Parse notes
Sponsored
Using aggregated usage data, Snowflake has identified security technology leaders [5] who are delivering next-generation applications and data sharing capabilities to enterprise security teams. Get the report to learn:
Anthropic disclosed a data breach after a contractor accidentally sent customer info to a third party. The breach impacted names and account balances. It was caused by human error, not a system breach per Anthropic. The news came right before the FTC announced its investigation into Anthropic's partnerships with Amazon and Google. Anthropic says the incidents are unrelated.
Akira ransomware group claims it breached Lush and secured 110GB of data. It is threatening to publish the data since negotiations have apparently failed. Passport scans were likely accessed, as well as financial, accounting, tax, project, and client docs. This incident demonstrates that Akira is a dangerous and flexible new threat that is able to hit major corporations.
Security researchers have discovered a new Golang-based malware loader called CherryLoader that mimics the icon and name of the CherryTree note-taking app to deceive users into installing it. Once installed, it drops either the JuicyPotatoNG or PrintSpoofer exploit and then runs a batch script to establish persistence. This article contains indicators of compromise.
This post dives into how the author went from wanting to work in infosec to deciding to pause and rethink what they actually wanted to do. You don't need to be an expert to enjoy learning about security. Working in security full-time isn't as exciting as it sounds. You can still explore security concepts without making a career out of it.
Hackers blur the lines between heroes and villains in the digital landscape. Though some are outlaws, others pioneer new possibilities. This post looks at the various types of hackers and their motives. Famous hackers have shaped the digital world through both ethical and illegal means. Hackers fundamentally think differently and use tools in unintended ways that can build up or tear down.
The Escape team underwent a project to spider 189.5M URLs to search for API keys and discovered 18,000 secrets, which included $20M in vulnerable Stripe tokens. This post covers how the team built a custom web spider using Golang and fasthttp along with the data analysis and verification pipeline. The process was deployed on a k8s cluster that could scale to 150 concurrent worker instances. The data collection took over 69 hours.
Sponsored
DNS is an often-overlooked aspect of network security, despite being the 1st step of almost every malicious attack. Control D [13] makes DNS an easy problem to solve. Block malicious domains, unwanted content and browse faster on all devices. The best part? It’s so easy your grandma can (probably) use it [13]. Available for personal use and teams of all sizes.
Above is an invisible network sniffer for finding vulnerabilities in network equipment. It is based entirely on network traffic analysis, so it does not make any noise on the air. Above is completely based on the Scapy library.
SecObserve is an open source vulnerability management system for software development teams that supports a variety of open source vulnerability scanners. It integrates easily into CI/CD pipelines.
Notation is a CLI project for adding signatures as standard items in the OCI registry ecosystem and building a set of tools around signing and verifying the signatures.
Researchers earned over $1.3 million hacking Teslas, EV chargers, and infotainment systems at Pwn2Own Automotive. Synacktiv won $450K for Tesla hacks. Day 1 saw $700K awarded, including $60K EV charger and $40K infotainment bounties. The 3-day event revealed 49 new auto vulnerabilities.
A post that provides a deep dive into the concept of Least Privilege as applied to AWS IAM. After providing some background and worked examples on how to determine the effective policy of an AWS principal, the post elaborates on why striving for Least Privilege may not be sufficient or productive in all cases.
A post from the Google Security team on creating large-scale security changes. It begins by detailing some scalability issues in the team’s attempt to roll out Strict CSPs. The post then delves into the tooling and metrics that were required to collect data and implement changes that scale better to the immense number of services that Google operates.
A critical vulnerability in Jenkins' built-in command line interface (CLI) allows attackers to obtain cryptographic keys that can be used to execute arbitrary code remotely. Update ASAP.
Cloud Threat Landscape is a comprehensive threat intel database of cloud security incidents, threat actors, tools, and techniques.
More than 5,000 GitLab servers have not been patched for a critical vulnerability that allows attackers to hijack the password reset process.