Tag: data
-
OWASP Top 10 2025 Released: Major Revisions and Two New Security Classes Added
The Open Web Application Security Project (OWASP) has officially unveiled the eighth edition of its influential Top 10 security risks list for 2025, introducing significant changes that reflect the evolving landscape of application security threats. The update features two new security categories and substantial shifts in risk rankings based on contributed data and community feedback.…
-
Faster Than Real-Time: Why Your Security Fails and What to Do Next
Tags: access, ai, apple, attack, breach, business, ceo, cio, cloud, control, cybersecurity, data, defense, detection, dns, endpoint, fintech, framework, identity, infrastructure, Internet, iot, jobs, LLM, malware, network, nist, privacy, resilience, siem, soc, technology, threat, tool, vpn, zero-day, zero-trust“Security systems fail. When it fails, what do you do?” This critical question from Spire Connect’s Pankaj Sharma set the stage at Gitex 2025 for a conversation with Francois Driessen, the “Human Ambassador” of ADAMnetworks. His core message is blunt: in cybersecurity, even real-time is not fast enough. By the time a threat is detected,…
-
Faster Than Real-Time: Why Your Security Fails and What to Do Next
Tags: access, ai, apple, attack, breach, business, ceo, cio, cloud, control, cybersecurity, data, defense, detection, dns, endpoint, fintech, framework, identity, infrastructure, Internet, iot, jobs, LLM, malware, network, nist, privacy, resilience, siem, soc, technology, threat, tool, vpn, zero-day, zero-trust“Security systems fail. When it fails, what do you do?” This critical question from Spire Connect’s Pankaj Sharma set the stage at Gitex 2025 for a conversation with Francois Driessen, the “Human Ambassador” of ADAMnetworks. His core message is blunt: in cybersecurity, even real-time is not fast enough. By the time a threat is detected,…
-
How GlassWorm wormed its way back into developers’ code, and what it says about open source security
Tags: access, ai, attack, blockchain, ciso, control, credentials, crypto, cybersecurity, data, data-breach, endpoint, exploit, framework, github, google, infrastructure, law, malicious, malware, marketplace, monitoring, open-source, resilience, service, software, supply-chain, threat, tool, update, wormadhamu.history-in-sublime-merge (downloaded 4,000 times)ai-driven-dev.ai-driven-dev (downloaded 3,300 times)yasuyuky.transient-emacs (downloaded 2,400 times)All three GlassWorm extensions are “still literally invisible” in code editors, the researchers note. They are encoded in unprintable Unicode characters that look like blank space to the human eye, but execute as JavaScript.The attackers have posted new transactions to the Solana blockchain that outline updated…
-
How GlassWorm wormed its way back into developers’ code, and what it says about open source security
Tags: access, ai, attack, blockchain, ciso, control, credentials, crypto, cybersecurity, data, data-breach, endpoint, exploit, framework, github, google, infrastructure, law, malicious, malware, marketplace, monitoring, open-source, resilience, service, software, supply-chain, threat, tool, update, wormadhamu.history-in-sublime-merge (downloaded 4,000 times)ai-driven-dev.ai-driven-dev (downloaded 3,300 times)yasuyuky.transient-emacs (downloaded 2,400 times)All three GlassWorm extensions are “still literally invisible” in code editors, the researchers note. They are encoded in unprintable Unicode characters that look like blank space to the human eye, but execute as JavaScript.The attackers have posted new transactions to the Solana blockchain that outline updated…
-
APT37 hackers abuse Google Find Hub in Android data-wiping attacks
North Korean hackers from the KONNI activity cluster are abusing Google’s Find Hub tool to track their targets’ GPS positions and trigger remote factory resets of Android devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apt37-hackers-abuse-google-find-hub-in-android-data-wiping-attacks/
-
APT37 hackers abuse Google Find Hub in Android data-wiping attacks
North Korean hackers from the KONNI activity cluster are abusing Google’s Find Hub tool to track their targets’ GPS positions and trigger remote factory resets of Android devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apt37-hackers-abuse-google-find-hub-in-android-data-wiping-attacks/
-
States Fine Firm $5.1M in Hack Affecting 3 Million Students
AGs Cite Security Failures Leading to Illuminate Education’s Late 2021 Data Theft. A California-based vendor of software used to collect and analyze student data, including records of children with disabilities and special educational needs, has been fined a total of $5.1 million by the attorneys general in three states in the wake of a 2021…
-
Konni Hackers Turn Google’s Find Hub into a Remote Data-Wiping Weapon
The North Korea-affiliated threat actor known as Konni (aka Earth Imp, Opal Sleet, Osmium, TA406, and Vedalia) has been attributed to a new set of attacks targeting both Android and Windows devices for data theft and remote control.”Attackers impersonated psychological counselors and North Korean human rights activists, distributing malware disguised as stress-relief programs,” the Genians…
-
Data privacy whistleblowers would get expanded protections under California proposal
California’s influential privacy agency sent the state legislature three proposals, including a measure to create anti-retaliation safeguards and financial rewards for insiders who make regulators aware of corporate practices that violate state privacy law. First seen on therecord.media Jump to article: therecord.media/california-data-privacy-agency-whistleblower-protections-proposal
-
18,000 Files Stolen: Intel Faces Insider Threat Challenge
The Intel case underscores the ongoing risk of insider threats and the need for stronger data protection measures. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/18000-files-stolen-intel-faces-insider-threat-challenge/
-
Data privacy whistleblowers would get expanded protections under California proposal
California’s influential privacy agency sent the state legislature three proposals, including a measure to create anti-retaliation safeguards and financial rewards for insiders who make regulators aware of corporate practices that violate state privacy law. First seen on therecord.media Jump to article: therecord.media/california-data-privacy-agency-whistleblower-protections-proposal
-
18,000 Files Stolen: Intel Faces Insider Threat Challenge
The Intel case underscores the ongoing risk of insider threats and the need for stronger data protection measures. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/18000-files-stolen-intel-faces-insider-threat-challenge/
-
65% of Leading AI Companies Found With Verified Secrets Leaks
A new study has revealed 65% of top AI firms have leaked sensitive data on GitHub, risking $400bn in assets First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/leading-ai-companies-secret-leaks/
-
ClickFix Campaign Targets Hotels, Spurs Secondary Customer Attacks
Attackers compromise hospitality providers with an infostealer and RAT malware and then use stolen data to launch a phishing attacks against customers via both email and WhatsApp. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/clickfix-targets-hotels-secondary-customer-attacks
-
New Attacks Against Secure Enclaves
Encryption can protect data at rest and data in transit, but does nothing for data in use. What we have are secure enclaves. I’ve written about this before: Almost all cloud services have to perform some computation on our data. Even the simplest storage provider has code to copy bytes from an internal storage system…
-
Crypto-less Crypto Investment Scams: A California Case
Tags: access, apt, blockchain, breach, business, china, communications, control, crime, crypto, cybercrime, data, email, finance, group, intelligence, international, jobs, network, office, organized, scam, theft, tool, usaMy readers will know by now that I am addicted to PACER – the Public Access to Court Electronic Records. When I see headlines like this one, I am compelled to dive in and read every publicly released document related to the case. USAO Central California The headline last month was that Shengsheng He, a…
-
New Attacks Against Secure Enclaves
Encryption can protect data at rest and data in transit, but does nothing for data in use. What we have are secure enclaves. I’ve written about this before: Almost all cloud services have to perform some computation on our data. Even the simplest storage provider has code to copy bytes from an internal storage system…
-
Crypto-less Crypto Investment Scams: A California Case
Tags: access, apt, blockchain, breach, business, china, communications, control, crime, crypto, cybercrime, data, email, finance, group, intelligence, international, jobs, network, office, organized, scam, theft, tool, usaMy readers will know by now that I am addicted to PACER – the Public Access to Court Electronic Records. When I see headlines like this one, I am compelled to dive in and read every publicly released document related to the case. USAO Central California The headline last month was that Shengsheng He, a…
-
Conduent warns of further financial fallout from cyberattack
The company has incurred millions in expenses related to data breach notifications stemming from an attack earlier this year.; First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/conduent-financial-risks-cyberattack/805083/
-
New Attacks Against Secure Enclaves
Encryption can protect data at rest and data in transit, but does nothing for data in use. What we have are secure enclaves. I’ve written about this before: Almost all cloud services have to perform some computation on our data. Even the simplest storage provider has code to copy bytes from an internal storage system…
-
Conduent warns of further financial fallout from cyberattack
The company has incurred millions in expenses related to data breach notifications stemming from an attack earlier this year.; First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/conduent-financial-risks-cyberattack/805083/
-
ClickFix Campaign Targets Hotels, Spurs Secondary Customer Attacks
Attackers compromise hospitality providers with an infostealer and RAT malware and then use stolen data to launch a phishing attacks against customers via both email and WhatsApp. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/clickfix-targets-hotels-secondary-customer-attacks
-
European Commission moves to loosen GDPR for AI and cookie tracking
AI training gets green light: The proposal directly addressed one of the most contentious issues in EU privacy law: whether companies can train AI systems using personal data.The draft stated that AI training, testing, and validation may be conducted under the GDPR’s “legitimate interest” basis, as long as companies implement safeguards such as data minimization,…
-
Whisper Leak uses a side channel attack to eavesdrop on encrypted AI conversations
Tags: ai, api, attack, ciso, cloud, cyberattack, data, finance, healthcare, leak, LLM, microsoft, mitigation, network, openai, service, side-channel, vpnInside Microsoft’s proof-of-concept: Researchers at Microsoft simulated a real-world scenario in which the adversary could observe encrypted traffic but not decrypt it. They chose “legality of money laundering” as the target topic for the proof-of-concept.For positive samples, the team used a”¯language model”¯to generate 100 semantically similar variants of questions about this topic. For negative”¯noise”¯samples,”¯it randomly…
-
Backup-Informationen direkt im Security-Operations-Center
Veeam Software hat die Einführung der neuen Veeam-App für Microsoft-Sentinel bekannt gegeben. Die Lösung bietet eine fortschrittliche Integration mit der Veeam-Data-Platform und befähigt Unternehmen, Cyber-Bedrohungen und Backup-Anomalien zu erkennen, zu untersuchen und umgehend auf diese zu reagieren. Auf diese Weise erreichen Unternehmen mit Veeam Datensicherheit und operative Effizienz in Security-Operations-Centern (SOC). Da Cyber-Angriffe zunehmend auf…
-
European Commission moves to loosen GDPR for AI and cookie tracking
AI training gets green light: The proposal directly addressed one of the most contentious issues in EU privacy law: whether companies can train AI systems using personal data.The draft stated that AI training, testing, and validation may be conducted under the GDPR’s “legitimate interest” basis, as long as companies implement safeguards such as data minimization,…
-
Backup-Informationen direkt im Security-Operations-Center
Veeam Software hat die Einführung der neuen Veeam-App für Microsoft-Sentinel bekannt gegeben. Die Lösung bietet eine fortschrittliche Integration mit der Veeam-Data-Platform und befähigt Unternehmen, Cyber-Bedrohungen und Backup-Anomalien zu erkennen, zu untersuchen und umgehend auf diese zu reagieren. Auf diese Weise erreichen Unternehmen mit Veeam Datensicherheit und operative Effizienz in Security-Operations-Centern (SOC). Da Cyber-Angriffe zunehmend auf…
-
Whisper Leak uses a side channel attack to eavesdrop on encrypted AI conversations
Tags: ai, api, attack, ciso, cloud, cyberattack, data, finance, healthcare, leak, LLM, microsoft, mitigation, network, openai, service, side-channel, vpnInside Microsoft’s proof-of-concept: Researchers at Microsoft simulated a real-world scenario in which the adversary could observe encrypted traffic but not decrypt it. They chose “legality of money laundering” as the target topic for the proof-of-concept.For positive samples, the team used a”¯language model”¯to generate 100 semantically similar variants of questions about this topic. For negative”¯noise”¯samples,”¯it randomly…
-
MAD-CAT “Meow” Tool Sparks Real-World Data Corruption Attacks
The infamous Meow attack, which devastated unsecured databases since 2020, has resurfaced with renewed force through MAD-CAT (Meow Attack Data Corruption Automation Tool). This custom-built adversarial simulation tool demonstrates how easily attackers can corrupt data across multiple database platforms simultaneously, highlighting a critical vulnerability that continues to plague modern infrastructure. The Evolution of Meow While Meow attack…