Search the archive

NEW YORK TIMES SOURCE CODE STOLEN USING EXPOSED GITHUB TOKEN

An attacker posted an archive of stolen source code and data belonging to the New York Times onto 4chan. The leaker claims to have accessed the source code via a compromised GitHub token which was confirmed by The Times. The Times stated that the leak did not impact any internal corporate systems or operations.

MALICIOUS VSCODE EXTENSIONS WITH MILLIONS OF INSTALLS DISCOVERED

A group of Israeli researchers managed to infect over 100 organizations by typosquatting the Dracula extension. The researchers created a domain for their typosquatted extension, which allowed them to become a verified publisher and increase credibility. They identified over 1,200 extensions that were known to have malicious code on the VSCode extension marketplace.

UPDATES FOR SECURITY ISSUE AFFECTING INTELLIJ-BASED IDES 2023.1+ AND JETBRAINS GITHUB PLUGIN

JetBrains has disclosed security issues affecting IntelliJ-based IDEs and the JetBrains GitHub Plugin leading to an access tokens leak. The issue has been fixed in the latest IDE versions. Users are urged to update and revoke any affected GitHub tokens. JetBrains has provided instructions on how to revoke tokens and set up the plugin again if needed.

A GUIDE TO KUBERNETES LOGS THAT ISN'T A VENDOR PITCH

This post explains logging in Kubernetes clusters using the 4Cs of cloud-native security framework. Code level logging can be achieved with sidecar pods. Cloud level logging relies on the specific cloud's services (for example CloudTrail on AWS). Container level logging isn't generally helpful for security. The post contains a deep dive into using and enabling AuditPolicy to collect logs at the cluster level.

WHAT HAPPENED TO RASP?

A blog post looking at the decline of RASP and the rise of ADR. The post outlines various nontechnical and technical critiques that stymied RASP's implementation such as unclear time-to-value and added complexity. It concludes by looking at how ADR might address some of these concerns but concludes that it's too early to tell if it will succeed.

TECHNICAL ANALYSIS OF THE LATEST VARIANT OF VALLEYRAT

The ValleyRAT malware uses a multi-stage process involving DLL sideloading, process injection, and shellcode execution to establish connections with a command-and-control server for downloading further malicious payloads. The malware utilizes encryption, decryption, and hashing algorithms to dynamically load and execute embedded DLLs, collect system information, and carry out specific actions based on the victim host's configuration. ValleyRAT conducts device fingerprinting to gather detailed information about the infected system, such as IP address, system uptime, hardware details, and user privileges, aiding in its malicious activities.

advanced mitigation techniques. Save your spot today!

RATIFY

Ratify is a verification engine that enables verification of artifact security metadata and admits for deployment only those that comply with defined policies.

GEMINI YOUTUBE RESEARCHER (PYTHON NOTEBOOK)

This Python Notebook demonstrates searching for YouTube videos, takes 5 results, "listens" to their audio tracks, summarizes them, and then assembles a report from those summaries. It could be helpful for catching up on conference talks, extracting summaries, and understanding TTPs for researchers.

EVIL NGINX PHISHING INFRA SETUP

This repository contains a guide to build a phishing engagement infrastructure setup using EvilNginx or GoPhish. The guide covers various parts of the lifecycle, from domain registration to securing the Nginx instances, and contains videos for further learning.

SNOWFLAKE BREACH EXPOSES 165 CUSTOMERS' DATA IN ONGOING EXTORTION CAMPAIGN

Mandiant, which is working with Snowflake on incident response, has identified that 165 customers' data has been breached. It stated that the attackers are using the Snowflake access to deploy an info-stealer malware dubbed FROSTBITE. Mandiant had previously denied responsibility and stated that the breaches were caused by a lack of MFA by customers.

CITY OF CLEVELAND SHUTS DOWN IT SYSTEMS AFTER CYBERATTACK

The City of Cleveland's IT systems have been shut down due to a cyberattack that forced essential services offline. Investigations are ongoing with third-party experts. Key services like emergency response and utilities remain unaffected. Authorities are working to provide updates as the situation unfolds.

ANTI-CHEAT EXPERT: ALL YOUR PIXELS ARE BELONG TO US

ACE is an anti-cheat software made by Tencent, a Chinese tech giant. It has raised privacy concerns as it takes screenshots of users' entire display. ACE has components with screenshot-taking capabilities, sparking worries about data privacy and potential misuse.

AI HELPS CATCH CSRF VULNERABILITY BEING INTRODUCED INTO 100,000+ INSTALL WORDPRESS PLUGIN MODULA

An AI system detected a CSRF vulnerability in the popular WordPress plugin Modula.

CHINESE HACKERS BREACHED 20,000 FORTIGATE SYSTEMS WORLDWIDE

Chinese hackers breached 20,000 FortiGate systems globally by exploiting a critical vulnerability.

16-YEAR-OLD ARRESTED IN FRANCE IN CONNECTION WITH HIGH-PROFILE EPSILON HACKING GROUP ATTACKS

A 16-year-old in France was arrested for links to the Epsilon hacking group attacks.

APPLE EMBRACES RCS IN IOS 18—AND MARKETERS SHOULD BE CELEBRATING

Apple announced that its Messages app will support Rich Communication Services (RCS) in iOS 18. The new standard will replace SMS as the default communication protocol between Android and iOS devices. RCS allows marketers to create more engaging customer experiences, including personalized messages and videos, location-based suggestions, and dynamic carousels.

MARKETERS ‘OVERESTIMATE' CHANCES OF ACHIEVING BRAND LOYALTY

Emotional brand loyalty is often confused with habitual behavior. A new study reveals that marketers overestimate brand loyalty, with only 13% of consumers identifying as true brand fans. Instead, speed, ease, and habit are the primary drivers of repeat purchases, with 97% citing these factors. Neurobiological principles like reward, memory, emotion, and social interaction influence loyalty. Effective tactics include gamification, shared values, and personalization.

ON WRITING A TAGLINE AND PITCHING IT

Taglines are long-term branding tools, while slogans support specific campaigns. A tagline isn't complete until it's clear, easy to understand, and resonates with others. Start with a brand's unique selling proposition or positioning statement and edit for brevity and clarity. Generate numerous options, refine them rigorously, and “kill your darlings” to ensure the best work is presented.

FIVE GOLDEN QUESTIONS THAT REVEAL EXACTLY WHY YOUR VISITORS AREN'T CONVERTING

To increase a website's conversion rate, survey customers who just bought your product or service. These users can help uncover obstacles that result in other visitors leaving without buying. Ask them where exactly they first found out about you, what persuaded them to purchase from you, which options they considered before choosing your product, and the one thing that nearly stopped them buying from you. Incentivize survey participation with a small reward and send a thank you email to respondents.

DUB: SHORT LINKS WITH SUPERPOWERS

Dub is an open-source link management tool. It offers branded and personalized short links, advanced analytics, QR codes for your links, and more. The tool is free for 3 domains and offers paid plans with additional features.

23 DIGITAL PR EXAMPLES AND STRATEGIES

Digital PR is designed to build high-authority links to help you build your brand and rank better in search. This guide covers PR examples categorized by ideation strategies and vehicles that drive the content. These include microsites, visual-led content, interactives, and keyword-driven digital PR.

YOUTUBE'S TESTING QR CODES FOR CHANNELS, USER-GENERATED SHORTS EFFECTS

YouTube's latest updates include channel-specific QR codes for easier sharing, new user-generated effects for Shorts, and an AI-powered "Jump Ahead" feature that skips to the most popular parts of videos. These features aim to increase engagement and user satisfaction without negatively impacting watch time.

B2B SAAS REBRANDING 101: HOW TO GET IT RIGHT

A rebrand might be necessary if the current messaging isn't effectively communicating a company's mission and values. This could involve overhauling the entire marketing strategy and public image and include a new name, logo, design style, or tone of voice. Brand refreshes update the existing brand strategy without completely changing the brand's identity. Rebranding should be avoided if the company is still new or driven by a need to keep up with competitors.

WHO PAYS HOW? E-COMMERCE PREFERENCES BY GENERATION

Businesses must offer diverse payment options to cater to different generational needs to stay competitive. Baby Boomers prioritize security, but are wary of new technologies. Gen X values secure, proven payment methods. Millennials and Gen Z favor convenience and are open to new technologies if secure. Financial health influences payment preferences. Boomers prefer simplicity, millennials seek tools for debt management, and Gen Z prioritizes avoiding extra fees.

REBRANDING AN ICON: THE CLASSIC AMERICAN GIRL LOOK GETS A FRESH SPIN

American Girl underwent a brand refresh to better connect with millennial moms.

THE RISE OF ANTI-VEGAN BEAUTY

Vegan beauty products may not be the healthy or environmentally friendly heroes they are promoted to be.

THE BEST SOCIAL MEDIA POSTS I'VE SEEN RECENTLY

A collection of inspiring, on-brand, and relatable social posts by Instagram, Notion, Hootsuite, and Rhode.

ENGINEERING FOR SLOW INTERNET

Minor issues in app development and speed can become significant problems in areas with slow Internet. While developers shouldn't be expected to spend excessive time on extreme cases, it's important to acknowledge elements of websites that may perform worse with slower internet. Apps should be resilient enough to handle basic tasks like transmitting text without getting stuck due to hardcoded timeouts.

MY VERY FIRST PRODUCTION BUG

A developer working on an autonomous driving system encountered an issue where a new, faster camera made the tracking system worse. The root cause was a preprocessor directive for the framerate, which was mistakenly defined as an integer and not a floating-point number due to a missing decimal point. This caused the sampling time to be calculated as zero, leading to incorrect position predictions by the Kalman filter.

SOMETIMES, OBJECT PROPERTY ORDER MATTERS

Since version 4.7, the order of properties in an object in TypeScript can affect type inference. This change was introduced to address bugs related to context-sensitive functions, but it can lead to unexpected errors when properties are reordered.

THREE LAWS OF SOFTWARE COMPLEXITY (OR: WHY SOFTWARE ENGINEERS ARE ALWAYS GRUMPY)

There are three fundamental laws of software complexity: systems inevitably degrade in design quality over time, successful systems create complexity through leaky abstractions to gain market share, and there is no upper limit to the complexity a system can reach. Most engineers end up working on poorly designed systems, which only grow more intricate and challenging to work on over time.

CLEVER CODE IS PROBABLY THE WORST CODE YOU COULD WRITE

Clear, readable code is more valuable than clever code in the long run. This developer's experience at a large tech company revealed that even though clear code might seem trivial, it's actually more difficult to write and maintain. In order to “preserve complexity” for promotion packets, documentation was important for demonstrating the complexity of the work.

SELF-SERVE DASHBOARDS

Self-serve BI dashboards don't work because they assume that the main barrier for business stakeholders is writing SQL queries, while the real issue is the lack of context and understanding of the data.

FLAMESHOT

Flameshot is an open-source screenshotting tool with a customizable appearance and in-app screenshot editing.

UNFORGET

Unforget is a minimalist, offline-first, and end-to-end encrypted note-taking app with desktop, mobile, and web support. It's open-source and has public APIs for creating your own client or syncing across devices.

CLIPBOOK

ClipBook is a free clipboard history app for macOS.

GENERATIVE AI IS NOT GOING TO BUILD YOUR ENGINEERING TEAM FOR YOU

While generative AI can help in producing code fast, it's not a substitute for the experience and mentorship required to develop junior engineers into seniors and beyond. The industry will face a bottleneck in the future if it believes that AI can simply replace junior engineers (which it can't).

THE COST OF SHUTTING DOWN THE INTERNET

A recent survey examined the economic impact of internet outages on countries and businesses and found that the United States and Amazon would face the highest financial losses in such a scenario. The U.S. would incur a $11 billion loss in a 24-hour outage, while Amazon would suffer a $1.5 billion loss in the same period.

EVEN APPLE MAKES MISTAKES (REDDIT THREAD)

Apple forgot to add a border radius to an image on its website, which made an iPhone screen look weird.

ESSAYS ON PROGRAMMING I THINK ABOUT A LOT

A collection of programming essays on various topics, such as falsehoods programmers believe, choosing boring technology, becoming a more effective programmer, and more.

ANNOUNCING ARC PRIZE

A $1M+ prize for new ideas to progress AI towards AGI.

MALICIOUS VSCODE EXTENSIONS WITH MILLIONS OF INSTALLS DISCOVERED

Researchers found malicious extensions on Microsoft's Visual Studio Code Marketplace, including a fake version of the popular Dracula theme.

Read the full guide on the WorkOS blog

APPLE WWDC 2024: THE 13 BIGGEST ANNOUNCEMENTS

Apple announced AI features and major updates across its operating systems at its Worldwide Developers Conference keynote. Apple's AI system, Apple Intelligence, will put powerful generative models at the core of the iPhone, iPad, and Mac. It will enable new capabilities across Apple's native apps, such as the ability to generate images or summarize text. Apple Intelligence will be available for free on the iPhone 15 Pro and on iPads and Macs with an M1 or later chip. Other announcements at the event include more customization in iOS 18, RCS support for the iPhone, a Passwords app to keep track of logins, and a Calculator app for iPadOS 18.

APPLE IS BRINGING RCS TO THE IPHONE IN IOS 18

Apple's Messages app will support RCS in iOS 18. It will replace SMS as the default communication protocol between Android and iOS devices. RCS offers typing indicators, read receipts, longer messages, and higher-quality images and videos. Apple likely integrated the protocol to appease EU regulators.