New tools, products, platforms, funding rounds, and company developments in AI security.
This is a 25-minute educational video covering the foundational concepts needed to understand web application security. It explains the basic building blocks of web applications, such as HTML, HTTP, JavaScript, and cookies, as well as core security concepts like the Same-Origin Policy (a rule that prevents websites from accessing each other's data without permission). The video prepares viewers to understand common security vulnerabilities like XSS (cross-site scripting, where attackers inject malicious code into web pages), CSRF (cross-site request forgery, where attackers trick users into performing unwanted actions), and SQLi (SQL injection, where attackers insert malicious database commands into input fields).
On Linux systems, users with uid=0 (user identifier zero) have root privileges, which bypass all security checks. An attacker can create a new account or modify an existing one to have uid=0 by editing the /etc/passwd file or using commands like 'usermod -u 0', giving them complete system control.
Procdump is a tool that creates core dumps (snapshots of a program's memory) and can be installed on Linux systems, though it receives less attention from security professionals there than on Windows. An attacker with access to a Linux system can use procdump to dump the memory of running processes and search through them for sensitive information like passwords and credentials, as demonstrated in a scenario where an attacker extracts a password from a user's text editor process.
The Silver Searcher is a fast search tool designed for finding code and files quickly, with a focus on searching through source code. It offers built-in features that make it faster and more convenient than traditional tools like grep (a command-line search utility) and findstr.
Attackers can abuse Component Object Model (COM, a Windows system that lets programs automate each other) to weaponize Microsoft Office applications like Excel and Outlook for malicious purposes, such as creating documents, stealing data, and establishing command-and-control channels. Since COM automation uses legitimate, pre-installed applications, these attacks can be hard to detect. The article highlights that monitoring for unusual COM usage patterns is important for defensive teams to catch this type of threat.
A researcher explored three security and privacy aspects of Apple's Airtag tracking devices: physically removing the speaker component, using browser APIs (code that web browsers provide to interact with hardware) to detect nearby Airtags without an iPhone, and investigating how data might be extracted through Airtags and Apple's Find My network. The post documents these findings as exploratory research into the Airtag ecosystem.
Security breaches happen regularly to organizations, and companies often don't discover them for days, months, or even years after they occur. The post argues that organizations should adopt red team exercises (simulated attacks by internal security experts to test defenses) to strengthen their security, since breaches cannot be completely prevented and automated malware can strike at any time.
Google's FLoC (federated learning of cohorts) is a proposed alternative to cookie-based user tracking in Chrome that assigns users to interest groups based on their browsing history. The system makes user fingerprinting (identifying individuals by combining their FLoC ID with their IP address) easier and more accurate, potentially compromising privacy even though FLoC IDs are recalculated regularly and Google has disabled it in the European Union due to privacy concerns.
Attackers can trick users into entering passwords by spoofing credential dialogs (fake password prompts that look legitimate) on macOS, Linux, and Windows after gaining initial access to a computer. On macOS, the osascript command can create fake password prompts; on Linux, zenity with the --password option works similarly; and on Windows, PowerShell's Get-Credential command can be misused. The source emphasizes that detection teams should watch for these suspicious commands in logs and look for specific command-line arguments like --password and 'with hidden answer' to identify attacks.
NFT standards like EIP 721 and EIP 1152 have a critical flaw: they don't require a cryptographic hash (a unique digital fingerprint) linking the actual content to the blockchain entry, so the blockchain only proves you own a token ID, not the actual digital asset it claims to represent. This means metadata files and images can be stored centrally (for example, on Amazon S3), modified by anyone with access, or disappear entirely, leaving you unable to prove ownership of the original content even if you have a local copy.
A speaker announced they would present at the Hong Kong Information Security Summit 2021 on March 9th, sharing insights on protecting modern remote workplaces from a red teaming perspective (the practice of simulating attacks to test security defenses). The talk, titled 'Red Team Strategies for Helping Protect the Modern Workplace,' focuses on security strategies relevant to distributed work environments.
This is a disclaimer page for educational material about red team strategies (methods used by authorized security testers to find vulnerabilities by simulating attacks). The content emphasizes that penetration testing (authorized attempts to break into systems to find security weaknesses) must have proper permission before being performed.
Microsoft analyzed the Sunburst attack (a major 2020 breach targeting SolarWinds software) and found that attackers used Cobalt Strike (a tool for command and control, letting attackers remotely direct compromised systems) alongside custom modifications to hide their backdoors in software. The attackers made each compromised system unique with different names and folder locations to avoid detection.
This article describes a method for creating security scores that compare different teams or services based on their security issues, helping organizations identify which areas need the most attention. The scoring system uses a multiplier (a scaling factor that makes severe issues count for much more than minor ones) to weight critical bugs more heavily than lower-severity ones, then sums these weighted values into a single score that can be displayed on a dashboard. By showing these scores to management, teams can have discussions about why some services have worse scores than others, which encourages improvements in security practices.
FireEye, a major security company, was attacked and adversaries accessed their internal red teaming tools (software used to test security by simulating attacks). The post warns that red teams are attractive targets for attackers and recommends implementing protective measures like honeypot machines (fake systems designed to detect intruders) and monitoring login attempts to quickly detect when attackers are trying to compromise their systems.
This post describes Microsoft Counterfit, a tool for testing machine learning models against adversarial attacks (subtle modifications to input data designed to fool AI systems). The author demonstrates how to set up Counterfit, create a custom target for a husky image classifier, and use the tool's built-in attack modules to test the model's robustness.
This article argues against the idea that manual red teaming (the practice of simulating attacks to find security weaknesses) is dying due to automation. The author contends that red teaming is fundamentally about discovering unknown vulnerabilities and exploring creative attack strategies rather than just exploiting known bugs, and therefore cannot be fully automated even though adversaries will continue using AI and automation tools to scale their operations.
Survivorship bias is the logical error of focusing only on successes while ignoring failures, which can lead to incomplete understanding. The article applies this concept to red teaming (security testing where a team acts as attackers to find vulnerabilities) by noting that the MITRE ATT&CK framework (a database of known adversary tactics and techniques) only covers publicly disclosed threats, potentially causing security teams to overlook attack methods that haven't been publicly documented or aren't in the framework.
Fix: The source explicitly recommends several protective measures: (1) Create honeypot machines with fake credentials and trigger notifications and alerts when accessed; (2) Set up notifications for logon attempts and successful logons via email and forward events to the blue team (defensive security team); (3) Disable remote management endpoints and allow list source IP addresses in the firewall; (4) Lock down machines by blocking all inbound connections while allowing outbound ones using Windows command 'netsh advfirewall set allprofiles firewallpolicy blockinboundalways,allowoutbound' or Linux commands 'sudo ufw enable', 'sudo ufw default deny incoming', and 'sudo ufw default allow outgoing'; (5) Perform red vs. red testing (security assessments where one red team tests another) to verify the red team has proper security controls in place.
Embrace The RedThis is an index page summarizing a series of blog posts about machine learning security from a red teaming perspective (testing a system by simulating attacker behavior). The posts cover ML basics, threat modeling, practical attacks like adversarial examples (inputs designed to fool AI models), model theft, backdoors (hidden malicious code inserted into models), and how traditional security attacks (like weak access control) also threaten AI systems.
This post describes how Generative Adversarial Networks (GANs, a type of AI system where two neural networks compete to create realistic fake images) can be used to generate fake husky photos that trick an image recognition system called Husky AI into misclassifying them as real huskies. The author explains they investigated this attack method and references a GAN course to learn more about the technique.