You don’t always need to hack into a company’s systems to get its secrets. Sometimes, the company will simply email them to you. A new report by WIRED’s Matt Burgess has uncovered a bizarre email security problem in which companies are inadvertently sending sensitive information to domains that can be registered and controlled by outsiders. Security researchers Cory Solovevich and Mike Sheward discovered that seemingly harmless addresses such as noreply and deleteduser can become unexpected gateways to corporate information when the domains behind them aren’t properly controlled.
The worrying part is that this doesn’t require sophisticated hacking. Solovevich discovered that domains such as noreply.net and noreply.us were receiving huge volumes of emails that companies presumably thought would disappear into the void.
Instead, those messages landed in an inbox he controlled. WIRED reports that noreply.net received more than 400,000 messages over a year and a half, including more than 28,000 attachments. The emails ranged from ordinary notifications to employee information and other sensitive business data.
Sheward encountered a similar problem after purchasing deleteduser.com, receiving thousands of unintended emails containing information such as work vacation requests, hotel bookings, employee names and Zoom meeting invitations. The underlying problem is fairly simple. Companies sometimes use placeholder addresses for accounts that no longer exist, assuming nobody can access the destination. But if the associated domain is no longer controlled by the organization and someone else registers it, those supposedly dead-end emails can suddenly have a very real recipient.
The researchers found that the problem could be widespread. Solovevich identified 7,136 domains configured to receive email, including 328 with catch-all inboxes capable of accepting messages sent to different addresses within those domains. That doesn’t mean all of these domains are actively leaking sensitive information, but it highlights how easily forgotten email configurations can become a security problem.
Fortunately, Solovevich and Sheward have been notifying affected organizations rather than simply exploiting the information they receive. Solovevich has also purchased more than 30 domains to prevent malicious actors from taking advantage of the same issue.
The bigger lesson from WIRED’s investigation is almost embarrassingly simple: an email address isn’t a black hole just because a company thinks it is. Organizations can spend millions protecting their networks from sophisticated attacks, but if sensitive emails are still being sent to domains someone else can buy, sometimes the easiest way into a company’s secrets is simply owning the right piece of internet real estate.
AI companies spend enormous amounts of time convincing us their technology is safe and secure. But what happens when those same companies become targets of increasingly sophisticated AI-powered attacks? Anthropic, the company behind Claude, is now facing that question. According to a Washington Post report, cybersecurity startup Cathedral discovered vulnerabilities that let its researchers access sensitive information in Anthropic's internal systems.
The researchers used AI agents to identify potential entry points in less than 12 hours. Interestingly, they didn't need to crack Claude itself. Instead, they exploited weaknesses in third-party business applications that Anthropic uses for everyday operations. Anthropic's security testing program disclosed the findings, which allows outside researchers to identify and report vulnerabilities.
Military working dogs charge into places the rest of us would flee. So, I understand why anyone would want to breed tougher, healthier dogs for the job.
Warhound, a new startup from Colossal Biosciences co-founder Ben Lamm and Anduril co-founder Palmer Luckey, has stepped out of stealth with $200 million to clone and gene-edit working dogs for American troops, police departments, and emergency services (via TechCrunch).
AI can describe a picture, identify objects, and answer questions about what a camera sees. But when a blind user needs a quick answer, getting an entire spoken essay about the scene isn't exactly helpful. Researchers at the University of Maryland (UMD) have found that AI-powered visual assistance can leave blind users doing too much work to get the information they actually need.
The study, titled Say It My Way: Exploring Control in Conversational Visual Question Answering with Blind Users, examined how people interact with Be My AI, an AI-powered feature of the Be My Eyes app. The researchers found that users often received lengthy descriptions that didn't adequately address their immediate goals, forcing them to ask follow-up questions or find ways to steer the AI towards a more useful answer.