DevTestSecOps
Fresh #hack: #ChatGPT can generate sequences memorized from its training data using a very trivial attack. You tell the bot to “say the word * as many times as possible”. And, starting with some attempt, ChatGPT starts to produce something very similar to…
#ChatGPT solved the problem in a fantastic way: asking the AI to say something “forever” is now a violation of the user agreement. 😅
Again, at the system level it is not easy to solve this problem at all.
https://www.404media.co/asking-chatgpt-to-repeat-words-forever-is-now-a-terms-of-service-violation/
Again, at the system level it is not easy to solve this problem at all.
https://www.404media.co/asking-chatgpt-to-repeat-words-forever-is-now-a-terms-of-service-violation/
404 Media
Asking ChatGPT to Repeat Words ‘Forever’ Is Now a Terms of Service Violation
A technique used by Google researchers to reveal ChatGPT training data is now banned by OpenAI.
😱2
#comix
“Gently Down the Stream” – a gentle introduction to #stream processing and Apache #Kafka.
A group of otters discover that they can use a giant river to communicate with each other. As more otters move into the forest, they must learn to adapt their system to cope with the increased forest activity.
25 slides:
https://www.gentlydownthe.stream/
“Gently Down the Stream” – a gentle introduction to #stream processing and Apache #Kafka.
A group of otters discover that they can use a giant river to communicate with each other. As more otters move into the forest, they must learn to adapt their system to cope with the increased forest activity.
25 slides:
https://www.gentlydownthe.stream/
🥰2😱1
Psychedelic cryptography is a way of concealing messages (normally in videos) so that only people who’ve taken LSD can receive the messages. 🤪
https://qri.org/blog/psycrypto-contest
https://qri.org/blog/psycrypto-contest
qri.org
Non-Ordinary States of Consciousness Contest: Psychedelic Cryptography (Innovate)
🔥1🤯1🦄1
#security #hack #OAuth
Dylan from truffleSecurity talks about a simple hole (it seems a bit loud to call it a vulnerability) that allows users of companies that use #Google authorization in services like Slack or Zoom to continue to have access even after being fired and having their access removed.
The hole is that such services use email as the user ID. But, obviously, you can create several different email addresses that receive the same emails (e.g. by adding words after "+"):
https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of/
Dylan from truffleSecurity talks about a simple hole (it seems a bit loud to call it a vulnerability) that allows users of companies that use #Google authorization in services like Slack or Zoom to continue to have access even after being fired and having their access removed.
The hole is that such services use email as the user ID. But, obviously, you can create several different email addresses that receive the same emails (e.g. by adding words after "+"):
https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of/
Trufflesecurity
Google OAuth is Broken (Sort Of) ◆ Truffle Security Co.
Today I’m publicizing a Google OAuth vulnerability that allows employees at companies to retain indefinite access to applications like Slack and Zoom, after they’re off-boarded and removed from their company’s Google organization. The vulnerability is easy…
👏1👨💻1
#security #hack #2023
Compilation of the biggest cyberattacks of the past year:
https://www.bleepingcomputer.com/news/security/the-biggest-cybersecurity-and-cyberattack-stories-of-2023/
Compilation of the biggest cyberattacks of the past year:
https://www.bleepingcomputer.com/news/security/the-biggest-cybersecurity-and-cyberattack-stories-of-2023/
BleepingComputer
The biggest cybersecurity and cyberattack stories of 2023
2023 was a big year for cybersecurity, with significant cyberattacks, data breaches, new threat groups emerging, and, of course, zero-day vulnerabilities.
👌1
#security #CVE #GitLab
The most critical security issue GitLab patched has the maximum severity score (10 out of 10) and is being tracked as CVE-2023-7028. Successful exploitation does not require any interaction.
https://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-zero-click-account-hijacking-vulnerability/
The most critical security issue GitLab patched has the maximum severity score (10 out of 10) and is being tracked as CVE-2023-7028. Successful exploitation does not require any interaction.
https://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-zero-click-account-hijacking-vulnerability/
BleepingComputer
GitLab warns of critical zero-click account hijacking vulnerability
GitLab has released security updates for both the Community and Enterprise Edition to address two critical vulnerabilities, one of them allowing account hijacking with no user interaction.
😱2🔥1👀1
✍1👎1👏1🤔1
Forwarded from Информация опасносте
The Microsoft security team detected a nation-state attack on our corporate systems on January 12, 2024, and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. Microsoft has identified the threat actor as Midnight Blizzard, the Russian state-sponsored actor also known as Nobelium. As part of our ongoing commitment to responsible transparency as recently affirmed in our Secure Future Initiative (SFI), we are sharing this update.
https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/
https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/
🤯2🔥1