New Release: Tor Browser 12.5.6

https://blog.torproject.org/new-release-tor-browser-1256/ 

 Exploit released for Microsoft SharePoint Server auth bypass flaw

https://www.bleepingcomputer.com/news/security/exploit-released-for-microsoft-sharepoint-server-auth-bypass-flaw/ 

 What is PPTP? Understanding this VPN protocol

https://adguard.com/en/blog/what-is-pptp-protocol.html 

 ShinyHunters member pleads guilty to $6 million in data theft damages

https://www.bleepingcomputer.com/news/security/shinyhunters-member-pleads-guilty-to-6-million-in-data-theft-damages/ 

 Encrypted Client Hello - the last puzzle piece to privacy

https://blog.cloudflare.com/announcing-encrypted-client-hello/ 

 Kia and Hyundai Blame TikTok and Instagram For Their Cars Getting Stolen

https://www.vice.com/en/article/bvj5jv/kia-and-hyundai-blame-tiktok-and-instagram-for-their-cars-getting-stolen 

 Meta's new AI assistant trained on public Facebook and Instagram posts

https://www.reuters.com/technology/metas-new-ai-chatbot-trained-public-facebook-instagram-posts-2023-09-28/ 

 Lazarus hackers breach aerospace firm with new LightlessCan malware

https://www.bleepingcomputer.com/news/security/lazarus-hackers-breach-aerospace-firm-with-new-lightlesscan-malware/ 

 The Growing Threat of Cybercrime Law Abuse: LGBTQ+ Rights in MENA and the UN Cybercrime Draft Convention

https://www.eff.org/deeplinks/2023/09/growing-threat-cybercrime-law-abuse-lgbtq-rights-mena-and-un-cybercrime-draft 

 Watch EFF's Talks from DEF CON 31

https://www.eff.org/deeplinks/2023/09/catch-effs-talks-def-con-31 

 Progress warns of maximum severity WS_FTP Server vulnerability

https://www.bleepingcomputer.com/news/security/progress-warns-of-maximum-severity-ws-ftp-server-vulnerability/ 

 Bing Chat responses infiltrated by ads pushing malware

https://www.bleepingcomputer.com/news/security/bing-chat-responses-infiltrated-by-ads-pushing-malware/ 

 FBI: Dual ransomware attack victims now get hit within 48 hours

https://www.bleepingcomputer.com/news/security/fbi-dual-ransomware-attack-victims-now-get-hit-within-48-hours/ 

 CalyxOS: Fairphone 5 will be supported

https://calyxos.org/news/2023/09/28/fp5-support-future/ 

 How To Turn Off Google’s “Privacy Sandbox” Ad Tracking—and Why You Should

https://www.eff.org/deeplinks/2023/09/how-turn-googles-privacy-sandbox-ad-tracking-and-why-you-should 

 J&K Police gets ‘free access’ to track anti-national elements on social media

https://www.greaterkashmir.com/latest-news/jk-police-gets-free-access-to-track-anti-national-elements-on-social-media 

 How to hide photos on iPhone, iPad, and Android

https://proton.me/blog/hide-photos-ios-android 

 Divided oversight panel recommends new limits for Section 702 searches

https://therecord.media/divided-privacy-panel-recommends-limits-for-section-702-searches 

 Food Delivery Robots Are Feeding Camera Footage to the LAPD, Internal Emails Show

https://www.404media.co/serve-food-delivery-robots-are-feeding-camera-footage-to-the-lapd-internal-emails-show/ 

 Cisco urges admins to fix IOS software zero-day exploited in attacks

https://www.bleepingcomputer.com/news/security/cisco-urges-admins-to-fix-ios-software-zero-day-exploited-in-attacks/ 

 Cisco Catalyst SD-WAN Manager flaw allows remote server access

https://www.bleepingcomputer.com/news/security/cisco-catalyst-sd-wan-manager-flaw-allows-remote-server-access/ 

 Norway seeks to extend ban on Meta’s consentless tracking ads across the EU

https://techcrunch.com/2023/09/28/norway-meta-ads-edpb-referral/ 

 How the “Surveillance AI Pipeline” Literally Objectifies Human Beings

https://www.404media.co/how-the-surveillance-ai-pipeline-literally-objectifies-human-beings/ 

 Budworm hackers target telcos and govt orgs with custom malware

https://www.bleepingcomputer.com/news/security/budworm-hackers-target-telcos-and-govt-orgs-with-custom-malware/ 

 India gov’t to propose setting up a separate body for vast data management, draft bill shows

https://techcrunch.com/2023/09/28/india-national-data-management-office/ 

 Pay Threema’s Android App with Cash and Remain Anonymous

https://threema.ch/en/blog/posts/cash 

 How to encrypt a zip file

https://proton.me/blog/encrypt-zip-file 

 Google User Data Has Become a Favorite Police Shortcut

https://archive.ph/Kucti 

 New York bans facial recognition in schools after report finds risks outweigh potential benefits

https://apnews.com/article/facial-recognition-banned-new-york-schools-ddd35e004254d316beabf70453b1a6a2 

 New laws will give Australians the right to sue for ‘serious’ breaches of privacy

https://www.theguardian.com/australia-news/2023/sep/27/australia-sue-breach-of-privacy-laws-new-reforms 

 Google fixes fifth actively exploited Chrome zero-day of 2023

https://www.bleepingcomputer.com/news/security/google-fixes-fifth-actively-exploited-chrome-zero-day-of-2023/ 

 SSH keys stolen by stream of malicious PyPI and npm packages

https://www.bleepingcomputer.com/news/security/ssh-keys-stolen-by-stream-of-malicious-pypi-and-npm-packages/ 

 Fake Bitwarden sites push new ZenRAT password-stealing malware

https://www.bleepingcomputer.com/news/security/fake-bitwarden-sites-push-new-zenrat-password-stealing-malware/ 

 Building automation giant Johnson Controls hit by ransomware attack

https://www.bleepingcomputer.com/news/security/building-automation-giant-johnson-controls-hit-by-ransomware-attack/ 

 Building automation giant Johnson Controls hit by ransomware attack

https://www.bleepingcomputer.com/news/security/building-automation-giant-johnson-controls-hit-by-ransomware-attack/ 

 Security researcher warns of chilling effect after feds search phone at airport

https://techcrunch.com/2023/09/27/sam-curry-chilling-effect-phone-search-airport/ 

 This startup wants to verify your ID without storing your personal data

https://techcrunch.com/2023/09/27/this-startup-wants-to-verify-your-id-without-storing-your-personal-data/ 

 Reddit is removing the option to prevent Reddit from tracking users to deliver advertising

https://www.reddit.com/r/reddit/comments/16tqihd/settings_updateschanges_to_ad_personalization/ 

 The Maker of ShotSpotter Is Buying the World’s Most Infamous Predictive Policing Tech

https://www.wired.com/story/soundthinking-geolitica-acquisition-predictive-policing/ 

 Russian zero-day seller offers $20M for hacking Android and iPhones

https://techcrunch.com/2023/09/27/russian-zero-day-seller-offers-20m-for-hacking-android-and-iphones/ 

 Government to overhaul privacy laws, including opting out of advertising, a right to be forgotten, and new rules for small businesses

https://www.abc.net.au/news/2023-09-28/government-agrees-to-sweeping-privacy-reforms/102912458 

 China lists mobile app stores that comply with new rule, but Apple missing

https://www.reuters.com/world/china/china-enforces-new-filing-rules-smartphone-app-stores-2023-09-27/ 

 Google Search caught publicly indexing users’ conversations with Bard AI

https://venturebeat.com/ai/oops-google-search-caught-publicly-indexing-users-conversations-with-bard-ai/ 

 GitHub repos bombarded by info-stealing commits masked as Dependabot

https://www.bleepingcomputer.com/news/security/github-repos-bombarded-by-info-stealing-commits-masked-as-dependabot/ 

 Hack of Egyptian Politician’s iPhone Tied to Tech Firm Sandvine

https://www.bloomberg.com/news/articles/2023-09-26/tech-firm-sandvine-tied-to-hack-of-egyptian-politician-s-iphone?accessToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzb3VyY2UiOiJTdWJzY3JpYmVyR2lmdGVkQXJ0aWNsZSIsImlhdCI6MTY5NTgxMzcxMywiZXhwIjoxNjk2NDE4NTEzLCJhcnRpY2xlSWQiOiJTMUxLRUREV1JHRzAwMSIsImJjb25uZWN0SWQiOiJENTY5QzIyNzE4NUM0NkM4OTgxMjBGMUI2QTBFNDIwQSJ9.F5TTq1VUG1c9U7MqAZHAHY4l_iV6EMWD5Ni0uTOtIMs 

 FIDO2 WebAuthn 2FA now in all Bitwarden plans including free

https://bitwarden.com/blog/fido2-webauthn-2fa-in-all-bitwarden-plans/ 

 Chat Control Criticism: Why the EU CSAM Scanning Plans Must Fail.

https://tutanota.com/blog/chat-control-criticism 

 All is not lost, but Europe is still split on encryption

https://proton.me/blog/eu-council-encryption-vote-delayed 

 Google quietly corrects previously submitted disclosure for critical webp 0-day

https://arstechnica.com/security/2023/09/google-quietly-corrects-previously-submitted-disclosure-for-critical-webp-0-day/ 

 New ZeroFont phishing tricks Outlook into showing fake AV-scans

https://www.bleepingcomputer.com/news/security/new-zerofont-phishing-tricks-outlook-into-showing-fake-av-scans/ 

 EFF, ACLU and 59 Other Organizations Demand Congress Protect Digital Privacy and Free Speech

https://www.eff.org/deeplinks/2023/09/eff-aclu-and-59-other-organizations-demand-congress-protect-digital-privacy-and 

 New Release: Tor Browser 12.5.5

https://blog.torproject.org/new-release-tor-browser-1255/ 

 GPUs from all major suppliers are vulnerable to new pixel-stealing attack

https://arstechnica.com/security/2023/09/gpus-from-all-major-suppliers-are-vulnerable-to-new-pixel-stealing-attack/ 

 With a New Commissioner, FCC Will Finally Try to Reinstate Net Neutrality

https://gizmodo.com/rosenworcel-fcc-reinstate-net-neutrality-1850873109 

 Windows 11 22H2 adds a built-in passkey manager for Windows Hello

https://www.bleepingcomputer.com/news/microsoft/windows-11-22h2-adds-a-built-in-passkey-manager-for-windows-hello/ 

 Signal’s Meredith Whittaker: AI is fundamentally ‘a surveillance technology’

https://techcrunch.com/2023/09/25/signals-meredith-whittaker-ai-is-fundamentally-a-surveillance-technology/ 

 Google assigns new maximum rated CVE to libwebp bug exploited in attacks

https://www.bleepingcomputer.com/news/security/google-assigns-new-maximum-rated-cve-to-libwebp-bug-exploited-in-attacks/ 

 New AtlasCross hackers use American Red Cross as phishing lure

https://www.bleepingcomputer.com/news/security/new-atlascross-hackers-use-american-red-cross-as-phishing-lure/ 

 FBI Agents Are Using Face Recognition Without Proper Training

https://www.wired.com/story/fbi-agents-face-recognition-without-proper-training/ 

 The U.S. Government’s Database of Immigrant DNA Has Hit Scary, Astronomical Proportions

https://www.eff.org/deeplinks/2023/09/us-governments-database-immigrant-dna-has-hit-scary-astronomical-proportions 

 Xenomorph Android malware now targets U.S. banks and crypto wallets

https://www.bleepingcomputer.com/news/security/xenomorph-android-malware-now-targets-us-banks-and-crypto-wallets/ 

 A ransomware group claims to have breached ‘all Sony systems’

https://www.videogameschronicle.com/news/a-ransomware-group-claims-to-have-beached-all-sony-systems/ 

 Facial recognition technology jailed a man for days. His lawsuit joins others from Black plaintiffs

https://apnews.com/article/mistaken-arrests-facial-recognition-technology-lawsuits-b613161c56472459df683f54320d08a7 

 Decade of newborn child registry data stolen in MOVEit mass-hack

https://techcrunch.com/2023/09/25/decade-of-newborn-child-registry-data-stolen-in-moveit-mass-hack/ 

 Mixin Network suspends operations following $200 million hack

https://www.bleepingcomputer.com/news/security/mixin-network-suspends-operations-following-200-million-hack/ 

 The End of Privacy is a Taylor Swift Fan TikTok Account Armed with Facial Recognition Tech

https://www.404media.co/the-end-of-privacy-is-a-taylor-swift-fan-tiktok-account-armed-with-facial-recognition-tech/ 

 New stealthy and modular Deadglyph malware used in govt attacks

https://www.bleepingcomputer.com/news/security/new-stealthy-and-modular-deadglyph-malware-used-in-govt-attacks/ 

 ‘Who Benefits?’ Inside the EU’s Fight over Scanning for Child Sex Content

https://balkaninsight.com/2023/09/25/who-benefits-inside-the-eus-fight-over-scanning-for-child-sex-content/ 

 A Tricky New Way to Sneak Past Repressive Internet Censorship

https://www.wired.com/story/equalitie-trojan-horse-internet-censorship/ 

 iOS 17 Security & Privacy

https://firewallsdontstopdragons.com/ios-17-security-privacy/ 

 We have reactivated our subreddit for those who use Reddit and are in need of a privacy community: https://www.reddit.com/r/thenewoil/

We are looking into adding privacy-focused alternatives for this community in the near future. 

 Troy Hunt scours the dark web for your stolen data — but he's just trying to help

https://www.abc.net.au/news/2023-09-23/cybersecurity-troy-hunt-have-i-been-pwned-fighting-data-breaches/102803748 

 Will U.K. Online Safety Bill Break Encryption For Mass Surveillance?

https://www.forbes.com/sites/stewartroom/2023/09/21/will-uk-online-safety-bill-break-encryption-for-mass-surveillance/ 

 The Man Who Trapped Us in Databases

https://www.nytimes.com/2023/09/22/magazine/hank-asher-data.html 

 The Bizarre Cottage Industry of YouTube Obituary Pirates

https://www.wired.com/story/youtube-obituary-pirates/ 

 Evasive Gelsemium hackers spotted in attack against Asian govt

https://www.bleepingcomputer.com/news/security/evasive-gelsemium-hackers-spotted-in-attack-against-asian-govt/ 

 National Student Clearinghouse data breach impacts 890 schools

https://www.bleepingcomputer.com/news/security/national-student-clearinghouse-data-breach-impacts-890-schools/ 

 Philips Hue will force users to upload their data to Hue cloud

https://www.home-assistant.io/blog/2023/09/22/philips-hue-force-users-upload-data-to-cloud/ 

 China’s quest for human genetic data spurs fears of a DNA arms race

https://www.adn.com/nation-world/2023/09/22/chinas-quest-for-human-genetic-data-spurs-fears-of-a-dna-arms-race/ 

 Dropout Risk System Under Scrutiny After The Markup Report

https://themarkup.org/hello-world/2023/09/23/dropout-risk-system-under-scrutiny-after-the-markup-report 

 Air Canada discloses data breach of employee and 'certain records'

https://www.bleepingcomputer.com/news/security/air-canada-discloses-data-breach-of-employee-and-certain-records/ 

 How the Supreme Court could alter the way Americans interact on the internet

https://www.usatoday.com/story/news/politics/2023/09/22/facebook-x-supreme-court-censorship-coercion-social-media/70796180007/ 

 LastPass: ‘Horse Gone Barn Bolted’ is Strong Password

https://krebsonsecurity.com/2023/09/lastpass-horse-gone-barn-bolted-is-strong-password/ 

 Apologies to all those who have been working on site translations, I haven't been very good at keeping the source documents updated. They have been updated with the latest site update and I will do my best to keep them updated going forward. Thanks for all your help and work. -Nate

https://crowdin.com/project/the-new-oil 

 New Blog Post: 2023 Proton VPN Review

https://blog.thenewoil.org/2023-proton-vpn-review 

 Don’t Fall for the Intelligence Community’s Monster of the Week Justifications

https://www.eff.org/deeplinks/2023/09/dont-fall-intelligence-communitys-monster-week-justifications 

 Dallas says Royal ransomware breached its network using stolen account

https://www.bleepingcomputer.com/news/security/dallas-says-royal-ransomware-breached-its-network-using-stolen-account/ 

 0-days exploited by commercial surveillance vendor in Egypt

https://blog.google/threat-analysis-group/0-days-exploited-by-commercial-surveillance-vendor-in-egypt/ 

 Nigerian man pleads guilty to attempted $6 million BEC email heist

https://www.bleepingcomputer.com/news/security/nigerian-man-pleads-guilty-to-attempted-6-million-bec-email-heist/ 

 On the Cybersecurity Jobs Shortage

https://www.schneier.com/blog/archives/2023/09/on-the-cybersecurity-jobs-shortage.html 

 Quantum Resistance and the Signal Protocol

https://signal.org/blog/pqxdh/ 

 Las Vegas struggles to get back online after cyber attack

https://abcnews.go.com/GMA/News/video/las-vegas-struggles-back-online-after-cyber-attack-103258597 

 BlackCat ransomware hits Azure Storage with Sphynx encryptor

https://www.bleepingcomputer.com/news/security/blackcat-ransomware-hits-azure-storage-with-sphynx-encryptor/