We’ve talked about grounding (giving an AI a textbook to look at) and prompting (giving an AI clear instructions). But sometimes, you don't just want the AI to look at a book; you want the AI to become an expert in its bones. This is called Fine-Tuning.
Showing posts with label article. Show all posts
Showing posts with label article. Show all posts
Adding Identity to the Authorization Layer
In the journey through information security, you will frequently encounter OAuth 2.0. While OAuth is excellent at authorization, it was never actually designed for authentication. To solve this, OIDC, or OpenID Connect, was created. Think of it this way: OAuth 2.0 is the key to a hotel room, while OIDC is the ID card that proves you are the person who booked it.
Phishing is Evolving Quickly
It’s not just application-level lateral movement and persistence to worry about, though. It’s possible the attacker can start moving laterally across other user accounts. If they have selected their targets well, they might even find they have admin access to some downstream SaaS application that has been configured for SAML logins using Okta.
For example, maybe they compromise a finance employee who has admin access to their business expenses SaaS application. Then the attacker might be able to use a new technique like SAMLjacking to start attacking other users in a watering hole attack to achieve lateral movement.
There are many options for lateral movement and persistence after an account compromise, so simple containment actions like password resets for SSO credentials are not nearly enough to contain a knowledgeable attacker.
Update IR playbooks to to deal with SSO account compromise, factoring in lateral movement and persistence across cloud apps. This really necessitates that you understand what business apps your organization is using, how they are accessed (e.g. SSO or username and password) and what functionality exists that could be abused by an attacker.
Tools :: no vnc :: EvilnoVNC :: Modlishka
Read More ::
- from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud
- 6-months-tracking-aitm-campaigns
- https://blog.thinkst.com/2024/01/defending-against-the-attack-of-the-cloned-websites.html
- https://zolder.io/using-honeytokens-to-detect-aitm-phishing-attacks-on-your-microsoft-365-tenant/
ark invest - autonomous taxis
https://ark-invest.com/articles/analyst-research/autonomous-taxis-gdp-impact/
Autonomous taxis and the potential economic gains.
Funny
"I need an any/any bidirectional exception in the IPS and Firewall for this netblock." Netblock is a Class C "Let me check the Infosec Guidebook..."
https://securityreactions.tumblr.com/post/146559515028
Another gruq post
Surveillance Evasion https://protectioncircle.org/2016/06/14/surveillance-evasion/
Volatility as a library
http://dsocon.blogspot.co.uk/2012/08/using-volatility-framework-as-library.html
Subscribe to:
Posts (Atom)