Itamar Gilad

Model-Based Input Validation for Preventing Prompt Injection Attacks Join Hilik Paz - arato.ai at Conf42 Prompt Engineering 2024, kicking off today! RSVP: https://lnkd.in/eUfwzjRY.

2

1 תגובה

Another perfect example of the challenges in our CVE data/ecosystem: https://lnkd.in/e2kmCGin - Bug is difficult to reproduce, not clear whether it is exploitable anywhere at all - Bug was reported/discussed 6 years ago - CVE created 4 years ago - 3 years ago someone asks whether this was fixed - No activity since - CVE: Exists and gets reported by scanners.

5

Israeli Platform for Browser Security Raised $26 Million LayerX, an Israeli startup, raises $26 million for its enterprise browser extension. This Series A funding was led by Glilot+, the early-growth fund of Glilot Capital Partners, with participation from Dell Technologies Capital and other investors. The total investment reached $34 million. LayerX's Enterprise Browser Extension integrates with any browser and helps employes to secure their devices, identities, data, and SaaS apps from web-borne threats and browsing risks. "We’ve transformed workforce protection for organizations without requiring the transition to a dedicated secure browser. Unlike other solutions, installed in a matter of minutes, the LayerX Browser Extension does not impact employee efficiency, speed, privacy or the browsing experience,” said Or Eshed, co-founder and CEO, LayerX. LayerX was founded in 2022 by Or Eshed, CEO, and David Vaisbrud. LayerX employs 30 people, most of them in the R&D centre in Israel. Source: https://lnkd.in/d4uc269N

6

RedTeam Tips: Orchestrating Chaos, Evading Defense Culture Dive deep into the strategies and tactics of Red Teaming with experts from Amir Gholizadeh from Hadess | حادث and Nima D. from Nova Groups. Read now: https://lnkd.in/d2fnnSYq Shellcode to ASCII string API Testing Tip Wmiexec Evasion Exfiltration DNS Linux Binaries Nameless Excel Macro Hiding Malware Using Shadow Copy Usermode EDR hook bypass Process Instrumentation Callback Overpass-the-Hash Reconnaissance Tips Process Injections Local Code Injection DLL Injection Remote Thread Injection Thread Hijacking Classic APC Early Bird APC MapView Injection Binary Proxy Execution Active Directory Reversible Encryption RPC Payload development in smb or webdav amsi one line bypass Transfer Dns in Linux Execute the exfil command and transfer its information with icmp #redteam #hackthebox #activedirectory #networksecurity #hardening #microsoftad #redteamguide #edr #evading #activedirectorysecurity #cybersecurity #offensivesecurity #oscp #ecptx #crtp #crte #crto #crts #cyberwarfare

88

2 תגובות

Google is reportedly in advanced talks to acquire Israeli cloud security startup Wiz for approximately $23 billion. If finalized, this acquisition would be Google's largest to date, significantly boosting its cloud security capabilities. Wiz, known for its robust cloud-native application protection, has rapidly grown since its inception, securing substantial funding and high valuations. Google has a notable history of acquisitions, including the $12.5 billion purchase of Motorola Mobility in 2011 to enhance its hardware capabilities and the $5.4 billion acquisition of cybersecurity firm Mandiant in 2022 to strengthen its security portfolio. Cloud security has become especially important in recent years as companies have spent heavily to move data to cloud platforms. Just last week, AT&T revealed that nearly all of its wireless customers’ call and text records were exposed in a massive breach caused by an “illegal download” on a third-party cloud platform. #Google #Wiz #Acquisition #CloudSecurity #CyberSecurity #TechNews #MergersAndAcquisitions #Startup #Investment #Motorola #Mandiant #AT&T #DataBreach https://lnkd.in/g3ugGfMd

3

Missed Upwind's eBPF meetup? You can still view it 👀 🐝   Upwind's Tel Aviv meetup featured the following: ⏺ Peter McConnell diving into eBPF and Golang for libpam ⏺ Moshe Hassan provided insights into eBPF security applications and attacker perspectives If you missed the meetup and would like to learn more - we've got you covered. You can view the recording by clicking on the link at the bottom of the post, or view Peter McConnell's deep-dive blog on the topic. These resources will equip you with the fundamentals of eBPF, explore its practical applications in security, and demonstrate how it can elevate your security posture. You'll also see eBPF in action through real-world case studies. Up and Upwind! 🏄‍♂️ https://lnkd.in/ezYCZnXD https://lnkd.in/eMEenuCC https://lnkd.in/e97q_cND #eBPF #meetup #TelAviv #infosec #Golang #libpam #cloudsecurity   

26

1 תגובה

🛎️ 📟 AU10TIX, a well-known Israeli-based authentication company serving major brands like Uber, TikTok, and LinkedIn, recently faced a security incident. An inadvertent exposure of administration credentials online for over a year potentially risked user identity documents, including drivers' licenses. The exposed credentials, detected by a researcher and disclosed to 404 Media, unveiled a logging platform with sensitive data such as names, dates of birth, nationalities, identification numbers, and document images. The incident, believed to stem from an infostealer on a Network Operations Center Manager's device at AU10TIX, fortunately did not result in actual data misuse, as confirmed by the company. However, this event underscores the critical importance of handling authentication data securely, especially for a company entrusted with verifying identities for high-profile clients. AU10TIX promptly terminated the compromised system and informed its customers about the situation. Stay informed: [Link to the full report here.](https://lnkd.in/egxtnGQB) #databreach #

1

Upcoming Talk Alert! 🚀 14th of May at 19h00 (UCT+2) Join Mikhail Aksenov as he delves into common attack vectors like Postgres, Redis, SSH, and web vulnerabilities that could leave your servers at risk. Not just that, Mikhail will also show you how to detect these exploitations when immediate fixes aren't an option. Mikhail conducted a similar workshop for BSides Cape Town 2023 📎 👨‍💻 Ideal for entry-level blue team specialists looking to sharpen their defensive skills! #Cybersecurity #BlueTeam #EthicalHacking

9

In this KubeFM episode, Hillai and Ronen, security researchers at Wiz, explore the intricacies of hacking Alibaba Cloud's Kubernetes cluster. They share their experiences and insights on identifying and exploiting vulnerabilities, mainly focusing on misconfigurations and their impact on cloud security. You will learn: - How Hillai Ben Sasson and Ronen Shustin gained access to a Kubernetes cluster through a Postgres database. - How they moved laterally and managed to obtain push and pull rights to a private container registry. - Recommendations for securing multi-tenant Kubernetes clusters and maintaining environment hygiene. Watch (or listen to) it here: https://lnkd.in/gz53VRJn 🙏 Many thanks to Sysdig for supporting our work and sponsoring this episode. Make sure to check out their Kubernetes security checklist https://lnkd.in/gr-av-Yn With 🎙Bart "🤌" Farrell

28

3 תגובות

🚀 11 DAYS until Pentra launches! The wait is almost over! We’ve spent 8 months perfecting Pentra, an AI-powered platform designed to take the stress out of pentesting reports. No more painstakingly compiling data—Pentra tracks every action in real-time and automates the report creation process, making it faster and more accurate than ever. ⚡ Why Pentra? Imagine having all the time you’d normally spend on manual report writing, freed up to focus on what really matters: hacking. With Pentra, you can create detailed, professional pentest reports with just a few clicks. 🎉 Beta Launch Offer! Sign up for our beta today and unlock 1 full year of FREE access to Pentra’s report automation platform. Don’t miss this opportunity to transform the way you work: https://pentra.ai/#beta 💬 Join the Community Join our growing community of pentesters and cybersecurity professionals on Discord to stay ahead of the curve and be part of the conversation: https://lnkd.in/dCyV8wVU #CyberSecurity #DataProtection #InfoSec #CyberResilience #DigitalSecurity #Automation #TechInnovation #BusinessAutomation #AI #ProcessAutomation #BetaTest #EarlyAccess #JoinTheBeta

9

🚀✨ Exciting news alert for all my tech wizards! 🧙‍♂️ Say hello to Element Security, the Israeli startup that just emerged from stealth mode with a whopping $5 million in funding! 💸🛡️ Their secret weapon? The Continuous Threat Exposure Management (CTEM) solution. 🛡️🎉 🔍 What does this mean for the cybersecurity realm? Let's dive in: - **CTEM** – Fancy term, right? Think of it as your 24/7 guardian angel scanning the digital universe for threats. - **$5M Funding** – Cha-ching! Money talks, and it looks like investors are betting big on Element Security and its innovative approach. 🔮 Predicting the Future: - As cyber threats evolve, solutions like CTEM will be crucial for staying ahead of the game. - Element Security's funding success could pave the way for more startups to shake up the cybersecurity landscape. 🔥 Let's discuss: - How will CTEM impact threat management strategies in the long run? Share your thoughts! - With automation on the rise, how can #automatorsolutions play a role in enhancing cybersecurity measures? Stay ahead of the curve, techies! 🚀💻 #ainews #automatorsolutions #ElementSecurity #CTEM #CybersecurityInnovation #TechTrends Read more about it here: https://buff.ly/3MLJrFZ 📰 #CyberSecurityAINews ----- Original Publish Date: 2024-09-17 06:15

1

Eyal Rahimi, VP Engineering at MazeBolt, explains how Layer 3 DDoS attacks disrupt networks by exploiting key protocols like IP and ICMP. These DDoS attacks flood systems with traffic, overwhelming essential network functions. To defend against this, companies need advanced detection and mitigation strategies to ensure their infrastructure stays secure. Read the full blog to learn more: https://lnkd.in/dDmvwhGV #CyberAwarenessMonth #DDoSProtection #CyberSecurity #NetworkSecurity #Layer3 #DDoS #DDoSDefense #CyberThreats #Vulnerabilities 

8

Want to learn how the CVE-2024-38526 supply chain attacks could impact your Kubernetes infrastructure?? Read all about it in our blog: https://shorturl.at/ZfHrK Nadav Aharon-Nov #kubernetes #security

7

📈 As data volumes grow and structures become increasingly complex, accurately classifying sensitive data is more crucial than ever. In this new article, our Data Scientist, Hanan Zaichyk, dives into Sentra's comprehensive approach to data classification and sensitivity estimation.   Learn how techniques such as our zero-shot classification ensure precise handling of sensitive data, empowering security teams to streamline processes and save time. Keep your data secure at scale. Read more here 👇

16

6 תגובות