Parse notes
Sponsored
As a security leader in 2024, you need to find a way to address existing exposure without slowing down business growth [7]. Yet, identifying which risks to proactively remediate is becoming harder than ever before. What's the best path forward?
Microsoft has warned that some of its corporate email accounts were breached and data was stolen by a Russian state-sponsored hacking group known as Midnight Blizzard. The attack was detected on January 12th and was conducted by Russian threat actors known as Nobelium, or APT29. The hackers gained access to a test account and used it to access a small percentage of Microsoft's corporate email accounts for over a month.
Three UK councils - Canterbury, Dover, and Thanet - have taken some public systems offline due to a cybersecurity incident under investigation. The authorities are working with the National Cyber Security Centre to understand the impact, which has disrupted online services for hundreds of thousands of residents.
VF Corp, the owner of Vans, Supreme, and The North Face, has reported to the SEC that hackers stole the data of 35.5 million customers. VF Corp says that it doesn't retain consumer social security numbers, bank account info, or payment card information and does not have any evidence that attackers stole customers’ passwords. VF Corp has not disclosed what data has been stolen.
This post navigates what the author calls the five eras of cybersecurity. From early ciphers that were secure against manual attacks but vulnerable to computers to the latest era which will see us dismantle much of what we've built over decades to create a more secure, resilient, privacy-focused digital future.
This post aims to set up a hypothetical phishing page for educational purposes to raise cybersecurity awareness. It is not a super sophisticated effort, but it shows the dangers of phishing pages and the social engineering behind them.
A post from DataDog that walks through two different attack scenarios that it has observed. In the first scenario, an attacker enumerated their credentials, established persistence, attempted to move laterally, and finally attempted to run a large EC2 instance in an unused region before being blocked. In the second scenario, the attacker immediately launched crypto mining tasks on ECS Fargate with 25 tasks in 17 regions, showing that this method can be much more effective.
Nightshade is a free tool that lets artists "poison" AI models from training on their work. It is now publicly available after months of development. It subtly alters images to trick AI into misidentifying them, weaponizing machine learning against itself to protect artists' creations.
A password strength app that evaluates and rates your password's robustness, estimates crack time, and provides helpful warnings and suggestions for stronger passwords.
A BurpSuite extension that brings taint tracking to web analysis. FlowMate tracks all parameters sent to a web application and matches their occurrences in the responses.
Huntr researchers recently discovered multiple high-severity vulnerabilities in popular AI/ML solutions like MLflow, ClearML, and Hugging Face. The most critical issues are in MLflow, including a path traversal bug allowing file deletion (CVE-2023-6831) and a data module flaw enabling path manipulation to overwrite files and achieve RCE
The Kansas court system requires at least $2.6 million in additional funds to recover from an October cyberattack that disrupted electronic filings and online records access for weeks.
This excerpt from 'Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency' tells the story of how Sarah Meiklejohn discovered that Bitcoin could be deanonymized. While Meiklejohn was a PhD student at UCSD, she became fascinated by the privacy claims made by users, developers, and even the creator of Bitcoin. Slowly via experimentation, she discovered methods to link together disparate transactions and form chains of payments that are critical to modern-day crypto tracking operations.
In this X thread, a user shares tricks for navigating the SSH Shell, like how to find out how many layers of SSH you're in and how to pass port forwarding connection requests after establishing a connection.
ReversingLabs tracks the landscape of software supply chain security and reports on trends that it has observed. Some key trends in 2023 were the proliferation of protestware, more malicious packages being hosted on repositories, and PyPi overtaking npm for the most malicious packages.
The US Federal Trade Commission (FTC) has reached a settlement with Texas-based data aggregation company InMarket Media, banning it from selling Americans' precise location data.