Parse notes
Nissan will be informing around 100,000 people in Australia and New Zealand that their data was breached over the next few weeks. Up to ten percent of victims had government identification stolen while the rest had other PII stolen. Nissan will be offering 12 months of free credit monitoring for affected individuals.
Fortinet has a critical vulnerability in its FortiClient EMS that enables remote code execution. The SQL injection vulnerability enables unauthenticated attackers to execute arbitrary commands. Horizon3 said that it will release a technical deep dive and proof-of-concept exploit code next week.
Salt Labs discovered vulnerabilities in ChatGPT and its third-party plugins, including a zero-click exploit that gives attackers access to victims' private GitHub repositories. OAuth implementation flaws were found in ChatGPT and multiple plugins, potentially allowing unauthorized access by a malicious actor to proprietary data. The vulnerabilities were reported to OpenAI and plugin developers in July and September 2023 and have since been resolved.
Researchers have discovered a new side-channel attack called token inference that can be used to infer the topic behind 55% of chats between an AI assistant and users on all platforms other than Gemini. The attack makes use of the fact that most AI Assistants send messages back token by token to provide faster responses. The encrypted token length is identical to the token length so the researchers were able to train two LLMs based on stylistic patterns in public chats from the various AI Assistants.
This blog post from Google discusses its threat model for post-quantum cryptography, which emphasizes the urgency of adopting quantum-safe algorithms to protect data from future quantum computing threats. It also outlines recommendations for prioritizing quantum threats and deploying hybrid post-quantum cryptography solutions and addresses specific use cases like encryption in transit, firmware signatures, software signatures, public key infrastructure, tokens, and other scenarios vulnerable to quantum threats.
This document, part of a two-part series, delves into practical and theoretical attacks in the industrial landscape, focusing on the vulnerabilities and potential methods attackers can use to disrupt automation processes within a factory setting.
Sponsored
Tired of the massive price tag and endless maintenance of legacy SIEM? EventSentry [10] offers real time event monitoring, web-based reporting, unlimited data and unlimited metrics — starting from $98 per license [10].
AI Goat is a series of vulnerable LLM CTF challenges for learning AI security. The challenge set is built on Vicuna LLM, which is derived from LLaMA and coupled with ChatGPT’s response data.
403JUMP is a tool designed for penetration testers and bug bounty hunters to audit the security of web applications. It bypasses HTTP 403 (forbidden) pages by employing various techniques like using different HTTP verbs and headers and managing concurrency.
Excalibur is a CLI tool that sends alerts if a given X account has been archived. It can also be used to find associated Mastodon, Medium, and Product Hunt accounts.
Red Canary has released its annual threat detection report, which provides an overview of the current threat landscape. Humans remain the most exploited vulnerabilities. Cloud account compromise has increased 16-fold. Containers are now nearly omnipresent, and MacOS malware is on the rise. MFA fatigue attacks have become increasingly prevalent and Cobalt Strike is no longer in the top 10 C2 platforms.
Modified versions of text editors were found in search results on a popular Chinese search engine. The fake software contained backdoors designed to execute remote commands and communicate with a malicious server. This kind of "malvertising" has been used to lure victims to malicious sites.
Data privacy company Onerep.com, supposedly based in Virginia, helps individuals remove personal information from people-search websites for a fee. However, investigations reveal the company actually operates from Belarus and Cyprus. The company's founder, Dimitri Shelest, has launched numerous people-search services over the years. Despite claims of independence, connections between Onerep.com and Nuwber.com raise questions about their relationship and practices.
Attackers have started to hijack user accounts on service providers' platforms and apps to initiate procedures to port victims' numbers to other devices or generate QR codes to activate new eSIMs.
The Federal Communications Commission has approved a new U.S. Cyber Trust Mark for consumer Internet of Things (IoT) devices that will denote that devices such as 'smart' home appliances meet baseline security standards.
Tech support firms Restoro and Reimage have been fined $26 million by the US Federal Trade Commission (FTC) due to their use of scare tactics to trick customers into paying for unnecessary computer repair services.