Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
The FBI quickly accessed the phone of Trump rally shooter Thomas Matthew Crooks, demonstrating advanced phone-hacking capabilities with the widespread use of tools like Cellebrite by law enforcement.
Kaspersky is closing its US operations and cutting jobs following President Biden's ban on the Russian company. The closure affects fewer than 50 employees, with layoffs starting this week.
When requesting training, the first step is to check if your company has any benefits related to training. You should approach your mentor with either the specific courses that you're looking to take or ask for help in finding courses. This post includes a template that can be used to submit a formal budget request after obtaining manager approval.
Previously, this feature was only available to Google One subscribers.
Microsoft warns that the Scattered Spider cybercrime group is now using Qilin ransomware in attacks alongside other ransomware payloads.
Singapore banks are phasing out one-time passwords (OTPs) in the next three months to protect customers from phishing and scams.
Sponsored
You want to stop vulnerabilities, automate license compliance, and simplify SBOM reporting. FOSSA [4] makes it easy. How easy? You don't even need to talk to a sales rep to access the free tier [4].
GitLab has disclosed a critical vulnerability (CVE-2024-6385) that affects its DevOps platform's CI/CD pipelines. The flaw, rated 9.6 out of 10 in severity, allows attackers to run pipelines as any user, potentially accessing sensitive data and injecting malicious code. GitLab strongly urges users to upgrade immediately to the latest patched version.
AT&T reported a data breach affecting nearly all its cellular customers, exposing call and text records. The breach, linked to the Snowflake attack, leaked phone numbers but not names or message content. AT&T is working with law enforcement and notifying affected customers, offering access to compromised data details.
A new vulnerability with a CVSS score of 9.1 allows attackers to bypass attachment extension blocking and deliver executables to victims has been discovered. The vulnerability stems from an error in the way Exim parses multiline headers. Researchers have found that more than 1.5M email servers run vulnerable versions of Exim.
The digital age has transformed international conflict, with cyber warfare emerging as a new paradigm. Data has become a weapon, reshaping how nations exert power and protect sovereignty in the global arena. This blog post dives into this transformation and what is coming next.
The Moonwalk malware has a modular design allowing for flexibility in functionality. It communicates through Google Drive and uses encryption for security. MoonWalk evades detection by using Windows Fibers and obfuscating its origins.
This comprehensive guide on password cracking and what it takes to build a password cracking workstation contains FAQs and links to previous posts on the topic. The guide notes that using GPUs can significantly speed up password cracking compared to using CPUs alone, but some algorithms may require a combination of GPU and CPU for efficient attacks. Building an efficient password recovery workstation involves considering power consumption, cooling solutions, and the type of attacks needed for different encryption formats.
Tracebit creates tailored canaries (fake honeypots) across cloud environments to lure threats, increase detection rates, accelerate responses, and reduce costs.
Gapcast is an IEEE 802.11 packet injection and analyzer software.
AES-GEM is a new encryption method that improves AES-GCM's security weaknesses. It offers AES-128-GEM and AES-256-GEM variants with enhanced key lengths and performance. While not ready for production yet, AES-GEM minimizes vulnerabilities and enhances encryption capabilities.
CISA's 2023 red team exercise on an unnamed federal agency revealed significant security vulnerabilities. The team exploited an unpatched Oracle Solaris vulnerability (CVE-2022-21587) to gain full access. Despite being notified, the agency took over two weeks to patch and failed to conduct a thorough investigation.
Cybercrime group Fin7, responsible for billions in losses, has made a comeback in 2024 after being declared dead by U.S. authorities in 2023. It is using a hosting provider called Stark Industries Solutions to set up thousands of fake websites targeting various brands for phishing attacks. Researchers have uncovered Fin7's extensive cybercrime infrastructure and warn of its rapid expansion and malicious activities, which includes targeting tourists visiting France for the Summer Olympics.
Hacktivist group NullBulge claims to have breached Disney's internal Slack, leaking 1.1 TiB of data, including messages, files, and code. The group aims to protect artists' rights and fair compensation. Disney has faced criticism for not paying royalties to writers and artists, with NullBulge possibly linked to the LockBit ransomware gang.
Researchers discovered API keys hardcoded in the company's codebase, putting sensitive information at risk of falling into the wrong hands.
A fake Microsoft Teams ad for Mac was used in a malvertising campaign targeting Mac users to deliver the Atomic Stealer malware.
Hackers are quick to use PoC exploits in attacks, sometimes within 22 minutes of release.
Evolve Bank & Trust reported a cyberattack affecting at least 7.6 million customers' personal data. The breach, resulting from a February ransomware attack by the LockBit gang, compromised names, Social Security numbers, bank account details, and contact information.
Fujitsu Japan has confirmed a cyberattack affecting 49 internal business PCs. First detected on March 15, the sophisticated malware evaded detection and stole sensitive customer and business data. The attack was limited to Fujitsu's internal Japanese network and didn't spread to customer environments. Affected individuals have been notified.
2.3 million individuals were affected by a breach of Advance Auto Parts' Snowflake instance. The stolen data includes names, birthdates, social security numbers, and ID information.
Governments are rushing to regulate AI despite a limited understanding of its potential and risks. This article dives into the possible ways AI can be regulated without the regulation being too restrictive or too loose.
This blog post discusses security issues found in the Ask Astro open-source chatbot application, focusing on potential chatbot output poisoning, inaccurate document ingestion, and denial of service risks. An audit identified architectural and implementation flaws in Ask Astro, including data poisoning through source material deletion and split-view poisoning through GitHub issues. Recommendations include implementing proper audit and moderation tools to mitigate data poisoning risks and ensuring content updates propagate accurately to the vector database.
The JFrog Security Research team found a leaked access token with administrator access to important Python repositories, preventing a potential supply chain attack. The leaked secret was identified in a Docker container, highlighting the importance of scanning for secrets in both source code and binary files. PyPI's quick response to revoke the leaked token (within 17 minutes) highlights the importance of acting swiftly when leaks are discovered.
Cytactic consolidates crisis readiness, response, and recovery tailored to versatile business profiles and risk landscapes.
OXO is a security scanning framework built for modularity, scalability, and simplicity.
k8s-sniff-https is a simple mitmproxy blueprint that intercepts HTTPS traffic from apps running on Kubernetes clusters. It is useful for reverse engineering API calls or debugging/troubleshooting apps that perform HTTPS calls to remote SaaS backends.
A new threat actor named "Crystalray" is using open-source software tools to scale its credential stealing and cryptomining operations. First spotted in February, Crystalray has now affected over 1,800 IP addresses globally. Its attack chain includes tools like ASN for reconnaissance, zmap for port scanning, and httpx for domain verification.
Signal is finally fixing a security flaw in its desktop client's encryption key storage after downplaying the issue since 2018. The flaw allowed anyone with access to the key to decrypt the database, making it vulnerable. Signal is implementing a new encryption method to enhance security and protect user data.
The EU introduced NIS 2 and DORA frameworks to enhance cybersecurity in the financial sector. NIS 2 covers various sectors, while DORA focuses specifically on financial entities. Both frameworks aim to improve digital resilience and compliance across different sectors.
Google has increased bug bounty rewards by five times - the maximum payout now at $151,515 for finding a single security flaw.
NATO is creating a new cyber defense center at its headquarters in Belgium to protect against cyber threats.
Google is now offering passkeys for high-risk users who join its Advanced Protection Program, replacing the need for a physical security key.
Sponsored
Is AI good or bad for GRC folks?
Four unpatched security vulnerabilities, including three critical ones, have been discovered in the open-source Git service Gogs. These flaws require authentication, but allow attackers to execute arbitrary commands, steal or delete source code, and plant backdoors.
Healthcare fintech company HealthEquity is reporting that it experienced a breach due to a compromised partner. HealthEquity detected anomalous behavior from a partner's personal device, leading to the discovery that their account had been compromised and used to exfiltrate PII. HealthEquity is notifying impacted individuals and has committed to providing credit report monitoring and identity restoration services.
FNTech, a third-party vendor that Roblox uses for managing conference registrations, has suffered a data breach. Registrants to the 2022-2024 Roblox Developer Conference may have had their registered name, email, and IP address leaked. FNTech has not yet released a statement on the breach.
AWS introduced trusted identity propagation to allow applications to propagate a user's IdP identity to applications running in AWS to access a subset of AWS services with SSO. Users can use the AWS CLI to obtain an auth token from their IdP which then gets used by IAM Identity Center to create an identity-enhanced IAM role session. This blog post includes a tutorial on building and using the CLI application to access data on S3 Access Grants, query Athena, and programmatically interact with other AWS services.
Grafana has announced that the “unnamed open source project” cited in the “How an empty S3 bucket can make your AWS bill explode” medium post was Grafana Loki. The author of the post used the same name as the default bucket in the Loki Helm chart when he was setting up the S3 bucket for his Loki installation, leading to other Loki clusters deployed using the default configuration to attempt writes to his bucket. Helm charts have been updated to not include default names unless using local storage. AWS also announced changes to S3 billing due to this bug.
Leveraging eBPF technology allows for the detailed monitoring of application performance and behavior in real-time without heavy instrumentation. This post describes two main methods, user and kernel probes, that offer different levels of visibility with varying impacts on application performance. Kernel probes provide efficient insights into applications without the performance overhead typically associated with user probes.
Sponsored
Looking for new areas of opportunity with automation?
Authzed is a permissions system that leverages open source project SpiceDB to provide fine-grained access control so that only authorized users have access to specific assets.
Beacon Object File (BOF) launcher is a library for executing BOF files in C/C++/Zig applications.