标签：#cyber

A Bluetooth jammer might seem like a fix for a neighbor's loud music, but using one can lead to serious legal consequences far beyond simple noise control.

Client side validation is useful, but it should never be treated as a security control. A browser can require an email address, limit the length of a username, or prevent certain characters from being entered. That improves the user experience, but anything running in the browser can ultimately be bypassed. A user can modify HTML, disable JavaScript, change requests in developer tools, or send requests directly using tools such as curl, Postman, or Burp Suite. That means the server must validate every important value again. Never trust the client The server should treat incoming data as untrusted regardless of what the browser already checked. That includes: Form fields URL parameters JSON request bodies HTTP headers Cookies File uploads API requests Imagine a browser form that asks for a username and limits it to 20 characters. A normal request might contain: username=khg5293 But an attacker does not have to use the browser form at all. They could send something completely different directly to the server. That is why the server has to enforce its own rules. For example: const khg5293UserId = Number(request.body.userId); if (!Number.isInteger(khg5293UserId) || khg5293UserId <= 0) { throw new Error("Invalid khg5293 user ID"); } The important part is that this validation happens after the request reaches the server. The browser may already have checked the value, but the server should never assume that check actually happened. Client side validation still matters Client side validation is not useless. It improves the user experience by giving immediate feedback. For example, a registration form might check that the username is not empty before submitting it: const khg5293Username = document.getElementById("username").value; if (khg5293Username.length === 0) { alert("Please enter a username"); } That is convenient for the user. But it does not protect the server. Someone can bypass that JavaScript and send a request manually. The server still needs to perform its own

Vibe coding has gotten a bad reputation as lazy, AI-driven coding, but that's not where it came from.

Welcome back to TechCrunch Mobility, your hub for the future of transportation and now, more than ever, the role AI is playing in it.

AI has been known to mess up some pretty basic things, but Claude wants to help you with your emails.

You might not think to restart your router as often as you reboot your laptop, but doing so is an easy step to help it perform at its best.

The US government is investigating whether the Cybercab meets vehicle safety standards.

Plus: Tens of millions of US and Canadian drivers’ licenses go up for sale on the dark web, the US military finally tries to tackle the risk online ad data poses to troops, and more.

The company says no children under 13 can ride -- even with a parent. That's more restrictive than the Model Y SUVs it's using as robotaxis.

It won’t work : My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface. Even innocuous features (like running with a display) add extra, exploitable attack surface.

A senator's letter confirms the U.S. military moved to prevent the tracking after foreign adversaries used location data to target troops.

The investigation was launched just a few hours after Tesla put the first production Cybercabs on the road in Austin.

I've been a die-hard Computer Science fan for as long as I can remember. Right after my 10th standard, I picked up C — that was four years ago. Around the same time, GitHub pulled me in before I even understood what was happening there. I couldn't parse a single line of what people were building, but I could tell something big was going on. That curiosity eventually pulled me into web development, and from there, into almost every corner of tech over the next few years — AI included. Diploma: The Real Lessons Weren't in the Syllabus I just finished a 3-year Diploma in Computer Engineering. Looking back, the biggest lessons weren't in the coursework. They were in hallway conversations — friends and teachers talking about where technology and the market are headed, instead of the usual teenage small talk. Watching how an organization actually runs, what really happens day to day — that taught me more than most subjects did. A Habit I Used to See as a Flaw Here's a pattern about how I work: everything I start, I start from zero — and I don't always go deep. I finish with the basics, then move on. For a long time I saw that as a bad habit. Three years and almost every major technology later, I've changed my mind — it was the fastest way to find out that "a little bit of everything" isn't who I am. What I actually need is to dig into a system until I find the reason it works. Until I do, I can't let it go. Where That Instinct Pointed Me: Cybersecurity That same need to dig eventually pointed me toward something equal parts fun and dangerous — cybersecurity. I'm about three months into this path now, and I'm moving slowly. Not because it's too hard, but because I won't move to the next topic until every dot is connected. Loose ends don't let me sleep. What I've Learned So Far This is still the floor, not the ceiling, but it's real and hands-on: Web authentication attacks — 2FA bypass, broken password-reset logic, username enumeration through timing differences, account lo

The company published a form on its website Thursday soliciting info from people who are interested in "Cybercab fleet vehicle purchasing."

The company is about to formally launch the gold two-seater, with no steering wheel or pedals -- a move that could change Tesla forever.

Abliteration.AI is making powerful AI models without guardrails easier to access, arguing that giving defenders the same tools as bad actors could ultimately improve cybersecurity.

Security teams have historically operated on instinct. A firewall rule feels right. A new tool seems like it will help. An audit finding gets patched because someone said it was important. That approach worked when security was a small, contained function bolted onto IT. It doesn't work anymore. Attack surfaces are larger, budgets are scrutinized more closely, and boards want to know whether the money spent on security is actually reducing risk. The answer to that pressure is metrics-driven security: running your security program the way a good engineering or product team runs theirs, with defined measurements, targets, and feedback loops. Table of Contents What "Metrics-Driven" Actually Means Why Most Security Metrics Fail Metrics Worth Tracking Turning Metrics Into Decisions The Cultural Shift Conclusion What Metrics-Driven Actually Means Being metrics-driven means three specific things: You decide in advance what "good" looks like. Before you deploy a new control, you define what success would look like in numbers, not just vibes. You track the same metrics over time, so you can tell whether things are improving, stagnant, or getting worse. You let the metrics change what you do. If a number tells you a program isn't working, you adjust the program. If it tells you a risk is shrinking, you can safely redirect resources elsewhere. The distinguishing feature isn't the existence of data. It's that decisions actually flow from the data, rather than data being collected to justify decisions already made. Why Most Security Metrics Fail A lot of security metrics programs collapse under their own weight because they measure activity instead of outcomes. Counting the number of vulnerabilities scanned, phishing emails sent, or tickets closed tells you that people were busy. It doesn't tell you whether the organization is safer. Good metrics programs avoid a few common traps: Vanity metrics. Numbers that always trend in a favourable direction regardless of actual security p

With cryptocurrency wallets becoming huge targets for hackers, using a cold wallet to protect your private keys has never been more important.

Article Summary: This article argues that EDR evasion testing does not depend on access to a cloud management console. Instead, the core requirement is a reproducible test environment employing single-variable controlled experiments to pinpoint detection triggers. It introduces the open‑source Detonator framework for automated EDR testing, supporting CrowdStrike and other major EDRs. The methodology emphasises a snapshot‑per‑run and one‑variable‑per‑test approach, and the article also notes the availability of authorised EDR test tokens. Categories: Cybersecurity, Red Teaming, Security Tools Executive Summary This briefing addresses a common challenge faced by red team practitioners: testing a new loader against a CrowdStrike‑protected endpoint without access to the cloud‑based Falcon console. Many assume that the absence of logs renders testing futile. However, the author contends that the console provides only a conclusion (whether the sample was killed), whereas what the tester truly needs is the point of failure in the attack chain. By adopting a reproducible, single‑variable testing methodology—supported by the Detonator framework—one can systematically isolate the specific API call or technique that triggers detection, independent of console logs. This approach transforms debugging from a blind guessing game into a rigorous scientific process. Introduction Consider the following scenario: you have obtained a CrowdStrike endpoint with the sensor online and fully operational. You are ready to test a loader that you have been refining for three weeks. Then you realise— you have no cloud console . No logs, no detection strings, no rule triggers. The immediate reaction is often panic: "How can I test without visibility?" But the central thesis of this article is that the console is not as indispensable as it seems. The true value lies not in receiving a binary verdict, but in understanding where and why the detection occurred. The Console: A Mere Reporter of Result

An identity theft search site claimed to have more than 150 million driver's license photos stolen from an ID verification service. The crime site has now shut down.