Search: “Content Credentials”

12 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 1727 Vulnerability 1124 Ransomware 958 Data breach 694 Exploit / PoC 628 Threat actor 553 Phishing & fraud 517 Policy & legal 169 Industry 112 AI safety & security 84 Research 37 Advisory 29 AI tools & infra 24 Tools 13

SeverityAll critical 2598 high 2116 medium 1584 low 273 info 117

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · securitySep 16, 13:24 UTC · 17h agoResearch

Did someone hack the Brazilian google.com.br?

Security AffairsJan 5, 11:30 UTC · Jan 5, 2017Research

Cloud misconfiguration exposes 100M+ Android Users

Infosecurity MagazineMay 21, 09:20 UTC · May 21, 2021Research

Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network

The Hacker NewsJun 18, 15:33 UTC · Jun 18, 2026Research

Storing Encrypted Photos in Google's Cloud

Schneier on SecurityAug 15, 05:50 UTC · Aug 15, 2021Research

Here’s How to Hack Windows/Mac OS X Login Password (When Locked)

The Hacker NewsSep 7, 11:28 UTC · Sep 7, 2016Research1

Google's New Restore Credentials Tool Simplifies App Login After Android Migration

The Hacker NewsNov 26, 04:34 UTC · Nov 26, 2024Research

Even cybersecurity researchers are exposing secrets in their arXiv LaTeX source

Help Net SecurityJun 19, 12:14 UTC · Jun 19, 2026Research

Flaw In Major Browsers Allows 3rd-Party Scripts to Steal Your Saved Passwords

The Hacker NewsJan 2, 10:53 UTC · Jan 2, 2018Research

Over 1 Billion Mobile App Accounts can be Hijacked Remotely with this Simple Hack

The Hacker NewsNov 5, 06:12 UTC · Nov 5, 2016Research

NordVPN Breach FAQ

The Hacker NewsOct 22, 14:45 UTC · Oct 22, 2019Research

Automatically Detecting DNS Hijacking in Passive DNS

Unit 42's machine learning pipeline detected 6,729 DNS hijacking events between March and September 2024, hitting political parties, ISPs, and universities.

Unit 42 processes roughly 167 million new DNS records daily and applies a machine learning model using 74 features over 169 TB of passive DNS and geolocation data to flag hijacked domains. From March to September 2024 the pipeline screened over 29 billion records and classified 6,729 as DNS hijacking, averaging 38 detections per day; a new model detects hijacks in customer traffic within about 10 minutes. Notable cases include a Hungarian political party's hijacked domain, defacement of a large utility company and ISP, and university and research center domains repurposed for illicit gambling. DNS hijacking typically relies on stolen registrar or DNS provider credentials or cache poisoning, enabling MitM attacks, phishing, drive-by downloads, and scams.

Palo Alto Unit 42Aug 17, 12:47 UTC · Aug 17, 2026Research in the wild