Zsolt N.

https://lnkd.in/eYbRzvqr #sovereign #data #vaults - how to store and recall data for #ssi beyond a #vc. - How to work with end-to-end encrypted storage? - How to turn #vc to a #database ? - How to work with non credential data in #ssi

5

What is the point of it all? Why are we building AI for Prometheus alerts? Why does it even MATTER for your business? Here's an overview.

33

2 Comments

Episode 3026 Legit Security with Liav Caspi, CTO and Co-founder at BHUSA 2024. Why do you need an AI Command Center? GenAI use in software development is exploding and security struggling to keep up – both in terms of understanding where GenAI is in use, and and how to ensure its security. With the Legit AI security command center – security teams can proactively safeguard AI use across the software development lifecycle (SDLC) and prevent the accidental or intentional misuse of malicious and vulnerable machine learning (ML), GenAI, and large language models (LLMs) — all from a single pane of glass. https://lnkd.in/gENGdKUz #bhusa #bhusa2024 #cybersecurity #genai #aicommandcenter #LLM #ml #securityguytv #sdlc

8

A previously unknown threat actor has been attributed to a spate of attacks targeting Azerbaijan and Israel with an aim to steal sensitive data. The attack campaign, detected by NSFOCUS on July 1, 2024, leveraged spear-phishing emails to single out Azerbaijani and Israeli diplomats. The activity is being tracked under the moniker Actor240524. "Actor240524 possesses the ability to steal secrets and modify file data, using a variety of countermeasures to avoid overexposure of attack tactics and techniques," the cybersecurity company said in an analysis published last weekThe attack chains commence with the use of phishing emails bearing Microsoft Word documents that, upon opening, urge the recipients to "Enable Content" and run a malicious macro responsible for executing an intermediate loader payload codenamed ABCloader ("MicrosoftWordUpdater.log"). In the next step, ABCloader acts as a conduit to decrypt and load a DLL malware called ABCsync ("synchronize.dll"), which then establishes contact with a remote server ("185.23.253[.]143") to receive and run commands.

8

1 Comment

🎉 Excited to share our latest article on ERC-7683: Demystifying Cross-Chain Intents for Seamless Swaps! Cross-chain complexities can be a pain for developers and users alike. Our new Medium article delves into how this groundbreaking standard that enhances cross-chain interactions by providing a unified framework for cross-chain actions. 👓 Dive into the benefits, security considerations, and best practices that ERC-7683 offers for a more robust and interoperable blockchain ecosystem. Check it out!

11

Doxing the identity of an initial access broker using Hudson Rock's Infostealers AI investigation module. We've established in the past that just like regular users get infected by Infostealers, so do hackers. In this video, Leonid Rozenberg demonstrates how Hudson Rock's AI can analyze all files retrieved from the computer of an initial access hacker and identify the name, phone number, and online behavior of the hacker. This kind of intelligence is critical in identifying the identities of threat actors, extremists, pedophiles, and other types of criminals. Talk to us to learn more - https://lnkd.in/dKaEznQT

56

4 Comments

🔍 Mind Map for Bypassing AV/EDR I recently found this great resource that efficiently maps out key techniques for bypassing anti-virus and EDR solutions. From droppers and shellcode obfuscation to process injection and sandbox evasion, it covers a wide range of practical methods. I highly recommend checking it out: https://lnkd.in/eEujX23V A must-see for anyone looking to enhance their offensive security skills! #CyberSecurity #RedTeam #BypassAV #OffensiveSecurity

4

Write-up from the Lupin & Holmes team about their discovery of a supply chain vulnerability affecting HashiCorp's Consul and a Fortune 500 company. Their security tool, Depi, identified several unclaimed npm packages in Consul's development environment that could be exploited through dependency confusion. Key takeaways: • What seemed like a minor development environment issue turned out to have broader implications • The vulnerability was responsibly disclosed and quickly patched by HashiCorp • The Fortune 500 company's bug bounty program demonstrated excellent handling of the disclosure This finding highlights why we need to pay more attention to the connections between dependencies, not just the dependencies themselves. As our software supply chains grow more complex, these overlooked areas can become significant security risks. Kudos to both HashiCorp and the affected Fortune 500 company for their swift response and transparent handling of the situation. It's great to see companies working collaboratively with security researchers to protect their users. #cybersecurity #softwaresecurity #bugbounty #supplychain #dependencyconfusion #infosec https://lnkd.in/gHJ-wAic

63

Simplifying Domain Ownership & Wallet Access 🌐 Our new video highlights the Domain Search Bar—your all-in-one solution for: 🔍 Comprehensive Domain Search: Domain check across ENS, Freename, Unstoppable Domains, ICANN extensions, and NETZYLO registries. 🔗 Own for Life: Mint top-level domains (TLDs) on Polygon (with more chains coming soon) for a one-time fee—no renewals required. Pay via Stripe, with crypto options arriving soon. 💼 Broker Service: If a name is taken, let us assist! For $49.99, we’ll try to contact the owner and negotiate a deal for you. ✉️ Effortless Login: Connect your wallet seamlessly with just an email—no complicated steps required. 💻 API Integration: Developers can now integrate our powerful search functionality into their own projects. Explore the API here 👉 https://lnkd.in/eFHXKFW3 #Web3 #BlockchainDomains #DigitalOwnership

3

NIST Releases an Open-Source Platform for AI Safety Testing: America's National Institute of Standards and Technology (NIST) has released a new open-source software tool called Dioptra for testing the resilience of machine learning models to various types of attacks. "Key features that are new from the alpha release include a new web-based front end, user authentication, and provenance tracking of all the elements of an experiment, which enables reproducibility and verification of results," a NIST spokesperson told SC Media: Previous NIST research identified three main categories of attacks against machine learning algorithms: evasion, poisoning and oracle. Evasion attacks aim to trigger an inaccurate model response by manipulating the data input (for example, by adding noise), poisoning attacks aim to impede the model's accuracy by altering its training data, leading to incorrect associations, and oracle attacks aim to "reverse engineer" the model to gain information about its training dataset or parameters, according to NIST. The free platform enables users to determine to what degree attacks in the three categories mentioned will affect model performance and can also be used to gauge the use of various defenses such as data sanitization or more robust training methods. The open-source testbed has a modular design to support experimentation with different combinations of factors such as different models, training datasets, attack tactics and defenses. The newly released 1.0.0 version of Dioptra comes with a number of features to maximize its accessibility to first-party model developers, second-party model users or purchasers, third-party model testers or auditors, and researchers in the ML field alike. Along with its modular architecture design and user-friendly web interface, Dioptra 1.0.0 is also extensible and interoperable with Python plugins that add functionality... Dioptra tracks experiment histories, including inputs and resource snapshots that support traceable and reproducible testing, which can unveil insights that lead to more effective model development and defenses. NIST also published final versions of three "guidance" documents, according to the article. "The first tackles 12 unique risks of generative AI along with more than 200 recommended actions to help manage these risks. The second outlines Secure Software Development Practices for Generative AI and Dual-Use Foundation Models, and the third provides a plan for global cooperation in the development of AI standards." Thanks to Slashdot reader spatwei for sharing the news. Read more of this story at Slashdot.

1

📚 tl;dr sec 259 - What Sucks in Security Supply Chain Firewall AWS re:Invent Security Talks ✨ Highlights 👨‍💻 AppSec 👨‍💻 - BSidesSF 2025 Call For Participation - Stack Analyser: Extract 500+ technologies from any repository - Specfy - 35 more Semgrep rules: infrastructure, supply chain, and Ruby - Travis Peters, Trail of Bits - Access approvals considered harmful - Alex Smolen ☁ Cloud Security ☁ - AWS re:Invent 2024 Security Talks - curated by Daniel Grzelak - Exploiting Public AWS Resources - CLI Attack Playbook - Eduard Agavriloae - Securing AWS Lambda | How Misconfigurations Can Lead to Lateral Movement - Yehonatan Bitton - Terraform Provider for RCE via Statefile Poisoning - Benedikt Haußner - Uncovering New Attack Techniques in OPA and Terraform - Shelly Raban ⛓ Supply Chain ⛓ - Catalog of Supply Chain Compromises - Cloud Native Computing Foundation (CNCF) - Vanir: Open-source Security Patch Validation - Google - Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages - Ian Kretz 🛡 Blue Team 🛡 - NoDelete: A malware analysis tool that locks folders to prevent file deletion - Charles L. - Credit Card Canarytokens are now on your Consoles - Jacob T. - Automated Hunting - Censys 😈 Red Team 😈 - An offensive Rust encore - Marco Ivaldi - A book on reconnaissance, exploitation, building a modern Rust-based RAT, and more - Sylvain Kerkour - Linux LKM Persistence - Hal Pomeranz 🤖 AI + Security 🤖 - ChainReactor: Leveraging AI to uncover privilege escalation chains on Unix systems - Giulio De Pasquale et al - Agentic Security Marketmap - Brandon Dixon - Agentic AI's Intersection with Cybersecurity - Chris Hughes https://lnkd.in/gq4JZj2d #cybersecurity #infosec #security #ciso #ai

67

6 Comments

We're working hard to take Midori to new heights, DRM support, better network security, more speed and stability all this in the new update of Midori Browser https://lnkd.in/e53s9gDQ #debian #browser #linux #privacy #tech #technology #web #midoribrowser #windows

1

WhatsApp Scores Historic Victory Against NSO Group in Long-Running Spyware Hacking Case: A U.S. judge has ruled that Israeli spyware maker NSO Group breached hacking laws by using WhatsApp to infect devices with its Pegasus spyware. From a report: In a historic ruling on Friday, a Northern California federal judge held NSO Group liable for targeting the devices of 1,400 WhatsApp users, violating state and federal hacking laws as well as WhatsApp's terms of service, which prohibit the use of the messaging platform for malicious purposes. The ruling comes five years after Meta-owned WhatsApp sued NSO Group, alleging the spyware outfit had exploited an audio-calling vulnerability in the messaging platform to install its Pegasus spyware on unsuspecting users' devices. WhatsApp said that more than 100 human rights defenders, journalists and "other members of civil society" were targeted by the malware, along with government officials and diplomats. In her ruling, Judge Phyllis Hamilton said NSO did not dispute that it "must have reverse-engineered and/or decompiled the WhatsApp software" to install its Pegasus spyware on devices, but raised questions about whether it had done so before agreeing to WhatsApp's terms of service. Read more of this story at Slashdot.

1

The latest update for #Indusface includes "CVE-2024-27348 – A Critical RCE Vulnerability in Apache HugeGraph Server" and "15 Best #APISecurity Tools in the Market in 2024". #cybersecurity #infosec https://lnkd.in/euZhNK3x

1

Friends, 💡 Decentralized systems like DAOs, DLTs, and blockchain aren't just buzzwords—they are the future of building trust. Transparency. Accountability. Immutable records. These technologies are shifting us towards a new paradigm of Zero Trust architecture. 🛡️ Why? Because the truth is—none of us are infallible. From young hustlers to seasoned executives, we're all capable of crossing lines, especially when there’s millions at stake. Take this recent example of a Detroit nonprofit CFO who siphoned off $44 million over decades for personal luxuries. With open ledgers and decentralized technology, trust is no longer a handshake—it’s code. It’s time we stop relying on “trusted” individuals and start leveraging systems designed to be unbreakable. At the end of the day, it's not just about technology; it's about reshaping our world to be accountable by design. Are you ready to build a future where trust is earned through transparency? 🌐🔗 #Blockchain #DecentralizedFuture #DigitalTrust #ZeroTrust #Innovation #TechLeadership

7