The wrong kind of access. [Research Saturday]

The wrong kind of access. [Research Saturday]

Dan Lisichkin, AI Security Researcher from Pillar Security, discussing their work on "A WIF Of Fresh Access, How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise." Researchers at Pillar Security uncovered a vulnerability in Google’s Gemini CLI workflows that could allow an attacker to turn a malicious GitHub issue into remote code execution and gain elevated access to a Google Cloud Platform (GCP) project. The exploit chain combined a misconfigured tool allowlist that allowed unrestricted command execution with exposed Workload Identity Federation credentials and overly broad service account permissions, potentially enabling attackers to impersonate privileged accounts. Google promptly addressed the issues by tightening tool restrictions, blocking the agent’s access to credential files, and limiting service account impersonation permissions, highlighting the risks of connecting AI agents to untrusted input and sensitive infrastructure. The research and executive brief can be found here: ⁠A WIF Of Fresh Access: How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise Learn more about your ad choices. Visit megaphone.fm/adchoices

Tämä jakso on lisätty Podme-palveluun avoimen RSS-syötteen kautta eikä se ole Podmen omaa tuotantoa. Siksi jakso saattaa sisältää mainontaa.

Jaksot(3815)

Peer pressure meets private keys.

Peer pressure meets private keys.

A classified memo ties Nvidia’s chief executive to Chinese espionage. AI coding agents crack under peer pressure, coughing up private keys. Big breaches hit seven million Japanese shoppers and three m...

9 Marras 29min

The hidden risks of system integration. [T-Minus: Space-Cyber Briefing]

The hidden risks of system integration. [T-Minus: Space-Cyber Briefing]

Though many look to ensure that they meet mission readiness requirements, overreliance on these practices can allow hidden risks to go unchecked. Host Maria Varmazis sits down with Vito Askins, found...

8 Marras 21min

Stealing more than the spotlight. [Research Saturday]

Stealing more than the spotlight. [Research Saturday]

This week, we are joined by Matt Poto, Associate Triage Analyst at Huntress, discussing their work on "Grand Theft Auto VI Hype Leads to Malware." Threat actors are exploiting the hype surrounding the...

7 Marras 14min

Keeping cyber threats on ice.

Keeping cyber threats on ice.

Federal agencies warn of cyberattacks on industrial refrigeration systems. Healthcare cybersecurity could get a post-midterm boost. Chainalysis exposes customer credentials, and DigiCert discloses a b...

6 Marras 28min

Claude, you've got company.

Claude, you've got company.

Claude Dispatch opens the door to hijacking. Residential proxies turn up on White House networks. Asian airlines suffer a wave of data breaches. Cisco and WatchGuard roll out critical patches. GhostMa...

5 Marras 29min

Ballots, bots, and backlash.

Ballots, bots, and backlash.

Election Day brings typical cyber threats, technical glitches, and misinformation. Hackers tamper with European refrigeration systems. OpenAI faces questions over years of security warnings. Nvidia re...

4 Marras 33min

Democracy without a safety net.

Democracy without a safety net.

CISA scales back its Election Day role. Google takes down a massive Android TV botnet. The UK warns of AI-powered attacks on critical infrastructure. German lawmakers face potential spyware threats. A...

3 Marras 29min

A TraderTraitor's guide to getting away with billions.

A TraderTraitor's guide to getting away with billions.

The FBI blames North Korea for a record-breaking crypto heist. Hackers hijack air raid alerts in Ukraine and Russia. European supermarket freezers come under attack again. Aur0ra ransomware operators ...

2 Marras 27min

Suosittua kategoriassa Politiikka ja uutiset

uutiscast
vallattomat
aikalisa
politiikan-puskaradio
rss-viihde-media
rss-vaalirankkurit-podcast
ootsa-kuullut-tasta-2
rss-ootsa-kuullut-tasta
otetaan-yhdet
rss-asiastudio
rss-voi-venaja
tervo-halme
mtv-uutiset-polloraati
rss-ulkopoditiikkaa
rss-50100-podcast
rss-etulinja
the-ulkopolitist
rss-seksicast
rss-termiviidakko
et-sa-noin-voi-sanoo-esittaa