Matthew Miller, Author at Techbest - Top Tech Reviews In Australia - Page 33 of 92

Google’s Gemini CLI Agent Represents a Concealed Malware Risk

Matthew Miller on July 29, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

  • The Gemini CLI agent from Google is prone to executing covert harmful commands.
  • The flaw was uncovered by security researcher Sam Cox.
  • This vulnerability entails inadequate validation, prompt injection, and confusing user experience.
  • Google has updated the status of the vulnerability to Priority 1, Severity 1.
  • Users are encouraged to upgrade to Gemini 0.1.14 for improved protections.
  • Activating sandboxing can thwart the attack, although it is not set as default.

Grasping the Gemini CLI Weakness

The Google Gemini CLI agent, built to connect with Google’s sophisticated AI language model using textual commands, has been identified to possess a critical vulnerability. Detected by Tracebit security researcher Sam Cox, this flaw permits the execution of harmful commands without the user’s knowledge.

The Detection Method

Cox found the vulnerability via a combination of inadequate validation, prompt injection, and misleading user interface. By inserting a prompt within a README.md file—along with a seemingly harmless Python script—Cox illustrated how credentials could be siphoned off using “env” and “curl” commands to a distant server.

Google’s Action Against the Risk

Initially rated as Priority 2, Severity 4, the vulnerability was reclassified by Google to Priority 1, Severity 1 following further investigation. This reassessment emphasizes the risk of major data breaches and unauthorized access.

Recommended User Measures

Users are strongly encouraged to update to Gemini 0.1.14, which offers new protections against shell code execution. Moreover, enabling sandboxing can provide additional defense to systems, though it is not automatically turned on during installation.

Mitigation Techniques

To reduce the threat posed by this vulnerability, users should promptly update their software and activate sandboxing. Sandboxing establishes an isolated environment that can prevent unauthorized code from impacting the host system.

Significance of Timely Updates

Continuous updates and prompt patching are essential for ensuring the safety of software utilities like the Gemini CLI. Users must remain alert and responsive to any security alerts from developers.

Risk posed by the Gemini CLI agent from Google

Conclusion

The Google Gemini CLI agent exhibits a serious security vulnerability that may enable silent operations of malicious commands. Uncovered by Sam Cox, this problem underscores the need for proper validation and thoughtful user interface design in terms of security. Users are advised to upgrade to the latest version and activate sandboxing for system protection.

Questions and Answers

Q: What is the Google Gemini CLI agent?

A: It serves as a text-oriented command interface meant to connect with Google’s AI large language model.

Q: How was the vulnerability identified?

A: The flaw was uncovered by security researcher Sam Cox through a series of improper validations, prompt injections, and a misleading user experience.

Q: What steps should users follow?

A: Users should upgrade to Gemini 0.1.14 and activate sandboxing to protect against possible threats.

Q: Why is sandboxing significant?

A: Sandboxing creates a separate environment that can stop harmful code from impacting the primary system.

Q: How did Google react to the vulnerability?

A: Google updated the classification of the vulnerability to Priority 1, Severity 1 and encouraged users to refresh their software.

Q: Is the vulnerability resolved in the latest edition?

A: The latest edition, Gemini 0.1.14, comprises protections against shell code execution.

Bluetooth Headphones Wireless in-Ear – Bluetooth 5.3 Hi-Fi Stereo Deep Bass Wireless Headphones Noise Cancelling CVC Wireless Earbuds 35 Hours Playtime 13 mm Driver Earphones Waterproof USB C Review

Matthew Miller on July 29, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Bluetooth Headphones Wireless in-Ear – Bluetooth 5.3 Hi-Fi Stereo Deep Bass Wireless Headphones Noise Cancelling CVC Wireless Earbuds 35 Hours Playtime 13 mm Driver Earphones Waterproof USB C

PHILIPS TAT2149WT Wireless Bluetooth Earbuds Review

Matthew Miller on July 27, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

PHILIPS TAT2149WT Wireless Bluetooth Earbuds – Small Earbuds Great Value Natural Sound with Dynamic Bass, Clear Calls and Pocket Size Charging Case – White

Pink Wireless Earbuds,Bluetooth In Ear Headphone with Microphone Review

Matthew Miller on July 27, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Pink Wireless Earbuds,Bluetooth In Ear Headphone with Microphone Comfort&Lightweight Earbud with Noise Cancellation,3D Surround Stereo,Long Life Portable Mini Charging Case(S/M/L earctips)

Hackers Obtained Clorox Passwords via Basic Social Engineering Techniques, Lawsuit Discloses

Matthew Miller on July 27, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Quick Overview

  • Clorox filed a lawsuit against Cognizant following a cyber attack in 2023.
  • Hackers obtained Clorox passwords through social engineering techniques.
  • The breach caused damages amounting to US$380 million (A$576 million).
  • Scattered Spider hackers deceived IT support desks to gain credentials.
  • The lawsuit emphasizes security shortcomings on Cognizant’s part.

Overview of the Cyber Attack

In August 2023, Clorox, a manufacturer of bleach, encountered a significant cyber attack carried out by the hacking collective known as Scattered Spider. This group is infamous for leveraging social engineering strategies, predominantly aimed at IT support desks to obtain credentials, subsequently exploited for ransomware attacks.

Information on the Lawsuit

Clorox has initiated legal action against its IT service provider, Cognizant, asserting that the hackers accessed sensitive passwords through basic social engineering methods. The lawsuit, lodged in California state court, accuses Cognizant of insufficiently securing Clorox’s network by providing credentials without thorough verification.

Hackers’ Approach and Implementation

The hackers reportedly reached out to the Cognizant Service Desk, seeking access to Clorox’s network. Alarmingly, the service desk released the credentials without applying fundamental verification steps, such as confirming employee identification numbers or verifying the identity of the caller’s supervisor.

Impact of the Breach

The breach resulted in US$380 million (A$576 million) worth of damages to Clorox. This included around US$50 million set aside for recovery efforts, while the remainder was due to Clorox’s inability to supply products to retailers after the attack.

Deficiencies in IT Security

Clorox’s lawsuit highlights various security deficiencies by Cognizant, including improper termination of certain accounts and flawed data recovery methods, which aggravated the breach’s consequences.

Conclusion

The cyber attack on Clorox, executed by the Scattered Spider group, reveals critical weaknesses in IT security protocols. By taking advantage of straightforward social engineering methods, hackers inflicted substantial financial harm and disrupted Clorox’s business operations. The legal action against Cognizant emphasizes the pressing need for strong security practices and comprehensive verification processes in IT services.

Q&A

Q: Why did Clorox decide to take legal action against Cognizant?

A: Clorox sued Cognizant after a cyber attack exposed significant security flaws, enabling hackers to access passwords through social engineering strategies.

Q: In what manner did the hackers infiltrate Clorox’s network?

A: The hackers leveraged social engineering to mislead Cognizant’s IT help desk into providing network credentials without proper verification.

Q: What financial consequences did the attack have on Clorox?

A: The attack led to US$380 million (A$576 million) in damages, comprising US$50 million in recovery expenses and interruptions in product distribution.

Q: What security shortcomings did Clorox point out in their lawsuit?

A: Clorox identified issues such as insufficient account deactivation and faulty data restoration practices, which added to the attack’s impact.

Q: What role does the Scattered Spider group play in this incident?

A: Scattered Spider is a hacking group recognized for employing social engineering to manipulate IT staff, gaining unauthorized access to networks for ransomware purposes.

Denon AH-C830NCW True Wireless in-Ear Headphones Review

Matthew Miller on July 26, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Denon AH-C830NCW True Wireless in-Ear Headphones, Active Noise Cancelling, Water Resistant Earbuds, Crystal Clear Call Quality – White

Sennheiser Momentum Sport Wireless Earbuds Review

Matthew Miller on July 26, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Sennheiser Wireless Earbuds, Momentum Sport, Black, High Performance Driver, 24 Hours Playtime, Hybrid Adaptive Noise Cancelling, Outcoming Sound Capture, Bluetooth 5.2, IP55, Sports Earphones

ACT’s $30 Million Overhaul of HR System Under Review Due to Increasing Employee Turnover

Matthew Miller on July 26, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Quick Overview

  • The ACT government is enhancing its HR system with a budget of $30.7 million.
  • The PC-HRM project is under examination due to elevated staff turnover and cultural challenges.
  • The initiative seeks to supersede prior unsuccessful efforts with SAP SuccessFactors.
  • Agreements with Frontier Software and Accenture are vital aspects of the enhancement.
  • The upgrade is anticipated to be finalized by June 2026, with complete rostering by June 2027.

Insights into the HR System Revamp

The Australian Capital Territory (ACT) government is currently engaged in a major upgrade of its human resources infrastructures, expected to be finished by 2026. This $30.7 million revamp, referred to as the Payroll Capability and Human Resource Management (PC-HRM) project, aims to replace obsolete systems and rectify previous shortcomings with the SAP SuccessFactors integration.

ACT's HR system upgrade encounters hurdles amid personnel shifts

Workforce Turnover and Obstacles in the Project

The project’s personnel includes 143 members, comprising public servants, consultants, and contractors. Yet, notable turnover has been observed, with 35 new hires and 21 exits over a span of two years. Concerns regarding cultural matters, exclusion, and leadership issues have surfaced, leading to scrutiny from ACT Legislative Assembly opposition members.

Officials have cited a variety of reasons for staff departures, including project completions, new opportunities, and personal reasons while reaffirming their dedication to a respectful work environment. An ongoing evaluation is addressing these issues.

The Challenging Journey Toward Modernisation

The PC-HRM initiative follows the failed HRIMS project, which utilized $77.63 million but yielded minimal outcomes. The current endeavor focuses on upgrading the existing systems, streamlining payroll processes, and rolling out self-service features.

Contracts with Frontier Software for system support and Accenture for integration are essential to the project’s development. As of April 2025, $19.13 million has been expended, consistent with the project budget.

Prospects and Completion Schedule

Despite changes in workforce, the ACT government assures that the primary payroll and HR platform enhancements are on track for completion by June 2026. A rostering and attendance solution for the entire ACT public service is forecasted for June 2027. The complexity of the project maintains it at an “amber” status, indicating ongoing challenges and risks.

Conclusion

The ACT government’s $30.7 million HR system enhancement aims to modernise and centralise payroll and HR functions. While it confronts scrutiny over staff turnover and cultural concerns, the project is progressing towards completion by 2026, with a comprehensive rostering solution by 2027. Key collaborations with Frontier Software and Accenture are crucial to this multifaceted upgrade.

Q&A Segment

Q: What is the financial allocation for the ACT’s HR system enhancement?

A: The financial allocation for the Payroll Capability and Human Resource Management (PC-HRM) initiative is $30.7 million.

Q: What are the reasons for the project’s scrutiny?

A: The project is scrutinised due to significant staff turnover, cultural concerns, and accusations of improper conduct within the team.

Q: When is the project anticipated to reach completion?

A: The essential HR system upgrade is projected to be finished by June 2026, with a rostering solution anticipated by June 2027.

Q: Who are the primary contractors involved in the enhancement?

A: Frontier Software and Accenture are the main contractors, tasked with system support and integration respectively.

Q: What are the key functionalities of the enhanced system?

A: The enhancement seeks to centralise payroll systems, automate processes, and offer staff self-service options.

Xiaomi Buds 5 Pro Wi-Fi Review

Matthew Miller on July 25, 2025


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Xiaomi Buds 5 Pro Wi-Fi – 11 mm HiFi Triple Driver, 55 dB ANC Active Noise Cancellation and 15 m/s ENC, Lossless Qualcomm Sound and Harman AudioEFX, Black