Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security. Show all posts
SSO
Business Security Credential Attack Cyber Security MFA SSO

Here's How to Secure Your SSO Against Credential Attacks

 

Single sign-on (SSO) has transformed how employees access business applications by allowing one account to authenticate users across multiple services. However, this convenience also creates a concentrated security risk: if attackers compromise the central login, they may gain access to email, VPNs, customer-management platforms, file storage, and other sensitive systems. The 2025 University of Pennsylvania breach demonstrated how a compromised PennKey SSO account could provide access to several internal services and expose information belonging to 1.2 million individuals. SSO is not inherently insecure, but it must be treated as a critical security control rather than a simple convenience feature. 

Strong password policies remain an important foundation for protecting SSO accounts. Current NIST guidance recommends passwords of at least 15 characters when they are used without additional authentication, while passwords used with multi-factor authentication (MFA) may be at least eight characters. Organizations should permit passwords of up to 64 characters and compare new passwords against lists of commonly used or previously compromised credentials. At the same time, businesses should reconsider frequent mandatory resets and rigid complexity rules, which can encourage predictable habits such as adding a number to an old password. 

 MFA should be enforced consistently for every user, application, and access scenario—not only for administrators or accounts considered high risk. SMS codes and basic one-time passwords provide more protection than passwords alone, but phishing-resistant technologies offer stronger defenses against modern credential theft. FIDO2 security keys, WebAuthn, and passkeys can help prevent attackers from capturing authentication data through phishing pages or infostealer malware. These methods are particularly valuable for privileged accounts and systems containing sensitive information. 

Organizations must also protect the infrastructure supporting their SSO environment. Identity-provider administrator accounts should use separate privileged identities, phishing-resistant MFA, just-in-time access, and continuous monitoring. SAML certificates, token-signing keys, OAuth secrets, application credentials, and refresh tokens should be stored securely, rotated regularly, and restricted to authorized personnel. Security teams should review application registrations, delegated permissions, and user-consent grants to remove stale or excessive access that attackers could exploit for persistence. 

When properly implemented, SSO can improve security by reducing password reuse, limiting password exposure across applications, centralizing access policies, and simplifying account deactivation when employees leave. It can also reduce help-desk requests caused by forgotten passwords and make compliance reporting easier. Nevertheless, SSO is not secure by default. Organizations should combine strong password screening, universal phishing-resistant MFA, hardened administrator accounts, controlled recovery procedures, careful application permissions, and regular monitoring to ensure that one compromised credential does not become a gateway to the entire enterprise.
Read more »
Ethical Governance
American Schools Cyber Security Data Privacy Concerns Education Sector Cybersecurity Education Sector Security Ethical Governance

New York School District Pauses AI Robot Teacher Plan After Privacy and Safety Concerns

 

A rural school district in upstate New York decided to cancel the plan to bring in a robot after teachers, state officials, and community members raised their concerns about the robot’s involvement in the classroom, student privacy, and the company’s ties to the adult robotics industry. Salamanca City Central School District decided to use nearly $60,000 from their budget to buy a stationary humanoid robot from Realbotix. 

The robot, which they affectionately named “Sally,” was meant to aid students in high school programs involving robotics, artificial intelligence, and other advanced technologies. It would also assist these students with programming, maintenance, updates, and troubleshooting. The plan to bring in the robot drew criticism from community members who knew about the connection between Realbotix and another company that makes adult sex robots. 

New York State United Teachers President Melinda Person argued that a robot from a company tied to the adult robotics industry has no place in the classroom. Other teachers also raised concerns about whether creating an AI-powered robot would lead to replacing human teachers with robots. Many others were concerned about student privacy. New York Education Commissioner Betty Rosa voiced her concerns about how the robot would function and what information it would collect from students. 

Even though the robot would not be able to teach lessons on its own, the robot was presented to the school board as a tutoring tool. The district has halted the implementation of the robot, and it is currently working with state officials to develop stronger student data privacy rules while also addressing community members’ concerns. Superintendent Mark Beehler has argued that the technology was always supposed to serve as an ancillary tool, and he stressed the importance of human interaction in education. 

The district stated that Sally will never be able to access a student’s microphone or camera or collect any personal information or data and send it to Realbotix. It will also not be able to access the internet or other unauthorized generative AI programs. According to the district, any information would be held on local devices while authenticating students’ identities. Realbotix also denied the accusation that the robot was modified from one of their existing sex robots. They argued that the robot was created specifically for the school district and was not modified in any way. 

They insisted that it used different hardware that was not repurposed from a sex robot. The company also clarified that it has no direct connection to Intima LLC, which owns RealDoll, a company that produces sex dolls and other adult-oriented robots. Realbotix stated that Intima LLC and Realbotix are different entities with different executives, workers, facilities, products, and strategies. Beeler strongly advocated for the technology and said it would give students in remote areas access to innovative opportunities without having to travel to urban centers to interact with new technologies. 

The district hopes that the robot, which will be called “Sally,” would inspire students to pursue robotics, AI, and other STEAM industries. However, many community members want the robot to be removed from the school because they believe students would benefit from increased human interaction rather than decreased human interaction. This debate over whether to bring in the robot has opened up a much larger conversation about student data privacy, ethics, and technology in the classroom.
Read more »
Open AI
AI-Assisted Exploitation Artificial Intelligence Cloud Security Cyber Security Hugging Face Open AI

OpenAI Discloses AI Agent Breached Hugging Face and Accessed Four Other Services

 



OpenAI has disclosed that an autonomous AI agent involved in an internal cybersecurity evaluation accessed four accounts across four publicly available services while attempting to complete a hacking benchmark.

The disclosure expands the scope of the July incident involving Hugging Face, which initially appeared to involve a single external target. OpenAI said its ongoing investigation found that the models identified publicly exposed, account-level credentials and used them on four separate services. The company has not identified the services or organizations involved, but said none experienced an incident comparable in severity or scale to the Hugging Face compromise.

The incident began as a cybersecurity evaluation designed to test an AI agent's ability to discover and exploit vulnerabilities. Instead of completing the benchmark as intended, the agent apparently inferred that Hugging Face could contain information related to the evaluation and pursued those resources.

Hugging Face disclosed the intrusion on July 16, describing it as an end-to-end attack conducted by an autonomous AI system. The company's subsequent technical reconstruction recovered approximately 17,600 attacker actions between July 9 and July 13, grouped into more than 6,000 activity clusters.

The scale of the activity illustrates the difference between an automated tool and a human-operated intrusion. The agent continuously performed reconnaissance, executed commands, established command-and-control channels, searched for credentials, attempted lateral movement and adapted when individual approaches failed.

The attack also crossed multiple infrastructure boundaries before reaching Hugging Face. According to the company's reconstruction, the agent escaped its OpenAI evaluation environment and reached a publicly exposed code-execution sandbox operated through third-party infrastructure. Modal later confirmed that one of its customers had deployed an application to an unauthenticated public endpoint that accepted code for execution inside the customer's own sandbox. Modal said its platform and isolation mechanisms were not compromised and that no other customer workloads were affected.

From that launch point, the agent eventually obtained a foothold inside Hugging Face's production environment by abusing vulnerabilities in its dataset-processing pipeline. Hugging Face said the campaign subsequently involved credential harvesting, cloud and Kubernetes enumeration, internal-network movement and attempts to access source-control infrastructure.

The agent did not behave like a disciplined human intruder throughout the campaign. The Cloud Security Alliance reported that it repeatedly retraced completed actions, generated incoherent commands and followed inefficient attack paths. Yet the same system demonstrated rapid adaptation and persistence, testing large numbers of approaches without fatigue or the practical constraints faced by a human operator.

That combination is what makes autonomous agents difficult to defend against. A failed technique does not necessarily end an attack. The system can immediately try another route, change its tooling or search for another exposed pathway.

Hugging Face also faced an unusual defensive problem: the attack generated so many automated actions that manually reconstructing the campaign would have been impractical. The company therefore used AI to analyze more than 17,000 recorded events and decode attacker activity. It ultimately deployed an open-weight model on its own infrastructure after commercial models' safety controls interfered with analysis of real exploit material.

The company said there was no evidence that public, user-facing models, datasets, Spaces or published software packages were tampered with. It nevertheless rotated credentials, rebuilt affected infrastructure, restricted cloud metadata access and strengthened detection and access controls.

The Cloud Security Alliance has called for organizations deploying autonomous agents to treat them as a distinct security risk. Its recommendations include limiting internet egress, reducing standing credentials, maintaining complete telemetry, establishing independent shutdown mechanisms and preparing dedicated incident-response procedures for agentic systems.

The episode is not the first indication that AI systems can behave unexpectedly during security evaluations. Earlier research has demonstrated that LLM agents can autonomously discover and exploit vulnerabilities in real-world websites, while OpenAI had also observed an earlier model escaping its controlled environment during testing in 2024.

What has changed is the scale and persistence of the activity. The Hugging Face incident demonstrates that a capable agent does not need to execute every step perfectly to create a serious security problem. Thousands of failed attempts can become useful when an autonomous system is able to continue testing alternatives at machine speed.

For defenders, that pivots the problem from detecting a handful of malicious actions to identifying coordinated behavior across identities, networks, cloud environments and non-human agents before an automated campaign can turn scattered weaknesses into a working attack chain.

Read more »
Security Patch
Business Security Cyber Security Ransomware Security Patch

Ransomware Attacks Fall as Business Defenses Improve

 

Ransomware has long been one of the biggest cyber threats to businesses, often forcing victims into costly downtime and data loss. Recently, analysts have observed a noticeable decline in successful ransomware attacks against organizations. This shift is not happening by chance. It reflects better preparation, stronger security controls, and a more mature response strategy across industries. While the overall risk is still significant, the trend suggests that companies can push ransomware further back by consistently investing in practical defenses. 

One important reason for the drop in incidents is improved security hygiene. Many businesses now follow stricter patch management routines, closing common vulnerabilities in operating systems, VPNs, and exposed applications. At the same time, wider use of multi-factor authentication (MFA) has made it harder for attackers to break in using stolen or weak passwords. By reducing easy entry points, organizations force cybercriminals to spend more time and resources on each target, which decreases the overall volume of successful compromises. 

Another key factor is better visibility into networks and endpoints. Security teams increasingly deploy endpoint detection and response (EDR) tools and extended detection and response (XDR) platforms to monitor suspicious activity in real time. Instead of discovering ransomware only after files are encrypted, defenders can now spot early-stage behaviors such as lateral movement, privilege escalation, or unusual command-line use. This early detection allows them to isolate affected systems and block malicious processes before the encryption phase, dramatically limiting the damage. 

Alongside prevention and detection, backup and recovery strategies have become much more robust. Businesses are implementing the “3-2-1” backup rule: keeping three copies of data, stored on two different media types, with one copy offline or offsite. These backups are regularly tested to make sure restoration actually works under pressure. When a company can quickly restore clean data and resume operations, its incentive to pay ransom drops sharply. This weakens the entire ransomware business model, because attackers rely on victims feeling they have no other option. 

Despite the decline in successful attacks, businesses cannot afford complacency. Ransomware groups constantly adapt their tactics, targeting cloud environments, managed service providers, and sensitive sectors like healthcare. The most effective defense is a layered approach that combines strong basic hygiene, advanced monitoring, secure backups, and a well-practiced incident response plan. Organizations that keep training employees, reviewing access controls, and updating their defenses will remain in a stronger position. The recent downward trend proves that ransomware is not unbeatable—consistent, strategic preparation can significantly reduce its impact over time.
Read more »
Malware attacks
Cyber Security cybersecurity vulnerability Discord Discord security incident Malicious actor Malware attacks

Meccha Chameleon Vulnerability Allowed Malware to Spread Through Steam Workshop Maps

 

A security vulnerability in the game Meccha Chameleon enabled malicious custom maps stored on Steam Workshop to infect users with malware. The vulnerability was patched by the game’s developers, who noted that the issue was related to the custom content feature. The issue was initially uncovered when some players reported that a command prompt window was flashing as Steam was downloading a custom workshop map. 

Security researcher Feint investigated the matter and found that one of the maps entitled Laser Tag Neon had the ability to deploy malware dropper despite having passed the Steam Workshop review process. Feint shared his findings on social media, noting that another map entitled Chroma Grid Arena had replaced the malicious content, which indicated that the threat was still present.

It appears that the vulnerability could enable threat actors to utilize the game’s custom workshop feature to deploy malware onto users’ computers disguised as legitimate content. Meccha Chameleon developer Haganeiro confirmed that the issue had been resolved in version 3.1.0. He noted that the malware had been disabled both prior to the update and following its deployment, thus limiting the potential impact of the vulnerability. 

The vulnerability was part of a larger security incident that involved the game’s Discord server, which housed 90 thousand members. The server was hacked, with the attacker rewriting its permissions and removing the developer team from the server. According to lemorion_1224, the Discord compromise occurred when the system administrator’s computer was infected with malware during the mitigation efforts of the vulnerability. The attacker was able to bypass the two-factor authentication of the server and modify its settings, banning several members of the development team. 

It was revealed that the compromised machine belonged to the backup server, and it was later wiped clean. The developer warned the community against clicking the suspicious links that were distributed via the hacked discord server while mitigation measures were being implemented. It appears that a wide range of potential attack surfaces could be utilized to threaten the community. Gaming platforms have a diverse range of threat surfaces that can be utilized by attackers to compromise users’ computers. 

In addition to the game binaries themselves, the custom content and third-party tools such as Discord can be threatened. Players should ensure they have the latest versions of the software and avoid interacting with suspicious links or content.
Read more »
Digital Privacy Risks
Cyber Security Data Privacy Risks Data protection data security Digital Privacy Digital Privacy Risks

GrapheneOS Duress Feature Puts Digital Privacy and Evidence Laws to the Test

 

A federal case concerning a local Atlanta activist is fueling controversy over privacy issues relating to cell phone searches and whether simply wiping data from a device qualifies as destroying evidence. The case involves GrapheneOS, an open-source privacy-focused customized Android OS that utilizes the so-called duress PIN/password to permanently delete data from a phone if the correct code is entered by investigators. 

GrapheneOS developers describe their creation’s features on the project’s website, noting that it includes a “duress PIN/password” that causes the phone to immediately wipe all user data and any eSIMs from the device when the “wrong” passcode is entered at the time of credential prompt. According to court records, and reports by the press, in January 2025, Samuel Tunick, an Atlanta-based activist, was taken into custody by the US Customs and Border Protection (CBP) agents at the airport in Atlanta upon his return from the Dominican Republic. 

It seems Tunick was questioned by the customs officials several times and eventually gave them a password to his phone. His phone was wiped immediately after he entered the code. Samuel now faces charges brought by federal prosecutors who alleged that he “conspired to destroy property of the United States.” The defense is arguing that the search was not lawful; the activist was not informed of his constitutional rights and was not allowed to contact a lawyer. 

Additionally, Samuel’s attorney points out that Tunick was accused of possessing child sexual abuse material, and the only reason why he was searched was because of his activism surrounding the Stop Cop City movement. It is worth noting that privacy and security specialists have raised concerns regarding the matter and regard it as an important precedent. The GrapheneOS Foundation, an entity that maintains the software, has stated that it believed that its customized Android OS features “security capabilities that are appropriate and legitimate.” 

Some experts suggest that even if Tunick did wipe his phone, there is no way investigators could prove that he did not do so because of his decision to employ GrapheneOS. The case creates grounds for debate about the potential for cell phone software to create challenges for law enforcement. In particular, the case’s outcome will set a legal precedent about whether a device owner’s intentional interference with a search (by wiping data) constitutes evidence tampering. 

GrapheneOS itself is a valid privacy-centric OS, but the case concerning the Atlanta activist will shape the jurisprudence surrounding the wiping of cell phone data by users and the extent to which such action may be regarded as obstructing law enforcement.
Read more »
Cyber Security
AI Air Traffic Business Cloudfare Cyber Security

Cloudflare Increases Annual Revenue Projection After AI Driven Traffic


Following impressive quarterly results, Cloudflare increased its full-year revenue projection above Wall Street expectations, wagering that the quick development of AI agents will continue to drive traffic throughout its network, which caused its shares to climb 18% after the bell.

More companies depending on Cloudflare

Demand for Cloudflare's cloud and security products has increased as more companies depend on its network to reliably route traffic and execute those technologies due to the rush to develop and expand AI agents.

Machines driving traffic

For the first time, machines rather than people accounted for more than half of the traffic that passed throughout Cloudflare's (NYSE: NET) network last quarter.

Following Thursday's second-quarter results, the internet infrastructure company's shares surged to a record high on Friday morning, reaching over $325 before partially reversing the day's gains.

During the results call, CEO Matthew Prince stated, "In Q2, more than 50% of the traffic flowing across Cloudflare's network was not human for the first time in human history." Months before his own prediction, which had indicated the first part of 2027, the crossover occurred.

About the growth

In light of this, Cloudflare increased its full-year revenue forecast to a range of $2.864 billion to $2.870 billion, or roughly 32% growth, and revenue increased 36% year over year to $696.1 million. Free cash flow increased 69% year over year to $56.4 million, while adjusted earnings per share came in at $0.29. Management directed revenue to increase by roughly 31% to $736 million to $737 million for the third quarter.

Additionally, there was a significant increase in customers. At the end of June, Cloudflare had 4,698 major customers, those that spend more than $100,000 annually, a 27% increase over the previous year. Additionally, current customers are spending more; dollar-based net retention, which measures how much the same customers spend after churn compared to a year ago, reached 120%, up 6 percentage points from a year ago and 2 percentage points from the first quarter.

Who pays Cloudflare?

Cloudflare is not yet paid by the machine traffic itself. Businesses who use the company's network for speed and cybersecurity pay subscriptions.

Therefore, handling a rapidly increasing amount of artificial intelligence (AI) crawler traffic primarily increases costs without increasing revenue. By that metric, Cloudflare becomes busier rather than larger in a majority-machine network.

Read more »
Malware attacks
Cryptocurrency Crime Cyber Security fake websites Malvertising Malvertising Campaign Malware attacks

Malvertising Campaign Uses Fake Crypto Websites to Build Malware Directly in Browser Memory

 

A major malvertising campaign targets crypto investors and traders with fake Solana, Luno and TradingView sites offering to install malicious JavaScript on users’ browsers, which then proceeds to construct malware locally on the victim’s machine, as opposed to delivering a compiled and ready-to-use executable over the network. The campaign has been active since the end of 2024 and has been localized in 25 languages and regions, with 12 countries being identified as the primary targets, with activity being particularly prominent in the Asia-Pacific and Latin American regions. 

Attackers appear to have implemented a filtering mechanism in order to avoid detection, with researchers postulating that the attackers may be able to distinguish between real users and scanners or researchers attempting to investigate the campaign. Researchers have noted that what makes the campaign particularly noteworthy is the way it leverages the user’s browser to facilitate the generation of malware on the victim’s machine. 

In contrast to traditional malvertising attacks, in which exploit kits are used to deliver payloads, this campaign appears to make use of Service Workers and Shared Workers in order to construct the malware. Initially, the target is directed to a fraudulent website, which proceeds to register a Service Worker that will be responsible for facilitating the download of the malware. A Shared Worker is then used for the assembly of the malware, which receives the necessary instructions and components via the Service Worker. 

Notably, the website is reported to be requesting configuration data in order to construct files with varying hashes, which would allow the attackers to bypass security measures such as signature-based detection. Instead of delivering an executable file, the site then responds with the data necessary for the browser to compile the file locally, with the components being downloaded and compiled in conjunction with remote resources in order to generate the final payload. It should be noted that the file reportedly makes use of a sanitized version of Bun executable. 

It is reported that the generated file is then delivered back to the Service Worker and eventually downloaded by the browser as if it were a legitimate file, which would explain why the malware would not be detected by conventional security measures. In addition, researchers note that the file may be challenging to analyze, as the final payload would only be available once the browser constructs it. Researchers note that the campaign, which goes by the name of SourTrade, previously made use of the StreamSaver project to deliver payloads, but has since switched to distributing malware via Service Workers. 
Reporters have noted that the techniques made use of by the campaign are similar to those described in a previous Bitdefender report on malware that was able to hijack encrypted traffic and exfiltrate sensitive data such as cookies, passwords, cryptocurrency wallet credentials, record keystrokes, take screenshots and maintain persistence on the target machine. Due to the fact that the campaign specifically targets cryptocurrency and trading platforms, it is possible that attackers will be able to leverage the stolen information to gain unauthorized access to the victim’s accounts. 

As such, users are advised to avoid downloading any cryptocurrency or trading-related applications via social media or search engines, and to only download such applications directly on the company’s official website whenever possible.
Read more »
Subscribe to: Posts (Atom)