Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Richard Densmore was sentenced to 30 years for running online chat rooms that targeted children through gaming sites. As part of terrorist network 764, he coerced minors into self-harm, sexual acts, and violence.
Apple's iOS 18 reportedly includes a new security feature that automatically reboots inactive iPhones after four days, resetting them to a more secure "Before First Unlock" state. This makes it harder for law enforcement to break into locked devices.
OpenAI's VP of research and safety, Lilian Weng, is leaving the company after 7 years. She will leave on November 15, joining several other AI safety researchers and executives who have left the company recently. This continues a pattern of departures amid concerns about OpenAI's prioritization of commercial products over safety.
A crimeware bundle called SteelFox, active since early 2023, impersonates legitimate software like Foxit PDF Editor and AutoCAD.
AWS offers a suite of security tools to boost any company's security.
Hackers are stealing tickets from Ticketmaster accounts, causing concertgoers to lose access to their purchased tickets.
Sponsored
Join ThreatLocker for expert insights on securing corporate devices inside and outside your network.
Researchers identified six security vulnerabilities in Ollama, an open-source LLM framework, related to issues like denial-of-service and path traversal. Four have been patched. Users are advised to filter exposed endpoints for the remaining vulnerabilities through proxies or firewalls.
Canada has ordered TikTok to cease business operations in the country, citing national security risks. Users can still access and post content. The government's decision affects TikTok's Vancouver and Toronto offices but doesn't ban the app. TikTok plans to challenge the order, stating it will destroy hundreds of local jobs.
The Realtek SD card reader driver has multiple vulnerabilities that allow unauthorized access to kernel memory, including leaking kernel memory and writing to arbitrary kernel addresses. These vulnerabilities can be exploited through specific control codes, such as IOCTL_SCSI_PASS_THROUGH_DIRECT. They enable users to read and write physical memory from user mode via the DMA capability of the device. Exploiting these flaws can lead to significant Windows kernel memory exploration and manipulation.
Parsers often fail to fully comply with RFC standards, allowing for various ways to bypass file upload validation. Techniques like altering headers, duplicating parameters, and manipulating content types can deceive validation mechanisms. Attackers can slip malicious inputs past security measures by exploiting loopholes in parsers' handling of multipart data.
This post defines all the security headers that are essential for protecting web applications from various vulnerabilities, such as Cross-Site Scripting (XSS) attacks. These headers provide critical security measures like controlling cross-origin resource sharing and preventing unauthorized sharing of browsing contexts. Websites can enhance security and ensure a safe browsing experience for users by implementing and configuring these headers properly.
This post explains how an exploit was developed to gain write access to the stack by manipulating a looping pointer and creating a double stack pointer. The exploit involved constructing a Return-Oriented Programming (ROP) chain within the stack frame of a vulnerable function using format string techniques. The final steps of the exploit involved adjusting the stack pointer to execute the prepared ROP chain, ultimately leading to the successful exploitation of the blind format string vulnerability.
Symbiotic integrates vulnerability detection and remediation capabilities directly into the IDE. The platform also provides just-in-time training to developers so that they have the information on how to write secure code.
Twyn is a security tool that compares the names of dependencies against a set of the most popular ones to determine if there are any similarities between them, preventing users from using a potentially illegitimate one.
Sastsweep is a tool designed for identifying vulnerabilities in open source codebases at scale. It can gather and filter for key metrics on repositories like project size and popularity. Sastsweep automatically detects potential vulnerabilities using Semgrep and provides a streamlined HTML report.
Trump could dismantle Biden's 2023 AI Executive Order. This would affect the US AI Safety Institute and reporting requirements. His team has characterized NIST's AI safety standards as an attempt to control speech through "woke" safety requirements.
This post provides a detailed look into fourteen post-quantum signature schemes. ML-DSA, SLH-DSA, and Falcon are notable standards for the second round of "signatures on ramp competition" operated by NIST. Falcon faces challenges due to its complex signing process, while HAWK shows promise for faster and simpler signatures. The aim is to improve post-quantum signature schemes for better performance in TLS connections.
Nokia investigated a data breach claim and found that leaked source code belonged to a third party, with no impact on company or customer data. The hacker tried to sell the data, which included SSH keys and logins, but Nokia denies any breach affecting its systems or data. The leaked source code was for a third-party app not developed by Nokia. The company will continue to monitor the situation closely.
The TSA has issued proposed cyber mandates for pipelines, rail, and airlines to enhance cybersecurity resilience.
Germany is creating a law to shield security researchers who find and report software vulnerabilities.
South Korea fined Meta $15.67M for illegally sharing Facebook users' sensitive data with advertisers.
Sponsored
Need a year-end pentest to check those compliance boxes or put your security controls to the test?
Okta discovered a vulnerability in the DelAuth procedure for Okta AD/LDAP that allows users with usernames with a length equal to or greater than 52 characters to authenticate with only a username and a stored cache key of a previous authentication (no password needed). This issue was resolved in Okta's production systems on October 30. Okta recommends that customers review their logs from July 23 to October 30 for evidence of exploitation.
There is a new phishing campaign that targets users by posting reviews with a fake customer support number. When users call the number, a fake customer support agent instructs them to enter a code on a website that installs the ConnectWise SmartConnect software. The customer support agent then asks questions and attempts to troubleshoot the issue while an accomplice uses the SmartConnect software to steal data or install other malware. The same customer support number has been seen in attacks on Netflix, Amazon, iCloud, and others.
500,000 people in Columbus, Ohio were affected by a ransomware attack in July claimed by the Rhysida gang. The stolen personal information included names, addresses, bank details, and Social Security numbers. The city dropped a lawsuit against a security researcher who was accused of exposing sensitive data from the attack.
AWS CloudTrail's behavior with VPC Endpoints allowed data exfiltration through denied cross-account requests. Exploiting the vulnerability requires creating a DynamoDB table with specific resource policies and using custom user-agents to smuggle data through CloudTrail logs. While now patched, the vulnerability demonstrates how CloudTrail's inconsistent logging behavior across services can be exploited for data exfiltration.
This blog post outlines DataDog's Detection as Code (DaC) workflow, Terraform repository structure, and testing strategy. The DataDog team's process involves defining a query in the UI, exporting the detection to Terraform from the UI, committing it to source code with tests based on Stratus Red Team, and then deploying via a GitLab CI/CD pipeline. The post provides samples of rules, suppressions, tests, and Terraform configurations.
Organizations can utilize Wazuh to build a zero trust security system that protects against cyber threats and compliance limitations of traditional security models. Zero Trust security changes how organizations handle security by continuously analyzing access requests and monitoring every device and user. Companies adopt Zero Trust security to protect against cyber threats and compliance limitations of traditional security models.
Sponsored
Pinggy is a tool that can create SSH tunnels over the public Internet without the need to download any binaries. There is a free plan that allows for custom domains and free persistent URLs for 7 days.
Vulnerable Apps is a sample repository that includes over 100 examples of vulnerable apps that can be used for educational or training purposes.
The Iscariot Suite is a collection of tools that enhances and augments trusted open-source and commercial Blue Team/Sysadmin products, turning them into traitor-ware to achieve offensive security goals.
AWS has developed a Security Guardians program that empowers builders to make security decisions to enable security efforts (threat modeling, security reviews, etc) at scale. AWS has defined five steps to creating a security guardians program: set the program vision, identify innovators with a passion for security, define the behaviors that guardians will be expected to perform, maintain guardians' interest by providing opportunities to learn new skills and potential for career advancement, and measure the success of the program by gathering feedback as well as other metrics.
Attacks on GenAI infrastructure like AWS Bedrock have increased, with attackers hijacking models for dark roleplaying applications. Permiso discovered attackers hosting a sexual roleplaying chatbot using hijacked LLM infrastructure in AWS. The attacker bypassed content filters to enable sexual and violent content, including potentially illegal material.
Threat actors are using DocuSign's Envelopes API to send fake invoices impersonating well-known brands like Norton and PayPal. Attackers are bypassing email security protections to trick recipients into e-signing these documents to authorize payments. This large-scale abuse of the API has been reported to DocuSign.
A global INTERPOL operation involving law enforcement agencies from 95 countries took down 22,000 malicious IP addresses linked to cyber threats.
Google Cloud will require all users to use multi-factor authentication by the end of 2025 to enhance security.
The FBI is seeking the public's help to identify Chinese hackers responsible for cyber intrusions that targeted companies and government entities.
Sponsored
APIs power your systems, but securing them shouldn't feel like a constant uphill battle. That's why STACKHAWK launched OVERSIGHT—a new feature providing a bird's-eye view of API security across your entire application portfolio. Designed to do more than just create another dashboard where teams can “admire their problems,” Oversight gives real-time insights to quickly pinpoint and fix security issues. As app portfolios grow, API DISCOVERY, API SECURITY TESTING, and OVERSIGHT keep security scalable and proactive, empowering teams to stay ahead of risks.
Chinese hackers are using "Botnet-7777" to conduct stealthy password spray attacks against Azure cloud accounts, targeting organizations across multiple sectors. Comprising mainly TP-Link routers, the 8,000-device botnet's distributed nature and low-volume attempts make detection difficult.
Scammers stole a Californian hotel's Booking.com credentials and sent targeted phishing messages to customers via the mobile app requesting additional information while citing reservation details. Booking.com confirmed a security breach with a partner but states its internal systems remain secure.
HUMAN's Satori Threat Intelligence team detected a new phishing campaign dubbed Phish n' Ships. The campaign utilizes n-day vulnerabilities, misconfigurations, and compromised admin credentials to upload fake SEO-optimized listings to compromised online shops. The listings redirect users to payment forms that allow the attackers to steal their credit card information. HUMAN has taken efforts to disrupt the campaign by reporting fake listings to Google as well as the online shops.
Successful security tooling programs require careful vendor selection based on a comprehensive rubric that prioritizes low false positives and workflow integration over cost while ensuring engineers aren't overwhelmed with vulnerabilities by implementing a phased "crawl-walk-run" approach to remediation. Tool success depends on full ecosystem integration with auto-creation/closure of vulnerability tickets, centralized security data lake visibility, and strong engineering team buy-in through their involvement in tool selection. Critical mistakes to avoid include selecting tools that create high operational overhead, failing to achieve complete coverage across all repositories, and overwhelming engineering teams with too many vulnerabilities at once instead of focusing on critical issues first.
Research on the Bluetooth Low Energy Generic ATTribute Profile (GATT) layer revealed vulnerabilities in various Bluetooth Low Energy (BLE) stacks. Attack scenarios were defined and a fuzzer was built to test BLE security. Vulnerabilities like DoS in NimBLE stack and Espressif GATT server example were discovered and reported.
This post provides an overview of Opus Security's vulnerability prioritization process. The strategy begins by utilizing the base CVSS score and then enriches it with additional information about the vulnerability such as the availability of exploit code, whether there are known attackers who are exploiting the vulnerability, and whether a patch is available. The next level involves adding in environmental factors such as how the resource is configured and its exposure.
The Noma platform delivers real-time monitoring, blocking, sensitive data masking, and alerting to defend against AI adversarial attacks and data leakage and enforce safety guardrails aligned with organizational and app-specific policies.