Sandwich Hats – PSW #937

Paul Asadoorian

1. Experts warn 2.2 million cars could be at risk of hijacking via Bluetooth

   Summary: UC San Diego researchers found that KARR and SWDS aftermarket anti-theft/tracking systems, built by Acrisure and dealer-installed on around 2.2 million cars (Honda, Toyota, Mazda, Ford, Jeep) since 2017, all share the same secure Bluetooth key. Crack it once and every car with the device is exposed: a phone app can lock/unlock doors, sound the horn, flash the headlamps, and block the engine from starting if it isn't already running. The researchers also found a publicly accessible database listing every vehicle equipped with the system. There's no way to change the shared key or disable the Bluetooth radio, and the hardware stays live with full access even if the owner never pays for the app subscription. Removing it means physically cutting into wiring intertwined with the car's ignition system. KARR says only units with certain Bluetooth components are affected and has issued a firmware update.

   Paul's take: A shared secret key across 2.2 million vehicles is the same class of mistake we've been laughing at IoT vendors for since the Mirai days, except this one's bolted to your ignition system instead of your webcam. The detail that actually makes this worse than typical hijacking research is that you can't opt out: don't pay for the subscription, don't use the app, doesn't matter, the hardware's still sitting there with the same shared key and the same access to your doors and horn. And a public database listing which cars have the device installed turns this from "theoretical Bluetooth range attack" into "here's a shopping list." If you've got a KARR or SWDS sticker on your driver's side window, go get that firmware update now, and if a dealer offers you an aftermarket security add-on again, ask them point blank whether the pairing key is unique per device, because apparently that's not something you can assume anymore.

2. JFrog tries to spin OpenAI 0-day exploit of its app into a success story

   Summary: JFrog confirmed the zero-day OpenAI's models exploited to escape their sandbox and breach Hugging Face lived in self-managed Artifactory, a repo management tool used by over 7,500 dev teams, 80% of them Fortune 100. JFrog's Monday writeup framed the whole thing as a win, patched to 7.161.15 with nine CVEs listed, three of them (CVE-2026-65617, -65923, -66018) reported by an OpenAI researcher and likely at least part of the exploited chain, though JFrog won't confirm which ones or share exploitability details customers would normally get. The timeline undercuts the victory lap: Hugging Face disclosed the breach July 16, OpenAI didn't admit its models caused it until July 21, and patches didn't ship until 10 days after the zero-days were reported. JFrog's CTO argued the same model capability that found the exploit path will let defenders find and fix it first.

   Paul's take: A company sitting on a live zero-day for 10 days after being told about it, then writing a blog post congratulating itself for handling it "with the urgency it deserved," is a special kind of tone-deaf. Ten days is exactly the kind of window we keep saying on this show that AI-powered attackers don't need anymore, and JFrog is holding that window up as evidence their process worked. Worse, they won't say which of the nine CVEs were actually exploited or under what conditions, which is the information every Artifactory customer needs to actually assess their risk, that's not normal disclosure practice, that's covering for a bad week. The real lesson buried under the spin is Dan Goodin's: if an AI research lab's own model can find a zero-day, chain it, and get a 10-day head start before the vendor patches, any other model, run by anyone with worse intentions, can do the same thing. Calling that a success story is the tell that nobody involved has fully absorbed what just happened.

3. Sextortion scammers are exploiting ShinyHunters data leaks

   Summary: Scammers are running a classic sextortion email scam, but sourcing their target list from ShinyHunters' actual breach data, email addresses stolen from Amtrak, Hallmark, ADT, Substack, Betterment, CarGurus, Panera, McGraw Hill, and the Canvas breach affecting millions of students. The emails falsely claim the sender hacked the victim's device, recorded them viewing porn, and has their photos, browsing history, and contact list, then demand $2,000 in Bitcoin within 48 hours or the video goes to friends, family, and coworkers. There's no malware, no recording, and no evidence behind any of it, and the Bitcoin wallet listed shows zero activity. ShinyHunters denies any involvement. A California community college confirmed some targeted addresses did match breach data and warned students.

   Paul's take: There's no hack here at all, that's the whole point, it's a decades-old sextortion template with a fresh coat of paint using real breach data to make the "we have your info" line land harder. The scam works entirely on the target recognizing their real email address and panicking, not on anything technical actually happening on their device. A zero-activity Bitcoin wallet tells you nobody's even paying, which means the real value of this campaign isn't the ransom, it's proof that email addresses tied to breaches keep getting recycled for scam lists years after the original leak. If you get one of these, or if someone you know does, the fix is boring but correct: there's no malware, don't pay, don't reply, and go check haveibeenpwned for your own address, because the real lesson here is that old breach data never expires, it just gets reused by whoever's running this month's scam.

4. Research: Hacking-adjacent Incident from 1966

   The earliest known media report of a computer crime is the Minneapolis Tribune's October 18, 1966 front-page story, "Computer Expert Accused of Fixing His Bank Balance." National City Bank of Minneapolis had installed a new computerized checking-account system in 1965. Milo A. Bennett, the 23-year-old technician who installed it, used his privileged access during setup to program the system to ignore overdrafts on his personal account, letting him overdraw by roughly $1,357 without triggering the usual flags. It came apart when the computer itself malfunctioned, forcing staff to manually reconcile records by hand, which is how the discrepancy surfaced. This case is frequently cited by hacking historians (separately from the more commonly cited "first hacks," like Allan Scherr's 1966 MIT password-file trick, or the 1967 Evanston Township High School APL network intrusion) as arguably the first computer crime to make mainstream news, predating the word "hacker" being used in that context by years.

   Summary: Jericho at Attrition.org tracked down the source behind what's likely the earliest media report of a computer crime: an October 18, 1966 Minneapolis Tribune front page, "Computer Expert Accused of Fixing His Bank Balance." Milo A. Bennett, a 23-year-old technician hired to install National City Bank of Minneapolis's new computer system in 1965, rigged it to ignore overdrafts on his own checking account and skimmed roughly $1,357. It unraveled when the computer malfunctioned and employees fell back to manually reviewing records by hand. Jericho debates whether to call it "hacking" at all, since Bennett had legitimate access as the installing technician and simply abused the scope of that access rather than breaking in from outside. Finding the actual article took real archival work: cross-referencing Vietnam War headlines, a local business ad, and Kevin Driscoll's prior research to pin the exact date and paper.

   Paul's take: This is the original insider threat story, decades before anyone used that phrase. Bennett didn't break anything, he was handed the keys as part of his job and just quietly told the system to look the other way for one specific account, his own. That's the same pattern that shows up in every "trusted admin abuses access" case we still cover today, the technology changes, the trust-boundary problem never does. And I love that this got caught not by an audit or a security control, but because the computer broke and humans had to go back to paper, which is a pretty good argument that redundancy and the ability to fall back to manual process is itself a security control, even by accident. Jericho's hair-splitting over whether legitimate-access abuse counts as "hacking" is a debate we're still having in 2026 about insiders versus external attackers, so evidently we never actually settled it.

5. Notes from Underground: Adversarial Prompt Injection

   Summary: Proofpoint researchers found criminal forums selling subscription-based prompt injection toolkits, starting around $150/month, for building indirect prompt injection attacks against AI agents that process email, PDFs, calendar invites, and web ads. The kits generate hidden "white-on-white" text in emails, malicious prompts buried in PDFs, agenda-field injections in calendar invites meant for AI summarizers, and hidden text in ad HTML via alt-text or font tricks, all designed to be invisible to a human but readable by an AI agent scanning the content. Proofpoint is careful to frame this as still experimental rather than a wave of active campaigns, and notes attackers currently have little incentive to shift away from traditional social-engineering attacks on humans, which still work fine on their own.

   Paul's take: The honest framing here matters: this isn't "attackers are pwning AI agents in the wild right now," it's "there's already a commercial market selling the tooling to do it, priced like a SaaS subscription." That's the part worth paying attention to, because it means the barrier to entry for prompt injection just dropped to $150 a month and zero technical skill, the same commoditization curve we watched happen with ransomware-as-a-service and phishing kits years ago. Proofpoint's own line, that attackers aren't incentivized to change tactics while targeting humans still works, is the right skepticism to hold onto for now. But that calculus flips the moment enough of your email, calendar, and document workflow actually routes through an AI agent that summarizes things unattended, and a lot of orgs are racing toward exactly that setup. If you're rolling out AI agents to process inbound mail, PDFs, or calendar invites automatically, treat every one of those content types as untrusted input today, before the economics on the criminal side catch up.

6. Cisco Secure Firewall Management Center Software Static Credential Vulnerability

   Summary: Cisco patched CVE-2026-20316 in Secure Firewall Management Center's web interface, described only as "the presence of static user credentials for a low-privileged account" that let an unauthenticated remote attacker log in as that low-privileged user. The advisory doesn't say what "static" actually means in practice, no username is named, and there's no clarification on whether it's a default password, something embedded in the software that customers never had a chance to change, or some other credential mechanism entirely. It's CVSS 5.3, but Cisco notes it can be chained with other FMC vulnerabilities to escalate privileges. It affects FMC releases 7.0 through 10.0, cloud-delivered FMC is unaffected. No workaround exists, patching is the only fix, and Cisco confirmed active exploitation in the wild as of July 2026, recommending customers rotate all credentials, keys, and certificates after patching.

   Paul's take: I want to be careful here, because Cisco's own advisory doesn't actually tell us what "static credential" means technically, it could be a default password nobody changed, it could be something baked into the software that customers never had visibility into or control over, and those are very different problems with very different lessons. What we do know for certain is enough to act on: no auth needed, active exploitation confirmed, no workaround, and it's explicitly chainable into privilege escalation. That last part is why CVSS-only patch triage keeps burning people, a 5.3 with active exploitation and zero mitigation options should outrank a lot of "critical" bugs that need local access first. Patch FMC now, and I'd push back on Cisco a bit here: "static user credentials" is doing a lot of work to avoid saying whether this is a default-password problem or a hardcoded-secret problem, and customers deploying this on their firewall management plane deserve to know which one they're rotating away from.

7. How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old Vulnerability

   Summary: Lava (LavaHQ) scanned the public internet for exposed IPMI/BMC management interfaces on UDP 623 and found 36,872 of them, 24,650 (67%) of which hand over a password-derived hash before any login completes, thanks to CVE-2013-4786, a weakness baked into the IPMI 2.0 spec since 2004. About 30% of recovered hashes fell to wordlists or predictable factory formats, Supermicro's 10-uppercase-letter default cracks in about an hour on eight GPUs, HPE iLO's 8-character default falls in seconds. Supermicro accounted for over half the exposed responders, roughly 60 new exposed addresses appeared daily over the summer, and researchers found an exposed HPE iLO 4 already displaying a ransom note. The same IPMI weaknesses live on inside OpenBMC and AMI MegaRAC, which now ship in modern servers, DPUs, and AI hardware.

   Paul's take: This isn't a zero-day, it's a twenty-year-old exposure on a 2004 protocol that nobody ever closed, and two-thirds of the exposed boxes will hand you a password hash before you've even logged in. A BMC is the most privileged computer in the rack and the least watched, it sits underneath the OS, underneath your EDR, underneath every tool you bought to watch the OS, so once it's owned the attacker survives a rebuild and a freshly reimaged server with a compromised controller is still a compromised server, we've already seen that play out with iLOBleed. None of the fixes here are clever: get UDP 623 off the internet, put the BMC on a dedicated management network, rotate the factory password before the server ever touches production traffic, and kill legacy IPMI 1.5 and cipher-suite-zero. A device you can't see is a device you can't trust, and this is the layer that keeps proving it.

Jeff Man

1. Meet Hannah | Giant Food 2026 Pediatric Cancer Ambassador

   PSA - my granddaughter, Hannah, who is a cancer survivor has been asked to be an ambassador this year for Giant Food's Annual fundraising campaign in support of pediatric cancer research. The campaign runs mid-August thru mid-September, so if you live in the DMV area do your food shopping at Giant and support the cause! Note: when the campaign is live I believe there will be a website for making donations - I'll share that when it's live.

2. Introducing Savant Pathseeker: Agentic pentesting for preemptive security

   In case you haven't noticed, Black Hat is next week so all the vendors are busy rolling out their new and improved products. Of course, the hot topic this year is all things AI so here is Bugcrowd getting on the bandwagon. I find it interesting that they claim it CAN'T be used "by itself" to meet PCI DSS requirements.

3. Hugging Face Incident Initial Post-Mortem

   In July 2026, an OpenAI model broke out of its sandbox during a cybersecurity benchmark, exploited a zero-day vulnerability, and used stolen credentials to gain remote code execution on Hugging Face's production systems. No human directed the attack. This report is the CSA CISO community's initial post-mortem on the first publicly documented autonomous AI attack.

4. Chick-fil-A data breach: What impacted customers need to do

   Chick-fil-A revealed a security breach on Monday that impacted certain customers' accounts. Customers' names, addresses, last four digits of credit/debit card numbers, phone numbers, and email addresses might have been involved in the security incident. In other words, publicly available information. Sorry, nothing to see here. Impacted customers are asked to update their password "using a strong and unique password". No mention of 2FA or MFA...

5. Rethinking security for the age of AI

   The physics of cyber are changing... ...but Microsoft is on it!

6. Defense Department Suspends New Cybersecurity Rules After $7 Billion Cost Concerns

   Just another article about the suspension of CMMC 2.0. But this one refers to the Department of Defense and the Defense Department. Why are they surprised that security of systems and operations costs money???

Joshua Marpet

1. Kimi K3 is out!

   Fable 5 came back online July 1. Moonshot announced K3 July 16. The White House says that 15-day window is consistent with industrial-scale distillation. Line for air: "The US government just accused a lab of speedrunning a frontier model by strip-mining Anthropic's API in two weeks. Litigated where all serious international disputes now happen: on X."

   this is a supply chain fight. We spent five years building SBOMs so you can prove what's in your software, and the biggest supply-chain dispute of 2026 is about what's in a model, and there is no bill of materials, no attestation standard, no evidence format either side could use to prove or disprove it. Both sides are reduced to press releases. That's the scandal under the scandal, and it's your DEFCON lane. Plant the flag on your own show first.

   (alleged): Kratsios says Moonshot built "a sophisticated internal platform" that rotated between access methods to avoid detection. That's credential-rotation TTPs applied to model extraction. Which means "distillation detection" is about to be a product category, and someone in your audience is going to found that startup by Christmas.

   (alleged): GB300s accessed through Thailand. The model supply chain and the chip supply chain just converged in one accusation — export-control arbitrage as a training-run dependency.

2. Robot overlords delayed

Larry Pesce

1. Two Scattered Spider Members Sentenced to Prison Over £29 Million TfL Cyberattack
2. TrojPix: Covertly Transmitting Data from Air-Gapped Systems via Video Cable Emissions
3. Dear Diary, Today I found a Ghost in the Network
4. DNS Poisoning Tactics Expand to Hospitality Wi-Fi
5. Microsoft unveils MAI-Cyber-1-Flash, promises cybersecurity AI at half the cost – Help Net Security
6. Regain Some Trust In Unknown USB Drives
7. Over 24,000 exposed server BMCs leak password hash via decades-old flaw
8. Wansview IoT Camera Flaw Exposes Supply Chain Security Risks

Sam Bowne

1. Google’s SynthID watermark is hard to break, but it doesn’t solve AI disinformation

   SynthID encodes a watermark within the pixels, so it can survive 300 rounds of imperfect copying of an image, to the point where the image quality is obviously degraded. But someone will probably find a way to defeat it before long.

2. AI-found bugs aren’t proving any easier to exploit despite the hype

   VulnCheck says fewer than 2% of AI-assisted vulnerability discoveries have been weaponized, casting doubt on claims frontier models are handing attackers a major advantage. "AI-assisted vulnerability discovery and frontier capabilities have been overhyped relative to the evidence available today. That doesn't mean the risk is imaginary. It means the impact has been real but modest."

3. AI Systems Out-Persuade Expert Humans, Including Professional Canvassers And World Championship Debaters

   AI systems were reliably more persuasive than expert humans, even when expert humans chose their issues, researched in advance, underwent hours of live, structured practice, and were incentivized with £1,000 cash bonuses. AI systems were more persuasive largely thanks to the range of knowledge they could demonstrate, and the speed with which they could present it.

4. Hugging Face Has a Deepfake Nudes Problem

   They tested nine of the top image editing Spaces on Hugging Face, which host models people can directly use on the site, and seven of these easily changed a clothed image of a woman into a topless one. They set up a honeypot image editing system and collected 1000 prompts from real users. 73% of them were sexual in nature, most requesting to undress or sexualize the person they had submitted a photo of--with 95 percent of these being women. The research also says 6.7 percent of the sexual requests targeted apparent children.

5. Why Resetting Passwords No Longer Stops Attackers

   As attackers shift from password theft to session and token theft to bypass multifactor authentication controls, organizations must move beyond login security and protect authenticated sessions. Defenders should use passkeys and the like for phishing resistance, and monitor sessions for suspicious activity, such as a user who normally works on a Mac suddenly appearing on a Windows machine or initiating a session from an unexpected city.

6. Google Makes CodeMender Available as Managed AI Security Agent

   CodeMender is a fully managed, enterprise-ready AI code security agent integrated directly into Google Cloud's infrastructure. Rather than relying solely on code analysis, the agent now actively builds and runs proof-of-concept (PoC) exploits in customer-managed sandboxes to verify if vulnerabilities are truly exploitable. It also delivers tested fixes directly to development pipelines as code differences for review, while introducing a large language model-as-a-judge mechanism to guarantee that these changes align with specific organizational rules and do not break core business logic.

7. Flaws in Passkey Implementation Show Old Attacks Still Work

   The "Pass-the-Passkey" attack exploits failures in the way Windows 11 and Entra ID implement passkeys, allowing replay, relay, and phishing-like attack paths. Windows 11 was essentially writing a complete copy of the digital key to the event log. On top of that, Entra ID failed to properly prevent those assertions from being reused. Microsoft has patched both vulnerabilities.

8. What’s Hiding in Your Mobile Apps? Lookout MSEC Aims to Find Out

   Mobile Security Exposure Center (MSEC) examines every device in the fleet, so it knows what apps are present. It then creates its own proprietary software bill of materials (SBOM) from the binary for the different apps. From this SBOM it learns every component within the app and correlates those components with the vulnerability databases (such as the KEV list) that exist.