Tag: api
-
Cyber Insights 2025: APIs The Threat Continues
APIs are easy to develop, simple to implement, and frequently attacked. They are prime and lucrative targets for cybercriminals. The post Cyber Insights 2025: APIs The Threat Continues appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/cyber-insights-2025-apis-the-threat-continues/
-
ChatGPT-Lücke ermöglicht DDoS-Attacken
srcset=”https://b2b-contenthub.com/wp-content/uploads/2025/01/shutterstock_2560810077.jpg?quality=50&strip=all 3696w, b2b-contenthub.com/wp-content/uploads/2025/01/shutterstock_2560810077.jpg?resize=300%2C168&quality=50&strip=all 300w, b2b-contenthub.com/wp-content/uploads/2025/01/shutterstock_2560810077.jpg?resize=768%2C432&quality=50&strip=all 768w, b2b-contenthub.com/wp-content/uploads/2025/01/shutterstock_2560810077.jpg?resize=1024%2C576&quality=50&strip=all 1024w, b2b-contenthub.com/wp-content/uploads/2025/01/shutterstock_2560810077.jpg?resize=1536%2C864&quality=50&strip=all 1536w, b2b-contenthub.com/wp-content/uploads/2025/01/shutterstock_2560810077.jpg?resize=2048%2C1152&quality=50&strip=all 2048w, b2b-contenthub.com/wp-content/uploads/2025/01/shutterstock_2560810077.jpg?resize=1240%2C697&quality=50&strip=all 1240w, b2b-contenthub.com/wp-content/uploads/2025/01/shutterstock_2560810077.jpg?resize=150%2C84&quality=50&strip=all 150w, b2b-contenthub.com/wp-content/uploads/2025/01/shutterstock_2560810077.jpg?resize=854%2C480&quality=50&strip=all 854w, b2b-contenthub.com/wp-content/uploads/2025/01/shutterstock_2560810077.jpg?resize=640%2C360&quality=50&strip=all 640w, b2b-contenthub.com/wp-content/uploads/2025/01/shutterstock_2560810077.jpg?resize=444%2C250&quality=50&strip=all 444w” width=”1024″ height=”576″ sizes=”(max-width: 1024px) 100vw, 1024px”>Über eine HTTP-Anfrage an die ChatGPT-API können Angreifer eine Zielwebseite mit Tausenden Netzwerkanfragen bombardieren. miss.cabul Shutterstock.comDer Sicherheitsforscher Benjamin Flesch hat kürzlich herausgefunden, dass eine Lücke im ChatGPT-Crawler für…
-
ChatGPT API flaws could allow DDoS, prompt injection attacks
OpenAI-owned ChatGPT might have a vulnerability that could allow threat actors to launch distributed denial of service (DDoS) attacks on unsuspecting targets. According to a discovery made by German security researcher Benjamin Flesch, the ChatGPT crawler, which OpenAI uses to collect data from the internet to improve ChatGPT, can be tricked into DDoSing arbitrary websites. “ChatGPT crawler…
-
API Security’s Role in Responsible AI Deployment
By now, you will almost certainly be aware of the transformative impact artificial intelligence (AI) technologies are having on the world. What you may not be aware of, however, is the role Application Programming Interfaces (APIs) are playing in the AI revolution. The bottom line is that APIs are critical to AI systems but […]…
-
Fleet: Open-source platform for IT and security teams
Fleet is an open-source platform for IT and security teams managing thousands of computers. It’s designed to work seamlessly with APIs, GitOps, webhooks, and YAML … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/01/21/fleet-open-source-platform-it-security-teams/
-
ChatGPT Crawler Vulnerability Abused to Trigger Reflexive DDoS Attacks
Security researchers have uncovered a severe vulnerability in OpenAI’s ChatGPT API, allowing attackers to exploit its architecture for launching Reflective Distributed Denial of Service (DDoS) attacks. This loophole, characterized by a high severity CVSS score of 8.6, raises significant concerns regarding the scalability and security of AI services deployed on cloud platforms, specifically Microsoft’s Azure.…
-
HPE’s sensitive data exposed in alleged IntelBroker hack
IntelBroker has struck again. This time, the notorious BreachForums bigwig, which has a long list of high-profile victims, including Europol, Cisco, and GE, has claimed to have breached IT giant Hewlett Packard Enterprise (HPE).The suspected Serbian-origin hacker is offering to sell on BreachForums, sensitive data allegedly stolen from HPE including product source codes and personally…
-
Forscher deckt auf: ChatGPT lässt sich für DDoS-Angriffe missbrauchen
Eine ChatGPT-API scheint bereitwillig eine lange Liste von Links zur gleichen Webseite anzunehmen – und diese anschließend ungebremst abzufragen. First seen on golem.de Jump to article: www.golem.de/news/forscher-deckt-auf-chatgpt-laesst-sich-fuer-ddos-angriffe-missbrauchen-2501-192565.html
-
Considerations for Selecting the Best API Authentication Option
Implementing API authentication is one of the most critical stages of API design and development. Properly implemented authentication protects data, user privacy, and other resources while streamlining compliance, preventing fraud, and establishing accountability. In fact, broken authentication is one of the leading causes of API-related breaches. Ultimately, by applying robust authentication mechanisms, organizations can dramatically…
-
A Brief Guide for Dealing with ‘Humanless SOC’ Idiots
image by Meta.AI lampooning humanless SOC My former “colleagues” have written several serious pieces of research about why a SOC without humans will never happen (“Predict 2025: There Will Never Be an Autonomous SOC”, “The “Autonomous SOC” Is A Pipe Dream”, “Stop Trying To Take Humans Out Of Security Operations”). But I wanted to write…
-
BeyondTrust Breach Exposes API Key Abuse Risks
3 min readWhen a single API key compromise spiraled into a broader attack, it exposed how overlooked non-human identities can become gateways for escalating threats. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/01/beyondtrust-breach-exposes-api-key-abuse-risks/
-
Open Banking Shortcomings Threaten UK Global Leadership Position Research Finds
APIContext has released its UK Open Banking API Performance 2023-2024 Report, the annual analysis of the performance of the open banking APIs exposed by the large CMA9 UK banks (the nine largest banks required by UK law to provide open banking services), traditional High Street banks, credit card providers, building societies, and new digital banks (neobanks).…
-
Exabeam enhances security platform with Open-API, automation
First seen on scworld.com Jump to article: www.scworld.com/brief/exabeam-enhances-security-platform-with-open-api-automation
-
Amplified by AI Tools, API Attacks Hit 55% of IT Teams
Kong’s API Security Perspectives Report Says Many Teams Unprepared for AI Threats. Despite 92% of companies securing their APIs, 40% of leaders doubt whether their investments are adequate against AI-driven threats, said Kong’s API Security Perspectives Report. Only 13% of organizations in the U.S. and 4% in the U.K. admit to taking no specific measures…
-
Microsoft sues ‘foreign-based’ cyber-crooks, seizes sites used to abuse AI
Scumbags stole API keys, then started a hacking-as-a-service biz, it is claimed First seen on theregister.com Jump to article: www.theregister.com/2025/01/13/microsoft_sues_foreignbased_crims_seizes/
-
Why Scalability Matters in Non-Human Identity and Access Management
6 min readFrom dynamic workloads to API-driven systems, managing non-human identities requires a new approach to security at scale. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/01/why-scalability-matters-in-non-human-identity-and-access-management/
-
Microsoft sues service for creating illicit content with its AI platform
Service used undocumented APIs and other tricks to bypass safety guardrails. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/01/microsoft-sues-service-for-creating-illicit-content-with-its-ai-platform/
-
Ivanti zero-day exploited by APT group that previously targeted Connect Secure appliances
Researchers from Google’s Mandiant division believe the critical remote code execution vulnerability patched on Wednesday by software vendor Ivanti has been exploited since mid-December by a Chinese cyberespionage group. This is the same group that has exploited zero-day vulnerabilities in Ivanti Connect Secure appliances back in January 2024 and throughout the year.The latest attacks, exploiting…
-
Hacking Group ‘Silk Typhoon’ Linked to US Treasury Breach
The attack used a stolen remote support SaaS API key to exfiltrate data from workstations in the Treasury Department’s Office of Foreign Assets Control. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/hacking-group-silk-typhoon-linked-us-treasury-breach
-
SOAR buyer’s guide: 11 security orchestration, automation, and response products, and how to choose
Tags: access, ai, api, attack, automation, business, chatgpt, cisco, cloud, compliance, container, cybersecurity, data, detection, edr, endpoint, firewall, fortinet, gartner, google, group, guide, Hardware, ibm, incident response, infrastructure, intelligence, jobs, LLM, malware, mandiant, marketplace, microsoft, mitigation, monitoring, network, okta, risk, saas, security-incident, service, siem, soar, soc, software, technology, threat, tool, training, vulnerability, vulnerability-management, zero-daySecurity orchestration, automation, and response (SOAR) has undergone a major transformation in the past few years. Features in each of the words in its description that were once exclusive to SOAR have bled into other tools. For example, responses can be found now in endpoint detection and response (EDR) tools. Orchestration is now a joint…
-
Microsoft moves to disrupt hacking-as-a-service scheme that’s bypassing AI safety measures
The defendants used stolen API keys to gain access to devices and accounts with Microsoft’s Azure OpenAI service, which they then used to generate “thousands” of images that violated content restrictions. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-generative-ai-lawsuit-hacking/
-
Microsoft moves to disrupt hacking-as-a-service scheme that’s bypassing AI safety measures
The defendants used stolen API keys to gain access to devices and accounts with Microsoft’s Azure OpenAI service, which they then used to generate “thousands” of images that violated content restrictions. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-generative-ai-lawsuit-hacking/
-
Effective API Throttling for Enhanced API Security
APIs are the backbone of modern digital ecosystems, but their misuse can expose systems to cyber threats. Effective API throttling not only optimizes performance but also acts as a critical defense mechanism against abuse, such as denial-of-service attacks. Discover how this powerful strategy enhances API security and safeguards your organization’s data in an interconnected world. …
-
Meet the WAF Squad – Impart Security
Introduction Web applications and APIs are critical parts of your attack surface, but managing WAFs has never been easy. False positives, rule tuning, risks of production outages, and log analysis – all of this work has made WAF historically difficult to operationalize. Well, that time is over. Meet Impart’s WAF Squad – a five-member squad…
-
Challenges and Solutions in API Security
Are Organizations Fully Grasping the Importance of API Security? It is surprising how often businesses underestimate the importance of Application Programming Interface (API) security while navigating the digital landscape. This concern arises due to the significant rise in API-centric applications. While APIs offer countless benefits, they also pose substantial cybersecurity challenges. So, how well are……
-
Part 15: Function Type Categories
On Detection: Tactical to Functional Seven Ways to View API Functions Introduction Welcome back to Part 15 of the On Detection: Tactical to Functional blog series. I wrote this article to serve as a resource for those attempting to create tool graphs to describe the capabilities of the attacker tools or malware samples they encounter.…