One of the things that has always confused me is how often a business will look at and spend on revenue generating and very little on revenue maintenance. Every budget year you see money thrown at expansion, new tools or software that bring in more money and I get it. You have to earn to keep the lights on. However, you also need to ensure that you can keep what you earn. Think about it like this, if you have a business and it only takes cash you would not just leave the cash laying around for anyone to take. No, you would invest in a secure place like a safe to keep it. This concept also involves modern “digital” businesses, but we just are not seeing them spend any money on the safe.

There you are doing your stollen credit card number shopping, like you do every Sunday. You come across a big batch of them, and the deal seems good. How do you know these things are real? I mean this isn’t exactly Amazon with reviews and a return policy. This is a dark web marketplace. The answer to your dilemma is to use a card checking service. One of, if not the, most popular services on the darker side of the web was Try2Check. I say was since this system was taken down by the US Government this week in what has been described as a multi-national operation.

The other day while wading through the sludge that is the internet, I stumbled across a poll on Twitter asking the binary question “Who do you trust more with AI; Bill Gates or Elon Musk?” This led to a fun few hours diving deeper into that particular rabbit hole. I stumbled across articles where Bill Gates talks about AI via interviews as well as some interviews of Elon where he disparages Gates’ grasp on AI. Like I said, fun.

DLL sideloading is a common technique for attackers to use when getting their malware in place and has been in use since around 2010. Simply put your malicious DLL in the same directory as the application and Windows in all its helpfulness loads it first instead of the legitimate one that might be in another directory. This method is also referred to as DLL search order hijacking. With the age of this technique and advances in EDR/MDR its usefulness has decreased.

There is an old adage that says compliance is not a substitute for security. You can check all the compliance check boxes, pass audits, and still end up with an insecure environment. Level Finance Crypto found this out the hard way after they were hacked due to a vulnerability in how some of their smart contracts were set up, despite passing more than one IT Security Audit.

A recent incident where ChatGPT users at Samsung unknowingly exposed sensitive data via ChatGPT has raised concerns in multiple industries. The banking and finance industry saw several companies put a stop on the use of ChatGPT and certain regulators began investigating how its use could leak PII, or other financial information. To combat this new obstacle to business adoption, Microsoft is looking to offer a private business model which would exclude user input from being used to train the LLM.

If you are a fan of science fiction movies, then you have probably seen multiple movies where an AI (Artificial Intelligence) has gone mad and decided that humankind needed to be eradicated. Everything from the Terminator series, through to the Matrix warns us of the dangers of creating something that is smarter and more powerful than ourselves. Of course, these are works of fiction, but they do represent an understanding of humankind’s hubris when it comes to creating artificial intelligence.

T-Mobile has disclosed their second breach of 2023. According to the mobile provider a threat actor gained access to their systems in February and was not detected until March. This allowed the attacker access to a small amount of customer data, 836 records. T-Mobile is stating that the data did not contain financial information, but it did contain enough Personally Identifying Information (PII) that the affected customers are exposed to identity theft.

Although not a new story the recent revelations around the CFPB (Consumer Financial Protection Bureau) data breach are very important. This incident is one of those times when you can either learn an important lesson, or you can ignore it and walk into a much bigger shitshow. The outcome of this one is something that only time will tell, but it is not something that anyone should just ignore.

After a three-year absence from Hacker Summer Camp, I finally returned to Vegas. Two of those years were related to Covid of course. However, three years is a long time to be out of the environment and the craziness that is both Black Hat and Def Con. To say I was excited to return to Vegas and everything that both cons have to offer would be an understatement. Both cons have their place in what I do here at DecryptedTech, but it was more than just the articles and conversations about security that I enjoy, it is getting to catch up with people I only see during the con and also the prospect of meeting new people and developing new relationships.