Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Google has released an update for Pixel phones that fixes vulnerabilities discovered being actively exploited by forensics firms. The first vulnerability is in the fast boot firmware and allows memory to be dumped from locked phones. Google’s fix involves zeroing the memory when booting fast boot mode. The second vulnerability allows local attackers to circumvent factory resets initiated by apps.
Despite being consistently ranked as the most critically dangerous software flaw for over a decade by OWASP, injection vulnerabilities continue to persist as a significant security threat. This post navigates how to prevent an SQL injection and prepare for a possible attack.
This post breaks down the use cases associated with LLM Security. Chatbot concerns are essentially just DLP concerns. Input and output filtering is relevant with custom apps if you’re relying on non-public data or an LLM cache.
An in-depth guide covering the different options for storing secrets in Lambda. The guide compares the performance, cost, and auditability of Environment Variables, Parameter Store, Secrets Manager, and KMS. It concludes with some example situations and strategies.
Sponsored
Can AI deliver on its promise to automate repetitive busy work? In this short webinar, you’ll learn to how to use Trustero’s Compliance AI Copilot [9] to simplify your compliance program. See how AI guides and helps manage assessments, maps evidence, and answers auditor questions — and the impact on your speed, cost, and effort.
StealthMole is a deep and dark web threat intelligence company that delivers a cloud-based, unified platform for digital investigation, risk assessment, and threat monitoring. Using AI, it provides tools and threat intelligence for identifying and eliminating digital risk and criminal activity.
SecuSphere is a DevSecOps platform designed to streamline and enhance organizations’ security posture throughout the software development life cycle as a centralized hub for vulnerability management, security assessments, CI/CD pipeline integration, and fostering DevSecOps practices and culture.
Cargo added a new subcommand called vet which matches all dependencies against a set of audits performed by the project authors or trusted entities.
Leicester City Council has acknowledged that the recent "cyber incident" it experienced on March 7 was a ransomware attack and data was stolen. The cybercriminal gang INC Ransom leaked 3TB of stolen data, including residents' personal information like passports, bank statements, and official council forms.
Ross Anderson was a respected cryptographer and security engineer. He passed away this week. Anderson was known for his brilliant insights and contributions to cybersecurity and academic freedom. His work, including the book Security Engineering, has been influential in the field.
Poland is investigating its previous government's use of spyware called Pegasus.
The US State Department is investigating a cyber incident involving leaked government data that includes personal details of government, military, and Pentagon employees.
On September 2023, Europol was notified that highly sensitive files of top Europol officials were missing due to a serious security breach at its headquarters in The Hague.
Sponsored
With a pre-mapped SOC 2 framework, Drata gives you everything you need to get and stay SOC 2 compliant.
A data breach at PandaBuy, an online shopping platform, has exposed the personal information of over 1.3 million customers. Two threat actors allegedly exploited multiple vulnerabilities to gain access. The leaked data includes usernames, names, phone numbers, emails, IP addresses, order details, addresses, and more.
This article provides a deep dive into a new critical vulnerability in the open-source AI framework Ray. The vulnerability is due to a lack of authorization in the Jobs API that is disputed and thus unpatched. The article goes in-depth into the framework, the vulnerability, the IoCs, and the impact of exploitation.
Omni Hotels has been experiencing a widespread outage affecting its reservation, hotel room door lock, and point of sale systems since Friday. All locations are open and accepting new customers but front desk employees have been experiencing widespread issues. Omni Hotels hasn't released any details on the cause, but internal IT employees have said that services are being built from scratch.
Damn Vulnerable RESTaurant is an intentionally vulnerable API service designed as a learning and training platform for developers, ethical hackers, and security engineers. It covers popular API vulnerabilities, including OWASP Top 10 API Security Risks, providing an interactive environment to identify and fix vulnerabilities, exploit them manually or through automation tools, and test security mechanisms.
The backdoor in the widely-used open-source xz compression library could have led to a significant security disaster had it not been fortuitously detected by a curious Microsoft engineer investigating latency issues. This near-miss scenario has raised alarms about the potential for similar undetected compromises in software infrastructure. This post analyzes the current state of open source software.
This post details a method that uses Tailscale to establish a C2 on a Kubernetes node. In this scenario, an attacker has obtained time limited cluster-admin credentials and wants to utilize those credentials to establish persistence. The described attack involves deploying Tailscale on the node via containerd or a static manifest and utilizing Tailscale ACLs to only allow communication from C2 controller nodes to the infected bot nodes.
Sponsored
Security professionals know the struggle: an endless stream of alerts, limited resources, and the constant fear of missing critical threats. CYREBRO collaborated with Google Cloud to enhance its Managed Detection and Response solution [11] and tackle these challenges. Built on Google Cloud’s big data and machine learning capabilities, CYREBRO’s new security data lake and detection engine ingest vast amounts of security data, separating the signal from the noise. The enhanced MDR solution focuses on the most relevant threats, shortens MTTD and reduces false positives, to minimize business risk. Learn more about CYREBRO’s Precision-Guided Detection [11].
Zafran connects to both vulnerability data and the organization’s security controls. It analyzes risk while taking into account controls’ efficacy as well as exploitability factors.
Snyk Maven Plugin tests and monitors Maven dependencies for vulnerabilities.
TrailDiscover is an evolving repository of CloudTrail events with detailed descriptions, MITRE ATT&CK insights, real world incidents, references, and security implications.
Google agreed to a proposed $5 billion class-action settlement requiring it to destroy or de-identify billions of web browsing data records collected from users in "Incognito mode," mandate better disclosures about data collection in Incognito, and impose limits on future data gathering. If approved, the settlement could apply to 136 million Google users who accused the company of illegally tracking their private browsing behavior.
The OWASP Foundation announced a data breach exposing personal information provided by aspiring members in resumes submitted between 2006 and 2014 as part of the old membership process. The breach, caused by a misconfiguration on OWASP's old wiki server, compromised names, addresses, phone numbers, email addresses, and other identifiable information of tens of thousands of members from the non-profit software security community organization.
The Efficient Security Principle is essentially that security is only as good as it needs to be to keep people using the service. This post provides guidance to security practitioners and leaders on how to utilize this principle.
A GitHub gist that provides some notes and tools for reverse engineers to deobfuscate/unminify obfuscated code.
Researchers from the firmware security firm Binarly released a free online scanner to detect the CVE-2024-3094 backdoor.
Chrome is adding Device Bound Session Credentials (DBSC) to enhance user protection against cookie theft, a mechanism that uses a private key tied to the device.
Sponsored
Datadog analyzed security posture data [4] from a sample of thousands of organizations [4] that use AWS, Azure, or Google Cloud. Their findings suggest that organizations still face significant challenges around issues such as:
A backdoor was found in the xz/liblzma compression library, impacting Linux systems using specific OpenSSH builds. It was submitted by a core developer to the project with years of legitimate contributions. The backdoor was discovered by a user who noticed a new memory leak in the project.
AT&T confirmed a massive data breach impacting over 7.6 million current and 65 million former customers. The leaked information included personal details like names, emails, addresses, phone numbers, social security numbers, dates of birth, and account credentials. The company has reset affected customers' passcodes and is notifying impacted individuals.
Apart from xz, Linux users have another vulnerability with CVE-2024-1086. Linux kernel versions between at least 5.14 and 6.6.14 are susceptible to privilege escalation. The exploit has a success rate of 99.4% on kernel 6.4.16.
This post dives into why investing in infosec is key for B2B SaaS companies as they are trying to sell to enterprises that will want to know how secure they are. These processes are usually long and rigorous and require startups to focus on showing their security acumen.
This blog post discusses the vulnerability management lifecycle in DevSecOps, focusing on three key stages: identification, observability, and management. The goal is to empower engineering teams to prioritize and address security risks within their digital products through technology-driven processes. The post emphasizes the importance of integrating security practices into software development to ensure a secure-by-design approach.
This blog post from Exodus Intel explains a vulnerability (CVE-2024-0582) in io_uring in the Linux kernel related to a use-after-free bug. The vulnerability occurs when an application registers and later unregisters a provided buffer ring with a specific flag, leading to memory issues. The post details the exploitation of this vulnerability and a data-only exploit strategy.
Cleanowners is a GitHub Action that helps keep CODEOWNERS files current by removing users who are no longer a part of the organization.
Root is a software supply chain collaboration and transparency platform that helps software consumers understand, prioritize, and mitigate their risks.
NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks.
The European Union has published draft election security guidelines targeting around two dozen large platforms like Facebook, Google, Instagram, TikTok, YouTube, and X that are regulated under the Digital Services Act. The guidelines aim to mitigate systemic risks such as political deepfakes while safeguarding rights like free speech and privacy.
Ubuntu is manually reviewing apps in the Snap Store after fake crypto wallet scams. Apps are now checked by engineers before being available for users to download. This change aims to prevent further cryptocurrency thefts and enhance app safety.
This report found a 56% increase in actively exploited zero-days in 2023 over 2022.
This post talks about hijacking attacks, often involving compromised accounts, that use curiosity to trick people into clicking on malicious links or attachments in emails.
OpenAI's Voice Engine technology, capable of cloning voices with just 15 seconds of audio, has been deemed too risky for widespread release due to misinformation concerns.
PyPI, the main Python Package Index repository, temporarily halted new project creation and user registration due to a continuous attack of malicious package uploads designed to infect devices through typosquatting techniques. After a 10-hour suspension, PyPI restored normal operations as it had addressed the security concerns.