When AI Gets Hijacked: Exploiting Hosted Models for Dark Roleplaying
https://ift.tt/F4N8Yo9
Submitted October 03, 2024 at 07:28PM by permis0
via reddit https://ift.tt/wljvYGQ
https://ift.tt/F4N8Yo9
Submitted October 03, 2024 at 07:28PM by permis0
via reddit https://ift.tt/wljvYGQ
permiso.io
Hijacking AI infrastructure with non-human identities like access tokens
Permiso has found that some attackers are using hijacked LLM infrastructure to power highly inappropriate AI chatbot services. In this article we will explain the methods we are observing attackers use when performing LLMJacking/LLMHijacking in AWS, why…
/r/netsec's Q4 2024 Information Security Hiring Thread
OverviewIf you have open positions at your company for information security professionals and would like to hire from the /r/netsec user base, please leave a comment detailing any open job listings at your company.We would also like to encourage you to post internship positions as well. Many of our readers are currently in school or are just finishing their education.Please reserve top level comments for those posting open positions.Rules & GuidelinesInclude the company name in the post. If you want to be topsykret, go recruit elsewhere. Include the geographic location of the position along with the availability of relocation assistance or remote work.If you are a third party recruiter, you must disclose this in your posting.Please be thorough and upfront with the position details.Use of non-hr'd (realistic) requirements is encouraged.While it's fine to link to the position on your companies website, provide the important details in the comment.Mention if applicants should apply officially through HR, or directly through you.Please clearly list citizenship, visa, and security clearance requirements.You can see an example of acceptable posts by perusing past hiring threads.FeedbackFeedback and suggestions are welcome, but please don't hijack this thread (use moderator mail instead.)
Submitted October 03, 2024 at 09:19PM by netsec_burn
via reddit https://ift.tt/mF0EjOV
OverviewIf you have open positions at your company for information security professionals and would like to hire from the /r/netsec user base, please leave a comment detailing any open job listings at your company.We would also like to encourage you to post internship positions as well. Many of our readers are currently in school or are just finishing their education.Please reserve top level comments for those posting open positions.Rules & GuidelinesInclude the company name in the post. If you want to be topsykret, go recruit elsewhere. Include the geographic location of the position along with the availability of relocation assistance or remote work.If you are a third party recruiter, you must disclose this in your posting.Please be thorough and upfront with the position details.Use of non-hr'd (realistic) requirements is encouraged.While it's fine to link to the position on your companies website, provide the important details in the comment.Mention if applicants should apply officially through HR, or directly through you.Please clearly list citizenship, visa, and security clearance requirements.You can see an example of acceptable posts by perusing past hiring threads.FeedbackFeedback and suggestions are welcome, but please don't hijack this thread (use moderator mail instead.)
Submitted October 03, 2024 at 09:19PM by netsec_burn
via reddit https://ift.tt/mF0EjOV
Reddit
From the netsec community on Reddit
Explore this post and more from the netsec community
Pwning LLaMA.cpp RPC Server with CVE-2024-42478 and CVE-2024-42479
https://ift.tt/GqY5c4d
Submitted October 04, 2024 at 05:43AM by pwntheplanet
via reddit https://ift.tt/kmeOfpQ
https://ift.tt/GqY5c4d
Submitted October 04, 2024 at 05:43AM by pwntheplanet
via reddit https://ift.tt/kmeOfpQ
( ͡◕ _ ͡◕)👌
Pwning LLaMA.cpp RPC Server
Built your portable pentesting lab with Pi-Tail that is controlled only by your smartphone
https://ift.tt/xzwJDYT
Submitted October 04, 2024 at 12:53PM by barakadua131
via reddit https://ift.tt/g1yW2iF
https://ift.tt/xzwJDYT
Submitted October 04, 2024 at 12:53PM by barakadua131
via reddit https://ift.tt/g1yW2iF
Mobile Hacker
Portable Hacking Lab: Control The Smallest Kali Linux With a Smartphone
This guide shows you how to set up a headless Pi-Tail, controlled entirely from your smartphone via SSH or VNC. This compact and cost-effective setup is perfect for on-the-go Wi-Fi pentesting, network scanning, and vulnerability assessments.
Exploiting Visual Studio via dump files - CVE-2024-30052
https://ift.tt/pLtaigY
Submitted October 05, 2024 at 02:05AM by goodbyeselene
via reddit https://ift.tt/Dx4baQO
https://ift.tt/pLtaigY
Submitted October 05, 2024 at 02:05AM by goodbyeselene
via reddit https://ift.tt/Dx4baQO
###
Exploiting Visual Studio via dump files - CVE-2024-30052
The PrintNightmare is not Over Yet
https://ift.tt/NF5Acoz
Submitted October 05, 2024 at 06:39PM by AlmondOffSec
via reddit https://ift.tt/DfJvltV
https://ift.tt/NF5Acoz
Submitted October 05, 2024 at 06:39PM by AlmondOffSec
via reddit https://ift.tt/DfJvltV
itm4n’s blog
The PrintNightmare is not Over Yet
Following the publication of my blog post A Practical Guide to PrintNightmare in 2024, a few people brought to my attention that there was a way to bypass the Point and Print (PnP) restrictions recommended at the end. So, rather than just updating this article…
New free 10h OpenSecurityTraining2 class: "Trusted Computing 1102: Intermediate Trusted Platform Module (TPM) usage" by Dimi Tomov is now released
https://ost2.fyi/TC1102
Submitted October 06, 2024 at 05:08PM by OpenSecurityTraining
via reddit https://ift.tt/vmGjH8c
https://ost2.fyi/TC1102
Submitted October 06, 2024 at 05:08PM by OpenSecurityTraining
via reddit https://ift.tt/vmGjH8c
p.ost2.fyi
Intermediate Trusted Platform Module (TPM) usage
Learning how to use the most popular complex functions of Trusted Platform Modules (TPMs)
Hacking Windows through iTunes - Local Privilege Escalation 0-day (CVE-2024–44193)
https://ift.tt/2Ly61rN
Submitted October 07, 2024 at 05:29PM by Titokhan
via reddit https://ift.tt/uoT4Pv0
https://ift.tt/2Ly61rN
Submitted October 07, 2024 at 05:29PM by Titokhan
via reddit https://ift.tt/uoT4Pv0
GitHub
GitHub - mbog14/CVE-2024-44193: Hacking Windows through iTunes - Local Privilege Escalation 0-day
Hacking Windows through iTunes - Local Privilege Escalation 0-day - mbog14/CVE-2024-44193
Monocle on Chronicles - Talkback automated infosec aggregator with a newsletter
https://ift.tt/Tac7pen
Submitted October 08, 2024 at 02:47PM by AnimalStrange
via reddit https://ift.tt/c3doK96
https://ift.tt/Tac7pen
Submitted October 08, 2024 at 02:47PM by AnimalStrange
via reddit https://ift.tt/c3doK96
Elttam
A Monocle on Chronicles - elttam
elttam is a globally recognised, independent information security company, renowned for our advanced technical security assessments.
Docker Zombie Layers: Why Deleted Layers Can Still Haunt You
https://ift.tt/4LROQvZ
Submitted October 08, 2024 at 04:44PM by guedou
via reddit https://ift.tt/jWY5gE3
https://ift.tt/4LROQvZ
Submitted October 08, 2024 at 04:44PM by guedou
via reddit https://ift.tt/jWY5gE3
GitGuardian Blog - Take Control of Your Secrets Security
Docker Zombie Layers: Why Deleted Layers Can Still Haunt You
Docker Zombie Layers are unreferenced image layers that continue to exist for weeks in registries, even after being removed from a manifest. In this hands-on deep dive, we explore how these layers can persist in registries and why ensuring the immediate revocation…
Open Sourcing Venator – a kubernetes-native threat detection system
https://ift.tt/zTjVHva
Submitted October 08, 2024 at 04:38PM by No_Piccolo_6303
via reddit https://ift.tt/6QrbD8s
https://ift.tt/zTjVHva
Submitted October 08, 2024 at 04:38PM by No_Piccolo_6303
via reddit https://ift.tt/6QrbD8s
Medium
Open Sourcing Venator
a kubernetes-native threat detection system
Launched Today: The NHI Index
https://non-human.id
Submitted October 08, 2024 at 09:10PM by shlumper3
via reddit https://ift.tt/ZJvjBay
https://non-human.id
Submitted October 08, 2024 at 09:10PM by shlumper3
via reddit https://ift.tt/ZJvjBay
Clutch
NHI Index
The NHI Index is a centralized resource for understanding, managing, and securing Non-Human Identities like API keys, tokens, secrets, and service accounts. Explore mapping of 360+ NHIs and access essential resources to enhance security.
EKUwu: Not just another AD CS ESC
https://ift.tt/4iaVvnx
Submitted October 08, 2024 at 11:57PM by AlmondOffSec
via reddit https://ift.tt/cpNA2Jz
https://ift.tt/4iaVvnx
Submitted October 08, 2024 at 11:57PM by AlmondOffSec
via reddit https://ift.tt/cpNA2Jz
TrustedSec
EKUwu: Not just another AD CS ESC
Using default version 1 certificate templates, an attacker can exploit a vulnerability (EKUwu) to generate certificates that bypass security controls,…
Ivanti Connect Secure - Authenticated RCE via OpenSSL CRLF Injection (CVE-2024-37404)
https://ift.tt/d5xhWLf
Submitted October 08, 2024 at 11:56PM by AlmondOffSec
via reddit https://ift.tt/yXfw1KO
https://ift.tt/d5xhWLf
Submitted October 08, 2024 at 11:56PM by AlmondOffSec
via reddit https://ift.tt/yXfw1KO
Amberwolf
Ivanti Connect Secure - Authenticated RCE via OpenSSL CRLF Injection (CVE-2024-37404)
Today, we are releasing the details of CVE-2024-37404, a zero-day vulnerability in the Ivanti Connect Secure product. This vulnerability allows an authenticated administrator to execute arbitrary code with `root` privileges on the underlying system.
How to turn a file write vulnerability in a Node.js application into RCE – even though the target's file system is read-only
https://ift.tt/LxrKBvW
Submitted October 09, 2024 at 02:49AM by MegaManSec2
via reddit https://ift.tt/sLihfdp
https://ift.tt/LxrKBvW
Submitted October 09, 2024 at 02:49AM by MegaManSec2
via reddit https://ift.tt/sLihfdp
Sonarsource
Why Code Security Matters - Even in Hardened Environments
This blog post showcases why fundamental code security is essential for an application despite all hardening measures applied in the underlying infrastructure.
Exploiting AMD atdcm64a.sys arbitrary pointer dereference - Part 3
https://ift.tt/G6zLdgB
Submitted October 09, 2024 at 06:36PM by 0xdea
via reddit https://ift.tt/uIl6ay0
https://ift.tt/G6zLdgB
Submitted October 09, 2024 at 06:36PM by 0xdea
via reddit https://ift.tt/uIl6ay0
hn security
Exploiting AMD atdcm64a.sys arbitrary pointer dereference - Part 3 - hn security
In the previous part of the […]
MITRE Blog Post: Emulating complete, realistic attack chains with the new Caldera Bounty Hunter plugin
https://ift.tt/gO4tkNL
Submitted October 09, 2024 at 05:54PM by L015H4CK
via reddit https://ift.tt/fPsiyJZ
https://ift.tt/gO4tkNL
Submitted October 09, 2024 at 05:54PM by L015H4CK
via reddit https://ift.tt/fPsiyJZ
Medium
Emulating complete, realistic cyber attack chains with the new Caldera Bounty Hunter plugin
Authors: Louis Hackländer-Jansen
Palo Alto Expedition: From N-Day to Full Compromise – Horizon3.ai
https://ift.tt/yHX0qvI
Submitted October 09, 2024 at 10:29PM by scopedsecurity
via reddit https://ift.tt/ezXtkOT
https://ift.tt/yHX0qvI
Submitted October 09, 2024 at 10:29PM by scopedsecurity
via reddit https://ift.tt/ezXtkOT
Horizon3.ai
Palo Alto Expedition: From N-Day to Full Compromise
Technical analysis and indicators of compromise for Palo Alto Expedition CVE-2024-5910, CVE-2024-9464, CVE-2024-9465, and CVE-2024-9466 leading to system compromise and credential exposure.
Axis Camera takeover alternative
https://ift.tt/cM6GIFJ
Submitted October 10, 2024 at 01:21AM by S3cur3Th1sSh1t
via reddit https://ift.tt/xSgrGA5
https://ift.tt/cM6GIFJ
Submitted October 10, 2024 at 01:21AM by S3cur3Th1sSh1t
via reddit https://ift.tt/xSgrGA5
www.r-tec.net
Blog Axis Camera APP takeover
r-tec recently analysed an Axis IP Camera of the model F9111 in a penetrationtest for one of our customers.
Measuring Detection Coverage
https://ift.tt/QYEvKxD
Submitted October 10, 2024 at 01:20PM by netbiosX
via reddit https://ift.tt/qk6AEJs
https://ift.tt/QYEvKxD
Submitted October 10, 2024 at 01:20PM by netbiosX
via reddit https://ift.tt/qk6AEJs
Purple Team
Measuring Detection Coverage
Purple Teaming and Detection Engineering even though that as a concept exist in the information security industry for years lack of specific standardization, models and metrics. The absence of dedi…
Can You Get Root With Only a Cigarette Lighter?
https://ift.tt/d3l2DPB
Submitted October 09, 2024 at 07:45PM by gquere
via reddit https://ift.tt/kQfSaPJ
https://ift.tt/d3l2DPB
Submitted October 09, 2024 at 07:45PM by gquere
via reddit https://ift.tt/kQfSaPJ