Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Home Depot has confirmed that a third-party SaaS vendor that it uses was breached, leading to the exposure of 10k employee's data. The exposed information includes names, work email addresses, and user IDs. This information is not inherently sensitive but could be utilized in phishing attempts.
In an ongoing effort to combat DDoS attacks, Amazon Web Services (AWS) has made significant progress in tackling the long-standing issue of IP spoofing, which allows attackers to hide the source of attacks. In this interview, AWS explains its new approach in disrupting a decades-old problem that has given attackers a major advantage.
Hakluke describes his bug bounty automation process and its evolution. Hakluke began with a bash script before moving to a framework that relied upon Django admin commands. To scale better, Hakluke moved to a distributed Golang environment and now plans to move over to a Cloud Native solution.
Google Public DNS uses multiple strategies like case randomization and DNS-over-TLS to protect users from cache poisoning attacks. These measures make it harder for attackers to manipulate DNS responses and improve security for users worldwide. Google Public DNS aims to enhance DNS security by actively implementing countermeasures and collaborating with the DNS community.
Knostic prevents the chatbots used by enterprises from sharing sensitive information with employees who should not have access to it.
Google Cloud has integrated its flagship Gemini language model into new AI-powered security tools unveiled at its Next 2024 event. These include Gemini in Threat Intelligence for conversational threat research, Gemini in Security Operations to assist in investigations and draft detection rules, and Gemini in Security Command Center to generate summaries of security alerts.
Jigsaw is a tool to obfuscate raw shell code by outputting randomized shell code, a lookup table, and a C/C++ stub to reassemble it at runtime.
Research from the University of Pennsylvania reveals a concerning lack of privacy on hospital websites, with 96% transmitting user data to third parties like Google, Meta, and data brokers without explicit consent. Despite being places where privacy is expected, many hospitals employ tracking technologies and lack transparency, with only 56% of those with privacy policies disclosing the third parties receiving user information.
Researchers at Bitdefender have discovered multiple vulnerabilities affecting LG TVs running WebOS versions 4 through 7 that allow remote attackers to gain root access, execute arbitrary commands, and potentially drop malware or conduct lateral network attacks.
Google's Chrome Enterprise Premium promises to add security features at a cost of $6/user/month. Chrome Enterprise Premium supports enforcing policies, managing software updates and extensions, and some TCP protocols such as SSH and RDP. Early adopters have reportedly been getting value from it.
X briefly launched a change that automatically replaced any instance of x.com (even in cases like fedex.com) in its redirects with twitter.com. The feature has since been rolled back.
Google's Find My Device network has been updated to be able to locate offline Android devices and integrate some third-party trackers.
CISA is investigating a breach at Sisense, and has advised Sisense customers to reset their credentials due to possible data exposure.
>> Learn more about using Orca’s Cloud Security Platform [4] to prioritize cloud risk
Sponsored
Orca’s 2024 State of Cloud Security Report [3] highlights risks found in actual production environments, based on data captured from billions of cloud assets [3] on all major public cloud providers. The researchers found that basic security practices are still lacking [3]. Even more troubling, many risks reside on exposed and public assets — for example, 21% of organizations [3] store sensitive data in a public-facing storage bucket.
Hackers are exploiting vulnerabilities in 92,000 D-Link devices to take control remotely. The vulnerabilities exist in end-of-life devices no longer supported by the manufacturer. Users should update firmware or replace outdated hardware to protect against these attacks.
Microsoft fixed two actively exploited zero-day vulnerabilities in the latest Patch Tuesday, addressing malware attacks. One vulnerability involved a malicious driver signed with a valid Microsoft certificate, while the other bypassed a security feature to deploy malware on Windows systems.
Hackers have been leveraging hijacked Facebook accounts to impersonate legitimate AI services like MidJourney and OpenAI’s SORA to trick users into installing malware. The pages utilize Facebook ads that pushed communities that supposedly allowed members to test new features but instead posted links to download malware masquerading as beta versions of the software. One particularly successful campaign operated a MidJourney page that amassed 1.2 million members over nearly a year.
This post discusses the history and evolving threat of vulnerable drivers in Windows operating systems, highlighting the need for monitoring and prevention strategies. Microsoft recommends a defense-in-depth approach that leverages technologies like Memory Integrity, Smart App Control, and the Vulnerable Driver Block List to enhance security against driver-based attacks.
This technical blog post details the vulnerabilities and exploits that led to the discovery of issues in CD Projekt Red's GOG Galaxy 2.0 gaming platform related to Denial-of-Service and Local Privilege Escalation (assigned CVE IDs 2023-50915 and 2023-50914). It highlights the risks associated with insecure interactions within the platform. The vulnerabilities involve inter-process communication and filesystem manipulation and can lead to potential exploitation for impactful attacks.
A tutorial from AWS on how to create security events for testing IR playbooks. The solution generates findings for a list of included CVEs that can be detected for GuardDuty, Inspector, or sent to a SIEM. AWS recommends that these should be run in a dedicated, sandboxed environment as a purple-teaming exercise.
Wiz maintains a database of cloud-focused incidents, actors, tools, and techniques. The website uses a collection of database tables that are filterable and it can also be subscribed via RSS feed.
gram is Klarna's locally hostable threat model diagramming tool. It is a webapp for engineers to collaboratively create threat models for their systems, providing an accessible way to document a system as a data flow diagram with threats and controls attached. The repository has a quickstart section to step through setting up the tool.
CloudFox is a tool by BishopFox to enumerate cloud environments. The tool can be used by defenders to enumerate attack paths or by attackers to automatically enumerate resources that stolen credentials can access. Currently, AWS and Azure are implemented, with support planned for GCP and Kubernetes.
This is a guide on evaluating children’s toys for privacy. It begins with some tips for evaluating privacy policies for the toys and companion apps. The post then provides a deep dive into how to inspect Bluetooth and Wi-Fi traffic and what to look for.
An introduction by AWS to the new Terraform Test framework introduced in v1.6. The tutorial includes worked examples on writing tests for success, failure, and tests for resources or variable validations. It also includes examples on how to run tests in a CodePipeline.
This edition of CISO conversations with Nick McKenzie and Chris Evans discusses the evolving role of CISOs in cybersecurity. The conversation provides an insightful look into the evolution and best practices of bug bounty and vulnerability disclosure initiatives from the perspective of two industry leaders.
The FCC is working to protect domestic violence survivors from being tracked by their abusers through connected car features like GPS and is seeking input from vehicle manufacturers and wireless service providers on how to limit abusers' access to these features.
Android 15 introduces Private Space for added data protection on your Android device, which will allow you to hide and secure sensitive apps and files within an encrypted area.
Google introduced the V8 Sandbox as a default option on supported platforms in Chrome to protect users from memory corruption exploits.
Sponsored
Credentials serve as the keys to our online existence — and are also a security liability. The average professional manages up to 200 sets of credentials [3] on average; when they’re compromised, cyber attackers gain instant entry into sensitive systems and can often move laterally to find your crown jewels.
Japanese optical product manufacturer Hoya Corporation announced that it is working to restore systems at some production plants following a cyberattack. The incident prompted Hoya to isolate servers, impacting IT systems at its headquarters and business divisions. The company has engaged forensic investigators and notified relevant authorities as it investigates and responds to the attack, which caused system failures across its operations.
Jackson County, Missouri, has declared a state of emergency and indefinitely closed key offices like Assessment, Collection, and Recorder of Deeds in response to a suspected ransomware attack that disrupted its IT systems. The attack has rendered certain systems inoperable, impacting services like tax payments, marriage licenses, and inmate searches, while other systems remain functional.
Researchers at Anthropic have devised a new technique to convince AI models to answer questions that they aren’t meant to. The method involves exploiting larger context windows to prime the LLM with a series of questions (that it won’t answer due to filters) and answers as if the LLM answered them. Over time, the LLM will get “confused” and think it answered the questions and will answer inappropriate questions.
This blog post explains how to bypass anti-reversing defenses, such as ptrace syscall and getppid() method, in iOS applications. It also covers bypassing sysctl syscall and jailbreak detection to analyze and manipulate application behavior at runtime. The author demonstrates methods to overcome these security measures using tools like frida and radare2.
This article discusses the use of LLMs to enhance the capabilities of threat intelligence analysts. It explains the technique of prompt engineering and provides an example of an ideally crafted prompt. The article also explores the practical applications of LLMs, few-shot prompting, and retrieval augmented generation (RAG).
Binarly is a firmware supply chain security platform that uses AI to detect and remediate known and unknown vulnerabilities at every step of the device and software supply chain.
Test every type of Container configuration scanner against a single repo that's comically insecure with documented issues
A live feed of C2 servers, tools, and botnets. The tool scrapes Shodan for IoCs of various malicious activities.
NIST has announced $3.6 million in grants to 18 education and community organizations across 15 states to address the cybersecurity skills shortage. Each state will receive around $200,000 to educate future cybersecurity employees through Regional Alliances and Multistakeholder Partnerships to Stimulate (RAMPS) projects aligned with local industry needs, overseen by the NICE cybersecurity workforce development partnership.
Critical risks in AI-as-a-service providers that could allow threat actors to escalate privileges, gain cross-tenant access to other customers' models, and more, have been identified. These risks stem from the ability to run malicious models uploaded in pickle format on shared inference infrastructure and exploit shared CI/CD systems.
With attacks on critical infrastructure in the energy and healthcare sectors continuously increasing, it’s time for countries to adopt binding international legislation that builds a new cyber treaty. There have been some efforts made, but a coordinated response could solidify previous efforts while building accountability and allowing for resource allocation towards protecting critical infrastructure.
The AWS Network Firewall is the least secure and most expensive firewall.
The Northernmost German state, Schleswig-Holstein, announced that it is migrating its 30,000 PCs to Linux and LibreOffice in an effort to establish IT digital sovereignty.
Microsoft introduced a new Windows driver to prevent users from changing default browsers manually or through software updates.
SurveyLama, a survey rewards platform, has disclosed a data breach impacting over 4.4 million users' personal information, including email addresses, names, addresses, phone numbers, dates of birth, IP addresses, and hashed passwords. The incident occurred in February but came to light recently through its addition to the Have I Been Pwned breach notification service.
The City of Hope, a cancer treatment and research organization, has reported a massive data breach affecting 827,149 individuals, with their sensitive personal information including names, Social Security numbers, and medical records being leaked.