Why Shadow APIs are More Dangerous than You Think

Why Shadow APIs are More Dangerous than You Think,

Shadow APIs are a growing risk for organizations of all sizes as they can mask malicious behavior and induce substantial data loss. For those that aren’t familiar with the term, shadow APIs are a type of application programming interface (API) that isn’t officially documented or supported. 
Contrary to popular belief, it’s unfortunately all too common to have APIs in production that no one on

,

Shadow APIs are a growing risk for organizations of all sizes as they can mask malicious behavior and induce substantial data loss. For those that aren’t familiar with the term, shadow APIs are a type of application programming interface (API) that isn’t officially documented or supported. 
Contrary to popular belief, it’s unfortunately all too common to have APIs in production that no one on

, ,
https://thehackernews.com/2023/04/why-shadow-apis-are-more-dangerous-than.html

Pakistan-based Transparent Tribe Hackers Targeting Indian Educational Institutions

Pakistan-based Transparent Tribe Hackers Targeting Indian Educational Institutions,

The Transparent Tribe threat actor has been linked to a set of weaponized Microsoft Office documents in attacks targeting the Indian education sector using a continuously maintained piece of malware called Crimson RAT.
While the suspected Pakistan-based threat group is known to target military and government entities in the country, the activities have since expanded to include the education

,

The Transparent Tribe threat actor has been linked to a set of weaponized Microsoft Office documents in attacks targeting the Indian education sector using a continuously maintained piece of malware called Crimson RAT.
While the suspected Pakistan-based threat group is known to target military and government entities in the country, the activities have since expanded to include the education

, ,
https://thehackernews.com/2023/04/pakistan-based-transparent-tribe.html

Lazarus Hacker Group Evolves Tactics, Tools, and Targets in DeathNote Campaign

Lazarus Hacker Group Evolves Tactics, Tools, and Targets in DeathNote Campaign,

The North Korean threat actor known as the Lazarus Group has been observed shifting its focus and rapidly evolving its tools and tactics as part of a long-running activity called DeathNote.
While the nation-state adversary is known for its persistent attacks on the cryptocurrency sector, it has also targeted automotive, academic, and defense sectors in Eastern Europe and other parts of the world

,

The North Korean threat actor known as the Lazarus Group has been observed shifting its focus and rapidly evolving its tools and tactics as part of a long-running activity called DeathNote.
While the nation-state adversary is known for its persistent attacks on the cryptocurrency sector, it has also targeted automotive, academic, and defense sectors in Eastern Europe and other parts of the world

, ,
https://thehackernews.com/2023/04/lazarus-hacker-group-evolves-tactics.html

ChatGPT Security: OpenAI’s Bug Bounty Program Offers Up to $20,000 Prizes

ChatGPT Security: OpenAI’s Bug Bounty Program Offers Up to $20,000 Prizes

,

OpenAI, the company behind the massively popular ChatGPT AI chatbot, has launched a bug bounty program in an attempt to ensure its systems are « safe and secure. »
To that end, it has partnered with the crowdsourced security platform Bugcrowd for independent researchers to report vulnerabilities discovered in its product in exchange for rewards ranging from « $200 for low-severity findings to up to

,

OpenAI, the company behind the massively popular ChatGPT AI chatbot, has launched a bug bounty program in an attempt to ensure its systems are « safe and secure. »
To that end, it has partnered with the crowdsourced security platform Bugcrowd for independent researchers to report vulnerabilities discovered in its product in exchange for rewards ranging from « $200 for low-severity findings to up to

, ,
https://thehackernews.com/2023/04/chatgpt-security-openais-bug-bounty.html

Israel-based Spyware Firm QuaDream Targets High-Risk iPhones with Zero-Click Exploit

Israel-based Spyware Firm QuaDream Targets High-Risk iPhones with Zero-Click Exploit,

Threat actors using hacking tools from an Israeli surveillanceware vendor named QuaDream targeted at least five members of civil society in North America, Central Asia, Southeast Asia, Europe, and the Middle East.
According to findings from a group of researchers from the Citizen Lab, the spyware campaign was directed against journalists, political opposition figures, and an NGO worker in 2021.

,

Threat actors using hacking tools from an Israeli surveillanceware vendor named QuaDream targeted at least five members of civil society in North America, Central Asia, Southeast Asia, Europe, and the Middle East.
According to findings from a group of researchers from the Citizen Lab, the spyware campaign was directed against journalists, political opposition figures, and an NGO worker in 2021.

, ,
https://thehackernews.com/2023/04/israel-based-spyware-firm-quadream.html

The Service Accounts Challenge: Can’t See or Secure Them Until It’s Too Late

The Service Accounts Challenge: Can’t See or Secure Them Until It’s Too Late

,

Here’s a hard question to answer: ‘How many service accounts do you have in your environment?’. A harder one is: ‘Do you know what these accounts are doing?’. And the hardest is probably: ‘If any of your service account was compromised and used to access resources would you be able to detect and stop that in real-time?’. 
Since most identity and security teams would provide a negative reply,

,

Here’s a hard question to answer: ‘How many service accounts do you have in your environment?’. A harder one is: ‘Do you know what these accounts are doing?’. And the hardest is probably: ‘If any of your service account was compromised and used to access resources would you be able to detect and stop that in real-time?’. 
Since most identity and security teams would provide a negative reply,

, ,
https://thehackernews.com/2023/04/the-service-accounts-challenge-cant-see.html

Urgent: Microsoft Issues Patches for 97 Flaws, Including Active Ransomware Exploit

Urgent: Microsoft Issues Patches for 97 Flaws, Including Active Ransomware Exploit,

It’s the second Tuesday of the month, and Microsoft has released another set of security updates to fix a total of 97 flaws impacting its software, one of which has been actively exploited in ransomware attacks in the wild.
Seven of the 97 bugs are rated Critical and 90 are rated Important in severity. Interestingly, 45 of the shortcomings are remote code execution flaws, followed by 20

,

It’s the second Tuesday of the month, and Microsoft has released another set of security updates to fix a total of 97 flaws impacting its software, one of which has been actively exploited in ransomware attacks in the wild.
Seven of the 97 bugs are rated Critical and 90 are rated Important in severity. Interestingly, 45 of the shortcomings are remote code execution flaws, followed by 20

, ,
https://thehackernews.com/2023/04/urgent-microsoft-issues-patches-for-97.html

Trouvez des bugs dans ChatGPT pourrait vous rapporter gros

Trouvez des bugs dans ChatGPT pourrait vous rapporter gros,

chatgpt

Le créateur de ChatGPT se dit prêt à vous payer jusqu’à 20 000 dollars – soit 18 300 euros – si vous trouvez des bugs dans son chatbot d’intelligence artificielle.

,

chatgpt

Le créateur de ChatGPT se dit prêt à vous payer jusqu’à 20 000 dollars – soit 18 300 euros – si vous trouvez des bugs dans son chatbot d’intelligence artificielle.

, ,
https://www.01net.com/actualites/trouvez-des-bugs-dans-chatgpt-pourrait-vous-rapporter-gros.html

North Korean Hackers Uncovered as Mastermind in 3CX Supply Chain Attack

North Korean Hackers Uncovered as Mastermind in 3CX Supply Chain Attack,

Enterprise communications service provider 3CX confirmed that the supply chain attack targeting its desktop application for Windows and macOS was the handiwork of a threat actor with North Korean nexus.
The findings are the result of an interim assessment conducted by Google-owned Mandiant, whose services were enlisted after the intrusion came to light late last month. The threat intelligence

,

Enterprise communications service provider 3CX confirmed that the supply chain attack targeting its desktop application for Windows and macOS was the handiwork of a threat actor with North Korean nexus.
The findings are the result of an interim assessment conducted by Google-owned Mandiant, whose services were enlisted after the intrusion came to light late last month. The threat intelligence

, ,
https://thehackernews.com/2023/04/lazarus-sub-group-labyrinth-chollima.html

iOS : après Pegasus, un nouveau spyware compromet les iPhone pour les espionner

iOS : après Pegasus, un nouveau spyware compromet les iPhone pour les espionner,

Un nouveau malware cible les iPhone et viole les libertés essentielles.

NSO Group est mort, vive QuaDream ! Cette société israélienne mettrait à disposition des outils permettant d’espionner les iPhone de personnes ciblées, généralement des opposants politiques, des journalistes ou des activistes. Microsoft et le Citizen Lab viennent de révéler ses agissements à travers le monde.

,

Un nouveau malware cible les iPhone et viole les libertés essentielles.

NSO Group est mort, vive QuaDream ! Cette société israélienne mettrait à disposition des outils permettant d’espionner les iPhone de personnes ciblées, généralement des opposants politiques, des journalistes ou des activistes. Microsoft et le Citizen Lab viennent de révéler ses agissements à travers le monde.

, ,
https://www.01net.com/actualites/ios-apres-pegasus-un-nouveau-spyware-compromet-les-iphone-pour-les-espionner.html