infosec
Imported tag from Readwise
infosec
For a long time, I thought the only way to run a successful pentesting practice was to have access to expensive tooling and software.
This is completely untrue. Here's what we use internally at @risk3sixty to run pentesting engagements (for little to no cost whatsoever):🧵
Fundamentally, the machine learning methodology used in modern AI systems is susceptible to attacks through the public APIs that expose the model, and against the platforms on which they are deployed. This report focuses on the former and considers the latter to be the scope of traditional cybersecurity taxonomies.
Apostol Vassilev • Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
If you don’t research why new mild anomalies happen, you deserve all the upcoming incidents.
Vicente Aceituno Canal • Cybersecurity Rules of Thumb
Attackers might be interested in learning information about the training data (resulting in DATA PRIVACY attacks) or about the ML model (resulting in MODEL PRIVACY attacks). The attacker could have different objectives for compromising the privacy of training data, such as DATA RECONSTRUCTION [89] (inferring content or features of training data), M
... See moreApostol Vassilev • Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
When we are lost, confused, or unsure, we generally look to others to see how they are acting for cues (social proof) for what we should be doing.
Christopher Hadnagy • Social Engineering
Recent advances in generative artificial intelligence have spurred developments in realistic speech synthesis. While this technology has the potential to improve lives through personalized voice assistants and accessibility-enhancing communication tools, it also has led to the emergence of deepfakes, in which synthesized speech can be misused to de
... See moreInformation Technology News -- ScienceDaily • Defending Your Voice Against Deepfakes
In other words, if the sympathy or assistance request is handled properly, the person being asked will have a strong emotional connection to that request. That connection can make it next to impossible for the person to refuse to help.
Christopher Hadnagy • Social Engineering
If any encryption algorithm is closely analyzed, weaknesses can be discovered. An algebraic attack exploits any mathematical weaknesses found in an algorithm, such as the original RSA algorithm always encrypting a ‘0’ as a ‘0’. An analytic attack looks for structural weaknesses in the algorithm, which is how 2DES was broken, and why we went from DE
... See more