A naukri.com initiative
Cyber Security News
Dev
1w
285
Image Credit: Dev
One SQL Query That Could Destroy Your Entire Database (And How Hackers Use It)
- SQL Injection attacks are a common and dangerous threat in cybersecurity, allowing attackers to bypass logins and access sensitive data.
- Attackers can bypass login mechanisms using SQL Injection by exploiting vulnerable login scripts.
- By using techniques like UNION to merge tables, attackers can dump sensitive data like credit card numbers from databases.
- SQL Injection can be used to execute destructive queries like deleting entire databases in a single line of code.
- Prevention methods include using parameterized queries, input validation, and avoiding dynamic SQL query building.
- SQL Injections can also be used for remote command execution, allowing attackers to control operating systems through SQL commands.
- Experts emphasize the importance of treating user input as hostile to prevent SQL Injection vulnerabilities.
- Mitigating SQL Injection risks involves disabling features like xp_cmdshell and following least privilege principles for database accounts.
- SQL Injection attacks are favored by attackers due to their ease of execution and potent impact on databases and systems.
- Key takeaways include using parameterized queries, validating inputs, auditing permissions, and practicing safe environment simulations.
Read Full Article
17 Likes
Securityaffairs
1w
39
Image Credit: Securityaffairs
A flaw in Verizon’s iOS Call Filter app exposed call records of millions
- A flaw in Verizon’s iOS Call Filter app exposed call records of millions.
- Verizon's Call Filter app allows users to identify and manage unwanted calls.
- The vulnerability in Verizon's app allowed retrieval of call histories for arbitrary numbers.
- Verizon quickly fixed the flaw, and no evidence of exploitation was found.
Read Full Article
2 Likes
Dev
1w
375
Image Credit: Dev
Countering security threats: Contactless payment
- Quishing, a form of cyber-attack using malicious QR codes, is causing significant financial losses.
- To counter these security threats, a developer has created a QR scam detection and tracking tool named Beaver.
- Beaver helps identify the source of fraudulent QR codes and provides comprehensive details to prevent future attacks.
- The developer plans to enhance the system with real-time intelligence features and train an AI model for detecting fake login pages.
Read Full Article
22 Likes
Medium
1w
336
The Rise of AI-Powered Cyber Attacks: How Machines Are Outsmarting Humans
- AI-driven cyber attacks leverage machine learning to identify and exploit vulnerabilities.
- Types of AI-powered cyber attacks: Phishing attacks, Malware attacks, and DDoS attacks.
- The future of cybersecurity involves investing in AI-driven security tools and fortifying defenses.
- Grasping these threats and crafting effective countermeasures is crucial for safeguarding against AI-driven cybercrime.
Read Full Article
20 Likes
Dev
1w
341
Image Credit: Dev
Understanding Bcrypt's Work Factor and Choosing the Right Value
- Bcrypt is a popular choice for password hashing, known for its unique features like automatic salt and adaptive hashing.
- The work factor in bcrypt controls the computational effort for hashing a password, affecting security and processing time.
- Adjusting the work factor is essential to keep passwords secure as hardware technology advances.
- Choosing the right work factor value in bcrypt is crucial to balance security and user experience.
- Increasing the work factor exponentially increases hashing time and brute-force resistance.
- It is recommended to adapt the work factor periodically to stay ahead of hardware advancements and ensure password security.
- Depending on the project type, work factor values for bcrypt can range from 10 for development to 14+ for high-security applications.
- Future-proofing password hashing involves adjusting the work factor over time as hardware improves, without interrupting user experience.
- Implementers should consider the context of their application and periodically monitor and adjust the work factor based on the evolving threat landscape.
- Key takeaways include doubling hashing time with each +1 in work factor, migrating periodically to adapt to hardware advancements, and customizing work factor based on the application's security needs.
- Tools like Auth0 blog, OWASP resources, and online CLI tools can aid in implementing and managing bcrypt for secure password hashing.
Read Full Article
20 Likes
Dev
1w
187
Image Credit: Dev
🔐 The Role of AES in Blockchain: Securing Off-Chain Data with Symmetric Encryption
- AES, specifically Advanced Encryption Standard, plays a crucial role in enhancing security and privacy in blockchain applications by encrypting off-chain data and securing keys and credentials.
- Benefits of using AES in blockchain include protecting sensitive information like personal records and medical data, as well as preserving privacy while ensuring data integrity.
- Real-world use cases of AES in blockchain applications include securing product data in supply chain management and encrypting patient records in healthcare with access control managed through blockchain logs.
- AES contributes to enhancing hybrid system security by encrypting off-chain storage like cloud databases while ensuring integrity and access traceability through blockchain logs.
- AES, as a symmetric-key algorithm, uses the same secret key for both encryption and decryption, employing steps like Key Expansion, SubBytes, ShiftRows, MixColumns, and AddRoundKey for encryption and decryption.
- In practical implementation, AES secures blockchain applications by identifying sensitive data, encrypting it using a secure key, storing the encrypted data off-chain, and storing a hash or reference on-chain for authorized users to decrypt.
- AES encryption involves operations such as SubBytes, ShiftRows, MixColumns, and AddRoundKey, with mathematical concepts rooted in Galois Fields, polynomial arithmetic, matrix multiplication, and bitwise XOR.
- It's essential to understand the internal workings of AES, including its components like Key Expansion, finite field arithmetic, and tasks like encrypting data blocks and generating round keys to ensure data confidentiality and secure communication.
- Real-world applications of AES encryption span secure communications, data storage, wireless security, mobile devices, banking and finance, as well as government and military sectors where AES-256 is used for encrypting Top Secret information.
- The complexity and importance of AES encryption lie in its mathematical foundations and layered transformations that ensure not just data secrecy but also structured security in various digital environments.
- AES encryption is widely adopted for its security, speed, and simplicity, finding applications in HTTPS, email encryption, file and disk encryption, wireless security, mobile devices, banking systems, government sectors, and more, demonstrating its critical role in safeguarding digital information.
Read Full Article
11 Likes
Hackernoon
1w
98
Image Credit: Hackernoon
AI Won’t Save Your Team—unless You Embrace Incremental Change
- In today's rapidly evolving tech landscape, organizations must adapt to technological advancements like DevOps and AI to stay competitive.
- Success is achieved through incremental improvements, with AI playing a key role in enabling smarter processes and productivity gains in DevOps.
- AI is helping DevOps teams address challenges such as skills gaps, cost reduction, and software quality, saving significant time for strategic focus.
- Generative AI poses cybersecurity risks and requires thorough testing and risk management for responsible adoption in enterprise operations.
- Lack of comprehensive AI legislation in the U.S. poses challenges in balancing innovation with accountability, as seen in the veto of California's AI safety bill.
- Business leaders must prioritize AI-powered testing to maintain confidence in every release and navigate the technology landscape.
- Cloud migration is accelerating, with a focus on faster release cycles driven by competition and enterprise AI adoption.
- AI, when used effectively, can help SaaS vendors and internal teams streamline processes and meet the demands of modern environments.
- Advancements in technology and regulations will shape the challenges and opportunities for organizations, emphasizing the need for AI and continuous improvement.
- DevOps teams embracing AI and focusing on incremental gains will be well-positioned for growth and resilience in the future.
Read Full Article
5 Likes
Hackernoon
1w
98
Image Credit: Hackernoon
Learning PenTesting Has Never Been Easier—Check Out These Free Resources for 2025
- In 2025, there are numerous free resources available for individuals interested in learning Penetration Testing (PenTesting) or ethical hacking.
- Penetration Testing involves simulating cyberattacks on systems, applications, or networks to identify vulnerabilities before malicious hackers exploit them.
- Free platforms like TryHackMe and Hack The Box offer hands-on cybersecurity training with beginner-friendly paths and structured modules.
- PortSwigger Web Security Academy focuses on teaching web application hacking and OWASP Top 10 vulnerabilities through interactive labs.
- INE provides free cybersecurity and networking courses, assisting in developing foundational knowledge in cybersecurity.
- Other resources include VulnHub for downloadable vulnerable machines, PentesterLab for step-by-step exercises, and OWASP for security best practices.
- Utilize tools such as Nmap, Burp Suite, Wireshark, Metasploit Framework, John the Ripper, and more, which are essential for PenTesters and are free to use.
- Establish a practice routine by engaging in different activities each day, including room challenges, web security labs, tool exploration, and community interaction.
- The article recommends focusing on skill development with free resources before pursuing certifications like OSCP or CEH to build a strong foundation in ethical hacking.
- PenTesting emphasizes problem-solving and understanding system vulnerabilities, encouraging individuals to approach it creatively and knowledgeably.
- 2025 is highlighted as an opportune time for beginners and enthusiasts to start their PenTesting journey due to the wealth of available free resources.
Read Full Article
5 Likes
Tech Radar
1w
230
Image Credit: Tech Radar
Look out for tax-themed scams this month, Microsoft warns
- Criminals are using the April 15 tax deadline to trick victims
- Phishing attacks used to deliver malware and infostealers
- Leaves victims at risk of fraud, identity theft, and monetary loss
- The most effective defense is education and being cautious
Read Full Article
13 Likes
Wired
1w
324
Image Credit: Wired
NSA Chief Ousted Amid Trump Loyalty Firing Spree
- The Trump administration reportedly fired the director of the National Security Agency, General Timothy Haugh, at the urging of far-right activist Laura Loomer, who targeted officials she deemed disloyal to President Donald Trump.
- Haugh and his civilian deputy, Wendy Noble, were removed from their positions following Loomer's influence during an Oval Office meeting.
- NSA dismissals were also accompanied by several National Security Council staff being forced out post the meeting.
- Trump confirmed the dismissals and acknowledged Loomer's advisory role, stating he listens to recommendations provided.
- Laura Loomer, known for endorsing conspiracy theories, has become an influential figure within Trump's circle, targeting those she believes undermine his agenda.
- In a separate incident, it was revealed that an operative from Elon Musk's Department of Government Efficiency, Christopher Stanley, previously ran websites distributing pirated ebooks and software.
- Stanley, now a senior adviser in the deputy attorney general's office, allegedly operated online forums focused on piracy, video game cheats, and hacking.
- Another instance highlighted a security lapse within national security adviser Mike Waltz's team, who inadvertently invited a Signal account to a private chat discussing sensitive information.
- At least 20 Signal group chats were identified involving Waltz's team, which raised concerns regarding the use of personal accounts for official work and the potential disclosure of classified information.
- The Pentagon announced a review of defense secretary Pete Hegseth's use of the Signal app to share operational plans against the Houthis in Yemen.
Read Full Article
19 Likes
Securityaffairs
1w
51
Image Credit: Securityaffairs
Port of Seattle ‘s August data breach impacted 90,000 people
- Port of Seattle is notifying 90,000 people of a data breach after personal data was stolen in a ransomware attack in August 2024.
- The cyber attack in August 2024 disrupted travel plans and impacted websites and phone systems of the Port of Seattle, which also operates the Seattle-Tacoma International Airport.
- The Rhysida ransomware group was identified as behind the attack, and the Port confirmed that unauthorized actors accessed and encrypted parts of their computer systems.
- Approximately 90,000 people were impacted by the data breach, with personal information compromised, including names, dates of birth, Social Security numbers, and driver's license numbers.
Read Full Article
3 Likes
The Fintech Times
1w
153
Visa Adds Featurespace and AI-Powered Fraud Prevention Platform to Portfolio
- Visa has added the 'ARIC Risk Hub', an AI-powered fraud prevention platform, to its global value-added services portfolio.
- The platform, powered by Featurespace, leverages adaptive AI to build profiles around genuine customer activity, maximizing approvals and stopping fraud attempts in real time.
- Eika Gruppen, an alliance of 46 local banks in Norway, saw a 90% reduction in phishing losses after implementing the ARIC Risk Hub.
- The ARIC Risk Hub is available globally and offers businesses a new AI-powered tool to combat fraud and protect customers.
Read Full Article
9 Likes
Medium
1w
132
Image Credit: Medium
Behind the Lock: How SSL Keeps You Safe Online (For Those Who Don’t Know What That Means)
- SSL (Secure Sockets Layer) is a technology that ensures messages, passwords, and payment information stay private and safe from digital thieves.
- SSL consists of different sub-protocols, each with a specific role in keeping you safe online.
- The Record Layer chops and encrypts information to keep it secure during transmission.
- The Handshake Protocol verifies website authenticity and establishes a private communication channel.
Read Full Article
7 Likes
Cybersecurity-Insiders
1w
158
Image Credit: Cybersecurity-Insiders
Securely Deploying and Running Multiple Tenants on Kubernetes
- Kubernetes is being used to run multiple tenants within the same infrastructure, posing security and operational challenges.
- Considerations for deploying multiple tenants on Kubernetes include isolation, resource management, and regulatory compliance.
- Options for security include Namespace-Based Isolation, Cluster-Level Isolation, and Virtual Clusters.
- Namespace-Based Isolation involves logical boundaries, RBAC, network policies, and resource quotas.
- Cluster-Level Isolation assigns each tenant a dedicated Kubernetes cluster for strong isolation.
- Virtual Clusters provide tenant-specific control planes within a shared physical cluster.
- Proper multitenancy strategies are crucial to prevent security breaches, resource contention, non-compliance, and operational inefficiencies.
- Secure multitenancy consolidates workloads efficiently but requires addressing security challenges through best practices.
- Failure to secure multitenancy can lead to compliance violations and security gaps in Kubernetes environments.
- Author Ratan Tipirneni emphasizes the importance of implementing robust security measures for secure multitenant environments.
Read Full Article
9 Likes
TechBullion
1w
333
Image Credit: TechBullion
Why Automated Security Champions Could Be the Inflection Point DevSecOps Needed
- The DevSecOps movement has emphasized embedding security throughout the software development lifecycle for over a decade.
- Security champions, developers embedded within teams with a focus on security, have been seen as crucial but challenging to implement.
- Arnica has introduced 'Security Champions with Arnica' to automate the identification of security champions based on their behavior.
- Traditional methods of building security champions programs often lack scalability and struggle to show measurable impact.
- Arnica's approach shifts from manual nominations to behavior-based discovery, making the process objective and repeatable.
- This automation helps identify developers demonstrating secure behavior and engages them through existing tools like GitHub and Slack.
- The system creates a lightweight security mesh within engineering teams, distributing ownership of security effectively.
- Arnica ensures security champions handle issues within their codebases, making informed decisions and escalating when necessary.
- Developers benefit from Arnica's system without needing to use a separate UI, as all security-related actions happen in familiar tools.
- The platform also aids in career development by providing visibility to developers who actively engage in security tasks.
Read Full Article
20 Likes
For uninterrupted reading, download the app