Author: HackWatchit

The U.S. National Institute of Standards and Technology (NIST) has observed in a discussion essay a growing convergence between OT (operational technology (OT) and IT, driven by the rise of the Internet of Things (IoT) and internet-connected equipment that were once isolated. OT infrastructure covers programmable systems and devices that directly interact with or control the physical environment. Covering industrial control systems (ICS), building automation, transportation networks, access control, and systems for monitoring or measuring physical conditions, these systems have longer life cycles, are sometimes difficult to access, and increasingly connect to broader networks rather than operating in isolation. NIST…

What if I told you this adorable puppy was hiding a secret message? In this post, we’ll find out how this dog was convinced to hide a message for us… and how to learn its secrets. Along the way, we’ll learn a lot about how images work and just enough math to make your high school teacher say “I told you so.” Let’s start with the basics. You might already know some of this, but stick with me here. Computers are really just things that take bits: `01100010 01101100 01100001 01100011 01101011 01101000 01101001 01101100 01101100 01110011 01101001 01101110 01100110…

Cybersecurity researchers at Netcraft have discovered a series of new SEO poisoning related attacks exploiting Google’s search results to spread malicious content and other scams. According to researchers, an “organized” network of attackers is using compromised websites to boost the visibility of malicious content in search rankings. Behind this operation is Hacklink, a black market platform that allows scammers to inject links to phishing pages and fraudulent services into unsuspecting websites, with search engines doing the rest. Hijacked Sites, Invisible Links, Manipulated Results Instead of defacing websites or stealing data, attackers using Hacklink insert invisible code into the source of…

Unknown threat actors have compromised internet-accessible Microsoft Exchange Servers of government organizations and companies around the world, and have injected the organizations’ Outlook on the Web (OWA) login page with browser-based keyloggers, Positive Technologies researchers have warned. The keylogging JavaScript code (Source: Positive Technologies) The initial vector for compromise is unknown The researchers haven’t been able to pinpoint how the attackers gained access to the compromised servers. Some of them were vulnerable to a slew of older vulnerabilities – including ProxyLogon (CVE-2021-26855), the three ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and SMBGhost (CVE-2020-0796) – but others weren’t affected by publicly known…

In May 2025, a sophisticated phishing campaign emerged, impersonating several U.S. state Departments of Motor Vehicles (DMVs). This campaign leveraged widespread SMS phishing (smishing) and deceptive web infrastructure to harvest personal and financial data from unsuspecting citizens. Victims received alarming messages concerning unpaid toll violations and were directed to fake DMV websites that prompted them to resolve the issue by paying a nominal fine. These cloned websites requested extensive personal information and credit card credentials under the guise of verifying user identity. Technical analysis of this campaign uncovered shared infrastructure, consistent domain naming conventions, reused frontend assets, and strong indicators…

The Global Supply Chain Is Already on Fire — We Just Don’t See the Smoke. The global supply chain is not a just a system — it’s a network of fragile interdependencies connected together with trust, timing & software at its very core. Every container, shipyard, import & semi-truck is the result of hundreds of dependencies that span across multiple countries, vendors, suppliers and intermediaries connecting them all. The thin layers of the global supply chain have become increasingly digitized in the past decade with automation, software and AI serving as the new foundation for connected trade. But even today,…

Altman recently shared a concrete figure for the energy and water consumption of ChatGPT queries. According to his blog post, each query to ChatGPT consumes about 0.34 Wh of electricity (0.00034 KWh) and about 0.000085 gallons of water. The equivalent to what a high-efficiency lightbulb uses in a couple of minutes and roughly one-fifteenth of a teaspoon. This is the first time OpenAI has publicly shared such data, and it adds an important data point to ongoing debates about the environmental impact of large AI systems. The announcement sparked widespread discussion – both supportive and skeptical. In this post I…

The UK Information Commissioner’s Office (ICO) has fined genetic testing provider 23andMe £2.31 million ($3.12 million) over ‘serious security failings’ that led to a ‘profoundly damaging’ data breach in 2023. The data protection watchdog said today that 23andMe failed to protect the sensitive data of UK residents who had their genotype data, health reports, and personal information stolen in credential stuffing attacks using stolen login credentials that went unnoticed for five months between April 2023 and September 2023. “This was a profoundly damaging breach that exposed sensitive personal information, family histories, and even health conditions of thousands of people in the…

BBKing // ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques. So I’m working the other day, and my wife asks me why the TV is on. I don’t know. I didn’t turn it on. But it’s near my desk, and I know nobody else turned it on, either. I had been running nmap on my local network to test something…