81–90 of 238 posts
how is this sort of stuff not at least encrypted at rest?
Encryption at rest does nothing to prevent online access to data. It's only useful if you leave your storage cabinet standing on the side of the road.
A number of replies here are noting (correctly) how this doesn't have much to do with AI (despite some sentences in this article kind of implicating it; the title doesn't really, fwiw) and is more of an issue with cloud providers, confusing ways in which security tokens apply to data being shared publicly, and dealing with big data downloads (which isn't terribly new)... ...but one notable way in which it does implic…
This incident is a good one to point back to.
On a lighter note - I saw a chat message that started with "Hey dude! How is it going". I'm disappointed that the response was not https://nohello.net/en/ .
In German, if you ask this question, it is expected that your question is genuine and you can expect an answer (Although usually people don't use this opportunity to unload there emotional package, but it can happen!)
Whereas in Englisch you assume this is just a hello and nothing more.
Would be insane if the GPT4 model is in there somewhere (as its served by Azure).
Meanwhile a big enterprise provider like MS suffers a bigger leak and exposes MS Teams/ OneDrive / SharePoint data of all its North America customers say.
Boom we have GPT model that can autonomously run whole businesses.
Earlier quoted context omitted.
Pentests where people actually get out of bed to do stuff (read code, read API docs etc) and then try to really hack your system are rare. Pentests where people go through the motions, send you report with a few unimportant bits highlit while patting you on the back for your exemplary security so you can check the box on whatever audit you're going through are common.
Yep, most pentests go through the OWASP list and call it done.
Part of me thought "this is fine as very few could actually download 38TB". But that's not true as it's just so cheap to spin up a machine and some storage on a Cloud provider and deal with it later. It's also not true as I've got a 1Gbps internet connection and 112TB usable in my local NAS. All of a sudden (over a decade) all the numbers got big and massive data exfiltration just looks to be trivial. I mean, obvious…
How do you have your NAS configured? The more specifics, the better; I’ve wanted one. Do you worry about failure? In your hardware life I mean, not your personal life.
It’s so easy to set up an Ubuntu image that I control completely and I would rather do that than run some questionable 3rd party NAS solution and excluding disks costs about $130.
The article tries to play up the AI angle, but this was a pretty standard misconfiguration of a storage token. This kind of thing happens shockingly often, and it’s why frequent pentests are important.
Pentests where people actually get out of bed to do stuff (read code, read API docs etc) and then try to really hack your system are rare. Pentests where people go through the motions, send you report with a few unimportant bits highlit while patting you on the back for your exemplary security so you can check the box on whatever audit you're going through are common.
They may be rare, but "real" pentests are still a thing.
https://qbix.com/blog/2023/06/12/no-way-to-prevent-this-says...
https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says...
The article tries to play up the AI angle, but this was a pretty standard misconfiguration of a storage token. This kind of thing happens shockingly often, and it’s why frequent pentests are important.
> it’s why frequent pentests are important. Unfortunately a lot of pen testing services have devolved into "We know you need a report for SOC 2, but don't worry, we can do some light security testing and generate a report for you in a few days and you'll be able to check the box for compliance" Which is guess is better than nothing. If anyone works at a company that does pen tests for compliance purposes, I'd recomme…
When I was consulting architecture and code review were separate services with a very different rate from pentesting. Similar goals but far more expensive.