Dr Gerhard Knecht, PhD
2.1K posts
@GerhardKnecht
Cybersec. & Audit VP, Global CISO, Global Head MSS, Prof. Speaker, TV appearance, Top 10 UK security personality 2010, Compliance guru, AI, Followback Security.
Researchers proved that your Android phone is sending data to Google every 4.5 minutes. Even when you opt out of EVERYTHING. Researchers at Trinity College Dublin did an exhaustive deep-dive into exactly how much data iOS and Android devices stealthily transmit back to Apple and Google. Both tech giants are running non-stop telemetry pipelines from your device. Even when you are not logged into an account. Even when you explicitly opt out of data collection. Even when the phone is completely untouched. The sheer volume of data being harvested is staggering. Android sends data back to Google every 4.5 minutes. iOS follows right behind, pinging Apple every 4.5 minutes. Within the first 10 minutes of powering on a fresh device, Android sends roughly 1MB of data to Google. iOS sends about 42KB to Apple. When the phones are just sitting there doing nothing, Google harvests around 1MB of data every 12 hours. Apple collects roughly 52KB. Google is collecting 20x more telemetry data than Apple. But what they are collecting is the real problem. The researchers discovered that your phone isn’t just sending generic system diagnostics. It is sending a highly detailed digital fingerprint: - Hardware serial numbers - Device IMEI numbers - Wi-Fi MAC addresses - Your phone number - SIM card details And it gets darker. iOS uploads the WiFi MAC addresses of every device near you. Your roommate's laptop, the café router, your neighbor's home gateway—all tagged with your exact GPS coordinates. If just one person in your building enables location services once, Apple now knows where every single device on that network lives. Forever. The researchers tried to opt out of everything. They turned off location services, restricted background data, and avoided signing into any accounts. It didn't matter. The data transmission never stopped. The escape hatch has been welded shut. Right now, millions of professionals use these devices to handle sensitive business data, proprietary code, and private operations under the assumption that "idle" means "safe." But the data shows there is no such thing as an offline smartphone anymore. --- Paper: Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google (2021)
Linux users are fighting new United States laws that require computers to ask for your age and share it with apps to keep kids safe online. The laws were made for big companies like Apple and Google but they cause big problems for Linux because it is free open software built by volunteers who care about privacy and freedom. System76 won a special rule in Colorado to skip this, while groups like MX Linux say no and some people have made tools to avoid the age check completely.
U.S. Marines recently proved that low-tech creativity can still defeat cutting-edge military artificial intelligence. In a DARPA field trial, a team of eight Marines was challenged to sneak past a sophisticated AI-powered detection system. Instead of relying on advanced stealth gear or electronic countermeasures, they turned to absurdly simple, almost cartoonish tactics and succeeded Some Marines cartwheeled and rolled across 300 meters of open ground. Others concealed themselves under ordinary cardboard boxes and slowly inched forward. One soldier even disguised himself as a small fir tree, shuffling gradually toward the objective. Remarkably, every Marine reached the target without ever triggering the AI sensors. The system had been trained extensively on normal human walking and running patterns, but it had no reference for these bizarre movements. Because the Marines’ actions fell completely outside the AI’s learned understanding of “human behavior,” they were effectively invisible to it. This exercise offers a timely lesson for the defense sector: no matter how advanced military AI becomes, it can still be outmaneuvered by human ingenuity, unconventional thinking, and old-fashioned manual tactics. This incident serves as a vital reminder for the defense industry that while AI is an incredibly powerful tool, it remains susceptible to creative human deception and the unpredictable nature of manual tactics. source: Scharre, P. (2023). Four Battlegrounds: Power in the Age of Artificial Intelligence. W. W. Norton & Company.
🚨 BREAKING: Toronto Police just seized “SMS Blasters” fake cell towers never seen before in Canada. These portable devices hijack thousands of phones at once, blast fake bank/Canada Post texts, and knock out real service (even 911 calls). Tens of thousands of phones hit. Over 13 MILLION disruptions. Three men charged 🇨🇳 • Dafeng Lin, 27, of Hamilton • Junmin Shi, 25, of Markham • Weitong Hu, 21, of Markham This is next-level cyber crime on our streets. Stay alert. Never click surprise links. #Toronto #CyberCrime #ScamAlert
Anthropic: 250 Documents Can Permanently Corrupt Any AI Model Someone can permanently corrupt any AI model in the world right now. Not by hacking it. Not by breaking its security. By publishing 250 documents on the internet. That is the finding from Anthropic, the UK AI Security Institute, and the Alan Turing Institute — released in October 2025 as the largest data poisoning study ever conducted. Here is what data poisoning actually means. Every AI model learns from billions of documents scraped from the internet. If someone can plant corrupted documents in that pool before training begins, they can secretly teach the model to behave in specific harmful ways when it encounters a particular trigger phrase. The model learns the backdoor during training. It carries it forever. It does not know it is there. Researchers have known about this attack for years. The assumption was that it required controlling a large percentage of training data — millions of documents — to work on a big model. The bigger the model, the more poisoning you would need. This study proved that assumption completely wrong. The researchers trained models of four different sizes — from 600 million to 13 billion parameters. They slipped in either 100, 250, or 500 malicious documents. Each poisoned document looked like a normal web page at first — a short extract of legitimate text — and then contained a hidden trigger phrase followed by gibberish. 100 documents: insufficient. The backdoor did not reliably form. 250 documents: success. Every model, at every size, was permanently backdoored. 500 documents: same result as 250. The number was constant regardless of model size. A model trained on 260 billion tokens needed the same 250 poisoned documents as a model trained on 12 billion. Scale offered zero protection. Anthropic's own words: "This challenges the existing assumption that larger models require proportionally more poisoned data." Then came the sentence that should end every conversation about AI safety: "Training is easy. Untraining is impossible." Once a backdoor is in the model, it cannot be removed without starting training completely from scratch. You cannot identify which 250 documents caused it. You cannot surgically extract the corrupted behavior. You must rebuild the entire model from the beginning. Anyone can publish content to the internet. Academic papers. Blog posts. Forum discussions. Product descriptions. If even a small fraction of that content is deliberately corrupted before a training run begins, the model that learns from it carries the damage permanently and silently. GPT-5. Claude. Gemini. Every model trained on public internet data is exposed to this attack vector. The defense does not exist yet. The researchers published this not to cause panic — but to force the field to take it seriously before someone uses it. Source: Anthropic, UK AISI, Alan Turing Institute (2025) · anthropic.com/research/small… · aisi.gov.uk/blog/examining…
GOOGLE BUILT A SECRET WEAPON FOR FILE DETECTION they ran it internally for years, gmail, drive, safe browsing, hundreds of billions of files every week then they open sourced it it's called magika and it exposes what files really are, not what they pretend to be rename malware to "resume.pdf"? magika sees through it disguise a script as an image? magika sees through it any trick attackers use with file extensions? magika sees through all of it ai trained on 100 million files. 200+ content types. 99% accuracy. 5ms per file one command `pip install magika` the same tool protecting google's billion users is now protecting yours github.com/google/magika
🚨 BREAKING: Scientists just learned how to control magnetism at the atomic level. Not materials. Not circuits. Individual spin patterns. Read that again. Instead of using electric charge… they’re using the spin of electrons to store and process data. And it gets crazier: They can create tiny magnetic whirlpools called skyrmions… that move with almost no energy and can store massive amounts of data This means: Faster computers Lower power usage Ultra-dense memory But the real shift is this: We’re not just building electronics anymore… we’re engineering structure at the smallest possible scale. So the real question is: If information can be stored in spin itself… what limits computation? Follow me I’m tracking where physics becomes technology.
