article thumbnail

Critical flaw in AI testing framework MLflow can lead to server and data compromise

CSO Magazine

The attacks can be executed remotely without authentication because MLflow doesn't implement authentication by default and an increasing number of MLflow deployments are directly exposed to the internet. It's pretty brutal." To read this article in full, please click here

CSO 111
article thumbnail

GUEST ESSAY: Leveraging ‘zero trust’ and ‘remote access’ strategies to mitigate ransomware risks

The Last Watchdog

As an enterprise security team, you could restrict internet access at your egress points, but this doesn’t do much when the workforce is remote. In short, anything accessible from the internet should be given extra attention. This disables peer-to-peer access, enabling internet-only access. Food for thought, eh!

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Podcast Episode 113: SAP CSO Justin Somaini and Election Hacks – No Voting Machines Required!

The Security Ledger

SAP CSO Justin Somaini. For consumers, that means boning up on account security – maybe getting a password manager. Somaini has the distinction of being the first CSO at Yahoo and also at Symantec. October is Cybersecurity awareness month.

CSO 40
article thumbnail

Facebook Removes Russia-based Internet Research Agency-Controlled Pages

Dark Reading

CSO Alex Stamos explains why the company deleted 70 Facebook and 65 Instagram accounts, and 138 Facebook pages.

CSO 43
article thumbnail

LW ROUNDTABLE: Cybersecurity takeaways of 2023 — and what’s ahead in 2024 ( part 2)

The Last Watchdog

“Kerberoasting” and “Golden Ticket” attacks were both introduced in 2014 and yet enterprises continue to have hundreds of accounts configured with unconstrained delegation. Richard Bird , CSO, Traceable AI Bird The bad guys are showing no restraint in exploiting API security weakness to their advantage.

article thumbnail

Malware disguised as ChatGPT apps are being used to lure victims, Meta says

CSO Magazine

Since March, Meta has discovered about 10 malware families using AI themes to compromise business accounts across the internet — including social media business accounts — and blocked over 1,000 unique ChatGPT-themed malicious URLs from being shared on its platforms. To read this article in full, please click here

Malware 106
article thumbnail

How API attacks work, and how to identify and prevent them

CSO Magazine

In early May, fitness company Peloton announced that it had exposed customer account data on the internet. Anyone could access users’ account data from Peloton’s servers, even if the users set their account profiles as private. The cause: a faulty API that permitted unauthenticated requests.