Search: “device-control”

Top 10 Best Device Control & USB Security Tools in 2026

A 2026 scorecard ranks ten USB and device control tools, placing Safetica, Ivanti DeviceLock and DriveLock at the top.

The article compares ten device control and USB security tools using a weighted scorecard covering control granularity, platform coverage, DLP integration, operability and value. Safetica, Ivanti DeviceLock and DriveLock rank highest, with notes on cross-platform depth, Windows granularity and European compliance fit. The piece highlights ownership changes, including CoSoSys joining Netwrix and Digital Guardian joining Fortra, and stresses device control as part of Zero Trust and DLP strategies.

Cyber Security News·Sep 10, 08:05 UTC · 6d agoIndustry

11 Best Device Control & USB Security Tools Compared (2026): Features & Pricing

2026 comparison of 11 device control and USB security tools ranks CoSoSys Endpoint Protector first for cross-platform control and DLP.

An editorial scorecard evaluates eleven device control and removable-media security tools across granularity, content-aware DLP, cross-platform parity, encryption/shadowing, and value. CoSoSys Endpoint Protector (now part of Netwrix) leads at 4.60 for genuine Windows, macOS, and Linux parity, with Ivanti DeviceLock at 4.25 for the deepest Windows peripheral control and Safetica positioned for SMB and mid-market value. Enterprise content-aware DLP anchors include Symantec (Broadcom), Forcepoint, Digital Guardian (Fortra), and Trellix, with pricing almost always per endpoint.

GBHackers·updated Sep 16, 09:52 UTC · 18h ago·first Sep 11, 07:08 UTC · 5d agoIndustry 14 sources

Your AI agents can now control your Google Home devices

Google launches early-access MCP server letting MCP-capable AI agents like Claude and ChatGPT control Google Home devices.

Google rolled out early access to a Model Context Protocol (MCP) server for Google Home, allowing agents such as Claude, ChatGPT, Hermes, OpenClaw, and Google Antigravity to control Nest devices, review camera summaries, monitor activity, and access event history. Setup requires a Google Cloud project configured for Home MCP plus user permission grants. Access begins this week for US Google Home Premium Advanced ($20/month) subscribers, with broader rollout timing unannounced.

TechCrunch · AI·Sep 16, 17:00 UTC · 11h agoAI industry 2 sources

Top 10 Best Endpoint Privilege Management (EPM) Tools in 2026

A 2026 scorecard ranks ten endpoint privilege management tools, led by BeyondTrust, ThreatLocker and Delinea for elevation, coverage and policy depth.

The article ranks ten endpoint privilege management (EPM) tools using weighted criteria covering elevation workflow, platform coverage, policy depth, time-to-value and value. BeyondTrust scored highest overall (8.4) for cross-platform breadth, with ThreatLocker (8.2), Delinea (8.1) and Admin By Request (8.0) highlighted for allowlisting integration, cloud administration and deployment speed respectively. It also notes that Netwrix acquired CoSoSys in 2024, which affects bundling when shortlisting both EPM and device control.

Cyber Security News·Sep 10, 07:58 UTC · 6d agoIndustry

Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline

ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.

ThreatFabric's Mobile Threat Intelligence team identified Manic, an Android malware active in the wild since at least February 2026 that combines banking fraud with surveillance and device-control capabilities. It monitors 169 Android apps including Ukrainian banks, government and eID services, messaging apps, crypto exchanges, and 2FA tools, using the Accessibility service as a classified UI keylogger and WebRTC for live screen viewing and remote control. A distinctive store-and-forward relay exfiltrates AES-GCM-encrypted data through nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting chains of up to four hops when direct C2 is unavailable. A July update added stronger anti-analysis, in-memory DEX loading, lock-secret phishing to extract device PINs, and hiding from the app launcher.

Security Affairs·Aug 20, 18:03 UTC · 27d agoMalware in the wild

Anthropic's new hardware standard lets AI agents control the physical world

Anthropic announced a standardized hardware driver interface letting AI agents control physical devices and for devices to interoperate.

Anthropic introduced a new hardware standard that provides a standardized driver interface for AI agents to control the physical world. The standard aims to let devices communicate with AI systems and with each other. Details on adoption, partners, or specifications were not included in the available text.

Ars Technica · AI·Aug 27, 22:15 UTC · 20d agoAI industry1

Mantax OTAX Android Ransomware Spies on Users, Steals OTPs and Encrypts Files

New Android malware family Mantax OTAX combines ransomware, spyware, and OTP theft via sideloaded APKs, linked to Indonesian threat actors.

Researchers at zLabs and Zimperium analyzed Mantax OTAX, an aggressive Android malware strain distributed as sideloaded APKs through phishing and messaging lures on third-party file-sharing services. The malware requests device-administrator and Accessibility permissions to steal lock-screen PINs, intercept SMS one-time passwords, harvest contacts and history, capture screens via MediaProjection, and silently photograph victims, while encrypting files with AES and writing .enc files on Android 9 and older. Its C2 uses HTTPS at apimantax[.]otax[.]fun with the active domain fetched dynamically from a GitHub repository, and a newer version adds WebSocket communication, app blocking, video overlays, and text-to-speech harassment. A Firebase misconfiguration exposed extortion conversations and victim data, and Android 10+ Scoped Storage limits the encryption reach but not the surveillance capabilities.

GBHackers·updated Sep 11, 12:14 UTC · 5d ago·first Sep 11, 07:14 UTC · 5d agoMalware in the wild 6 sources1

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

ThreatFabric identified Manic, an Android banking malware and spyware targeting Ukrainian and European financial apps with novel offline Wi-Fi mesh data exfiltration via nearby infected devices.

ThreatFabric reported a new Android malware family called Manic combining banking fraud and surveillance capabilities, targeting 169 package IDs across Ukrainian banks, government and identity services, messaging apps, and Russian and European financial institutions. The malware uses phishing sites and dropper apps impersonating utilities for distribution and relies on accessibility services and notification permissions for keylogging, overlays, and remote control. It introduces a store-and-forward relay mechanism that stages encrypted data locally and relays it through nearby infected devices via Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting up to four hops when the primary device lacks internet access. Activity dates back to February 2026, with active development through late July.

The Hacker News·Aug 21, 17:10 UTC · 26d agoMalware in the wild

Military device manufacturer discloses cyber incident to SEC

The Record·Aug 7, 16:57 UTC · Aug 7, 2026Policy & legal

Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity

Researchers introduce InjectEave, using electromagnetic injection and hardware nonlinearity to induce side-channel leakage and eavesdrop on headphone audio from 30 meters.

An arXiv paper shows electromagnetic injection can actively amplify side-channel leakage: nonlinear hardware such as amplifiers, ADCs, and power converters modulates secret electrical signals onto an injected EM carrier, upconverting low-frequency secrets into measurable EM emissions. By tuning injection frequency and amplitude, an adversary can shape the effective spectrum and entropy of the resulting leakage. The InjectEave attack demonstrated eavesdropping on wired and wireless headphone audio from up to 30 meters and in through-wall scenarios using accessible RF equipment, plus leakage of smart home device power consumption and analog sensor inputs. Case studies show closed-loop eavesdropping and manipulation of landline phone conversations, and the paper discusses mitigations.

arXiv cs.CR·Sep 4, 06:22 UTC · 12d agoResearch

How CHERIoT Provides Strong and Usable Isolation Without an MMU

ACM Queue paper explains how CHERIoT uses CHERI hardware capabilities to give microcontroller-class IoT devices memory and privilege isolation without an MMU.

The ACM Queue article (DOI 10.1145/3831361) describes CHERIoT, a RISC-V-derived platform that scales CHERI capability-based hardware down to small embedded and IoT microcontrollers. It provides strong, fine-grained isolation and memory safety without a memory management unit, aiming to make compartmentalization practical for low-cost devices. The piece emphasizes usability of the isolation model alongside its security guarantees.

Lobsters · security·Sep 10, 14:59 UTC · 6d agoResearch

How BitLocker PINs help protect your data and devices

NCSC UK guidance explains that configuring BitLocker PINs mitigates many BitLocker vulnerabilities and urges readiness for future bypass flaws.

The UK National Cyber Security Centre published guidance explaining how BitLocker PINs strengthen protection of data and devices. According to NCSC, enabling a pre-boot PIN mitigates many known BitLocker vulnerabilities that rely on default TPM-only configurations. The guidance encourages organizations to configure PINs now to be prepared for the next disclosed BitLocker bypass.

NCSC UK·Aug 13, 12:00 UTC · Aug 13, 2026Advisory

AI will not fix a governance problem in your camera estate

Hikvision EMEA security director argues camera estates need governance, recovery controls, and secure-by-default settings rather than AI fixes.

Rob Janssens, EMEA Cyber Security Director at Hikvision Europe, discusses securing surveillance camera estates whose lifecycles outlive their installers, leaving lost documentation and admin credentials. He advocates secure-by-default settings such as mandatory password activation, login-failure monitoring, IP filtering, and controlled SSH access, and argues customers should be able to recover control without the original integrator. He distinguishes secure-by-design from secure-by-default, recommends VPNs and network segmentation over disabling controls, and weighs European requirements like source code escrow and country-of-origin rules.

Help Net Security·Aug 27, 00:00 UTC · 21d agoIndustry

Researchers found a way to hijack devices through Zoom screen sharing

Researchers used a public AI tool to find a Zoom flaw enabling device hijacking via screen sharing in under 20 prompts.

Security researchers discovered a serious vulnerability in Zoom that can be used to hijack devices through the screen-sharing feature. The flaw was reportedly found by a publicly available AI tool in fewer than 20 prompts, highlighting the role of agentic AI in vulnerability discovery. The article does not report active exploitation or assign a CVE in the provided text.

Ars Technica · Security·Aug 12, 13:37 UTC · Aug 12, 2026Vulnerability

US military disabled ad tracking on troops’ devices following reports of targeted attacks

US DoD disabled ad tracking on troops' devices after foreign adversaries targeted service members using commercially bought location data.

Per letters shared with Senator Ron Wyden, the Army, Air Force, Navy, Marine Corps, and Special Operations Command disabled advertising IDs on iPhones, Android devices, and Windows computers across the federal military enterprise. The protections rolled out earlier in 2026, with the Air Force implementing changes in July, to prevent adversaries from exploiting app-derived location data sold through data brokers. Wyden warned that personal devices brought onto military bases could still expose troops and facilities, and noted the intelligence community and FBI buy such data without warrants.

TechCrunch · Security·Sep 4, 13:21 UTC · 12d agoPolicy & legal

Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens

The Hacker News·Aug 5, 08:52 UTC · Aug 5, 2026Phishing & fraud1

Thousands of servers can be backdoored by exploiting buggy motherboard controllers

Ars Technica · Security·Aug 5, 22:35 UTC · Aug 5, 2026MalwareCVE-2013-4786

Chrome adopts what may be the best protection yet against account takeovers

Chrome adopts device-bound session credentials that tie login sessions to a specific device, defending against cookie-theft account takeover attacks.

Chrome is adopting device-bound session credentials, which bind authenticated sessions to the physical device rather than to transferable cookies. The mechanism targets a common account takeover technique in which attackers steal session cookies and replay them on other machines. Ars Technica characterizes it as possibly the strongest protection yet against this class of takeover, which has become increasingly common.

Ars Technica · Security·Aug 11, 20:59 UTC · Aug 11, 2026Tools

Top 10 Best Mobile Device Management (MDM) Solutions in 2026

A 2026 MDM buyer guide ranks ten solutions, recommending Microsoft Intune for Microsoft 365 estates and Jamf for Apple-only environments.

A 2026 buyer guide evaluates ten mobile device management solutions, leading with Microsoft Intune as the default for Microsoft 365 organizations and Jamf for Apple estates. It recommends choosing the enrolment model before selecting a vendor and clarifying BYOD visibility to prevent privacy disputes. Kandji, Mosyle, Omnissa Workspace ONE, ManageEngine, Scalefusion, and Hexnode are covered as alternatives. Guidance ties MDM to Zero Trust data access policies via Apple User Enrolment and Android work profiles.

Cyber Security News·Sep 9, 07:45 UTC · 7d agoIndustry

How to Spot and Stop Rogue Device Joins

Wiz details how adversaries use realistic device names in Entra ID registrations to evade detection and which behavioral signals still expose them.

Wiz researchers describe how adversaries generate realistic device names during Entra ID device registration instead of leaving recognizable fingerprints from public tooling, making rogue device joins blend into enterprise environments. The post explains how this trend changes Entra ID detection approaches. It also identifies behavioral signals that still expose these attacks. No specific CVE or victim was named.

Wiz Blog·Aug 18, 16:24 UTC · 29d agoResearch in the wild

JarvisGUI: Towards Cross-Device GUI Agents with Dynamic Task Composition

JarvisGUI benchmark tests GUI agents on cross-device workflows across Android, Windows, and Ubuntu, revealing major gaps in state transfer and long-horizon reasoning.

JarvisGUI is a dynamic benchmark that formulates GUI tasks as input-output transformations under a lightweight type system, automatically composing multi-step cross-device workflows across Android, Windows, and Ubuntu virtual environments. Evaluation shows state-of-the-art open-source GUI agents struggle with state-transfer awareness, cross-platform contextual reasoning, and long-horizon dependency management, exposing a capability gap invisible to existing single-device benchmarks.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 16:59 UTC · 7d agoAI research1

Analog Pin Directionality as an Exfiltration Attack Surface in Mixed-Signal ICsnew

Researchers demonstrate exfiltration through nominally input-only analog pins in mixed-signal ICs, recovering data at 10 kbps on a 55nm PPG front-end.

The paper identifies a directionality-based attack class in analog/mixed-signal (AMS) ICs where data-dependent circuit-offset modulation converts a nominally input-only pin into an outbound information channel. Three host conditions enable the attack: a closed-loop amplifier, an exposed amplifier input, and sufficiently high impedance at that pin. Silicon validation on a photoplethysmography analog front-end in 55nm CMOS showed exfiltration at up to 10 kbps with error-free PRBS recovery, under 0.001% area overhead, and only 0.03 dB SNR reduction.

arXiv cs.CR·Sep 16, 17:39 UTC · 10h agoResearch

Malicious SIMs can hijack smartphones, steal files, and lock them onto 2G

Help Net Security·Aug 11, 00:00 UTC · Aug 11, 2026VulnerabilityCVE-2025-48618

Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11

DEF CON researchers chained Windows Plug and Play auto-install abuse with third-party driver flaws to reach SYSTEM on fully updated Windows 11.

In 'Plug And Pwn' research prepared for DEF CON 34, Alejandro Hernando and Borja Martinez emulated USB devices so Windows auto-installed signed vendor software, chaining a Sierra Wireless SwiService.exe SetDNS primitive, a Sony FeliCa co-installer path-traversal flaw that writes a DLL into System32, and device reconnection for SYSTEM code execution. A remote variant over Remote Desktop forges a synthetic Intel RealSense device and abuses a CRYPTBASE.dll search-order hijack when PnP or low-level USB redirection is enabled. Microsoft notes RDP does not allow supported PnP and RemoteFX USB redirection by default, and no in-the-wild exploitation has been reported.

The Hacker News·Aug 11, 10:48 UTC · Aug 11, 2026Research

The 12 Best Mobile Device Management (MDM) Solutions, Compared and Priced

A comparison of 12 MDM platforms ranks Microsoft Intune as best value for Microsoft 365 estates and Jamf, Kandji, and Mosyle for Apple fleets.

The buyer's guide compares 12 mobile device management (MDM) products, naming Microsoft Intune best value since it is included in Microsoft 365 E3/E5, and Jamf, Kandji, and Mosyle as Apple specialists with day-one OS support and automated compliance remediation. Eight of the twelve publish rates; per-device pricing punishes multi-device users, while Microsoft, Omnissa, and IBM offer per-user options. Free tiers from Mosyle, Miradore, and ManageEngine support genuine small deployments.

GBHackers·updated Sep 10, 08:19 UTC · 6d ago·first Sep 10, 08:09 UTC · 6d agoIndustry 4 sources

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.

Check Point Research disclosed BTR Reforged, a technique that abuses BTR.sys, a legitimately signed Windows Defender boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw. The BTR_CLI proof-of-concept tool, presented at Black Hat USA 2026 and DEF CON 34, installs the driver via direct registry writes and executes deletions during the boot-time 'golden window' before Defender's user-mode services start, demonstrated by deleting the full Defender stack on a patched Windows 11 machine. Exploitation requires SeLoadDriverPrivilege; Microsoft confirmed it does not meet criteria for immediate servicing and no patch is planned. No evidence of real-world abuse was found, and related indicators of compromise via Sysmon events were published.

The Hacker News·Aug 21, 15:52 UTC · 26d agoToolsCVE-2021-240921

NCSC Urges Stronger Controls for Agentic AI Systems

UK's NCSC urges organizations to apply sandboxing, human oversight, and strict access controls when deploying autonomous AI agents.

The UK National Cyber Security Centre published guidance recommending stronger controls for autonomous agentic AI systems. Recommended measures include sandboxing, active human oversight, and tightly scoped access controls to limit unintended agent activity. The guidance aims to help organizations realize the benefits of agentic AI while managing its cyber risk.

Infosecurity Magazine·Aug 20, 12:45 UTC · 27d agoAI safety & security

Vulnerability giving attackers full control of Macs is under active exploitation

An actively exploited macOS screen-sharing vulnerability lets remote attackers log in without a password and take full control of Macs.

Ars Technica reports that a vulnerability in macOS screen sharing is under active exploitation, allowing remote hackers to log in to Macs without a password. Successful exploitation gives attackers full control of affected machines. The article excerpt does not include a CVE identifier, affected versions, or patch details.

Ars Technica · Security·Aug 14, 18:32 UTC · Aug 14, 2026Exploit / PoC in the wild

Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix

CISA advisory maps CVE-2021-42260 to Rockwell ControlLogix, CompactLogix, and GuardLogix controllers with firmware below per-series patch levels.

CISA published an ICS advisory associating CVE-2021-42260 with multiple Rockwell Automation controller families: ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, CompactLogix 5480, and Compact GuardLogix 5380. Affected firmware versions fall below 34.015, 35.014, 36.013, and 37.011 depending on the series. The vendor provides updated firmware as remediation.

CISA Advisories·Sep 1, 12:00 UTC · 15d agoAdvisoryCVE-2021-42260

Agent as Policy for Robotic Manipulation

Agent as Policy lets a general-purpose agent drive a physical robot via runtime reasoning and program generation, reaching 100% success on manipulation tasks.

The paper introduces Agent as Policy (AGP), which puts task planning and execution for a physical robot under a general-purpose agent's control with no task-specific or environment-specific training. The agent interprets visual evidence, writes executable programs, issues motion commands, and revises actions based on physical outcomes. AGP was evaluated on real-world manipulation tasks including assembly from human videos, block construction from goal images, die reorientation, targeted throwing, and bimanual towel folding. It achieved success rates of 100%, 100%, and 80% on three block construction configurations.

Hugging Face daily papers·Sep 10, 20:00 UTC · 6d agoAI research

Rockwell Automation 1756-ENBT Module

Rockwell's 1756-ENBT ControlLogix EtherNet/IP bridge (all versions) is vulnerable to DoS via crafted CIP packets, crashing the module until manual restart.

CISA republished Rockwell Automation's advisory for CVE-2025-10478, a CWE-754 flaw affecting all versions of the 1756-ENBT ControlLogix EtherNet/IP bridge, scored CVSS 7.5. A crafted CIP packet can crash the module, and the device requires a restart to recover. Affected critical infrastructure sectors include critical manufacturing, food and agriculture, transportation systems, and water. No public exploitation has been reported; CISA recommends minimizing network exposure.

CISA Advisories·Sep 3, 12:00 UTC · 13d agoAdvisory 3 sourcesCVE-2025-10478

Akuity gives AI agents operational context to safely ship software

Akuity launches Agentic Control Plane and MCP Server to govern AI agent actions inside production software delivery pipelines.

Akuity introduced an Agentic Control Plane and MCP Server that lets AI agents such as Claude, Codex, and Cursor access deployment and cluster context under existing identity, permission, and audit controls. MLB reported the product identified over 100 degraded applications within hours. Akuity positions it against open-source MCP servers granting raw access with no identity inheritance or policy layer.

Help Net Security·Sep 15, 08:37 UTC · 1d agoAI tools & infra

[Control Systems] Siemens security advisory (AV26-890)

Canada's Cyber Centre relayed a Siemens advisory affecting Reyrolle 7SR5, Teamcenter, Siveillance Control, Desigo CC and other products.

Advisory AV26-890, dated September 8, 2026, flags Siemens vulnerabilities in Reyrolle 7SR5 (versions prior to V2.70), Teamcenter, Siveillance Control, SIMATIC AX Runtime, Desigo CC, Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT across multiple versions and models. The Cyber Centre encourages users and administrators to review the Siemens advisory and apply available updates. No specific CVEs or exploitation details are provided in the relayed advisory.

Canadian Centre for Cyber Security·Sep 8, 17:27 UTC · 8d agoAdvisory