Parse notes
Sponsored
The web browser is the most widely used enterprise application, but one of the least protected ones. The rise of Highly Evasive Adaptive Threats (HEAT), combined with AI usage, puts browsers in danger of being breached at any moment.
Security researchers have discovered vulnerabilities in Subaru's Starlink system that allow tracking of vehicles' year-long location history and control of car features. Though now patched, the incident highlighted broader privacy concerns about automotive data collection and employee access to customer information.
Bank of America confirmed that a breach of a third-party software provider led to the exposure of at least 414 customers' personal data. The compromised data includes names, SSNs, addresses, phone numbers, passport numbers, and loan numbers. Bank of America has stated that its systems are not impacted and that it has found no evidence of breach.
Researchers are warning of threat campaigns that are utilizing fake Reddit pages to social engineer users to download files via a fake WeTransfer site. The campaign involves fake Reddit threads where a user asks for help downloading a tool, another user provides a fake WeTransfer link, and then the first user thanks them. The link redirects to a fake WeTransfer page which redirects the user to a page that downloads the Lumma Infostealer malware.
A security engineer investigating GitHub Desktop discovered a vulnerability in Git's Credential Protocol that could leak user credentials. Further research revealed similar bugs across multiple Git-related projects, stemming from improper message handling in credential helper implementations.
A blog post with resources and a lab environment for beginners to get started with AWS security. The post begins with an overview and demonstration of 4 common attacks against EC2 and S3. The post then provides an overview of CLI and GUI based auditing.
Axoflow automatically discovers security data sources (such as syslog, OpenTelemetry, Windows, and more) and then classifies, normalizes, and enriches the data, reduces data volume by more than 50%, and eliminates the need for manual data wrangling.
A simple static password generator. Generated passwords are 20 characters, lower and uppercase, and contain special characters by default.
Baitroute is a web honeypot library that creates fake vulnerable endpoints to detect and deceive attackers. It offers easy integration with popular web frameworks and minimal performance impact. By setting up rules and alert handlers, you can monitor and respond to attacker activity on the decoy endpoints.
A fired IT contractor broke into the British Museum on January 23 and sabotaged several IT systems, forcing the closure of temporary exhibitions through the weekend. The individual was arrested at the scene while the museum was working to restore normal operations.
Researchers from Abnormal Security have reported on a new malicious chatbot that is being sold via Telegram. They believe that GhostGPT is a wrapper around a jailbroken version of ChatGPT or other open-source LLM. This post highlights the risk that these tools bring by giving low-skilled hackers more powerful tools.
A report was submitted to the U.S. Dept of Defense regarding a security issue found in a Google Drive link. The link contained PDFs disclosing sensitive personal information, posing a risk of privacy violation and identity theft. The suggested action is to either remove the folder or adjust its privacy settings.
This survey investigates how developers approach code security, examining their challenges, priorities, and organizational support needs.
Hackers stole $85 million in cryptocurrency from Phemex and the exchange suspended transactions, identified vulnerabilities, and reported the incident to authorities.
Brian Krebs reports on major cybersecurity concerns as Trump dismantles key federal security infrastructure, including firing all Cyber Safety Review Board advisors, scraps AI safety measures, and appoints officials who aim to weaken CISA's role in combating misinformation and cyber threats.