Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
In 2024, data breaches cost businesses an average of $4.88 million globally. Data encryption has become increasingly vital and reliable, especially with growing interconnected systems and data transfers. It provides essential protection by encoding information, making it accessible only with the correct decryption key.
Poor credential management causes 70% of cloud data breaches. Beyond passwords, companies must protect API keys, SSL certificates, authentication tokens, and federated identities. This article notes various actions one can take if credentials are compromised.
Mercari presents 7 scenarios in which an attacker with write permissions to a branch protected GitHub repository can bypass those protections to merge malicious code without a review. For each of the first six methods mentioned, Mercari also presents a technical control to prevent the attack. However, the final scenario, which involves the attacker adding a commit to a PR that another user created using GitHub Actions and approving it, does not have a comprehensive defense mechanism built into GitHub.
Sponsored
Data shows that web applications and email—which are primarily accessed via web browsers—account for over 80% of security breaches [11]; and a majority of the client-side zero-day exploits are browser vulnerabilities. Learn how to choose the right approach to protecting the browser in _The CISO's Guide to Enterprise Browsers_ by Menlo
Boofuzz is a fork of and the successor to the venerable Sulley fuzzing framework. Besides numerous bug fixes, boofuzz aims for extensibility. The goal: fuzz everything.
Sectemplates offers Open source templates you can use to bootstrap your security programs. The templates cover preparation checklists, runbooks, security metrics, and document templates. Users can freely use the content for personal and commercial purposes, excluding products for sale or developed based on it.
httptap is a CLI program that allows users to view HTTP(S) requests made by any Linux program.
South Korea has temporarily restricted downloads of Chinese AI company DeepSeek's app over data privacy concerns, specifically its transfer of user data to ByteDance. While existing users can continue using the service, they're advised against sharing personal information until DeepSeek complies with Korean privacy laws.
Shadow stacks are a security feature that Intel CET implements to defend against ROP attacks by shadowing and comparing the current stack against a protected, read-only copy. The “Secure Kernel” is a Windows feature that allows the kernel to run in a virtualized form by a protected Secure Kernel. This post utilizes the SourcePoint debugger to perform a novel dynamic analysis of the Windows Secure Kernel.
Chase has announced that they will begin to delay, decline, or block Zelle payments to contacts that likely originated from social media contacts. When payments are set up, Chase may request additional information such as the purpose of the payment to make this decision. This move is likely prompted by the CFPB lawsuit against Zelle as well as fraud statistics from Chase.
Demo of an SSH honeypot with artificial intelligence which features a terminal that simulates an Ubuntu environment, allowing you to explore and test Linux commands.
Microsoft is removing the Location History feature from Windows, which allowed Cortana to access device history.
The pro-Russia group NoName057(16) launched DDoS attacks on Italian airports, banks, and ports in response to President Mattarella's remarks comparing Russia to the Third Reich.
A critical SQL injection vulnerability in PostgreSQL, working alongside a BeyondTrust zero-day, was essential to the December US Treasury breach. The bug affects all PostgreSQL versions but requires complex exploitation, which is why it may have caught the Treasury's security team by surprise.
The Watergate Hotel is notifying 2,200 victims of a data breach that occurred in April 2024. The breached data includes names, financial and credit card information, health insurance and medical information, SSNs, government IDs, and driver's license numbers. The Qilin ransomware gang took credit for this attack in May 2024 but Watergate has not confirmed the details.
Valve is notifying users who downloaded the PirateFi free-to-play game that they discovered that it was malware. The game seems to have been a Trojan that steals browser cookies from the infected system. A user reported that the game was being circulated via bots on Telegram channels offering $17/hour to be an in-game chat moderator.
Google's new Android fraud protection feature aims to detect and block scam attempts in real-time, identifying suspicious apps and activities before they reach users. While a significant improvement for security, it's not foolproof - users still need to practice basic cybersecurity and remain vigilant against evolving threats.
The Quiq team undertook a project to identify malicious or overprivileged Chrome extensions using osquery. They developed a query that would surface the uid of any Chrome extension with clipboardWrite, all_urls, tabs, or cookies permissions. The team then examined the Chrome extension store page of each application and allowlisted or removed them.
Google has thousands of web apps that it needs to protect from three fundamental weaknesses of the design of the web: lack of encryption, lack of isolation, and injection. To combat this, Google has developed a high-assurance web framework that is built upon safe coding, adaptability, and observability. This post also includes a case study and table of different key security controls and how they map to elements of the framework.
Sponsored
Microsoft's security baseline covers just 137 of 2000+ policies,
helps you secure Microsoft 365 by closing attack vectors, enforcing zero trust, and hardening access. Learn key configurations for Exchange, SharePoint, Teams, and more.
QuSecure is designed to help organizations migrate to Post Quantum Cryptography without overhauling existing infrastructure. The company touts a software-based security architecture that overlays onto current networks, providing cryptographic agility and multi-layered protection.
PyCript WebSocket is a Burp Suite extension that enables users to encrypt and decrypt WebSocket messages.
Terraform-AWS-Vulne-Soldier (aka vulne-soldier) provides a Terraform module for automating the remediation of EC2 vulnerabilities based on Amazon Inspector findings.
Doge.gov documenting Elon Musk's team's federal cost-cutting efforts had glaring security flaws that allowed anyone to edit its database as demonstrated by experts by adding unauthorized entries.
AWS IAM has launched a new capability that supports sending encrypted SAML assertions from an IDP to AWS. This protects the assertions by allowing them to be encrypted in transit through any intermediaries.
A China-linked threat actor, previously known for espionage activities using the PlugX backdoor, conducted a ransomware attack against a South Asian software company in late 2024, demanding up to $2 million in ransom. The attack utilized the same toolset seen in earlier espionage campaigns, including a malicious DLL sideloaded through a legitimate Toshiba executable, which was linked to the Fireant (aka Mustang Panda) espionage group. While several theories were proposed for this unusual combination of espionage and ransomware activity, Symantec notes that the most likely explanation is that an individual actor was attempting to profit personally using their employer's toolkit.
After 3 months of testing in Canary releases, Google Chrome now uses AI for "Enhanced protection" to guard against dangerous websites and downloads in real-time.
Microsoft Threat Intelligence reported that Storm-2372, an advanced persistent threat (APT) group, has been using a device code phishing technique since August 2024 to bypass multi-factor authentication (MFA) and gain unauthorized access to targeted accounts.
Veriti Research reported that cybercriminals are exploiting public interest in the recently declassified files related to John F. Kennedy (JFK), Robert F. Kennedy (RFK), and Martin Luther King Jr. (MLK) by launching phishing campaigns, distributing malware, and setting up fake domains to steal user credentials and compromise systems.
Sponsored
The first step to tap into the $30B+ federal market?
A group of Italian entrepreneurs reported that they were the victims of a wire fraud scheme. The entrepreneurs report that they received a call allegedly from the Italian Defense Minister Guido Corsetto requesting 1 million Euros so that they could free kidnapped journalists. Upon hearing of this scam, Corsetto posted on X about it to warn other potential victims.
In what could be the third major data breach in four years, Zacks Investment has been breached again. Have I Been Pwned (HIBP) verified 12 million unique email accounts in the leak. However, HIBP also notes that roughly 93% of the leaked email addresses were already in its database from past breaches of the same platform or other services.
A new phishing kit called Astaroth can bypass two-factor authentication to steal login credentials from Gmail, Yahoo, and Microsoft accounts. Astaroth utilizes an evilnginx-style proxy to Man In The Middle user sessions to intercept authentication data, making it difficult for users to detect the attack. The sophisticated kit is sold on cybercrime networks for $2,000 and includes custom hosting options to evade detection.
Part two of a series describing how Sekoia develops detection rules using Sigma to identify TTPs. Sekoia implements the Alerting and Detection Strategy Framework which focuses heavily on testing and documentation. Sekoia augments their automated documentation with comprehensive testing that tests syntax, test coverage, and both production and pre-production regression testing.
Researchers discovered a "whoAMI" vulnerability where attackers could exploit AWS accounts by publishing malicious AMIs with specific names, targeting systems that don't specify owner verification when searching for AMIs. This post dives into this new attack.
Michal Zalewski discusses common pitfalls in corporate security teams, from their origins to cultural challenges and eventual breaches. Security teams often start reactively, leading keener senses on security challenges which often morph into a sense of superiority and disconnect from other departments. The cycle usually ends with a major breach that prompts a reevaluation of the team's strategy and communication.
Sponsored
In this Cloud SIEM product brief [11], you'll learn how to:
JScrambler can prevent web supply chain attacks by monitoring script execution, preventing vulnerability exploitation, detecting modifications in third-party resources, and detecting anomalous behavior.
Databoxer aims to be a lightweight cross-platform solution for file encryption. Databoxer operates based on the ChaCha20 encryption algorithm in combination with the Poly1305 universal hash function to perform its encryption operations. It claims these implementations to be safer and faster than the most popular AES algorithm used in many other similar programs.
SlackPirate is a tool to enumerate and exfiltrate sensitive data from Slack workspaces. It helps red-teamers identify security risks and helps blue-teamers detect and prevent sensitive data leaks.
The Shadowserver Foundation is warning of a massive password-spraying attack targeting a wide range of networking devices. The attackers are using a botnet composed of almost 2.8 million source IP addresses. The compromised devices seem to be largely edge network devices.
Trump reportedly plans to nominate Sean Cairncross as National Cyber Director, despite his lack of cybersecurity experience. Cairncross, a lawyer, would replace Harry Coker, who had decades of CIA and NSA experience.
Citing half a dozen CVEs, CISA and the FBI have released a scathing critique of manufacturers writing memory-unsafe code. They have urged organizations to adopt memory-safe languages such as Go, Rust, and Swift. Acknowledging that full rewrites are difficult, they have urged organizations to make plans for a phased transition and utilize memory safety flags and testing.
Variston finally shut down as it started crumbling after Google exposed its secretive operations in 2022.
According to a report by Recorded Future, Salt Typhoon, a Chinese threat group, continues to target global telecom networks using Cisco routers.
Following a viral AI-generated post, Scarlett Johansson warns about the dangers of AI being used to create non-consensual content and urges legislators to take action to regulate AI use.