Security News Bites for May 23, 2025
Lazy Passwords Still Prevail
A new study of over 19 billion newly exposed passwords manifests a widespread weak password reuse crisis. Lazy keyboard patterns, such as 123456, still reign supreme, and 94% of passwords are reused or duplicated, data leaks from 2024-2025 reveal. Names like Ana rank as the second most popular component. Only 6 percent of passwords of the 19 billion were unique. If you want to learn more, check out the link. Credit: Cybernews
Good Hackers Earn Over $1 Million at Pwn2Own Berlin
Pwn2Own is a conference where vendors put up bounties for hackers to find bugs and turn them over to the vendors to fix. Hackers compromised everything from VMWare to AI Apps to Office apps like Sharepoint. At least these folks were willing to trade their compromises for cash. Credit: Security Week
Foreign Intelligence Services Recruit Government Workers Fired by DOGE
This is not a big surprise. Foreign intelligence services often try to recruit people with inside knowledge. In this case, it is reported that the UAE wants to jumpstart their AI efforts. What a better way than to hire the entire Defense Digital Service team that Musk fired. What could possibly go wrong? Nothing illegal – in concept. But we are giving our IP that we spent millions on to foreign governments. Maybe not specific classified information, but the workers can’t forget everything they learned during a career working for the feds. Credit: Zetter-Zeroday
FCC Bars Chinese Firms to Test Electronics for US Consumers
The Federal Communications Commission (FCC) voted on Thursday (4-0) to finalize rules barring Chinese labs deemed a risk to US national security from testing electronic devices such as smartphones, cameras, and computers for use in the United States. The FCC says about 75% of all electronics headed for the US are tested in China; many with deep ties to the CCP. What could possibly go wrong? Credit: Cybernews
Polymorphic Phishing Attacks Flood Inboxes
In 2024, researchers tracked one malicious email every 42 seconds. Many of the attacks were part of polymorphic phishing attacks. Polymorphic malware changes subject lines, sender addresses and content in real time, making signature-based anti-virus software useless. Hackers are using AI to send more realistic malicious emails to you and me. This is affecting industries differently. While overall malware only increased by 8 percent in the finance industry, malware is up 663 percent in construction. Credit: Helpnet Security
by 