L’habit ne fait pas le moine. Personne n’a forcé la moindre porte. Personne n’a injecté le moindre virus. Entre le 11 et le 12 septembre, quelqu’un a simplement écrit à Revolut depuis une adresse qui avait toutes les apparences de la légitimité. La néobanque a répondu comme on répond à une autorité qu’on ne songe pas à contredire. Résultat : passeports, selfies de vérification et historiques de transactions Bitcoin de clients fortunés se sont retrouvés entre les mains d’inconnus. Aucun pare-feu n’a eu son mot à dire. Les points clés de cet article : Revolut a été victime d’une escroquerie sophistiquée où une adresse mail légitime a été utilisée pour obtenir des données sensibles de clients fortunés. Les informations volées incluaient des passeports, des selfies de vérification et des historiques de transactions Bitcoin, exposant les clients à des risques physiques. SwissBorg, la fintech suisse régulée pour investir dans la crypto. Créez votre compte et gagnez jusqu'à 50€ dès 100€ de transaction en entrant le code JournalDC ! Rejoindre SwissBorg Lien commercial Revolut a cru parler à l’État, et l’État n’y était pour rien Qu’est ce que l’ingénierie sociale ? L’ingénierie sociale, c’est l’art de pirater une personne plutôt qu’une machine. Au lieu de forcer un mot de passe ou d’exploiter une faille logicielle, l’attaquant manipule la confiance. Il se fait passer pour une autorité légitime comme un service client, une banque, ici carrément une agence gouvernementale. L’objectif ? Convaincre sa cible de lui livrer elle-même l’information ou l’accès recherché. Le principe existe depuis bien avant l’informatique. Mais le numérique l’a rendu redoutablement efficace : un e-mail bien construit, envoyé au bon moment depuis la bonne adresse, coûte infiniment moins cher qu’un audit de sécurité pour percer les défenses techniques d’une entreprise. Revolut, victime d’un accès jugé légitime Dans le cas Revolut, l’ingénierie sociale a pris une forme particulièrement vicieuse. L’attaquant n’a même pas eu besoin d’imiter une adresse : il disposait d’un accès réel à l’intérieur du domaine mail d’une agence gouvernementale. Conséquence : une demande frauduleuse jugée indiscernable d’une vraie réquisition légale par les équipes de conformité de Revolut. L’incident tombe à un moment particulièrement sensible pour la néobanque. Revolut a obtenu en août 2026 son agrément bancaire complet en France, quelques mois après celui décroché au Royaume-Uni. La néobanque explorerait par ailleurs une entrée en bourse à une valorisation comprise entre 150 et 200 milliards de dollars selon TechCrunch, contre 75 milliards lors de sa dernière levée privée. Une trajectoire financière que ce genre de fuite de données n’aide certainement pas à sécuriser. Un mécanisme qui a berné tous les contrôles Le mécanisme mérite qu’on s’y attarde, parce qu’il ne ressemble à aucune fuite classique. L’attaquant n’a pas usurpé un nom de domaine ni bricolé un en-tête falsifié. Il disposait d’un accès à une boîte mail non autorisée, mais logée à l’intérieur de l’infrastructure réelle d’une agence gouvernementale. Le mail passait donc tous les contrôles d’authenticité, au sens le plus strict du terme. Le protocole SPF vérifie que le serveur expéditeur est bien habilité à envoyer au nom du domaine. DKIM garantit, de son côté, que le contenu n’a pas été modifié en chemin. DMARC, enfin, arbitre les deux. Les trois ont donné leur feu vert, comme le détaille The Block. Le message venait en effet authentiquement de l’intérieur du domaine visé. Revolut n’a flairé l’entourloupe qu’après coup, en recontactant l’agence elle-même, qui a répondu, gênée, n’avoir rien demandé. Contactée par la presse, la néobanque n’a pas cherché à minimiser l’affaire : « Une escroquerie sophistiquée par usurpation externe. » Revolut à TechCrunch SwissBorg, la fintech suisse régulée pour investir dans la crypto. Créez votre compte et gagnez jusqu'à 50€ dès 100€ de transaction en entrant le code JournalDC ! Rejoindre SwissBorg Lien commercial La riposte de Revolut face à l’ampleur du vol Rien de plus, rien de moins. Revolut assure avoir bloqué l’adresse compromise, alerté dans la foulée l’agence visée, la police ainsi que les régulateurs financiers. La néobanque affirme par ailleurs que les systèmes et les fonds des clients restent intacts. Ni le nom de l’agence usurpée ni le nombre exact de clients touchés n’ont filtré. Revolut parle d’un périmètre limité. Le chercheur en sécurité ZachXBT, qui a le premier diffusé la notice client sur son canal Telegram, livre toutefois une lecture plus inquiétante. Selon lui, l’attaque semble avoir ciblé en priorité des utilisateurs fortunés, et non une liste de clients au hasard. Extrait de la notice envoyée par Revolut aux clients concernés, détaillant les catégories de données exposées. Source : notice client Revolut, relayée par Mark Karpelès et ZachXBT, 12 septembre 2026. « Ce qui s’est passé ? Revolut a reçu une demande d’informations clients qui semblait provenir d’une agence gouvernementale légitime. La demande émanait d’un compte e-mail non autorisé, envoyée directement depuis le domaine e-mail officiel de l’agence gouvernementale. Comme la communication portait des identifiants d’authentification de domaine valides, elle a été traitée en toute bonne foi, dans la conviction raisonnable qu’il s’agissait d’une demande authentique émanant d’une agence gouvernementale. Détails d’identité : nom complet, date de naissance, profession Coordonnées : adresse postale, adresse e-mail et numéro de téléphone Documents et données de vérification : une copie du document d’identité (passeport et/ou permis de conduire) et l’image de vérification faciale (le selfie fourni pour la vérification). À noter qu’aucune donnée de télémétrie faciale biométrique n’a été impliquée ni compromise Données financières : relevés de compte (dont IBAN, statut du compte, date d’ouverture, numéro de référence du wallet), historiques de retraits et historique complet des transactions (y compris Bitcoin).» Un butin en Bitcoin taillé sur mesure pour l’extorsion physique Le tiroir ouvert par ce faux e-mail n’a rien d’anodin dans son contenu. Il contient : des copies de passeport ou de permis de conduire, des selfies de vérification d’identité, des relevés de compte, un IBAN, les historiques de retraits et de transactions au comptant, dont l’activité Bitcoin des clients concernés. Mark Karpelès, ancien patron de Mt. Gox, a publié dès le 12 septembre des extraits de la notification qu’il avait reçue en tant que client touché. Il confirme que son propre historique de transactions figurait dans le lot. Une adresse postale, une identité vérifiée et un solde en Bitcoin connu : voilà de quoi construire un dossier presque complet sur une cible. C’est bien là que le dossier prend une tournure différente d’une fuite de données ordinaire. Un cours qui plonge se corrige en quelques séances. En revanche, une donnée d’identité, non. Couplée à un solde en Bitcoin avéré, elle reste vraie pour toujours, sans date de péremption. Marc Zeller, fondateur de l’Aave Chan Initiative, lui-même touché, a résumé l’ironie du dossier en une phrase sur X : « Réveil difficile, toutes mes données ont fuité chez Revolut. Un rappel cinglant que le KYC n’a jamais produit le moindre bénéfice tangible, et qu’il a mis beaucoup de monde en danger. » Rien n’a été confirmé, en revanche, sur une éventuelle indemnisation ou sur la liste précise des personnes prévenues. Woke up to all my data leaked by @Revolut.Sharp reminder that KYC hasn’t produced meaningful upside and has put many in harm’s way. pic.twitter.com/RimOBQr7DW— Marc Zeller (@mzeller) September 12, 2026 En France, ce genre de fuite ne reste jamais théorique Exposer une activité Bitcoin, ce n’est pas juste embêtant. C’est un problème de sécurité physique immédiat, et la France en sait quelque chose. Le pays concentre à lui seul l’écrasante majorité des cas mondiaux d’agressions violentes visant des détenteurs de cryptomonnaies, ce qu’on appelle par euphémisme les « wrench attacks ». Le Journal du Coin en avait déjà chiffré la hausse de 33 % au premier semestre 2026. Le ministre de l’Intérieur Laurent Nuñez a chiffré le phénomène fin juin : 77 enlèvements et extorsions liés aux cryptoactifs recensés en France depuis janvier 2026, contre 45 sur l’ensemble de 2025. Un dispositif d’alerte lancé au printemps a déjà permis près de 200 interpellations, préventives ou après les faits. Le rythme s’accélère, et chaque fuite de données comme celle de Revolut vient nourrir un peu plus le vivier de cibles potentielles. SwissBorg, la fintech suisse régulée pour investir dans la crypto. Créez votre compte et gagnez jusqu'à 50€ dès 100€ de transaction en entrant le code JournalDC ! Rejoindre SwissBorg Lien commercial Des enlèvements bien réels, pas une hypothèse Des séquestrations, parfois des amputations de doigts filmées pour forcer un virement, menées contre des gens dont l’adresse et le patrimoine numérique avaient fuité quelque part. Rien d’hypothétique. Un couple ligoté à Alès en présence d’un enfant, une famille tuée au Mexique pour un wallet supposé contenir des millions : la mécanique est toujours la même, une donnée volée devient une adresse à visiter. Et ce scénario ne demande pas un piratage spectaculaire pour s’enclencher. Il se nourrit justement de fuites comme celle-ci, où l’identité complète d’un client rejoint son historique de transactions dans un même document. Le précédent le plus cité par les chercheurs reste la fuite Ledger de 2020, qui avait exposé plus de 270 000 clients dans le monde. Pendant des années, ces données ont servi de vivier pour des listes vendues quelques centaines de dollars sur le dark web. Leurs acheteurs pouvaient ainsi cibler de vrais détenteurs de cryptomonnaies plutôt que des inconnus au hasard. Coinbase avait déjà trébuché sur la même faille Revolut n’invente rien de nouveau dans le genre de défaillance qu’elle vient d’essuyer. En mai 2025, Coinbase reconnaissait que des agents de support corrompus, en Inde, avaient vendu les données de près de 70 000 clients pour quelques centaines de dollars pièce. Une tentative d’extorsion a même suivi, à hauteur de 20 millions de dollars. La facture totale, procès et remboursements compris, a dépassé les 400 millions de dollars. En comparaison, Coinbase avait perdu des clients par la corruption d’un sous-traitant, Ledger par une base mal protégée. Rien de tel chez Revolut. Il n’y a eu ni employé corrompu ni serveur mal configuré, seulement un mail qui avait l’air vrai, envoyé depuis un endroit qui, techniquement, l’était. Le vrai maillon faible reste humain C’est peut-être le vrai enseignement de l’histoire. Le maillon faible du secteur n’a jamais été la blockchain elle-même, ni même les protocoles d’authentification des e-mails : ceux-ci ont fonctionné exactement comme prévu, du premier au dernier octet. Le maillon faible, c’est l’humain de l’autre bout — celui qui reçoit une requête cochant toutes les cases officielles. Il n’a, au fond, aucun moyen simple de savoir si la personne qui l’envoie a réellement le droit d’être là. Face à ce genre d’attaque, aucun audit de sécurité informatique ne remplace un simple coup de fil de vérification, passé avant d’ouvrir le dossier KYC plutôt qu’après. Pour les clients français concernés, une option concrète existe : saisir directement la CNIL, compétente en cas de violation de données personnelles au titre du RGPD. Cette démarche reste possible indépendamment des démarches déjà engagées par Revolut auprès des régulateurs financiers. Rejoignez SwissBorg et découvrez une autre façon d'investir dans la crypto. Interface fluide, agrégateur qui balaie plusieurs exchanges pour vous obtenir le meilleur prix, cadre régulé européen : tout est pensé pour durer. Et pour commencer du bon pied, le code JournalDC vous rapporte jusqu'à 50 € dès 100 € de transaction. Récupérer mon bonus Lien commercial L’article Adresses Bitcoin et identité : Revolut victime d’ingénierie sociale est apparu en premier sur Journal du Coin.

So, I see crazy amount of code being generated with AI, also the inflated PR description. How are all appsec folks keeping up with it? I feel the old school manual code review (small incremental change written by a human - change is small enough that PR is easy to understand and you can review source/sinks, authn, authz, etc.) is no longer relevant. With the amount of code being generated and the pace the leaders expect from its engineers (AI can write everything so ship fast), there is lot of work to do from security standpoint. I know some of u would say I should use AI too. But claude is so fuc*king sloppy lot of times. (Yes, correction from previous conclusion, you are right I am wrong). submitted by /u/NaturalManufacturer [link] [comments]

Hey, I wanted to ask for some guidance. I’ve recently gotten back into pentesting after around 7–8 months and I’ve been doing CTFs again. I’m still able to solve CTFs and I understand the vulnerabilities and their nuances once I’m working on them. The main thing I’m struggling with right now is the approach to a black-box pentest. When I’m looking at a large application with a lot of endpoints, directories, parameters and different functionalities, I sometimes struggle with figuring out what I should be testing where and how I should think about the application as a whole. I know the vulnerabilities themselves but I don’t always naturally make the connection between a particular feature and the potential vulnerabilities I should investigate there. A lot of the time when I see a solution afterwards I realize that I knew about the vulnerability but simply didn’t think of that angle while testing. So I wanted to understand how you personally formulate your approach when starting a black-box pentest. How do you break down a large application? How do you decide what areas to prioritize? And more importantly how do you systematically think through each functionality and generate hypotheses for what could go wrong rather than just going through a checklist of vulnerabilities? I’m trying to rebuild that ability to think well around the entire application rather than just knowing individual vulnerabilities. Would really appreciate any advice or framework you use for approaching black-box assessments. submitted by /u/Weak_Cry8172 [link] [comments]

Cross-check the views of your attack surface and find the endpoints that cannot corroborate each other.

Open-source platform to secure and manage endpoints via MDM, patch management, software deployment, and osquery-powered visibility with compliance and vulnerability monitoring.

Punti chiave da ricordare Il rilevamento e la risoluzione degli incidenti sono solo il punto di partenza. La direttiva NIS2 impone alle organizzazioni di indagare, ricostruire gli eventi e produrre rapporti difendibili. La direttiva NIS2 estende la responsabilità in materia di sicurezza informatica ai settori essenziali e importanti dell’UE, con scadenze di segnalazione degli incidenti comprese tra le 24 e le 72 ore, mentre alcuni paesi impongono scadenze ancora più strette. Gli enti essenziali rischiano multe fino a 10 milioni di euro o al 2% del fatturato globale (a seconda di quale sia l’importo più elevato), mentre gli enti importanti rischiano multe fino a 7 milioni di euro o all’1,4%. La direttiva NIS2 introduce requisiti di sicurezza informatica più rigorosi in tutti i settori essenziali e importanti, estendendo la responsabilità oltre la prevenzione e il rilevamento fino alla risposta, all’indagine e alla segnalazione. Le organizzazioni e gli enti del settore pubblico nell’UE o che forniscono servizi a enti dell’UE sono ora tenuti a: Rilevare e rispondere rapidamente agli incidenti Comprendere cosa è successo, come è avvenuto e quali dati sono stati interessati Segnalare entro 24 ore (allerta precoce) e 72 ore (aggiornamento dettagliato) Garantire la verificabilità e la difendibilità delle proprie azioni Ciò crea una notevole urgenza ed evidenzia una lacuna che molte organizzazioni non sono in grado di colmare: condurre indagini approfondite e difendibili su endpoint, cloud e dispositivi mobili. È qui che le moderne capacità di informatica forense digitale e risposta agli incidenti (DFIR) diventano essenziali. Che cos’è la NIS2? La direttiva NIS2 è una normativa sulla sicurezza informatica a livello dell’UE che sostituisce la direttiva NIS originale del 2016. Il suo obiettivo è stabilire uno standard comune di sicurezza informatica in tutti gli Stati membri dell’UE e affrontare la crescente portata e sofisticazione delle minacce informatiche che prendono di mira le infrastrutture critiche e i servizi digitali. La NIS2 amplia la portata della direttiva originale per coprire un maggior numero di settori, introduce obblighi più rigorosi in materia di segnalazione degli incidenti e attribuisce alla dirigenza la responsabilità diretta dei rischi legati alla sicurezza informatica. Che cosa sono la digital forensics e la risposta agli incidenti (DFIR)? Il rispetto dei requisiti della NIS2 in materia di indagini e reportistica difendibile dipende da una capacità in cui molti team di sicurezza investono troppo poco: la DFIR. La digital forensics e la risposta agli incidenti (DFIR) sono discipline complementari che consentono alle organizzazioni di contenere rapidamente le minacce, preservando al contempo i dati necessari per comprenderne e ridurne l’impatto. La risposta agli incidenti si concentra sull’individuazione, il contenimento e la risoluzione degli incidenti di sicurezza. Il suo obiettivo è limitare i danni e ripristinare le operazioni il più rapidamente possibile. La digital forensics si concentra sull’indagine degli incidenti attraverso la raccolta, l’analisi e la conservazione delle prove digitali. Consente ai team di ricostruire gli eventi, determinare la causa principale e comprendere la portata completa dell’impatto, con risultati in grado di supportare i requisiti normativi, legali e assicurativi. Le funzionalità DFIR consentono alle organizzazioni di: Identificare le tracce lasciate dagli autori delle minacce attraverso l’analisi dei dati storici (ad es. malware, script, e-mail) Condurre attività di ricerca delle minacce e di corrispondenza dei modelli (ad es. utilizzando YARA o cercando identificatori per parola chiave) Ricostruire una cronologia degli eventi difendibile a fini di reporting e audit Perché ho bisogno di una soluzione DFIR se dispongo già di un sistema EDR/XDR? Le soluzioni DFIR ed EDR/XDR si integrano a vicenda e sono entrambe essenziali per un piano completo di risposta agli incidenti. Le soluzioni EDR/XDR forniscono preziosi dati di telemetria e avvisi che aiutano a individuare tempestivamente gli incidenti di sicurezza, i quali possono poi essere ulteriormente indagati e convalidati attraverso i processi DFIR. Ma il rilevamento è solo il primo passo. Le tecniche, le competenze e le soluzioni DFIR sono essenziali per condurre indagini approfondite, analizzare i vettori di attacco e comprendere la portata e l’impatto complessivi degli incidenti di sicurezza. Le funzionalità DFIR forniscono una comprensione più approfondita acquisendo e analizzando dati a un livello molto granulare da endpoint, server, cloud e altre fonti di dati per identificare esattamente come si è verificato un incidente di sicurezza, quali dati sono stati compromessi e chi sia l’autore della minaccia. In che modo i requisiti NIS2 si intersecano con il DFIR? Esistono quattro aree chiave in cui il DFIR supporta il rispetto dei requisiti NIS2: Conservazione e analisi delle prove digitali durante e dopo gli incidenti informatici. Ricostruzione degli eventi a supporto della segnalazione e del monitoraggio degli incidenti. Documentazione difendibile per le autorità di vigilanza, i revisori e, ove applicabile, i procedimenti giudiziari. Analisi post-incidente per dimostrare la due diligence e gli insegnamenti tratti. Quali sono le conseguenze della non conformità? Le sanzioni possono arrivare fino a 10 milioni di euro o al 2% del fatturato annuo globale per i soggetti essenziali, a seconda di quale sia il valore più elevato, e a 7 milioni di euro o all’1,4% per i soggetti importanti. Oltre alle sanzioni pecuniarie, la NIS2 attribuisce alla direzione la chiara responsabilità di supervisionare i rischi legati alla sicurezza informatica e garantire l’adozione di controlli adeguati. Le autorità di regolamentazione (diverse per ogni Stato membro) hanno il potere di far rispettare la conformità attraverso audit, ispezioni e ordini di adeguamento, con conseguenze specifiche che variano a seconda del paese. Alle organizzazioni e agli enti pubblici può inoltre essere richiesto di dimostrare in che modo gli incidenti vengono indagati, segnalati e risolti. È importante sottolineare che requisiti come l’allerta precoce entro 24 ore e la notifica entro 72 ore sono concepiti non solo per sanzionare i ritardi, ma anche per garantire che le organizzazioni rispondano in modo efficace e comunichino con chiarezza durante gli incidenti. In che modo le soluzioni di Magnet Forensics vi aiutano a soddisfare la conformità alla NIS2 Rispettare le scadenze serrate della NIS2 richiede più del semplice rilevamento. Richiede la capacità di indagare, analizzare e segnalare gli incidenti con rapidità e in modo difendibile. Il portafoglio di Magnet Forensics è progettato per supportare ogni fase di tale processo. Acquisizione remota e analisi basata sull’intelligenza artificiale con Magnet Axiom Cyber e Magnet Review Acquisisci in remoto le prove dagli endpoint di tutta la tua organizzazione senza accesso fisico, un aspetto fondamentale quando il tempo stringe. Gli strumenti di analisi basati sull’intelligenza artificiale individuano istantaneamente i risultati rilevanti da enormi set di dati, riducendo a poche ore ciò che richiederebbe giorni di analisi manuale. Le visualizzazioni della cronologia e delle connessioni forniscono una chiara visione immediata della progressione dell’attacco. Le regole YARA e l’integrazione con il framework MITRE ATT&CK consentono una rapida identificazione delle minacce per una segnalazione conforme. Flussi di lavoro automatizzati e integrati 24 ore su 24, 7 giorni su 7 con Magnet Automate Mantieni le indagini attive 24 ore su 24, elaborando più elementi di prova in parallelo senza aumentare il personale. Crea flussi di lavoro standardizzati una volta sola; eseguili in modo coerente ogni volta. Integra l’intero stack forense e di sicurezza (XDR/EDR, SIEM, SOAR) per eliminare i passaggi di mano manuali e ridurre il ritardo tra l’allerta e la raccolta, assicurando che nessun dato critico vada perso. Aggiornate automaticamente le parti interessate man mano che le indagini procedono (ad esempio, attivate gli aggiornamenti su Slack per informare il vostro team quando l’elaborazione dei dati è completata e pronta per la revisione). Collaborazione in tempo reale per tutte le parti interessate con Magnet Review Condividete i dati in modo sicuro con investigatori, legali, addetti alla conformità e altre parti interessate non tecniche da qualsiasi luogo, in tempo reale. L’interfaccia intuitiva consente agli utenti non tecnici, compresi i dirigenti con responsabilità personale, di interagire direttamente con i dati. Filtra, cerca e contrassegna insieme gli artefatti degni di nota per un allineamento immediato tra i tuoi team. Mantieni la catena di custodia e i percorsi di audit per la rendicontazione normativa. Raccolta dati remota su scala aziendale con Magnet Nexus Sii pronto per un incidente: implementa l’intero sistema nella tua infrastruttura e raccogli dati da più endpoint contemporaneamente. L’elaborazione degli artefatti in tempo reale mette in evidenza i risultati critici man mano che i dati vengono raccolti ed elaborati, non ore dopo. La scalabilità basata sul cloud gestisce i picchi imprevisti senza hardware aggiuntivo. Ottenete di più lavorando insieme grazie a un flusso di lavoro collaborativo che distribuisce la configurazione dei casi, l’assegnazione di tag e il filtraggio tra i membri del team. Controllate dove vengono archiviati i dati con un approccio unico basato su agenti di raccolta ibridi. I prossimi passi Per le organizzazioni e le amministrazioni pubbliche che devono rispettare le scadenze di conformità alla direttiva NIS2, il percorso da seguire prevede: Valutazione delle capacità attuali: valutare le capacità esistenti alla luce dei requisiti specifici della direttiva NIS2 in materia di conservazione dei dati, analisi e tempistiche di rendicontazione. Implementazione di strumenti di livello forense: implementare soluzioni come Magnet Axiom Cyber, Automate, Review e Nexus, progettate specificamente per indagini digitali su scala aziendale (soprattutto quelle soggette a vincoli temporali normativi). Sviluppo di flussi di lavoro automatizzati: creare flussi di lavoro standardizzati e documentati per la risposta agli incidenti che garantiscano una gestione coerente degli eventi e mantengano la conformità ai requisiti di segnalazione. Promuovere la collaborazione tra le parti interessate: istituire piattaforme sicure e accessibili per il coordinamento tra team tecnici, dirigenza e autorità esterne. Esecuzione di test periodici: le organizzazioni devono condurre esercitazioni teoriche per testare l’efficacia dei propri manuali di risposta agli incidenti (IR), verificando che le capacità forensi siano in grado di rispettare le rigide scadenze previste dalla NIS2. Prepararsi con prontezza investigativa Quando scatta il conto alla rovescia di 24 ore, è la prontezza investigativa a distinguere le organizzazioni che rispondono con sicurezza da quelle che agiscono alla cieca. Le soluzioni di Magnet Forensics sono progettate appositamente per le moderne indagini digitali, fornendo ai team la velocità, la scalabilità e la difendibilità richieste dalla direttiva NIS2. Ci impegniamo ad aiutarvi a rafforzare la vostra prontezza investigativa e a costruire una resilienza a lungo termine per soddisfare in modo più efficace la direttiva NIS2. Per saperne di più sulle nostre soluzioni di indagine digitale, contattateci all’indirizzo sales@magnetforensics.com per parlare con un esperto. The post In che modo le moderne funzionalità DFIR contribuiscono al rispetto della direttiva NIS2 appeared first on Magnet Forensics.

Magnet Forensics spoke with Miguel Clarke, a former FBI Supervisory Special Agent turned cybersecurity director, about the widening gap between the cybercrime economy and the industry built to fight it. Watch the full conversation below. Key Takeaways The cybercrime economy is estimated at more than $10 trillion, against a cybersecurity industry of roughly $300 billion. Miguel Clarke argues that gap means investment needs to rebalance toward recovery, not just detection. Most incident response programs stop at containment. The handoff between the SOC and the digital forensics team is rarely planned out, and that’s where the investigative gap opens up. Unifying evidence across endpoint, cloud, mobile, and memory, and using AI to clear repetitive work, can help cybersecurity teams move from raw data to a decision they can stand behind. Miguel Clarke spent decades investigating cybercrime as an FBI Supervisory Special Agent before moving into the private sector as a cybersecurity director. Along the way, he’s watched two numbers grow further apart: the size of the cybercrime economy, and the size of the cybersecurity industry built to fight it. The cybercrime economy is estimated at more than $10 trillion and the cybersecurity industry is in the neighborhood of $300 billion. “We have an industry that’s trying to fight an entire economy that is orders of magnitude bigger,” Clarke said. The situation calls for rebalancing, he added: less share of the wallet on identification and detection, more on recovery. I foresee that if we want to have an impact on the cybercrime problem, we are going to have to shift all the way over to that recovery — invest in it with our time, talent, and treasure.” Miguel ClarkeFormer FBI Supervisory Special Agent Why post-incident analysis is needed to close the investigative gap Agencies are drowning in more: more alerts, more logs, more artifacts scattered across endpoints, cloud environments, and mobile devices. Federal investigators today aren’t short on data, Clarke said, what’s often missing in a typical federal incident response cycle is what that data needs to become. What we’re really looking for is wisdom that comes from knowledge, that’s derived from information, which is derived from data.” Miguel ClarkeFormer FBI Supervisory Special Agent Most incident response programs are built around detection and containment, though these efforts prompt more questions to be answered. How did the attacker get in? How far did they spread? What was accessed? Was anything exfiltrated? Did they leave persistence we haven’t found? Can we prove any of this with defensible evidence? Can these conclusions withstand audits, regulatory review, insurance claims, or litigation? This is where the investigative gap shows up most, Clarke noted. Teams usually measure incident response in terms of time to respond or recover, but rarely talk about how they are interfacing with the digital forensics team. The handoff between the SOC and the digital forensics incident response team is often not planned out. Clarke recommends game-planning that handoff intentionally, rather than leaving it to be figured out mid-incident: How are we going to hand off when there’s an incident? Who’s going to make that decision? And then what’s the criteria that elevates this from a SOC problem to a digital forensics problem? For federal digital forensics investigators, the stakes are high: mistakes or misstatements can jeopardize an entire case. “Federal investigators represent the government, so the margin for error is so much smaller,” Clarke said. “I don’t think that courts are very permissive of mistakes or misstatements that are made by the government.” How unifying digital evidence closes the investigative gap Clarke’s answer to the handoff problem isn’t just about tools. It’s a change in how the existing pieces relate to each other. Bringing all the data together in one view is extremely important, he said. Agencies and organizations that can pull threat intelligence and forensic artifacts into a single platform, spanning end-to-end investigations, put themselves in the strongest position going forward. It means correlating evidence across endpoint, cloud, mobile, and memory into a single defensible timeline — rather than piecing together fragments from several systems after the fact. Unifying access and analysis across scattered evidence sources reduces investigative delays before logs quietly roll over and evidence ages out. Why forensic readiness matters more than prevention Clarke’s argument circles back to where he started: an industry that measures itself almost entirely by what it prevents is going to keep losing ground to an economy that measures its returns in the trillions. Forensic readiness is driven by a simple recognition: agencies that can prove what happened, close cases cleanly, and recover fast will out-position the ones still betting everything on keeping every attacker out. “You have tons of data out there,” Clarke said. “Structure it correctly, create information, use that information to develop knowledge, and mix that with experience.” Clarke sees a similar shift needed in how teams think about AI. The debate over whether AI outperforms an investigator, he said, isn’t the one worth spending energy on. What matters is what AI frees investigators up to do: clearing the repetitive, energy-draining work out of their way so that they can spend their time where human judgment is needed. For federal cybersecurity teams facing rising case volumes and shrinking margin for error, the edge lies beyond detection and containment. It’s faster insight, turning what’s already been collected into readiness they can stand behind. Ready to strengthen your forensic readiness? Download the eBook: Closing the investigative gap in incident response. The post $10 trillion vs. $300 billion: A former FBI investigator on why cybersecurity investment needs to shift toward recovery appeared first on Magnet Forensics.

CVE-2026-15409 is an unauthenticated SSRF in the SMA1000 WorkPlace interface. The chain is the interesting part. The /wsproxy WebSocket endpoint is used to reach a locally bound Erlang distribution node (couchdb@127.0.0.1 on port 1050), the Erlang handshake is completed with a hardcoded cookie, and os:cmd() gives command execution as the couchdb user. From there the operator read policy_file.xml, decrypted the stored LDAP bind passwords (static 32-byte AES key lifted from ASAPPasswordUtil.class bytecode), and dropped a standalone Linux build of Impacket secretsdump to /tmp on the appliance. secretsdump then ran from the SonicWall itself against internal DCs, with DCSync automated using recovered LDAP creds and, more effectively, domain-controller machine-account hashes for pass-the-hash. The exploit is a direct refactor of Rapid7's public PoC, reworked for unattended bulk use. Full chain, scripts and IOCs in the writeup. https://hunt.io/blog/sonicwall-sma1000-uk-council-attack submitted by /u/Straight-Practice-99 [link] [comments]

Researchers found 36,769 exposed AI endpoints, but only 2% had an HTTP authentication gate. Running AI locally is supposed to give organizations more control. Models, prompts and documents stay on infrastructure they manage instead of being sent to a third-party cloud. But that advantage disappears quickly when the infrastructure itself is exposed to the public internet. A new study from Mysterium VPN offers a useful snapshot of the problem. The researchers found 36,769 self-hosted AI endpoints across model servers, agent-building platforms and vector stores that were reachable and identifiable through a public internet scanning index. “Only 2.02% return an HTTP authentication challenge; for the overwhelming majority, there’s no network-layer gate whatsoever.” reads Mysterium VPN’s report. “Open WebUI: 18,529 reachable, 1 behind a gate: The most widely deployed local-LLM front-end has, as a population, no perimeter.” That number needs to be read carefully. A service returning HTTP 200 isn’t automatically unauthenticated because a login page can also return 200. Mysterium therefore used HTTP 401 and 403 responses as evidence of an authentication gate and made a stronger claim only where the application fingerprint itself proved anonymous access. “We counted the doors. We didn’t open them.” That distinction matters because the researchers didn’t connect to the exposed systems, retrieve data, run models, read credentials or exploit vulnerabilities. They queried Netlas, a third-party internet scanning index, and counted responses that matched specific fingerprints. The largest number came from Open WebUI. The researchers identified 18,529 reachable instances, but only one returned an HTTP authentication challenge. vLLM accounted for another 4,880 endpoints, with just three showing an authentication challenge, while LocalAI had 150 and llama.cpp 69, with neither showing a challenge. Ollama produced a particularly important finding because the researchers could verify anonymous access from the service response itself. An exposed Ollama server returns the text “Ollama is running” from its root endpoint without requiring credentials, and 6,935 hosts returned that fingerprint. Of those, 6,046 returned an explicit HTTP 200 response. This isn’t just about seeing a chatbot from the internet. An exposed Ollama API can reveal the models installed on the machine and can be used to generate text using the owner’s hardware. That creates a straightforward resource-abuse problem: someone else gets the GPU time and the owner gets the electricity bill. The security community calls this LLMjacking, but the underlying problem is familiar. The AI label doesn’t make an exposed API magically safer. There is also evidence that this isn’t a small or isolated deployment mistake. A separate SentinelOne and Censys study published in January identified around 175,000 publicly exposed Ollama hosts across 130 countries. Almost half of those systems supported tool-calling capabilities that could execute code, access APIs or interact with external systems. Mysterium’s own number is much smaller because it comes from a different scanning source and a stricter fingerprint. The researchers explicitly describe their 36,769 endpoints as a lower bound rather than a measurement of the entire internet. They also found 22,024 responses on Ollama’s default port 11434, but excluded those from the main total because a port number alone doesn’t prove which service is running there. The more interesting security issue may sit one layer above the model itself. Mysterium found 5,223 exposed agent builders and workflow platforms, including Flowise, n8n, ComfyUI, Dify, RAGFlow, Langflow and Open WebUI Pipelines. These systems deserve more attention because they don’t simply host an AI model. They often connect that model to the rest of the company’s infrastructure. An automation workflow can contain an OpenAI API key, database credentials, Slack tokens, webhook secrets, CRM passwords and other information needed to make the workflow work. They aren’t broken. They’re doing what they were designed to do. The problem starts when someone places that functionality directly on the internet without another security layer in front of it. Flowise is a good example. Mysterium identified 1,341 reachable Flowise instances and found zero HTTP authentication challenges among them. The same report points to CVE-2026-40933, a critical Flowise vulnerability that can allow an authenticated attacker to execute arbitrary commands through the MCP adapter. Flowise fixed the issue in version 3.1.0. That combination matters. A reachable application isn’t necessarily vulnerable, and a vulnerability doesn’t automatically mean an internet-facing installation can be compromised. But putting a system that stores credentials on the public internet increases the number of ways an attacker can eventually reach those credentials. n8n illustrates another part of the problem: attackers don’t always need a vulnerability. In August, GitGuardian researchers examined n8n API tokens exposed in public GitHub commits. They identified 4,576 unique tokens associated with 1,255 hostnames. Of the 896 instances that were reachable during testing, 321 accepted at least one leaked token. Those credentials could provide access to workflows and connected systems without exploiting a software flaw. That’s an important lesson for AI security because many organizations now use automation platforms to connect databases, cloud services, source-code repositories, customer systems and AI services. The risk doesn’t stop at the workflow layer. Vector databases can contain the actual information that an AI system uses to answer questions. Mysterium identified 920 vector-store endpoints, almost all of them exposed Attu consoles for Milvus. But the researchers are clear that this number tells us very little about the real exposure. Qdrant’s native port and Milvus’s native database port weren’t scanned by the source, so a database could be publicly reachable without appearing in the census. That makes the vector-store figure a floor, not a ceiling. A model server exposes computing capability, an agent builder can expose credentials, and a vector store can expose the information that an organization has loaded into its AI system: internal documents, support tickets, customer records or private knowledge bases. “We are reporting a floor of 920 for the one class where the true number is likely highest. Nobody should read this study as evidence that self-hosted vector databases are well protected.” continues the report. “We simply couldn’t see them.” That’s one of the most important qualifications in the research. The absence of evidence here isn’t evidence that these systems are safe. The same caution applies to geography. Mysterium wanted to publish a country breakdown, but rate limits prevented reliable results for several major countries. Rather than publish a misleading ranking, the researchers dropped it. The one figure they could support was that 4,136 of the 22,024 responses observed on port 11434, or 18.8%, came from the United States. The study also deliberately avoided turning exposure into compromise. The researchers didn’t contact the hosts, retrieve documents, inspect prompts or chat logs, read credentials, run inference, exploit vulnerabilities or publish IP addresses and hostnames. That’s important because the research measures exposure, not confirmed compromise. The underlying problem, however, is difficult to dismiss. Over the past two years, organizations and individual developers have moved more AI infrastructure away from managed cloud services and onto their own machines. That can improve privacy and control, but it also transfers much of the security responsibility to whoever deploys the system. A local AI stack should therefore be treated like any other internet-facing service. If the model doesn’t need to be reachable from the internet, bind it to localhost or a private network. If remote access is necessary, put authentication and network controls in front of it, rather than relying entirely on the application’s own login system. The same logic applies to agent builders. If an n8n or Flowise installation holds API keys and credentials that can reach production systems, it deserves the same level of protection you’d give a password manager. Calling it an “AI tool” doesn’t reduce the value of what it stores. There is also a basic operational question that many organizations should answer now: what AI infrastructure is already exposed? Mysterium’s fingerprints can be used with internet-scanning services to check for exposed deployments. That makes the research useful not because it proves that 36,769 systems are compromised, but because it gives defenders a way to look for their own systems before someone else does. And that may be the uncomfortable part of the findings. The AI security problem isn’t always a sophisticated model attack or a novel prompt-injection technique. Sometimes it’s a developer binding a service to 0.0.0.0, putting it on a cloud server and forgetting that the internet can see it. “None of this is a vulnerability report, and it would be unfair to file it as one. Ollama, Open WebUI, Flowise, and n8n aren’t broken.” concludes the report. “They’re doing what they were designed to do: run on a machine and serve a local user. The failure is in deployment — thousands of people binding to 0.0.0.0 on a cloud box, in a hurry, and never putting anything in front of it. “ The AI is new. Leaving the front door open isn’t. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI)

Threat actors are adapting malware not only for conventional endpoint defenses and sandboxes, but also for large language model-powered tools increasingly used to triage suspicious code. ESET researchers linked the activity to Russia-aligned threat actor UAC-0099, which used the method during an attack against an organization in Ukraine. The group inserted a safety-sensitive, weapon-related request The post Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.