Parse notes
Sponsored
The expansion of attack surfaces in a post-pandemic work environment, shrinking team sizes and budgets, and the rise of generative AI are fueling an urgent need for businesses to improve — and prove — their security posture. Vanta’s State of Trust 2023 Report [5] surveyed 2,500 business and IT leaders across key geos to find out which global trends are worth paying attention to. Read now [5] to discover:
Canada’s government has confirmed a breach on two of its third-party service providers after 1.5TB of data was leaked by ransomware group LockBit. Some of the data dates back to 1999. The leak impacts anyone who was relocated while using public services. Potentially impacted individuals are being offered credit monitoring services and the option to be reissued valid passports that might have been compromised.
Healthcare engagement platform Welltok confirmed hackers stole 1.6M+ people's data by exploiting MOVEit. It reported that names, dates of birth, addresses, social security numbers, and other sensitive data were leaked
The Ddostf botnet is targeting MySQL servers for use in its DDOS-as-a-Service platform. The botnet is gaining access by brute-forcing weak admin credentials and then installing User Defined Functions to act as a C2 server for use in the botnet.
This is a simple step-by-step learning guide on how to hack WPA-protected Wi-Fi.
This post from Target Australia details the decisions and migrations that it made to improve scalability and security in its EKS clusters. Target Australia moved from manually security-hardening Amazon Linux AMIs to using BottleRocket OS-based AMIs and adopted Karpenter (running on Fargate) to replace Cluster Autoscaler to replace AutoScaling Group-based compute with EC2-based compute for its clusters.
This article discusses transitive access via service accounts in GCP that could allow users to access services as Service Accounts, gaining access to all the IAM resources tied to those accounts. It details the IAM permissions that allow for this, detection methods like using Google Policy Analyzer, and how to identify these service accounts using Google APIs.
Lasso aims to take over LLM security by detecting and monitoring LLM data flow in real time and alerting for possible breaches of policy, enabling organizations to safely deploy LLMs in production environments.
Logging Made Easy (LME) is a free and open logging and protective monitoring solution serving all organizations.
HackTheBox has announced the launch of a new set of labs called Sherlock that focuses on DFIR skills. 15 Sherlock labs will be available for free to all users before the labs are split into 8 free labs and the rest being premium.
The ransomware strain known as Play is being offered to other threat actors as a service. Adlumin has identified and stopped PlayCrypt attacks that had nearly identical tactics, techniques, and procedures (TTPs), hinting at people buying these attacks as a service, allowing anyone with a wallet to do a ransomware attack.
Google has released new Titan security keys that support passkeys for passwordless authentication. The new keys are available in USB A or C, support FIDO2, are NFC compatible, and can store up to 250 passkeys.
YouTube has announced that it will be requiring creators to add labels to realistic content that features AI in the coming months. Creators who consistently fail to add these labels may be suspended from the YouTube Partner Program. Music labels and distributors will be able to request the removal of AI-generated content that mimics artists' voices.
Microsoft has paid out $63 million in rewards to security researchers participating in its bug bounty programs throughout the last 10 years. Of the $63 million awarded since 2013, $60 million of that was allocated in the last five years.
Morgan Stanley has agreed to a $6.5 million settlement over the insecure disposal of hardware containing unencrypted personal information.
A repository containing open source and freely usable Threat Intel feeds that can be used without any additional requirements.