Salt Labs discovered vulnerabilities in ChatGPT and its third-party plugins, including a zero-click exploit that gives attackers access to victims' private GitHub repositories. OAuth implementation flaws were found in ChatGPT and multiple plugins, potentially allowing unauthorized access by a malicious actor to proprietary data. The vulnerabilities were reported to OpenAI and plugin developers in July and September 2023 and have since been resolved.
2024.03.15·packetstormsecurity.com·4 min read·GitHub repository·TLDR InfoSec Researchers have discovered a new side-channel attack called token inference that can be used to infer the topic behind 55% of chats between an AI assistant and users on all platforms other than Gemini. The attack makes use of the fact that most AI Assistants send messages back token by token to provide faster responses. The encrypted token length is identical to the token length so the researchers were able to train two LLMs based on stylistic patterns in public chats from the various AI Assistants.
This blog post from Google discusses its threat model for post-quantum cryptography, which emphasizes the urgency of adopting quantum-safe algorithms to protect data from future quantum computing threats. It also outlines recommendations for prioritizing quantum threats and deploying hybrid post-quantum cryptography solutions and addresses specific use cases like encryption in transit, firmware signatures, software signatures, public key infrastructure, tokens, and other scenarios vulnerable to quantum threats.
This document, part of a two-part series, delves into practical and theoretical attacks in the industrial landscape, focusing on the vulnerabilities and potential methods attackers can use to disrupt automation processes within a factory setting.
Sponsored
Tired of the massive price tag and endless maintenance of legacy SIEM? EventSentry [10] offers real time event monitoring, web-based reporting, unlimited data and unlimited metrics — starting from $98 per license [10].
AI Goat is a series of vulnerable LLM CTF challenges for learning AI security. The challenge set is built on Vicuna LLM, which is derived from LLaMA and coupled with ChatGPT’s response data.
403JUMP is a tool designed for penetration testers and bug bounty hunters to audit the security of web applications. It bypasses HTTP 403 (forbidden) pages by employing various techniques like using different HTTP verbs and headers and managing concurrency.
Excalibur is a CLI tool that sends alerts if a given X account has been archived. It can also be used to find associated Mastodon, Medium, and Product Hunt accounts.
Red Canary has released its annual threat detection report, which provides an overview of the current threat landscape. Humans remain the most exploited vulnerabilities. Cloud account compromise has increased 16-fold. Containers are now nearly omnipresent, and MacOS malware is on the rise. MFA fatigue attacks have become increasingly prevalent and Cobalt Strike is no longer in the top 10 C2 platforms.
Modified versions of text editors were found in search results on a popular Chinese search engine. The fake software contained backdoors designed to execute remote commands and communicate with a malicious server. This kind of "malvertising" has been used to lure victims to malicious sites.
Data privacy company Onerep.com, supposedly based in Virginia, helps individuals remove personal information from people-search websites for a fee. However, investigations reveal the company actually operates from Belarus and Cyprus. The company's founder, Dimitri Shelest, has launched numerous people-search services over the years. Despite claims of independence, connections between Onerep.com and Nuwber.com raise questions about their relationship and practices.
Attackers have started to hijack user accounts on service providers' platforms and apps to initiate procedures to port victims' numbers to other devices or generate QR codes to activate new eSIMs.
The Federal Communications Commission has approved a new U.S. Cyber Trust Mark for consumer Internet of Things (IoT) devices that will denote that devices such as 'smart' home appliances meet baseline security standards.
Tech support firms Restoro and Reimage have been fined $26 million by the US Federal Trade Commission (FTC) due to their use of scare tactics to trick customers into paying for unnecessary computer repair services.
Roku has disclosed a breach in which hackers accessed 15,363 customer accounts and associated credit card data through credential-stuffing attacks. The hackers changed some account logins, enabling unauthorized streaming subscription purchases. Accounts are being sold online.
QNAP released an advisory about its NAS software products. Three vulnerabilities have been discovered, one of which allows unauthenticated users to compromise systems. QNAP is urging users to update ASAP.
Stanford University has announced that the personal information of 27,000 people was stolen in a ransomware attack in September that targeted its Department of Public Safety network. The attackers did not gain access to other systems. The Akira ransomware group claimed responsibility for the attack in October and has since published the stolen data on its dark web leak site.
Compliance standards like the new PCI DSS 4.0 increasingly align with security best practices, making them more relevant for security teams. With its transition period ending in March, PCI DSS 4.0 provides an opportunity to examine how the updated requirements impact security professionals' priorities within governance, risk, and compliance efforts.
A novel attack method on AWS allows attackers to create a large amount of RANGE requests for parts of large (>1GB) files before quickly canceling the request. This bills owners for the full request, which can result in a 50x cost amplification. This post discusses defenses against this attack and why current remedies fail.
A comparison of the available EKS optimized base OSes for security and scalability. Amazon Linux 2023 provides consistent improvements over Amazon Linux 2, but Bottlerocket, which was designed specifically for container orchestration, trumps both. Bottlerocket provides strong security defaults while providing a minimal host OS as it strips out traditional tools like shells and interpreters that are not necessary for container orchestration.
Sponsored
Software is drowning in security debt. Research by Veracode [10] has found that 70.8% of organizations have security debt and nearly 50% have critical debt. The problem starts when your security testing doesn’t match the velocity of your release schedule. What can you do about it? Run security tests faster and earlier [11] with Veracode Dynamic Analysis (DAST). It’s free for 14 days [11] (no credit card required!)
CloudGrappler is a tool designed for effortless querying of high-fidelity and single-event detections related to well-known threat actors in popular cloud environments such as AWS and Azure.
A CLI tool (and library) for identifying hash types.
Nemesis is a data enrichment pipeline and operator support system for offensive security. It automates a number of repetitive tasks operators encounter on engagements.
President Biden's proposed $7.3 trillion budget seeks to boost cybersecurity funding. It includes $3 billion in funding for the CISA. The budget also allocates $13 billion for improved cyber defenses across government agencies.
Magnet Goblin is a financially motivated threat group that rapidly exploits 1-day vulnerabilities in internet-facing services. They use an Ivanti VPN exploit discovered within a day of its release. Their arsenal includes NerbianRAT, WARPWIRE, MiniNerbian backdoors, and remote management tools. They have targeted Ivanti, Magento, Qlik Sense, and possibly Apache ActiveMQ in recent campaigns.
AWS has launched a new set of dashboards that provide near-real-time visualizations of Cloudwatch logs generated by AWS WAF. The dashboards visualize key WAF metrics such as bot detection, CAPTCHA solve rates, and the top 10 matched rules for each web ACL. The dashboards are enabled by default at no additional charge.
Google paid out $10 million through its bug bounty programs in 2023. It has paid out $59 million since 2010.
Indoor security cameras will be banned inside all Airbnb listings to protect customer privacy. Stricter regulations on outdoor cameras and noise decibel monitoring devices were also announced.
Kali Nethunter now supports performing bad bluetooth HID attacks.
Russian hacking group Midnight Blizzard gained access to some of Microsoft's source code repositories and internal systems in a breach that was discovered in January. No customer-facing systems were compromised. The hackers attempted unauthorized access using exfiltrated Microsoft corporate email data, including secrets shared with customers.
Security researchers have revealed multiple vulnerabilities in Sceiner's smart lock firmware that allow attackers to manipulate its locks and open doors. The issues, which affect products sold by Sceiner and brands like Kontrol and Elock, include insecure cryptography, plaintext processing, and outdated protocols in the lock firmware and associated mobile app used for remote control.
A new social engineering campaign uses links resembling those generated by Skype, Zoom, and Google Meet to trick users into downloading RATs. The campaign targets Windows and Android users with specialized Trojan programs for each platform.
Applications have different mechanisms for importing dependencies. Executed libraries are dependencies that actually run. Library loading is when a dependency is imported and loaded into memory prior to usage. Runtime tracing can determine library usage.
Form hijacking is where an attacker exploits an HTML injection vulnerability by utilizing the formaction attribute or injecting their own form, thereby bypassing CSP. This is possible because the form-action directive was added in CSP v2 and is not covered by default-src. This post lists options to fix this and presents an overview of different scans in Burp Suite related to CSPs.
This post looks at statistical trends of vulnerabilities in the GitHub Advisory Database. The most common CWE associated with vulnerabilities was cross-site scripting. Maven was the ecosystem associated with the greatest number of vulnerabilities.
Sponsored
Security compliance can be complicated, especially when you’re
has everything you need to understand the process and get your SOC 2 report. Includes a free ebook, evidence collection spreadsheet [10], customizable policy templates, and an audit readiness checklist.
Secutils.dev is a versatile yet simple toolbox for security-minded engineers.
Ostorlab is a security scanning framework built for modularity, scalability, and simplicity.
Under New Management is a Chrome extension that periodically checks whether your extensions have changed owners.
The US charged ex-Google engineer Linwei Ding with stealing trade secrets related to AI and tensor processing units, including chip designs, GPU details, and cluster management software. Ding allegedly stole the data with the intent of using it at AI firms he was associated with in China. If convicted, he faces up to 10 years in prison per count.
Cybersecurity professionals are increasingly tempted to earn extra income on the dark web by offering offensive cybercrime services like phishing, crypto theft, and malicious coding. This trend is driven by layoffs, stagnant salaries, and employers unwilling to raise compensation, pitting enterprises against insiders with intimate knowledge of their vulnerabilities.
This article describes an experience with adopting passkeys. When the experience works properly, passkeys feel seamless and futuristic. There are still issues with websites adopting passkey support and interoperability between devices.
The CISA has laid out key actions for securing open source software.
TikTok sent a push notification that included a mechanism to search for representatives to its users to urge representatives to vote against an initiative to force ByteDance to divest from TikTok or face a ban.
VMware is urging customers to patch critical vulnerabilities that allow hackers to escape VMware's sandbox and hypervisor protections across all versions of ESXi, Workstation, Fusion, and Cloud Foundation products. The four flaws, with two rated at a 9.3/10 severity, undermine the products' core purpose of running sensitive operations inside a virtual machine segmented from the host machine.
Apple has released fixes for two new iOS and iPadOS vulnerabilities. The first vulnerability is in the iOS Kernel and the second is in RTKit. Both vulnerabilities allow attackers with arbitrary kernel read and write permissions to bypass kernel memory permissions.