The wrong kind of access. [Research Saturday]

The wrong kind of access. [Research Saturday]

Dan Lisichkin, AI Security Researcher from Pillar Security, discussing their work on "A WIF Of Fresh Access, How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise." Researchers at Pillar Security uncovered a vulnerability in Google’s Gemini CLI workflows that could allow an attacker to turn a malicious GitHub issue into remote code execution and gain elevated access to a Google Cloud Platform (GCP) project. The exploit chain combined a misconfigured tool allowlist that allowed unrestricted command execution with exposed Workload Identity Federation credentials and overly broad service account permissions, potentially enabling attackers to impersonate privileged accounts. Google promptly addressed the issues by tightening tool restrictions, blocking the agent’s access to credential files, and limiting service account impersonation permissions, highlighting the risks of connecting AI agents to untrusted input and sensitive infrastructure. The research and executive brief can be found here: ⁠A WIF Of Fresh Access: How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise Learn more about your ad choices. Visit megaphone.fm/adchoices

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(3815)

Peer pressure meets private keys.

Peer pressure meets private keys.

A classified memo ties Nvidia’s chief executive to Chinese espionage. AI coding agents crack under peer pressure, coughing up private keys. Big breaches hit seven million Japanese shoppers and three m...

9 Nov 29min

The hidden risks of system integration. [T-Minus: Space-Cyber Briefing]

The hidden risks of system integration. [T-Minus: Space-Cyber Briefing]

Though many look to ensure that they meet mission readiness requirements, overreliance on these practices can allow hidden risks to go unchecked. Host Maria Varmazis sits down with Vito Askins, found...

8 Nov 21min

Stealing more than the spotlight. [Research Saturday]

Stealing more than the spotlight. [Research Saturday]

This week, we are joined by Matt Poto, Associate Triage Analyst at Huntress, discussing their work on "Grand Theft Auto VI Hype Leads to Malware." Threat actors are exploiting the hype surrounding the...

7 Nov 14min

Keeping cyber threats on ice.

Keeping cyber threats on ice.

Federal agencies warn of cyberattacks on industrial refrigeration systems. Healthcare cybersecurity could get a post-midterm boost. Chainalysis exposes customer credentials, and DigiCert discloses a b...

6 Nov 28min

Claude, you've got company.

Claude, you've got company.

Claude Dispatch opens the door to hijacking. Residential proxies turn up on White House networks. Asian airlines suffer a wave of data breaches. Cisco and WatchGuard roll out critical patches. GhostMa...

5 Nov 29min

Ballots, bots, and backlash.

Ballots, bots, and backlash.

Election Day brings typical cyber threats, technical glitches, and misinformation. Hackers tamper with European refrigeration systems. OpenAI faces questions over years of security warnings. Nvidia re...

4 Nov 33min

Democracy without a safety net.

Democracy without a safety net.

CISA scales back its Election Day role. Google takes down a massive Android TV botnet. The UK warns of AI-powered attacks on critical infrastructure. German lawmakers face potential spyware threats. A...

3 Nov 29min

A TraderTraitor's guide to getting away with billions.

A TraderTraitor's guide to getting away with billions.

The FBI blames North Korea for a record-breaking crypto heist. Hackers hijack air raid alerts in Ukraine and Russia. European supermarket freezers come under attack again. Aur0ra ransomware operators ...

2 Nov 27min

Populært innen Politikk og nyheter

giver-og-gjengen-vg
aftenpodden-usa
aftenpodden
popradet
forklart
stopp-verden
det-store-bildet
nokon-ma-ga
lydartikler-fra-aftenposten
hanna-de-heldige
rss-espen-lee-usensurert
rss-gukild-johaug
dine-penger-pengeradet
aftenbla-bla
rss-ness
e24-podden
fotballpodden-2
amerikansk-politikk
rss-utenrikskomiteen-med-bogen-og-grasvik
frokostshowet-pa-p5