Apple won’t build a backdoor – yet iOS apps leak secrets anyway 

Posted in Commentary with tags on March 20, 2025 by itnerd

Apple’s UK encryption rollback has reignited the global debate on privacy. But while all eyes are on government backdoors, the latest Cybernews research exposes an even bigger risk – iOS apps are leaking sensitive data at scale, and Apple isn’t doing much if anything to stop it.

Last week, the Cybernews research team revealed that 71% of 156,000 iOS apps are leaking hardcoded secrets – a serious security flaw with major implications for businesses and consumers.

Now, their latest report dives deeper into the top 10 most commonly exposed secrets and why they pose a significant risk to user data, whether owned by consumers or businesses.

Here’s a quick look at the top 3 threats for businesses and individuals:

  • Project ID (Google) exposes app resources, logs, and potentially weakly secured services, increasing the likelihood of data breaches.
  • Google App ID can be used to impersonate apps, granting unauthorized access to user data, APIs, and backend systems.
  • API Keys (Google): if exposed, these can lead to unauthorized service access, risking data loss, tampering, and breaches of user privacy.

This is the first research of its kind at this scale – no one has ever published even approximate findings on Apple’s secret leaks before. These findings raise a bigger question: is Apple’s App Store security review failing to catch these weak spots? 

With stolen credentials linked to 31% of all breaches and an increasing reliance on mobile devices for sensitive transactions, this is a problem that app users and developers must address.

For more details, including a look at the most sensitive leaked secrets, read the full article here.

10000% VPN Surge in Turkey After Social Media Restrictions

Posted in Commentary with tags on March 20, 2025 by itnerd

VPNMentor just published a report about a staggering increase of VPN demand in Turkey amidst the controversial detention of Istanbul Mayor Ekrem İmamoğlu and after authorities restricted access to social media and messaging platforms across the country.

Their research team conducted an analysis of user demand data in Turkey after authorities restricted access to social media and messaging platforms and VPNMentor detected a surge of 10,104% in VPN demand.

You’ll find all the details to our findings here: https://www.vpnmentor.com/news/turkey-vpn-surge/

Bell Pure Fibre 8 Gbps now available for business in select areas 

Posted in Commentary with tags on March 20, 2025 by itnerd

Following up on Bell’s previous announcement regarding the re-launch of Bell Pure Fibre 8 Gbps for residential customers, Bell has passed along to me that this high-speed Internet option is now available for businesses in select areas of Ontario and Québec.

This significant speed increase offers businesses enhanced connectivity capabilities, supporting various business needs and applications. Bell Pure Fibre 8 Gbps provides businesses with a powerful Internet solution.

Currently, their 8 Gbps coverage includes the following areas (for residential and businesses):

Ontario:

  • Toronto, GTA (stretching from Ajax/Whitby to Brampton/Mississauga)
  • Ottawa and surrounding suburban areas (i.e., Kanata, Orleans)
  • London
  • Guelph
  • Kitchener
  • Georgetown

Quebec:

  • Montreal, Laval and GMA (Greater Montreal Area)
  • Québec City
  • Levis

Their 8 Gbps coverage will continue to expand, customers (whether residential or business) are encouraged to check Bell.ca regularly to see if they qualify.

Businesses interested in exploring this high-speed option can also learn more and review available plans by visiting Bell.ca/smallbusiness.

Guest Post: SAP Concur Delivers Joule, American Express Integration at Fusion 2025

Posted in Commentary with tags on March 20, 2025 by itnerd

At SAP Concur Fusion 2025 today, we are bringing together customers and partners to explore how SAP Concur delivers AI, and greater visibility, to travel and expense management. At the event, we’re debuting new product innovations and strategic partnerships that harness AI, enhance visibility, automate tasks, and drive compliance—unlocking new efficiencies, spend insights, and improved employee experiences.

SAP Concur Debuts Joule with Concur Travel and Expense

SAP is transforming the way businesses run with Joule, its generative AI copilot. Now, this evolution will extend to business travel and expense management. SAP is embedding Joule in SAP Concur solutions, bringing the portfolio one step closer toward a fully automated travel and expense management process. In Concur Expense, Joule helps to ensure that expense reports are ready for submission with minimal effort. For example, Joule can assemble a timeline view of expenses, review for mistakes or missing expenses, and make recommendations for how best to complete the expense report. Additionally, Joule can answer employees’ questions so they no longer have to search through Concur Expense or the SAP Help portal, resulting in fewer support cases and improved efficiency for both employees and administrators. Joule with Concur Expense is expected to be generally available in the second quarter 2025.

SAP Concur also will embed Joule in Concur Travel initially to help with planning locations for offsite meetings. Joule can provide meeting location recommendations and high-level flight and hotel cost estimates based on meeting attendees’ origination points. Once the meeting site and hotel options are selected, Joule will create an email template to send to team members with a link to book directly in Concur. Joule with Concur Travel is available now as part of the early adopter program with general availability expected later this year.

Automating Expense Management in Concur Expense

SAP Concur and American Express (Amex) are expanding their partnership to simplify expense management for shared customers. One-third of SAP Concur customers use the Amex corporate card to capture expense transactions. To streamline the end-to-end experience, SAP Concur and Amex are launching a real-time authorization data capability whereby American Express Corporate Card purchases automatically generate and categorize expenses, starting with meal transactions, in Concur Expense at the time of spend. This integration will include real time mobile notifications via the Concur mobile app that alerts the employee with expense policy reminders in the moment to help drive policy adherence and minimize manual effort.

The most common type of expense submitted within Concur Expense is meals. In fact, a quarter of all expenses are meals, which is why the capability will first be available for meal expenses. For example, when users purchase lunch with their Amex Corporate Card, an expense entry is automatically created and the user can be notified if additional information is required, such as capturing the receipt image or adding attendees.

SAP Concur is on a journey to fully automate the expense management process, from purchase to reimbursement. Last year, we took a big step with our partnership with Mastercard. With the integration, meal expenses purchased with participating Mastercard corporate cards are automatically populated in Concur Expense, and alerts are issued if any additional information is needed.

We’ve heard from customers that they love the hands-free experience, commenting:

  • The automation is really nice, and keeps the trips organized.
  • Much faster data, and less time organizing expense reports.
  • Solicits faster receipt capture while reducing duplicate risk.

We’re working to expand access to the integration so more Mastercard customers can benefit from a simpler and more efficient experience.

“At SAP Concur, we’re creating a world where travel and expenses practically manage themselves,” said Brian Veloso, Managing Director at SAP Concur Canada. “We continue to deliver on that journey with these touchless experiences enabled by industry-leading generative AI and close partnerships with top payment providers.”

Additionally, American Express Global Business Travel has integrated its hotel marketplace, featuring over 2 million properties across 180 countries with competitive rates, into the new Concur Travel solution, providing customers access to comprehensive hotel content, including negotiated programs and preferred partner rates.

With its Concur Travel and Expense solutions, SAP remains the market share leader for worldwide travel and expense management software, with 49.6 percent 2023 market share [source: IDC]. These leading solutions are part of the SAP Business Suite, SAP’s comprehensive portfolio of integrated solutions that combines our core Cloud ERP and Line of Business applications, fueled by the world’s most powerful business data and actionable AI.

“We are redefining the business travel experience, raising the bar for integrated travel and expense management like never before with the power of SAP Business AI,” said Brian Veloso, Managing Director at SAP Concur Canada. “It’s exciting to see our large, global customer base benefit from continual innovations that enhance the user experience and serve the needs of travelers, travel managers and CFOs.”

To learn more about announcements at SAP Concur Fusion or to join the virtual event visit here.

Pennsylvania State Education Association notifies 500K people of data breach VIA a ransomware gang

Posted in Commentary with tags on March 19, 2025 by itnerd

The Pennsylvania State Education Association this week confirmed it notified 517,487 people of a July 2024 data breach that compromised the following personal info including SSNs, passwords, routing numbers, credit/debit card numbers, and a lot more. 

Ransomware gang Rhysida claimed responsibility for the breach in September 2024 but the PSEA has not yet verified Rhysida’s claim.

In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote: 

“Rhysida is thought to have ties to the ransomware group Vice Society and first surfaced in May 2023. Its ransomware can steal data and lock down targeted systems. It then demands a ransom both for deleting stolen data and for a key to restore infected systems. Rhysida has claimed 82 confirmed ransomware attacks since it began, compromising more than 5.3 million records. Its average ransom demand is $1.08 million.”

“Ransomware attacks can both steal data and lock down computer systems. Organizations are then forced to either pay a ransom or face extended downtime, data loss, and putting data subjects at increased risk of fraud.”

“In 2024, Comparitech researchers logged 74 confirmed ransomware attacks on the US education sector, 72 of which were against schools and colleges. These attacks compromised more than 3 million records in total. Rhysida’s attack on the PSEA is the third-largest of the year by number of records affected. The largest such attacks in 2024 were on Texas Tech University Health Sciences Center (1.5 million) and Chicago Public Schools (700,000).”

“In 2025 so far, we are tracking nine confirmed ransomware attacks on US education, plus another 31 unconfirmed claims that haven’t been acknowledged by the targeted organizations.”

This is yet another bad situation where a threat actor is about to cause lots of misery to lots of people for many years to come. That illustrates why we all need to wrap our heads around protecting organizations from threat actors who mean to do harm to us all.

StilachiRAT Targeting Credentials and Crypto Wallets Warns Microsoft

Posted in Commentary with tags on March 19, 2025 by itnerd

News of a novel remote access trojan named StilachiRAT, which Microsoft has warned employs advanced techniques to sidestep detection and persist within target environments.

In November 2024, Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) we named StilachiRAT that demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data. Analysis of the StilachiRAT’s WWStartupCtrl64.dll module that contains the RAT capabilities revealed the use of various methods to steal information from the target system, such as credentials stored in the browser, digital wallet information, data stored in the clipboard, as well as system information.

Microsoft has not yet attributed StilachiRAT to a specific threat actor or geolocation. Based on Microsoft’s current visibility, the malware does not exhibit widespread distribution at this time. However, due to its stealth capabilities and the rapid changes within the malware ecosystem, we are sharing these findings as part of our ongoing efforts to monitor, analyze, and report on the evolving threat landscape.

Erich Kron, Security Awareness Advocate at KnowBe4, has the following comments:

“People who work or play in the cryptocurrency world are significant targets for bad actors due to the unregulated nature of the funds, the possibility for anonymity, and the fact that once a transaction is complete, unlike with wire transfers or other more traditional methods, there is no way to undo it.”

“As cryptocurrency continues to become more mainstream, attackers will adjust their tactics as they refine their efficiency and speed. Many people just getting started with cryptocurrency are not familiar with its pitfalls, and are sometimes excited to make a profit, so they take foolish risks.”

“For those people dealing with cryptocurrency, it is important that accounts use extremely strong passwords that are unique and impossible to guess. In addition, accounts should be protected by MFA, and the individuals should educate themselves about common cryptocurrency scams and cyberattack methods.”

This is all good advice not just for anyone in the crypto space, but in general. Things like MFA and strong passwords are going to mitigate threat actors like this one from carrying out attacks of any sort. Crypto related or not.

5 Miles Lab Data Leaked To The Web

Posted in Commentary with tags on March 19, 2025 by itnerd

Recently, the Safety Detectives Cybersecurity Team stumbled upon a forum post on the clear web where a threat actor posted a link to a database allegedly belonging to 5 Miles Lab, a digital advertising company that contained 8.3 million lines of their corporate inbox information. Which of course is bad.

You can see the full report here: https://www.safetydetectives.com/news/5mileslab-leak-report/

Bad News For Tesla Owners… Your Data Has Been Leaked And There’s Only One Way To Fix That

Posted in Commentary with tags on March 19, 2025 by itnerd

The owners of Telsa cars have had their personal data leaked. 404 Media is reporting that a website called DOGEQWEST which is a direct shot at Elon Musk’s involvement in the activities of the Trump Administration has posted what it claims to be a searchable map of the names, addresses and other personally identifiable information of every Tesla owner in the USA. And to make things even more interesting, if you want to call it that, the only way to get your name removed is to prove to the website’s operators that you’ve sold your Tesla.

Now it isn’t clear how accurate this data is, or how this data was obtained. But 404 Media has confirmed that at least some of the data is accurate. On top of that, while the website doesn’t openly advocate violence, the cursor for the website is a Molotov cocktail and it says stuff like this:

Under a heading that reads “Is DOGEQUEST a protest platform?” the website says “If you’re on the hunt for a Tesla to unleash your artistic flair with a spray can, just step outside—no map needed! At DOGEQUEST, we believe in empowering creative expressions of protest that you can execute from the comfort of your own home.”

So clearly this site is meant to twist the screws on Elon by making the brand so toxic that people avoid it and Elon loses money. The thing is that if someone wants to target Elon because they don’t like him or his political views, then they should target Elon and leave Tesla owners out of this. There’s no way that posting personally identifiable information about Tesla owners for any random human that wants to make a political point can be considered to be acceptable. Thus I really hope either the people who run this site have a change of heart (unlikely I know), or they get a visit from a three letter agency. Because this isn’t cool at all.

Kite Mobility Debuts Oakville’s First All-Electric Rideshare Hub at The Saw Whet by Caivan

Posted in Commentary with tags on March 19, 2025 by itnerd

Kite Mobility has announced the launch of its first all-electric rideshare hub in Oakville, located at The Saw Whet by Caivan. This marks a major step in expanding sustainable transportation options in the region, offering residents convenient, cost-effective, and eco-friendly alternatives to car ownership.

Residents at The Saw Whet can now access a BMW i4 electric vehicle, available exclusively for their use. In the coming months, the fleet will expand to include additional electric cars (EV’s), and electric bikes (e-bikes), providing a comprehensive shared mobility solution tailored to urban living. Through Kite’s user-friendly mobile app, residents can seamlessly book vehicles, manage payments, and enjoy 24/7 access to the fleet.

With transportation accounting for nearly 25% of Canada’s greenhouse gas emissions, Kite’s electric rideshare platform plays a vital role in fostering greener communities. By integrating electric ridesharing into The Saw Whet’s lifestyle amenities, residents can reduce their carbon footprint while enjoying effortless access to premium EVs.

A Smarter, More Sustainable Way to Get Around

Kite’s electric rideshare service is designed to be seamless and cost-effective, featuring:

  • Flexible booking through the Kite app
  • 24/7 availability for resident-exclusive vehicles
  • No added maintenance, insurance, or fuel costs for users
  • Unlimited mileage within the service area
  • Affordable, pay-per-use pricing, offering significant savings compared to traditional car ownership

To celebrate the launch, Kite Mobility is offering an exclusive promotion to residents at The Saw Whet: enjoy the first ride free—up to one hour.

Join the Movement Toward Greener Cities

The Saw Whet, located at 2501 Saw Whet Blvd, provides a perfect setting for Kite Mobility’s services, blending modern design with the natural beauty of Bronte Creek Provincial Park and the Fourteen Mile Creek Natural Heritage System. The addition of an EV-sharing hub further enhances The Saw Whet’s reputation as a community at the forefront of sustainable urban living.

For more information about Kite Mobility or to download the Kite mobile app, visit www.kitemobility.io.

Hitachi Vantara Introduces Hitachi iQ M Series, a Modular Design with Hybrid Cloud Data Orchestration for GenAI and Industry-Specific Workloads

Posted in Commentary with tags on March 18, 2025 by itnerd

Hitachi Vantara, the data storage, infrastructure, and hybrid cloud management subsidiary of Hitachi, Ltd., announced Hitachi iQ M Series, the latest addition to the Hitachi iQ portfolio of AI-ready infrastructure solutions. This new solution provides a lower entry cost with built-in adaptability and scalability as customer needs evolve. Integrating accelerated computing platforms with robust networking, Hitachi iQ M Series combines Hitachi Vantara Virtual Storage Platform One (VSP One) storage, integrated file system choices, and optional NVIDIA AI Enterprise software into a scalable, adaptable, cost-effective AI infrastructure solution.

For more information on Hitachi iQ, please visit: https://www.hitachivantara.com/en-us/solutions/ai-analytics/hitachi-iq

The rise of generative AI and the explosion in data processing power are pushing the pace of change. As more businesses adopt AI, the rapid increase in training costs and data management presents significant challenges. The Hitachi iQ M Series allows for a choice of NVIDIA accelerating computing platforms to select the most suitable GPU for specific workloads to ensure optimal performance across different AI applications. The solution allows for the scaling of compute and storage independently with the flexibility to adapt to diverse and fluctuating data sizes, data types, and workloads, meaning businesses can allocate resources efficiently, scaling compute or storage as needed rather than overprovisioning, and reducing unnecessary expenses.

Additionally, Hitachi iQ is integrating the NVIDIA AI Data Platform reference design, created to power the era of enterprise agentic AI. Using the design, Hitachi Vantara will integrate its premier enterprise-grade storage with NVIDIA’s accelerated computing, networking, and AI software to enable AI agents with near real-time business insights. This ensures that Hitachi Vantara customers will benefit from the highest standard for performance and reliability, seamlessly powering their most critical AI applications and transforming their data into actionable insights. Through its continued collaboration with NVIDIA, Hitachi Vantara will continue to innovate its AI-ready infrastructure, reshaping how organizations manage and use data, closing the gap between AI agents and business knowledge.

As a part of the Hitachi iQ portfolio, M Series features flexible configurations using NVIDIA accelerated computing and a choice of a high-performance file system or a global namespace file system. There is also an optional object storage repository available within the Hitachi iQ portfolio. As a result, the M Series can handle the various data types, sizes, and workload demands, making it ideal for businesses operating in dynamic and data-intensive environments.

Hitachi iQ Powered by Hammerspace and VSP One

Additionally, to bolster the data orchestration power of Hitachi iQ, Hitachi Vantara has entered into a strategic resell agreement with Hammerspace, a fast-growing software company that is radically changing how data is used and preserved. Through the agreement, Hitachi Vantara has integrated Hammerspace software with the VSP One storage platform, expanding Hitachi iQ’s capabilities to address different data management requirements for dataset creation, processing, governance and protection. The joint VSP One and Hammerspace solution ensures distributed data is easily and transparently accessible from anywhere for GenAI workloads. As a result, Hitachi iQ represents a complete infrastructure solution for AI, GenAI, analytics, and data lake environments across a range of industry-specific use cases.

The Hitachi iQ portfolio of AI-ready infrastructure, solutions, and services is among the most comprehensive, end-to-end AI enablement tools available today. The portfolio includes an AI Discovery Service designed to help customers identify the most valuable AI use cases, assess their data readiness, determine ROI, and create a strategic roadmap for successful AI implementation.

For more information on Hitachi Vantara, please visit: hitachivantara.com.