Tag: STIG
-
The Register: Crooks stole AWS credentials from misconfigured sites then kept them in open S3 bucket
Source URL: https://www.theregister.com/2024/12/09/aws_credentials_stolen/ Source: The Register Title: Crooks stole AWS credentials from misconfigured sites then kept them in open S3 bucket Feedly Summary: ShinyHunters-linked heist thought to have been ongoing since March Exclusive A massive online heist targeting AWS customers during which digital crooks abused misconfigurations in public websites and stole source code, thousands of…
-
Hacker News: Compromising OpenWrt Supply Chain
Source URL: https://flatt.tech/research/posts/compromising-openwrt-supply-chain-sha256-collision/ Source: Hacker News Title: Compromising OpenWrt Supply Chain Feedly Summary: Comments AI Summary and Description: Yes Summary: This text presents a comprehensive security analysis regarding vulnerabilities in the OpenWrt firmware supply chain, detailing how command injection and SHA-256 collisions can be exploited. It emphasizes the importance of secure coding practices and robust…
-
Hacker News: Ultralytics AI model hijacked to infect thousands with cryptominer
Source URL: https://www.bleepingcomputer.com/news/security/ultralytics-ai-model-hijacked-to-infect-thousands-with-cryptominer/ Source: Hacker News Title: Ultralytics AI model hijacked to infect thousands with cryptominer Feedly Summary: Comments AI Summary and Description: Yes Summary: The Ultralytics YOLO11 AI model was compromised due to a supply chain attack that led to the deployment of cryptominers when users installed certain versions from PyPI. This incident highlights…
-
Embrace The Red: Terminal DiLLMa: LLM-powered Apps Can Hijack Your Terminal Via Prompt Injection
Source URL: https://embracethered.com/blog/posts/2024/terminal-dillmas-prompt-injection-ansi-sequences/ Source: Embrace The Red Title: Terminal DiLLMa: LLM-powered Apps Can Hijack Your Terminal Via Prompt Injection Feedly Summary: Last week Leon Derczynski described how LLMs can output ANSI escape codes. These codes, also known as control characters, are interpreted by terminal emulators and modify behavior. This discovery resonates with areas I had…
-
The Register: BT Group confirms attackers tried to break into Conferencing division
Source URL: https://www.theregister.com/2024/12/05/bt_group_confirms_attempted_attack/ Source: The Register Title: BT Group confirms attackers tried to break into Conferencing division Feedly Summary: Sensitive data allegedly stolen from US subsidiary following Black Basta post BT Group confirmed it is dealing with an attempted attack on one of its legacy business units after the Black Basta ransomware group claimed they…
-
Simon Willison’s Weblog: Quoting Steve Yegge
Source URL: https://simonwillison.net/2024/Dec/4/steve-yegge/ Source: Simon Willison’s Weblog Title: Quoting Steve Yegge Feedly Summary: In the past, these decisions were so consequential, they were basically one-way doors, in Amazon language. That’s why we call them ‘architectural decisions!’ You basically have to live with your choice of database, authentication, JavaScript UI framework, almost forever. But that’s changing…
-
Wired: Senators Warn the Pentagon: Get a Handle on China’s Telecom Hacking
Source URL: https://www.wired.com/story/senators-warn-pentagon-salt-typhoon-china-hacking/ Source: Wired Title: Senators Warn the Pentagon: Get a Handle on China’s Telecom Hacking Feedly Summary: In a letter to the Department of Defense, senators Ron Wyden and Eric Schmitt are calling for an investigation into fallout from the Salt Typhoon espionage campaign. AI Summary and Description: Yes Summary: The text outlines…