Parse notes
Sponsored
SafeBase analyzed Trust Center activity from over 1,000 customers to pinpoint the most frequently asked buyer questions about AI on inbound security reviews [4] — covering everything from AI policies, processes, and practices to risk, validation, and data protection.
HPE is notifying individuals affected by a 2023 cyberattack attributed to Russian state hackers. The breach, affecting email and SharePoint systems, exposed sensitive personal data including Social Security numbers through the mailboxes of HPE's cybersecurity and business teams.
HSHS and Prevea Health experienced a cyberattack in August 2023 that disrupted their systems. The breach has affected 882,782 individuals' personal and medical data. HSHS has offered credit monitoring and is sending notification letters to affected individuals.
Over 430,000 people's data was exposed in breaches at two healthcare organizations, University Diagnostic Medical Imaging (UDMI) and Allegheny Health Network (AHN). UDMI's November breach affected 138,080 individuals' medical data, while AHN reported that 292,773 patients were impacted by an October cyberattack on their contractor IntraSystems.
The author discusses how they discovered a new unannounced BitLocker feature in a Windows Insider Preview build that automatically cleans up stale recovery keys when the 200-key limit is reached in Microsoft Entra ID. Using IDA Pro to analyze the fveskybackup.dll file, along with Fiddler and ETL traces for monitoring API calls, the author uncovered two critical functions that handle the automatic deletion of stale recovery keys in batches of 16. This discovery points to the resolution of a long-standing issue where silent encryption would fail when hitting the key limit, eliminating the need for manual cleanup by IT administrators once the feature reaches general availability.
This blog post from Elastic walks through how machine learning models, particularly clustering techniques like k-means can be utilized in the ELK stack to improve search relevance by grouping similar documents together. To demonstrate this, the post uses a 20 Newsgroups dataset and OpenAI's text-embedding-ada-002 model, and demonstrates that clear cluster separation and accurate clustering results were achieved. The workflow showcased in this blog allows Elastic users to easily implement advanced clustering techniques for various applications, showing high performance and potential for further enhancements.
As the successor to NTLM, Kerberos is the most widely used authentication mechanism for Active Directory. This article presents an in-depth overview of different attacks like Kerberoasting, unconstrained delegation, constrained delegation, and others against Kerberos and methods for detection and mitigation. Each attack includes necessary background information, a description of the attack and potential impact, and strategies for detecting the attack.
ThreatMate's platform incorporates analytics, continuous monitoring, and a multi-tenant design to help Managed Service Providers monitor, manage, and secure customers' internal, external, and cloud environments from a single dashboard.
Baitroute is a web honeypot library that serves vulnerable-looking decoy endpoints that mislead attackers and lead to false positives. It provides easy integration with popular web frameworks and claims to pose minimal performance impact. Developers can also write their own rules using YAML files.
Living Off the Tunnels (LOTTunnels) is a project that aims to document digital tunnels that can be abused by threat actors.
The UK government reportedly issued a secret order requiring Apple to create a backdoor for accessing encrypted iCloud data worldwide. Apple is likely to withdraw encrypted storage in the UK rather than comply, as it argues such backdoors would compromise user security globally.
A security researcher, Eran Shimony has successfully bypassed OpenAI's new "deliberative alignment" safety feature in o3-mini, getting it to provide Windows exploit instructions by posing as a historian. According to Shimony, OpenAI's models are particularly susceptible to natural language social engineering attacks, while Meta's Llama models are instead vulnerable to ASCII art-encoded malicious prompts, and Claude is most vulnerable to generating harmful code because it doesn't effectively classify code's potential malicious uses.
Thomas Ptacek writes about how VSCode's SSH Agent defies the intuition that a security researcher familiar with similar tools like Emacs Tramp might have. Unlike Tramp, which operates minimally on remote systems using existing shell commands, VSCode's SSH Agent installs a full Node.js environment and runs an agent with extensive capabilities including filesystem access, file editing, shell process launching, and self-persistence - behaviors that make security professionals nervous, especially in production environments. Thomas ends the blog by noting that Fly.io is able to accomplish the same remote development feature on their instances without such invasive installation on remote hosts.
Microsoft has advised users to reinstall Windows with security updates past December 2024 for users running into installation issues with Windows 11, version 24H2 where the OS wouldn't accept further security updates.
Mike Privette provides an in-depth financial analysis of the Cybersecurity market in 2024 with increasing trends in funding, M&A, and decreasing layoffs.
Researchers from ReversingLabs found two models from Hugging Face hiding malicious code in Python's Pickle files.