General

Detecting Dangling SaaS Subdomains and Real Subdomain Takeovers

Subdomain takeover is one of those vulnerabilities that refuses to die. Every few years it gets rediscovered, scanners add more signatures, and reports get louder, but in my opinion not better. After running real world assessments for years, I kept hitting my head on the wall with tools that are flagging dozens of possible takeovers, and most of them collapse when you actually look at them.

Free Membership Required

You must be a Free member to access this content.

Join Now

Already a member? Log in here
Read more...

DROP drops for consumer privacy

California this year launched an online site to put teeth into the 2023 California Delete Act. It could be the most powerful privacy tool consumers have ever had. It could also create havoc for the data broker and social media industries.

On January 1, the California Delete Request and Opt-out Platform (DROP) is an online tool allowing residents to remove and opt out of data collection. On the site, consumers enter personal identifiers, including phone numbers and email addresses currently in use. After submit the request, data brokers must process the deletion request within 45 days. The starting date, August 1, 2026, gives brokers the time to establish internal processes. People requesting the deletions can check their DROP status after that date to see if your data was deleted. They can add more information about themselves at any time. New data can take up to 90 days to process.

California’s Delete Act was a step forward, but lacked the mechanism to allow consumers to easily get their data removed. Instead of a single place, they contacted every company they knew carried their data and submitted a letter requesting deletion. But they had to know where that data was to issue a request, and they would never know if it had ever been deleted. The state also now offers a website allowing residents to know how many data brokers are collecting data.

Read more...

AI industry at a crossroads

The AI industry appears to be reaching a crossroads that will determine its future in the next two years. The only clear outcome is it will not be what it is now, nor what it is predicted to be.

Most doomsayers and cheerleaders largely agree on a single vision: The technology will destroy hundreds of thousands of jobs. Wealthy investors and captains of industry consider that a good thing and mumble about universal income legislation and Star-Trekkian futures. White-color workers and unions see the future less optimistically. But cooler heads see a precarious future. Those cooler heads include Anthropic’s Claude, OpenAI’s Chat GPT, and X.ai’s Grok. Cyber Protection Magazine talked to all three, and they all came up with four likely scenarios that may be brewing even as this article is read.

A security breach or a major AI system collapse.
Technical plateau causing diminishing returns on scalability.
Strict regulatory legislation that stifles innovation and makes development too expensive to pursue.
A significant economic downturn or massive market correction drying up capital investment.

Free Membership Required

You must be a Free member to access this content.

Join Now

Already a member? Log in here
Read more...

What’s behind the alarming rise in helpdesk vishing

Vishing, or voice-based social engineering, in which attackers use phone calls to trick people into revealing information or granting access to networks, is seeing an alarming growth in cases. In general terms, criminals will pose as a trusted colleague or external contact and use convincing pretexts to pressure individuals to share sensitive details or take actions they believe are routine.

Free Membership Required

You must be a Free member to access this content.

Join Now

Already a member? Log in here
Read more...