Notices by Joseph Cox (josephcox@infosec.exchange)

New from 404 Media: a Musk ally has demanded administrative access to Notify.gov, a system that lets the government text the public. The access would give them large swathes of the publics' personal data too. A worker has resigned in protest rather than give access https://www.404media.co/musk-ally-demands-admin-access-to-system-that-lets-government-text-the-public/

New from 404 Media: anyone can push updates to the Doge.gov site. Two sources independently found the issue, one made their own decision to deface the site. "THESE 'EXPERTS' LEFT THEIR DATABASE OPEN."

https://www.404media.co/anyone-can-push-updates-to-the-doge-gov-website-2/

New from 404 Media: inside the gov meeting where Musk ally laid out plans for data sharing across gov/AI. We got audio. In the call an employee pushed back and said the plan would be “illegal.” Musk ally said “we should still push forward and see what we can do.” https://www.404media.co/things-are-going-to-get-intense-how-a-musk-ally-plans-to-push-ai-on-the-government/

New from 404 Media: 'forbidden words'. Github commits reveal how software engineers working on behalf of the government are purging federal databases. Shows not just removing terms, but building blunt-force tools to remove banned material https://www.404media.co/forbidden-words-github-reveals-how-software-engineers-are-purging-federal-databases/

Huh, a new declassified CIA guide to sabotaging fascism has suddenly gone viral https://www.404media.co/declassified-cia-guide-to-sabotaging-fascism-is-suddenly-viral/

OpenAI is furious that DeepSeek might have stolen all of the data OpenAI stole from all of us

https://www.404media.co/openai-furious-deepseek-might-have-stolen-all-the-data-openai-stole-from-us/

Meta CEO Mark Zuckerberg “loved” an AI-generated slop image of a horse made out of bread posted by a spam page that also posts AI-generated images of amputated children and circumvents Facebook’s algorithm to link users offsite to ad-laden AI-generated content farms https://www.404media.co/zuckerberg-loves-ai-slop-image-from-spam-account-that-posts-amputated-children/

A bug in Cloudflare (and just the nature of how CDNs work) let an attacker learn the broad location of Discord, Signal, Twitter users by just sending them an image, according to a security researcher. It works because you can then check which Cloudflare data center cached the image https://www.404media.co/cloudflare-issue-can-leak-chat-app-users-broad-location/

New from 404 Media: Meta is laying the narrative groundwork for Trump's mass deportations. Meta now says users can call migrants pieces of trash, vomit, etc. Multiple experts drew parallels to when Facebook contributed to a genocide in Myanmar. Now U.S. https://www.404media.co/meta-is-laying-the-narrative-groundwork-for-trumps-mass-deportations-2/

New: this OnlyFans model publishes her machine learning explainers to both YouTube and Pornhub. Although YouTube may get a million views, that'll generate around $300. The same content posted to Pornhub, with ~30k views, makes $1000. We spoke to her https://www.404media.co/why-this-onlyfans-model-posts-machine-learning-explainers-to-pornhub/

New: the vast majority of traffic, something like 90%, to a nonconsensual nudify app is coming from Meta platforms like Instagram. The nudify app pays for Instagram ads, Instagram gets cash, and drives people to the app. Meta directly helping spread it https://www.404media.co/instagram-ads-send-this-nudify-site-90-percent-of-its-traffic/

New from 404 Media: Meta has deleted trans and nonbinary messenger themes. Comes amid Meta's now allowing users to target trans and gay people, and as Musk says Facebook lifting restrictions on "mainstream discourse"

https://www.404media.co/meta-deletes-trans-and-nonbinary-messenger-themes/

New from 404 Media: data hacked from location giant Gravy reveals thousands of ordinary apps hijacked to steal your location data. Candy Crush, MyFitnessPal, Tinder. Period trackers, prayer apps. Because of how data collected, apps may not even know https://www.404media.co/candy-crush-tinder-myfitnesspal-see-the-thousands-of-apps-hijacked-to-spy-on-your-location/

Thank you Gizmodo for including my perspective on why Musk is an ARPG poser and is probably cheating at Diablo IV, Path of Exile 2. Very very on brand.

https://gizmodo.com/path-of-exile-2-players-call-bullshit-on-elon-musks-video-game-stream-2000548126

404 Media is back for the new year, and just *today* we have published multiple scoops with only four of us reporting, writing, editing.

First: Facebook is censoring its own employees' criticism of hire of UFC head, according to internal messages we got https://www.404media.co/facebook-deletes-internal-employee-criticism-of-new-board-member-dana-white/

Second: hackers have claimed a massive breach of location data company Gravy. This is a beating heart of worldwide phone monitoring, and provides data to the U.S. government. It's a "nightmare" scenario https://www.404media.co/hackers-claim-massive-breach-of-location-data-giant-threaten-to-leak-data/

Third today: police automatic license plate readers are accidentally exposing live feeds to the open internet. So a privacy advocate built a tool that automatically scans the plates and puts them in a spreadsheet to highlight the risk these cameras pose https://www.404media.co/researcher-turns-insecure-license-plate-cameras-into-open-source-surveillance-tool/

Fourth: People are using AI video generator Runway to post extremely violent Minionfied videos to social media. Unfortunately what people are actually using AI for! https://www.404media.co/minion-gore-videos-use-ai-to-post-murder-to-instagram-tiktok-and-youtube/

404 Media is primarily powered by paying subscribers. They get access to all of our articles, bonus podcast stuff every single week, FOIA trainings, more. $10 a month. Subscribe here if you like: http://404media.co/membership/

This is the "nightmare scenario all privacy advocates have feared and warned about." Could leak the locations of people who realistically had no idea they were being tracked through ordinary apps or ads https://www.404media.co/hackers-claim-massive-breach-of-location-data-giant-threaten-to-leak-data/

New from 404 Media: hackers claim massive breach of location data giant Gravy. Gravy gives data to Venntel, which sells it to U.S. government (FBI, DHS, etc). Data includes customer lists, and even peoples' location data. Hackers threatening to publish it https://www.404media.co/hackers-claim-massive-breach-of-location-data-giant-threaten-to-leak-data/

New from 404 Media: Facebook is deleting internal employee criticism of its new board hire UFC president and CEO Dana White. Facebook also deleting internal employee posts asking why the first ones deleted https://www.404media.co/facebook-deletes-internal-employee-criticism-of-new-board-member-dana-white/

New: Instagram has begun testing a feature in which Meta’s AI will automatically generate images of users in various situations and put them into that user’s feed. We confirmed with Meta it's real. https://www.404media.co/instagram-begins-randomly-showing-users-ai-generated-images-of-themselves/

New from 404 Media: Telegram has handed U.S. authorities data on thousands of its users. An absolutely massive spike in data turn overs after the arrest of Telegram CEO Durov.

Was ~100 impacted users to U.S. authorities in October. Now 2253.

https://www.404media.co/telegram-hands-u-s-authorities-data-on-thousands-of-users/