Smart TVs Give ‘Opt Out’ a Plot Twist
Between Samsung’s residential proxy app ban and LG’s ambient audio disputes, smart TVs are having a major privacy moment. Now, hitting “no” on your smart TV’s tracking pop-up is clearly just a polite suggestion.
Some smart TVs continue sending tracking-related traffic after users opt out, Northeastern researchers found. Testing 12 TVs, they caught Samsung and Vizio systems blasting out suspicious post-opt-out traffic, while Roku’s opt-out conveniently excluded its own channel.
Automatic content recognition (ACR) snoops on what you watch, potentially scanning your HDMI inputs. Since this traffic was mostly encrypted, researchers couldn’t confirm exactly what viewing data was hoarded. Meanwhile, a VIDAA-related server exposed 57 million viewing detections. Authentication was eventually added, but transmissions remain gloriously unencrypted.
Go disable ACR and personalized ads in your settings. For actual protection, apply router-level blocking with the researchers’ blocklist—or just yank the internet cable and use an external streamer.
Turns out, “no” just means “try harder.”
Capcom Warns of a Phishing Sequel
Capcom is warning of a phishing hangover after a CAPCOM ID breach exposed 11.7 million records containing emails, login activity, and IP addresses. The actual victim count remains unclear.
Attackers changed 196 passwords, which Capcom reset. The company hasn’t confirmed exposed original credentials, and credit cards miraculously weren’t touched. However, a Friday update revealed 19 Japanese accounts were used to access shopping profiles, exposing names, addresses, and purchase histories.
This gives scammers premium material to personalize fake alerts. Visit CAPCOM ID directly to check for unauthorized changes, enable two-factor authentication, and replace reused passwords. Avoid links in suspicious messages referencing genuine details. Though Capcom claims the breach is contained, the spilled data provides ongoing ammunition for creative crooks.
Resident Evil’s next jump scare shouldn’t be an “urgent account verification” email.
Zeabur Breach Exposes 321K Accounts
Zeabur’s second breach in two months exposed 321,810 accounts and 3.2 million records.
Attackers also gained root access to 101 Google Cloud servers and installed unauthorized SSH keys on 50 of them.
Rotating stolen credentials isn’t enough when attackers have established persistent access through unauthorized SSH keys.
Revoke exposed credentials, audit connected services, and rebuild compromised servers before migration.
Morgan Stanley, JPMorgan Block AI Agents
Major U.S. banks are restricting third-party AI agents from accessing customer accounts.
The move follows concerns that customers sharing banking credentials with AI tools could expose sensitive financial data or enable unauthorized transactions.
The challenge for banks is ensuring AI agents operate within approved permissions, especially when they have the ability to move money.
Limit AI agent permissions and test whether agents can bypass access restrictions or initiate unauthorized transactions.
Meta Ordered to Pay $25B Over Privacy Failures
A New Mexico judge ordered Meta to pay $25 billion after a jury found that Facebook misled users about privacy and third-party data access.
The case stems partly from the Cambridge Analytica scandal, though Meta disputes the ruling and plans to appeal.
This case reinforces that security leaders need to ensure their privacy promises match their organization’s actual practices.
Audit third-party data access and test whether privacy settings actually restrict how personal information is collected or shared.
Chicago Delivery Robots Spark Privacy Fight
Chicago lawsuits accuse Coco Robotics and Serve Robotics of collecting biometric data without consent, which both companies deny.
The cases question whether robot navigation data qualifies as protected biometric information under Illinois law.
My concern is that data collected for robot navigation could create additional privacy risks if retained or shared beyond its intended purpose.
Organizations should audit autonomous systems’ data collection, limit retention, and ensure compliance with biometric privacy laws.
Claude Finds 493 Flaws in Open-Source Software
Anthropic’s Claude found 493 security issues across 25 open-source projects, including vulnerabilities that silently disabled protections for years.
The findings also prompted OpenSSH developers to reduce code accessible before authentication.
What stands out to me is how long some of these flaws went undetected.
Review configurations and test whether authentication controls enforce their intended restrictions.
Could Infostealers Bypass Your MFA?
Infostealer malware steals credentials and session tokens, enabling account hijacking and potential MFA bypass.
How to protect against infostealers:
- Deploy EDR/XDR tools to detect infostealer activity and identify suspicious attempts to access stored credentials.
- Use phishing-resistant MFA and managed password managers to reduce credential theft risks.
- Monitor for compromised credentials using threat intelligence and immediately revoke exposed sessions to protect against account hijacking.
Measure how quickly you can identify infostealer infections and invalidate stolen sessions before attackers reuse them.