HUMAN's Satori Threat Intelligence team detected a new phishing campaign dubbed Phish n' Ships. The campaign utilizes n-day vulnerabilities, misconfigurations, and compromised admin credentials to upload fake SEO-optimized listings to compromised online shops. The listings redirect users to payment forms that allow the attackers to steal their credit card information. HUMAN has taken efforts to disrupt the campaign by reporting fake listings to Google as well as the online shops.
Successful security tooling programs require careful vendor selection based on a comprehensive rubric that prioritizes low false positives and workflow integration over cost while ensuring engineers aren't overwhelmed with vulnerabilities by implementing a phased "crawl-walk-run" approach to remediation. Tool success depends on full ecosystem integration with auto-creation/closure of vulnerability tickets, centralized security data lake visibility, and strong engineering team buy-in through their involvement in tool selection. Critical mistakes to avoid include selecting tools that create high operational overhead, failing to achieve complete coverage across all repositories, and overwhelming engineering teams with too many vulnerabilities at once instead of focusing on critical issues first.
Research on the Bluetooth Low Energy Generic ATTribute Profile (GATT) layer revealed vulnerabilities in various Bluetooth Low Energy (BLE) stacks. Attack scenarios were defined and a fuzzer was built to test BLE security. Vulnerabilities like DoS in NimBLE stack and Espressif GATT server example were discovered and reported.
This post provides an overview of Opus Security's vulnerability prioritization process. The strategy begins by utilizing the base CVSS score and then enriches it with additional information about the vulnerability such as the availability of exploit code, whether there are known attackers who are exploiting the vulnerability, and whether a patch is available. The next level involves adding in environmental factors such as how the resource is configured and its exposure.
The Noma platform delivers real-time monitoring, blocking, sensitive data masking, and alerting to defend against AI adversarial attacks and data leakage and enforce safety guardrails aligned with organizational and app-specific policies.
A Cross Platform AxCrypt compatible Open Source Encryption command line tool in C# for .NET 8+.
Miri is a rust lang Undefined Behavior detection tool that seeks to detect unsafe code that fails to uphold safety requirements.
Microsoft's Recall feature, which captures PC screenshots for AI searching, will be delayed until December. Originally planned for June with the release of Copilot+ laptops, it was postponed due to security concerns. Microsoft promises it will be opt-in and removable, addressing user skepticism about data privacy.
A fired Disney World menu production manager allegedly hacked servers, altering prices and adding false allergy information. Though caught before implementation, the attack cost Disney $150,000.
This post describes how to effectively manage AWS security during mergers and acquisitions through a detailed six-step, 90-day process. Success requires careful onboarding of AWS accounts into the parent organization's security tools and monitoring systems while prioritizing the remediation of critical security risks like permissive IAM policies and public-facing resources over lower-severity issues. It is important to build trust with the acquired team while maintaining security momentum through the transition period, ultimately working toward full integration into the parent organization's infrastructure-as-code practices and security controls.
Google Project Zero's LLM-based tool, Big Sleep, discovered a stack buffer underflow vulnerability in SQLite.
2024.11.04·googleprojectzero.blogspot.com·10 min read·TLDR InfoSec ChatGPT-4o can be misused for voice-based financial scams.
Guardio Labs discovered a serious vulnerability in the Opera browser that allows malicious extensions to access private APIs.
2024.11.04·links.tldrnewsletter.com·12 min read·TLDR InfoSec Sponsored
If your audience is in tech, they read TLDR. Capture their attention with a native ad placed at the top, middle or bottom of TLDR newsletters. Learn more [4] about running your first campaign with us.
As bots and AI content flood online spaces, marketers face growing challenges in connecting with their audiences. Increasing distrust in AI is reflected in declining engagement on major social media platforms. To adapt, marketers should prioritize simplicity and authenticity. This may involve rediscovering older channels like TV and radio, leveraging word-of-mouth strategies, and engaging with niche communities that prioritize real social connections.
Kenya leads in social media use with an average of 3 hours and 43 minutes daily per user, followed by South Africa, Brazil, and the Philippines, all exceeding 3 hours. Globally, over 5 billion active users spend nearly 2.5 hours per day on social media, with TikTok seeing the highest average time per user and YouTube dominating overall usage. Women spend an average of 16 minutes more daily than men. Japan reports the lowest social media use at 1 hour and 53 minutes per day.
“Punching up” is when lower-status brands challenge higher-status competitors to emphasize their underdog appeal, often attracting empathy and loyalty from audiences. Examples include Ben & Jerry's versus Häagen-Dazs, Beehiiv challenging ConvertKit, and Avis embracing its #2 position to avoid promoting the top competitor. Successful campaigns are subversive but can face backlash. The tactic works best when targeting stagnant incumbents.
A strong value proposition defines a company's purpose, target customers, and solution to a pressing problem, attracting both investors and customers. To create one, identify the problem, highlight the risks of inaction, connect product features to the issue, and provide proof of effectiveness. Concise, customer-focused propositions that address specific pain points resonate with potential customers.
Square posts are too small on LinkedIn, as you have less space to work with and also take up less space on the feed. Use a 4:5 ratio instead (1200px X 1500px).
PaveAI transforms Google Analytics data into actionable insights using AI, helping marketers identify key performance drivers and optimize their strategies accordingly. The tool integrates with platforms like Google Ads and Facebook Ads to provide advertising optimization recommendations.
Apple Intelligence, released with iOS 18.1, introduces new productivity tools that streamline tasks like summarizing text, prioritizing urgent emails, and enhancing grammar-checking across iPhone, iPad, and Mac. Users can rewrite prose in different tones (friendly, professional, or concise) with a few taps. Email prioritization helps surface messages that require immediate attention. The update also includes AI-based notification summaries and audio transcription tools that identify key points in recordings.
OpenAI's marketing team uses ChatGPT to streamline tasks like audience analysis, content creation, and design visualization. They recommend using ChatGPT for quick ideation, competitive research, persona-based messaging, and testing brand-aligned tones. Tips include leveraging real-time search for insights, custom GPTs for brand consistency, and voice chat for pitching guidance. Non-developers can draft designs with ChatGPT's visual tools and then collaborate with design teams for refinement.
Account-based expansion is more cost-effective than new acquisitions, shortens sales cycles, and leverages customer data for targeted growth. Traditional B2B marketing and sales models prioritize new logos, which leads to missed expansion opportunities. Key tactics include creating account-specific content, using customer data for precise targeting, and aligning sales, marketing, and customer success. A structured, data-driven approach helps identify and grow high-potential accounts, unlocking significant revenue within the current customer base.
This podcast uncovers the importance of subversive marketing, 11 tried and tested tactics, and how to apply them ethically.
Websites penalized or unindexed by Bing won't show up in ChatGPT's search results, highlighting a dependency on Bing's indexing.
Creators can now filter and prioritize message requests based on follower count, verification status, and account type (ie. brand or creator).
The Wicked movie floods culture with green-and-pink promotions, echoing Barbie's "culture-jacking" strategy.
Cloudflare's Workers platform uses a V8 isolate architecture instead of traditional containers due to their ability to achieve sub-millisecond serverless latency and support a massive number of tenants without sharing memory or state. Unlike containers, which take hundreds of milliseconds to seconds to spin up, V8 isolates warm up in under 5 milliseconds. This lets Cloudflare run thousands of tenant workloads at the edge with minimal overhead. However, this has its own limitations, such as the lack of process-level isolation.
This is an article on how to reimplement JavaScript's == operator in pure JavaScript without using the operator itself. It walks through each step of the Abstract Equality Comparison Algorithm, which shows the underlying behavior of the operator and the different complexities of JavaScript's type coercion.
Some programming languages have bizarre syntax, which makes syntax highlighting difficult. This developer built a syntax highlighter. The post goes over how they dealt with the challenges of lexing and parsing complex syntax.
Take ownership of your own career, build trust and earn respect through clear communication and impact, and maintain consistency. Great engineers are able to challenge leadership decisions with evidence-based arguments.
2024.11.04·read.highgrowthengineer.com·12 min read·TLDR Web Dev Software consultants should charge by the hour rather than accepting fixed-price contracts as it benefits both the consultant and the client. Charging a fair hourly rate allows consultants to provide genuine value and discourages clients from squeezing them for every penny.
A software engineer at Stripe left his job without another lined up. He was anxious during the interview process and had various successes and challenges at Stripe.
Ink is a React library for building interactive command-line applications. It provides a component-based UI experience similar to React in the browser.
Someday is a free and open-source Calendly alternative built on Google-Apps-Script for Gmail users. It has a scheduling integration, customizable work hours, and a simple booking process.
CSV SQL Tool allows users to run SQL queries on CSV files directly in their browsers without uploading data, ensuring privacy and speed.
While hardware has become incredibly fast, the applications we use have not kept pace, resulting in a frustrating experience for users. Modern computers are so powerful that they allow developers to build sluggish software. This article provides examples of applications that consume excessive resources without providing a smooth user experience.
Google Cloud has spent 25 years building a sophisticated network infrastructure. Starting with a simple network, Google has made numerous innovations over time, which has led to the fifth-generation Jupiter data center network architecture. This architecture is capable of scaling to 13 Petabits/sec of bisectional bandwidth.
It's difficult to replicate research results in experimental systems research due to complex dependencies and a lack of standardized tools. The complexity of deploying state-of-the-art systems remains a significant barrier to entry to repeatability.
Apple silently uploads user passwords to iCloud Keychain and keeps them even when the user disables the feature.
AI model prompts are essentially programs, which means that software engineering research is needed to develop robust tools and techniques for creating, debugging, and maintaining effective prompts.
Online conferences, unlike their in-person counterparts, are still great for fostering coordination, knowledge distillation, and serendipitous discovery through curated content, asynchronous discussion, and accessibility.
This developer built their resume website using HTML, CSS, and Eleventy.
Sponsored
Companies spend $4,000+ and take 36 days to fill a position, only to lose 17% of new hires in their first month. In many cases, the problem is onboarding “sink or swim” processes.
2024.11.01·bamboohr.com·Sponsor·TLDR OpenAI has launched an upgraded web search feature for its AI assistant. Called 'ChatGPT with Search', the feature makes web searches based on user questions, providing source attributions with the answers it provides. It has the potential to streamline web search by eliminating the need for multiple search queries and link exploration. The system uses a fine-tuned version of GPT-4o.
2024.11.01·arstechnica.com·5 min read·TLDR Amazon executives were confident a beta version of a new and improved Alexa was doable by early 2024. However, the timeline started slipping - the deadline has been moved to 2025. Alexa's conversational abilities have improved, but it still has issues and struggles with some tasks. Getting Alexa right is important for Amazon given the huge portion of kids and families that use Echo hardware.
2024.11.01·bloomberg.com·22 min read·TLDR Meta has partnered with GelSight and Wonik Robotics to commercialize tactile sensors for AI. The partnership aims to create devices that can learn about the world in richer detail to advance research into AI. Meta is working with GelSight on Digit 360, a tactile fingertip with human-level multimodal sensing capabilities. Its work with Wonik will focus on developing robotic hands with tactile sensors like Digit 360. These products will be available for purchase next year.
2024.11.01·techcrunch.com·2 min read·TLDR Cloud milking is a zero-energy technique for extracting water from fog. The technique mimics the way that the leaves capture water droplets from fog. It involves erecting special structures in the path of the wind to collect water droplets as the wind blows fog through them. Cloud milking is revolutionizing the recovery of forests devastated by fire and drought.
2024.11.01·theguardian.com·5 min read·TLDR GenAIScript is a JavaScript-ish environment with convenient tooling for file ingestion, prompt development, and structured data extraction. It can programmatically assemble prompts for LLMs using JavaScript. GenAIScript features a JavaScript toolbox for working with prompts, abstractions to make the process easy and productive, and seamless Visual Studio Code integration. A large collection of guides and examples are available.
2024.11.01·microsoft.github.io·Tool·TLDR