Ivan Bütler

0.8 seconds to hack the gun safe: manager codes, encryption keys, and debug ports of the strongbox lock. 🗄️👨🏽‍🏭💥💵 Security experts Mark Omo and James Rowley shared their highly interesting research last week on safes from Liberty Safe - a US government contractor and a popular manufacturer of gun storage safes. The analog version of the lock was quite secure; researchers were unable to find any vulnerabilities there. But there is a digital version of the lock, named “Prologic” - and this part of the presentation is fun and full of very interesting bugs. Some interesting facts that caught my eye: 🗄️ In earlier versions of the locks, the master key was shared with law enforcement authorities. 🗄️ The person who sells or installs your safe will have a maager code to open it (in case you forget your code). At the end of the day, those safes are not very safe, huh? More detail: Cash, Drugs, and Guns: Why Your Safes Aren't Safe [PDF]: https://lnkd.in/dVJJvU2E #technology #guns #infosec #hacking #research #cybersecurity #embedded #future #safety #tech

465

49 Kommentare

Hacker group ShinyHunters claims to have breached Vietnam’s Credit Information Center (CIC), stealing up to 3 billion records including 160 million personal records. If confirmed, this is a wake-up call: centralized national databases are prime targets, but often the least defended. I’ve been warning about these vulnerabilities for years. Data isn’t gold. It’s radioactive. Valuable when handled with precision, catastrophic when leaked.

412

12 Kommentare

🚨 CVE‑2025‑54309: Critical Vulnerability in CrushFTP A high-severity vulnerability, CVE‑2025‑54309, has been identified in CrushFTP (versions prior to 10.8.5 and 11.3.4_23). When the DMZ proxy feature is not enabled, improper AS2 validation allows remote attackers to gain administrator access via HTTPS, and this flaw has been actively exploited in the wild. 💡 Why it matters: Exploiting this vulnerability could result in: * Full administrative takeover of CrushFTP servers. * Rapid lateral movement in environments with exposed file transfer infrastructure. 🛡️ Recommended actions: * Update CrushFTP immediately: Upgrade to version 10.8.5 (or 11.3.4_23 and above) to apply the security fix. * Enable DMZ proxy as a stopgap mitigation: If patching isn't yet feasible, placing CrushFTP behind a DMZ proxy reduces exposure to this vulnerability. We got your back! Use these scripts from the Vicarius research team: 🔍 Detection script: https://lnkd.in/ekmawXUs 🩹 Remediation script: https://lnkd.in/ekgx-Hiv Remediate CVE-2025‑54309 with #vRx by Vicarius: https://lnkd.in/dXedBin6

82

Ukrainian CERT is reporting APT28 malware that calls out to an LLM to autonomously guide cyber ops! The Russian malware uses a HuggingFace hosted Qwen-2.5-Coder-32B-Instruct instance to guide command execution, focused on gathering basic endpoint information and exfiltrating documents. LLM API keys are the next IOC? Certainly creates an interesting new detection surface. H/T Craig J. W. CC Adam Pennington, Jonathan Baker, Gianpaolo Russo, Christina Liaghati, PhD, Guido Zarrella https://lnkd.in/eKSKeZUm

327

7 Kommentare

We've published cheat sheets for the first three volumes of NIST's new Digital Identity Guidelines! If you're planning on reading SP 800-63-4, 63A-4, or 63B-4, visit the Trusted Cyber Annex site (link in the comments) and download our cheat sheets for free. They not only highlight the recommendations and other information that we think are the most important, but they also include the NIST definition of each term next to where that term is first used. These additions make the Digital Identity Guidelines easier and faster to absorb. Please spread the word about this work! We are 100% reader-supported, so we rely on you to help us reach the cybersecurity community. Thank you!

56

8 Kommentare

New CTI Labs: CVE-2017-1000353 Offensive and Defensive (October 2025 CISA KEV Additions) In October 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added five new vulnerabilities to its known exploited vulnerabilities catalogue, one of which was a critical 2017 vulnerability affecting Jenkins versions 2.56 and earlier and 2.46 LTS and earlier. This vulnerability allowed attackers to gain remote code execution on vulnerable instances. Why is this critical for you and your team? Jenkins is a widely used application. Shodan reports confirm that there are 000s of instances are exposed to the internet, with the vulnerable versions. With this vulnerability being a critical remote code execution vulnerability, the impact is significant. Understanding how to investigate logs for this attack and understanding how to successfully achieve exploitation is important for any team. Even though it's a 2017 vulnerability, it's very recent addition to CISA KEV illustrates just how significant it is, and that even today, attackers are using this vulnerability to gain footholds and compromise on vulnerable victims. Who is the lab for? SOC Analysts Incident Responders Penetration Testers Red Teamers Threat Hunters Here is a link to the Offensive lab: https://lnkd.in/eaFn4D-i Here is a link to the Defensive lab: https://lnkd.in/eEc6Z7Jj

27

AI Security Incidents forensics report A year or two ago we constantly heard the same question literally from everyone. "yeah, AI can be vulnerable but are there real incidents already?" we almost ended up paying cybercriminals to perform one ... oh cmon! just joking ;) Now especially last month news were bombarded with quite profound AI security incidents from Asana AI to the latest Amazon Q. It felt like someone in the galaxy knew that we are preparing a report and decided to add a few lines ;) Long story short, we at Adversa AI just released the Top AI Security Incidents (2025 Edition) — a detailed, real-world report that shows how AI systems are actually failing in practice, and what security teams can do to stop it. Show it to your CISO next time if he will ask about real AI attacks. From chatbots leaking personal info, to agents triggering unauthorized crypto transfers, to cross-tenant data exposure via MCP — the incidents are real, and the impact is serious. ↓ Some key points: — Prompt injection caused 35.3% of all documented cases. — Even simple prompts led to $100K+ in real losses. — GenAI was involved in 70.6% of incidents — but Agentic AI caused the most dangerous ones. — Many failures happened outside the model — in Models, memory, MCP and the logic between components. What’s inside: - Vivid visualizations to expose where AI systems are failing — by time, type, sector, and severity. - Data Across Layers: Timelines, exploit complexity matrices, and stack-wide failure maps reveal how attacks evolve - 17 real examples, clearly explained. - A look at how the attacks worked. - Steps teams can take to prevent similar issues. References to AI Security initiatives from OWASP GenAI Security Project , Coalition for Secure AI, Cloud Security Alliance, MITRE ATLAS. Steve Wilson, Christina Liaghati, PhD, Daniele Catteddu, Omar Santos, David LaBianca, Ken Huang, CISSP, Anton Chuvakin, Kapil R. R., Michael Coates → Download the full report: https://lnkd.in/dcFASFcG If you’re building, deploying, or protecting AI systems — this report is for you. Let me know what you think or feel free to share with others who might find it useful. #AIsecurity #GenAISecurity #AgenticAISecurity #CISO #AIRedTeaming #Cybersecurity

45

19 Kommentare