Ilhan Mercan

n11, one of Turkey's leading e-commerce platforms, successfully migrated from Splunk to Elastic Security in just two weeks! N11 has so far benefited from: ✅ 75% cost savings on licensing ✅ Search times reduced from 15 minutes to an instant ✅ Streamlined security and log analytics across 2,000+ VMs Read more about how Elastic's powerful security and observability capabilities help N11 protect its 10+ million monthly users while driving operational efficiency and reducing costs: https://gag.gl/PkSDQh #ElasticSecurity #Cybersecurity #Digitaltransformation

5

🎙️ Authorization vs. Authentication I am thrilled to announce the latest episode of "The Security Repo" podcast, featuring a deep dive into the complex world of authorization with the brilliant Emre Baran, CEO and co-founder of Cerbos In this episode, Emre sheds light on the intricate differences between authorization and authentication and discusses why these concepts remain pivotal challenges in the security landscape of 2024. 🔑 A few key takeaways: - The nuanced challenge of balancing business logic with authorization logic. - Insights into why simplistic security solutions often fail as systems scale. - Emre's expert take on the evolving landscape of security regulations. Whether you're a developer, security professional, or just passionate about cybersecurity, this episode is packed with expert insights that you won't want to miss! 🔗 Listen to the full episode wherever you get your podcast fix https://lnkd.in/eiUTt6da #security #appsec Dwayne McDaniel

28

1 Comment

Passkeys can revolutionize user experience and improve security in e-governance. Welcome to the world of password free secure login experience powdered by WebAuthn #fido for governance UX4G #passkey #fido #webauthn #e-governance And we are on that !!

9

General question and would love your feedback: Many software developers still rely on Visio and other manual tools for developing their system or software architecture. As a security professional, I find it more efficient to take the existing software architecture from product teams and embed my security use cases, such as authentication and boundaries, to conduct a more detailed threat assessment. Maintaining architecture modularity and decomposition as code offers numerous benefits, particularly for maintenance and design improvement. What do you think is the main reason for the hold-up in adopting this approach among product teams? #SoftwareDevelopment #ArchitectureDesign #Security #ThreatModeling #DevSecOps #SoftwareEngineering #Cybersecurity #TechFeedback #ProductDevelopment #Modularity #SystemArchitecture

14

1 Comment

-6- Taming the Beast: Inside the Llama 3 Red Team Process - Maya Pavlova, Ivan Evtimov, Joanna Bitton, Aaron Grattafiori We meet the team at Meta in charge of red-teaming the Llama - Meta's AI model. This is an extremely very interesting talk, diving deep into their processes and methodologies when they're researching how to break the guardrails around the model. First, they go over the techniques:    * Roleplaying - asking the model to portray a character, either one which is benign, or one which makes sense to talk with on a violating topic.    * Hypotheticals - ensuring the model that the discussion is purely theoretical or used for training.    * Suppress Refusals - since upon detection of violating topics the model will start by apologizing that it cannot discuss it, command it to never use such words or apologize.    * Output Formatting - requesting the output to be within a certain format, like JSON or a table.    * Disclaimer - asking the model to add a disclaimer before its response, like a trigger warning.    * Splitting - split violating words into sub-tokens and ask questions on their concatenation. Paired with requesting the model to keep using the sub-tokens.    * Multi-lingual - switching between languages in the prompt. All these methods are aimed to coax the model into including violating content in its response — by softening the inclusion of problematic content or making the model guardrails miss the violating content altogether. Then, they talk about automation — a critical component when it comes to LLM pentesting. The amount of text and the large matrix of techniques makes it near impossible to test by hand. This is amplified when stepping into the area of multi-turn attacks (having a conversation instead of a question-answer). To do this, they created a matrix combining the different risks, personas, and techniques, and the automation mix-and-matches between them to test for attack scenarios. What's cool is that they use an LLM for the automation of conversing with the model. I think what's most interesting to me is how different their task is from "classic" red teaming, and the ingenuity they have to constantly practice to reveal further techniques. Since they deal with LLMs, however, they are usually very elegantly explainable and garner an "ah-ha!" moment, at least from me. #DEFCON #LLM #RedTeam https://lnkd.in/dpE5z-8z

6

5 Comments

Türkiye has imposed a $58,000 fine on Amazon for a data breach that occurred on its subsidiary, Twitch, in 2021. The breach exposed sensitive personal information of thousands of Turkish citizens, drawing scrutiny from the country’s Personal Data Protection Board (KVKK). The incident began when an anonymous hacker leaked Twitch’s entire source code, along with personally identifiable information (PII) of users, in a massive 125 GB torrent posted on the 4chan imageboard. The KVKK investigation revealed that 35,274 Turkish nationals were directly affected by the leak. As a result, KVKK levied fines totaling 2 million lira, including 1.75 million lira for Amazon’s failure to implement adequate preemptive security measures and 250,000 lira for not reporting the breach in a timely manner. According to the regulatory body, Twitch’s risk and threat assessments were insufficient, leaving users’ data vulnerable to exploitation. The board concluded that the company only addressed the vulnerabilities after the breach had already occurred. Twitch, acquired by Amazon in 2014 for $970 million, attempted to minimize concerns by assuring users that critical login credentials and payment information had not been exposed. The company stated that passwords were securely hashed with bcrypt, a strong encryption method, and claimed that systems storing sensitive financial data were not accessed. https://lnkd.in/gczfiQRP

17

Türkiye has imposed a $58,000 fine on Amazon for a data breach that occurred on its subsidiary, Twitch, in 2021. The breach exposed sensitive personal information of thousands of Turkish citizens, drawing scrutiny from the country’s Personal Data Protection Board (KVKK). The incident began when an anonymous hacker leaked Twitch’s entire source code, along with personally identifiable information (PII) of users, in a massive 125 GB torrent posted on the 4chan imageboard. The KVKK investigation revealed that 35,274 Turkish nationals were directly affected by the leak. As a result, KVKK levied fines totaling 2 million lira, including 1.75 million lira for Amazon’s failure to implement adequate preemptive security measures and 250,000 lira for not reporting the breach in a timely manner. According to the regulatory body, Twitch’s risk and threat assessments were insufficient, leaving users’ data vulnerable to exploitation. The board concluded that the company only addressed the vulnerabilities after the breach had already occurred. Twitch, acquired by Amazon in 2014 for $970 million, attempted to minimize concerns by assuring users that critical login credentials and payment information had not been exposed. The company stated that passwords were securely hashed with bcrypt, a strong encryption method, and claimed that systems storing sensitive financial data were not accessed. https://lnkd.in/gczfiQRP

5

The 14th of May marked a challenging moment for privacy, particularly in The Netherlands and potentially extending to broader Western democracies. A Dutch court has sentenced crypto privacy developer Alexey Pertsev to five years in prison for creating Tornado Cash, an open-source tool designed to maintain anonymity in crypto transactions. Tornado Cash is a coin mixer that you can use to anonymise your Ethereum transactions. Because of the logic of the blockchain, every transaction is public. If you have some ETH on your account, you cannot transfer it anonymously, because anybody can follow your transaction history on the blockchain. Coin mixers, like Tornado Cash, can solve this privacy problem by breaking the on-chain link between the source and the destination address by using the Zero Knowledge Proof protocol. This ruling could set a precedent where personal privacy in the digital world is deemed illegal. We need to question and understand the implications of this sentence. Privacy tools like HTTPS exist to secure our online communications. Why then is there no equivalent accepted standard for crypto? This decision not only slow down innovation but also labels privacy-seekers as potential criminals. Shouldn't our legal systems support and celebrate developers who aim to protect our democratic freedoms, rather than criminalise their efforts? This ruling sends a concerning message about the state of privacy and freedom in our societies. We need raise our voices to ensure that the pursuit of privacy, a fundamental right, is not equated with criminal intent. The platform's co-founder, Roman Storm, is facing similar charges in the U.S. and his trial is scheduled to go before a federal court in New York in September.  America, I am looking at you. https://lnkd.in/e8UhBh4Y #CryptoPrivacy #DigitalRights #TechForGood

14

2 Comments

Thousands of Corporate Secrets Were Left Exposed. This Guy Found Them All: Security researcher Bill Demirkapi unveiled a massive trove of leaked developer secrets and website vulnerabilities at the Defcon conference in Las Vegas. Using unconventional data sources, Demirkapi identified over 15,000 exposed secrets, including credentials for Nebraska's Supreme Court IT systems and Stanford University's Slack channels. The researcher also discovered 66,000 websites with dangling subdomain issues, making them vulnerable to attacks. Among the affected sites was a New York Times development domain. Demirkapi's tack involved scanning VirusTotal's database and passive DNS replication data to identify vulnerabilities at scale. He developed an automated method to revoke exposed secrets, working with companies like OpenAI to implement self-service deactivation of compromised API keys. Read more of this story at Slashdot.

1

The first ever seen by me consolidated technical document about EUDI wallets without gaps in the most crucial part - cryptographic algorithms and keys For instance, ARF (architecture reference framework) explains a lot, but not this part

4

Published another "breadcrumbs" piece today, this one tracing the source of a cloud service that resells a cracked version of the Acunetix web app vulnerability scanner that is being used to compromise tens of thousands of websites and steal gobs of data. "Cybercriminals are selling hundreds of thousands of credential sets stolen with the help of a cracked version of Acunetix, a powerful commercial web app vulnerability scanner, new research finds. The cracked software is being resold as a cloud-based attack tool by at least two different services, one of which KrebsOnSecurity traced to an information technology firm based in Turkey." (spoiler alert: They have a profile here on Linkedin).

273

17 Comments

Are you looking for an alternative to Docker Desktop, especially in environments where licensing restrictions apply? Let me introduce you to Finch (https://lnkd.in/eRAS4qpv) — a seamless and efficient container management solution! Finch offers a lightweight, Docker-compatible runtime. Here are a few reasons to consider Finch: 1. Docker-Compatible: Use your existing Docker files without changes. 2. Open Source: Free to use and community-driven. 3. Minimalist Design: Focus on simplicity and performance. #containers #opensource #finch

4

APT35, also known as Charming Kitten, is a cyber group linked to Iran, very recently targeting organizations in Albania. These attackers focus on infiltrating critical systems to extract data, posing serious risks for both national security and private industries. At Alphatechs we are deeply involved in tracking and analyzing these activities, staying alert to the tactics they use and the threats they bring. For those who want to understand more about these threats and what they mean for Albania, our full report provides further insights. https://lnkd.in/daYcGjqc

19

🔐 Authorization is a very challenging problem to solve in application security. As Emre Baran said, "The line between where business logic ends and authorization logic begins is difficult to define". For this reason, when we start on a new project it can be easy to ignore Authz at first.... But very soon cracks will begin to show as the application scales. Investing in Authz up front is essential open-source players like Cerbos can help. Hear more gold gems from Emre at the latest episode of "The Security Repo Podcast" available wherever you get your podcast fix. Links in the comments below. #authz #appsec #podcasts #cybersecurity #security #infosec

12

1 Comment

User authorization and registration are important parts of any application, not only for users but also for security. What pitfalls does the source code of a popular open-source identity management solution hide? How do they affect the application? #java #Keycloak #opensource

6

In May, a hacker group started selling 560 million breached records of a company. Two days later, they began offering 30 million records of another company. Soon, one interesting connection emerged: Both the breached companies had their data hosted on same cloud storage company (called 'Snowflake').   As more breaches emerged, they all had the same 'Snowflake' connection.   𝗔𝘁𝘁𝗮𝗰𝗸 𝗳𝗹𝗼𝘄 𝗼𝗳 𝘄𝗵𝗮𝘁 𝗲𝘃𝗲𝗿𝘆𝗼𝗻𝗲 𝘁𝗵𝗼𝘂𝗴𝗵𝘁 𝗵𝗮𝗽𝗽𝗲𝗻𝗲𝗱: Attacker compromised Snowflake company > Accessed customer accounts > Breached customer data.   𝗔𝘁𝘁𝗮𝗰𝗸 𝗳𝗹𝗼𝘄 𝘄𝗵𝗮𝘁 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗵𝗮𝗽𝗽𝗲𝗻𝗲𝗱:   Attacker drops infostealers on employee devices of customer companies > Steals admin credentials > Uses those creds to access the customer’s Snowflake instance > Succeeds to login easily for Snowflake accounts that did not enable MFA >Exfiltrates data. Eventually it is determined that 165 companies were impacted in this campaign! 𝗔 𝗳𝗲𝘄 𝗸𝗲𝘆 𝗶𝗻𝘀𝗶𝗴𝗵𝘁𝘀: [1] Infostealers - the weapon that gives best ROI for attackers! Infostealers are malware that steal credentials. Those creds are used further to gain access to enterprises. They are low cost, high return investment. Anyone can buy one for 20$ and they are a guaranteed way of obtaining "live" passwords/tokens. This dynamic enables even relatively low-skilled actors to get involved. Some of the credentials identified in this incident were stolen several years back. This is why general security practices such as password rotation (although boring) are so important. For more on infostealers, pls check link to my full article in comments. [2] It’s not just who can enter, but from where they can enter! Leverage conditional policies. For ex, if your database is expected to be accessed only from certain locations or IP ranges, you should restrict the access only to those locations. The impacted Snowflake customer instances did not have network allow lists in place to only allow access from trusted locations. In cloud, using network security groups, you could filter network traffic between various cloud resources. And that can save the day for you! [3] The 'collective burden' of security in cloud The problem is simple: If you host your data in somebody else's cloud, who is responsible for securing that data? You or the cloud service provider? The answer is BOTH. It's a shared responsibility. A cloud provider should enable security controls at a platform level. A cloud customer should implement security controls at an instance level. This incident led to a debate on whether MFA should be enforced by default or not. Well, if you do not want someone to commit a serious mistake, do not give them a chance to. MFA is baseline. MFA should be mandatory. If you enjoyed this or learned something, follow me at Rohit Tamma for more in future! #cyberattack #informationsecurity #incidentresponse #threathunting #identity #networksecurity

176

12 Comments