony over all this is fairly astounding. There is no support for ending all physical media on PlayStation consoles. None whatsoever that I can find. There is either silence or hatred.

For ownership rights, for preservation efforts, for collectors, and for many others, this may be a “Give me physical media or fuck all the way off” type scenario. We’ll now have to wait and see if Sony bothers to listen.

Filed Under: downloads, ownership, playstation, video games

Companies: sony

IBM’s 2025 Cost of a Data Breach Report found that 16% of breaches studied involved attackers using AI tools, most often for phishing or deepfake impersonation attacks. For security teams, that has direct implications for the service desk.

The service desk is a natural target for social engineering, as an attacker that convinces an agent they are a legitimate user may not need to bypass technical controls. They can simply ask for help getting around them. AI makes that easier, helping attackers sound more credible by personalizing their approach.

Onboarding is particularly exposed in a threat landscape where AI enables more convincing social engineering attacks.

New employees need fast access, but the organization may not yet have strong familiarity with who they are. Attackers can exploit that gap, so service desk agents need better ways to prove identity before they hand over credentials, reset MFA or approve sensitive changes.

Three ways AI aids service desk attacks

1. AI makes impersonation more convincing

High-profile attacks against M&S, MGM Resorts, Clorox and others all started with a simple question to the service desk: “Can you help me get access?”. From there, the threat actors gained access to accounts, escalated their attacks and cost the victim organizations millions.

Impersonation has long been a risk at the service desk, and AI makes it even harder for agents to judge whether a request is genuine.

Attackers can now use generative AI to create polished emails, convincing chat messages and realistic call scripts in seconds. In more targeted attacks, they can also use AI-generated voice or video to impersonate an employee.

Onboarding is especially exposed. New employees are not always known to IT teams, and first-day access issues are expected. An attacker posing as a new hire can use AI to sound credible, reference the right department and create just enough urgency to push a request through.

2. AI accelerates reconnaissance and personalization

More personal information is available on the internet than ever before, and AI helps threat actors find it.

When defending against onboarding attacks, this is a real concern. Organizations often share more than they realize. A welcome post might name a new employee, or a job advert might mention the systems the company uses. A LinkedIn profile might show the hiring manager, team structure and office location.

Threat actors can pull this information, then use AI to scrape more from LinkedIn, company websites, job posts, press releases and social media. They can then turn those details into a believable story. Names, roles, locations, departments, internal tools and reporting lines can all be worked into a script that sounds credible.

That level of detail can make a malicious request look routine. And when a request feels routine, it is more likely to move quickly.

3. AI helps attackers scale service desk attacks

An attacker no longer needs to create a social engineering campaign from scratch. They can use AI to create dozens of phishing email variations, test different pretexts and adapt their wording to tailor their efforts.

That creates a problem for service desks because they are built to respond quickly. Attackers know this, so use urgency and persistence to make a malicious request feel like another routine task in a busy queue.

AI makes it easier for attackers to adjust their approach, and they can try the same basic request across multiple channels or agents until someone approves the reset, releases the credential or changes the recovery method.

How to prevent AI-enabled service desk attacks

AI-enabled attacks are designed to look normal, so prevention cannot rely on service desk agents making perfect judgment calls under pressure.

It’s here that specialized solutions can help secure an especially high risk process the service desk deals with: onboarding.

Specops Secure Onboarding helps secure onboarding end-to-end and beyond, ensuring agents have the tools they need to confidently verify identity and protect new credentials from interception.

1. Secure password delivery during onboarding

A new starter needs credentials quickly, but sending a password via SMS or email creates risk if it’s intercepted.

A safer approach is to not send credentials at all. Specops Secure Onboarding instead allows the IT team to send secure enrollment links to new hires, with instructions explaining how to create their own strong passwords. As there’s no credential created or shared from the service desk, this eliminates the risk of interception.

2. Use biometric liveness detection to defeat impersonation

Traditional identity checks are becoming less reliable; for instance, the answers to security questions can often be guessed from information an attacker can source from social media profiles.

Especially in instances where the service desk may not be familiar with the employee,  such as a new starter on their first day, agents need confidence that the person requesting access isn’t an attacker impersonating a genuine employee.

Biometric liveness detection, delivered through solutions like Specops Secure Onboarding, can help by confirming that a real person is present during verification, rather than a static image, recording, mask or deepfake. This is especially useful for remote onboarding, where the service desk may never meet the employee face to face.

3. Verify identity before sensitive service desk actions

Sensitive actions need stronger identity verification before they are approved. For instance, a request to reset the password of a privileged account should trigger checks as biometric liveness detection to provide high assurance that the request is genuine and the person making it linked to the correct account.

Specops Secure Onboarding ensures that verification takes place before agents complete actions like password resets. Agents can enforce verification through strong identity checks and make trust decisions with greater confidence.

Protect your service desk from AI-enabled attacks with Specops 

Specops Secure Onboarding helps organizations secure the service desk during high-risk actions by placing identity verification at the center of processes like onboarding, delivering: 

• Stronger protection against identity-based attacks: Replace assumed trust with verified identity throughout onboarding, helping service desk teams defend against AI-powered impersonation.
• A consistent onboarding experience: Give every new starter the same secure process, wherever they are based, without adding unnecessary friction for HR teams or employees.
• Less risk at the service desk: Verify identity before sensitive actions are taken, so agents are not left to judge whether a request is genuine based on trust alone.

If you’re interested in seeing how Specops Secure Onboarding can help your service desk defend against sophisticated social engineering attacks, contact us today or book a demo.

Sponsored and written by Specops Software.

Through the looking glass: Meta launched a new AI image-generation model called Muse Image this week, letting users create, edit, and blend photos using natural language prompts inside Meta AI, with the tool already live on Instagram and WhatsApp and expected on Facebook and Messenger soon. However, the new feature is already raising privacy concerns, as it allows anyone to generate AI images using other people’s Instagram photos.

All public Instagram profiles are automatically opted into Meta’s new AI image platform by default, letting users generate AI images using someone else’s likeness simply by tagging their account in a prompt. Meta notes that users won’t be notified when someone uses their photos to generate an image, so they have no way of knowing how many images are being generated in their likeness, or by whom.

Thankfully, Meta says users can opt out of the image-generation feature without making their account private. To do so, open Instagram settings by tapping your profile picture, hit the hamburger menu in the top-right corner, then select Sharing and Reuse.

Under “Allow people to reuse your content on Instagram and with AI features on Meta,” toggle off both Posts and Reels.

Switching off those two options will prevent others from creating new AI images using your photos, but images that have already been created won’t be deleted. The only other way to stop random people from generating AI images with your photos is to make your account private, which limits your content to approved followers only.

Muse Image is currently rolling out on Instagram and WhatsApp and is expected to reach Facebook and Messenger soon. Meta will also bring it to advertisers through its Advantage+ Creative suite of AI-powered tools, which automates aspects of ad creation such as background generation, image animation, and music integration.

Meta has often drawn scrutiny from privacy advocates and industry observers over user privacy and data security. Earlier this year, the company’s smart glasses raised privacy alarms after contractors working with Meta in Kenya revealed they were being paid to review graphic and often intimate footage captured through the Meta AI Glasses, including clips of people using bathrooms, getting dressed, and engaging in sexual activity.

From Folarin Balogun’s suspended ban and Cristiano Ronaldo’s shortened suspension to the treatment of Iran and referee Omar Artan, so many aspects of World Cup 2026 have defied belief. But the brazen introduction of full-screen hydration break ads arguably tops the lot.

From the moment the USA was confirmed as a co-host, there were light-hearted rumours that this beautiful game of two halves could be disfigured by the introduction of additional breaks for commercials, a la the NFL and NBA.