Search the archive

WALLET

Last week, three ex-team members of PEPE, the memecoin, allegedly stole $15 million, sold the tokens, and deleted their social accounts, causing an 18% drop in PEPE and sending shockwaves throughout the rest of the memecoins.

MALWARE

ReversingLabs found over a dozen malicious npm packages mimicking the roblox.js gaming API wrapper. The packages drop Luna, an info stealer malware, into the code. This attack is a continuation of a campaign seen in 2021. It targets Roblox community developers and highlights npm supply chain risks.

MOVEIT, THE BIGGEST HACK OF THE YEAR, BY THE NUMBERS

The mass exploitation of MOVEit's Transfer software has rapidly cemented itself as the largest hack of the year so far. While the full impact of the attack will likely remain unknown for months to come, there are now more than 1,000 known victims of the MOVEit breach, according to cybersecurity company Emsisoft. This report looks into the MOVEit attack by the numbers.

DUOLINGO DATA LEAK POSTED ON HACKING FORUM

Duolingo suffered a data breach when a public API endpoint leaked non-public profile information such as email addresses. The dataset was released on BreachForums for the equivalent of $2.13.

NVME: NEW VULNERABILITIES MADE EASY

This blog post showcases how researchers at CyberArk used Static Code Analysis tools to find a Pre-Auth Remote DoS vulnerability (CVE-2023-0122) caused by a NULL Pointer Dereference in the NVMe driver of the Linux kernel.

BYPASS TWO-FACTOR AUTHENTICATION OF FACEBOOK ACCOUNTS ($25,300)

This write-up explains how Facebook's Two-Factor Authentication was bypassed during Meta’s bug bounty Researchers conference in Seoul, South Korea, in 2023. The author was awarded $25,300 and ranked 2nd place on the conference Leaderboard.

METHODS TO BACKDOOR AN AWS ACCOUNT

An exploration of the different AWS mechanisms that an attacker that has gained privileged access to an AWS account can use to establish persistence. This is part three of a series - the previous two parts focus on escalating privileges on a compromised AWS account.

APPLICATION

Cerby has received capital to secure non-standard applications. Research has found that 52% of organizations have experienced cybersecurity incidents caused by their inability to secure these kinds of applications. Applications are defined as nonstandard if they do not support common identity and security standards such as SAML and SCIM.

IPFUSCATOR

A blazing-fast, thread-safe, straightforward, and zero memory allocation tool for swiftly generating alternative IP(v4) address representations in Go.

VILLAIN

Villain is a high-level C2 framework that can handle multiple TCP sockets and HoaxShell-based reverse shells. It features payload generation and file uploads. Villain was added to the Kali Linux repository in the most recent update.

LANDSCAPES

This document is a comprehensive overview of modern cybersecurity. It discusses the various threats that exist in the digital realm, such as ransomware, phishing, and various forms of social engineering. It also explores the role of nation-states in cyber warfare and the importance of fortifying one's digital stronghold. The document emphasizes the ongoing nature of cybersecurity and the need for vigilance and continuous learning.

BROWSER EXTENSION RISK REPORT: HIGH RISKS FOR SAAS DATA

Researchers at Spin.AI assessed 300,000 Chromium browser extensions and found that 51% of all installed extensions were high risk and had the potential to cause extensive damage to the organizations using them. The extensions all had the ability to capture sensitive data from enterprise apps, run malicious JavaScript, and surreptitiously send protected data, including banking details and login credentials, to external parties.

LAPSUS$: COURT FINDS TEENAGERS CARRIED OUT HACKING SPREE

An 18-year-old from Oxford has been found guilty of being a part of an international cyber-crime gang responsible for a hacking spree against major tech firms such as Uber, Nvidia, and Rockstar Games.

EXPANDING TESTING FOR END-TO-END ENCRYPTION ON FACEBOOK MESSENGER

Meta has once again reaffirmed its plans to roll out support for end-to-end encryption by default for one-to-one chats on Messenger by the end of the year.

MICROSOFT SIGNING KEYS KEEP GETTING HIJACKED

Microsoft’s digital keys have been hijacked to sign yet more malware for use by a previously unknown threat actor in a supply-chain attack that infected roughly 100 carefully selected victims.

CRYPTO STARTUP BANKRUPT AFTER LOSING PASSWORD TO WALLET

Prime Trust is a crypto startup designed to help other startups provide crypto retirement funds. It had to file for bankruptcy after losing the password to a physical crypto wallet with $38.9 million in it.

RISKS IN AWS SSM PORT FORWARDING

AWS Systems Manager Session Manager (SSM) allows for IAM users to access EC2 instances. One common use case for this is port forwarding to other services such as RDS. The SSM-SessionManagerRunShell document may be implicitly granted to the user. This article details how to fix this.

WELLBEING AT WORK IS ABOUT FEELING CONNECTED

Whether hybrid, remote, or fully in-office, the leading indicator of performance and reduced instances of burnout is how connected an employee feels to the broader organization. This involves more access to information and resources, time to do work, and feedback from peers and managers.

KLAVIYO FILES FOR AN IPO

At almost $600m ARR, still growing at 57% YoY, and profitable for the last 6 months, could Klaviyo be the first SaaS IPO out of the pandemic gates that sets the path for others?

INSTACART FILES FOR AN IPO

Grocery delivery giant Instacart has filed to go public in what is the first significant venture-backed tech IPO since December 2021.

EMBRACING FAILURE

Founders are increasingly being more open with their failures, and that’s a good thing. It shows that building startups and pursuing innovation is all about experimenting and taking shots on goal. Failures aren’t failures, simply attempts.

YOU NEED A CO-FOUNDER

Although there’s been some successful solo founders, you’ll often hear that you need a co-founder in a complimentary domain in order to build a truly great startup. But what is a co-founder? It’s really just a title, someone you trust to run the company in your absence. It doesn’t need to be someone with equal equity as you.

THE ENGINEERING EXECUTIVE’S ROLE IN HIRING

A comprehensive dive into the components of an effective hiring process for technical roles. Build a scalable system, train your hiring managers, set benchmarks and reporting windows with your recruiting team, and determine compensation levels before you kick off the hiring process.

POOZLE

Poozle is an open-source single API for Product Integrations.

AROUND THE WORLD IN 21 DAYS

Our expectations of how people use technology and the reality of that usage can often be different. Stay close to your users.

HOW TO GET SOMEONE ON YOUR PODCAST

Make it as easy as humanly possible for them to say yes, schedule, do the prep, and show up.

IS REPORTING CASH-ON-HAND TO YOUR INVESTORS NOW A RED FLAG?

Over the last 18 months, a lot of my personal portfolio companies started to put their cash-on-hand status right at the top of their investor update. It showed that month-month they were being cautious with cash, but it also often meant they weren’t really growing all that much. As the macro improved a little, is now the time to start deploying capital to build value?

PRACTICE SPEAKING UP

The imaginary cost of speaking up is often less than the real cost.

FEWER MEETINGS MEANS YOU HAVE TO SHOW MORE IMPACT

If you’re declining meetings to focus on other things, eventually you’re going to have to show that this tradeoff meant something.

ORGANIZATIONS

WORDPRESS ANNOUNCES 100-YEAR DOMAIN NAME REGISTRATIONS

HOW TO USE AI TOOLS IN CONTENT MARKETING

HOW TO BUILD A 730-DAY CONTENT LIBRARY

WOMEN IN TRAVEL: SAMANTHA TAYLOR

GEN Z IS MORE LIKELY TO BE OK WITH TARGETED ADS

AN ALT TEXT GUIDE TO ENSURE EVERYONE CAN ENJOY YOUR MEMES

ALGORITHM, AND MORE

TO TEST OR NOT TO TEST, A TECHNICAL PERSPECTIVE

This article delves into the creation of test cases from a technical perspective, detailing what should be included in each test and what to avoid. It answers the age-old question of what to test vs. what not to test.

AURORA SERVERLESS – A MIGRATION STORY

A team that swapped databases almost every other month finally settled on AWS Aurora Serverless V2. This article breaks down their application architecture and use cases for their database and explains why they would continuously switch. The team eventually landed on Aurora Serverless, which was nice because scaling was taken care of. However, Aurora was still in development at the time and therefore a bit unstable.

WRITING A PACKAGE MANAGER

Writing a package manager is not easy, but it’s a great exercise in building something that’s not usually built. This tutorial goes through design decisions made, tradeoffs considered, and implementation details when writing a package manager with many visual examples.

DESIGNER

Collaboration is a hard but necessary aspect of working in teams. This article provides actionable advice on how to overcome the two most common challenges when working with your designer or product manager: adding scope and slow responses. It also provides a guide to building a working relationship that will make you one of their favorite engineers to work with.

SOME TACTICS FOR WRITING IN PUBLIC

Many people shy away from writing in public for fear of receiving negative comments. This article explains some tactics that can help make the comments on blog posts more informative and useful.

HOW TO MAKE TIME FOR PROFESSIONAL DEVELOPMENT

In today’s fast-paced business world, continuous learning is not just a buzzword, it is a necessity. However, balancing its undeniable value with the pressing demands of the average workday is tricky. This article offers tips that make it easier to prioritize professional development.

GRAPHWEAVER

Graphweaver allows you to turn multiple data sources into a single GraphQL API. It’s built for Node in TypeScript and supports all major sources, like Postgres, MySQL, and more.

CRUMB

Crumb is a high level, functional, interpreted, dynamically typed, general-purpose programming language with a terse syntax and a verbose standard library.

BICYCLE

Bicycle is a framework for defining database schemas whose access patterns are generated as code and compiled into each server binary. This reduces dynamic query parsing at run time. The framework uses gRPC, RocksDB, and Rust.

WASHING YOUR CODE: NAMING IS HARD

Naming is one of the hardest problems in programming. Bad naming can make debugging difficult and codebases harder to understand. This article takes a look at naming anti-patterns and how to fix them. It lays out some rules for clear naming. For example, the shorter the scope of a variable, the shorter its name should be.