Parse notes
The Department of Defense notified 20,600 individuals that their information was breached after an unsecured cloud email server was discovered to be spilling sensitive emails to the open internet. This happened between February 3 and February 20, 2023, and the notification was sent out on February 1, 2024.
A ransomware attack encrypted the database of the Hipocrate healthcare management system used by over 100 Romanian hospitals. 25 facilities have been confirmed impacted while another 75 are offline as a precaution. The massive incident took HIS servers down, encrypting files and databases.
An AI Acceptable Use Policy (AUP) establishes guidelines on the proper deployment of generative AI to mitigate risks. This post navigates how to create one with real examples. Developing an AI AUP forces risk leaders to define controls and frameworks to oversee emerging generative AI given its potential negative impacts if utilized without oversight.
Mercari discusses the considerations that went into the design of its passkey implementation. The company chose to adopt passkeys to try to create a phishing-resistant environment. Complications encountered included issues preventing attackers from registering passkeys, problems syncing passkeys, and UX difficulties around using passkeys.
Sponsored
DNS is an often-overlooked aspect of network security, despite being the 1st step of almost every malicious attack. Control D [12] makes DNS an easy problem. Block unwanted content, spoof your location, and browse faster. The best part? It’s all done from a modern UX and architecture [12]. No apps to install 🎉
KTrust aims to secure Kubernetes workloads with a continuous threat exposure management platform that provides risk prioritization, breach and attack simulation, and ransomware protection capabilities.
MSAK is a tool written in Python to help discover and test exposed standard and custom services of ModBus Servers/Slaves over Serial or TCP/IP connections.
Awesome GraphQL Security is a curated list of GraphQL Security frameworks, software, libraries, and resources. The list is divided into offensive, neutral, and defensive tools.
Microsoft’s threat intelligence team has captured evidence of foreign government-backed hacking teams interacting with OpenAI’s ChatGPT to automate malicious vulnerability research, target reconnaissance, and create malware.
Maxim Dounin, a core developer of Nginx, has left the project and created his own fork called freenginx after a dispute over the assignment of CVEs.
The US Department of Justice announced that a court-authorized operation has dismantled a botnet of hundreds of Ubiquiti Edge OS routers controlled by Russian cyber spies. The group, known as APT28 or Fancy Bear, was using the hijacked routers as a global espionage platform.
lolcerts is a repository of code signing certificates known to have been leaked or stolen and then abused by threat actors.
A new wifi auth vulnerability has been discovered. It allows an adversary to skip messages 2 and 3 of the 4-way handshake, enabling them to complete the authentication process without knowing the network’s password.