Dark Reading Weekly -- March 09, 2023

Employees Are Feeding Sensitive Biz Data to ChatGPT, Raising Security Fears

More than 4% of employees have put sensitive corporate data into the large language model, raising concerns that its popularity may result in massive leaks of proprietary information.

TSA Issues Urgent Directive to Make Aviation More Cyber Resilient

Will stricter cybersecurity requirements make flying safer? The TSA says yes, and sees it as a time-sensitive imperative.

AI-Powered 'BlackMamba' Keylogging Attack Evades Modern EDR Security

Researchers warn that polymorphic malware created with ChatGPT and other LLMs will force a reinvention of security automation.

What GoDaddy's Years-Long Breach Means for Millions of Clients

The same "sophisticated" threat actor has pummeled the domain host on an ongoing basis since 2020, making off with customer logins, source code, and more. Here's what to do.

Key Proposals in Biden's Cybersecurity Strategy Face Congressional Challenges

The strategy document does nothing to change things on the ground in the near term; legislation, regulation, and follow-up executive action are all going to be key to moving forward the administration's agenda.

Booking.com's OAuth Implementation Allows Full Account Takeover

Researchers exploited issues in the authentication protocol to force an open redirection from the popular hotel reservations site when users used Facebook to log in to accounts.

EV Charging Infrastructure Offers an Electric Cyberattack Opportunity

Attackers have already targeted electric vehicle (EV) charging stations, and experts are calling for cybersecurity standards to protect this necessary component of the electrified future.

Emotet Resurfaces Yet Again After 3-Month Hiatus

More than two years after a major takedown by law enforcement, the threat group is once again proving just how impervious it is against disruption attempts.

CISA, MITRE Look to Take ATT&CK Framework Out of the Weeds

The Decider tool is designed to make the ATT&CK framework more accessible and usable for security analysts of every level, with an intuitive interface and simplified language.

Everybody Wants Least Privilege, So Why Isn't Anyone Achieving It?

Overcoming the obstacles of this security principle can mitigate the damages of an attack.

Rising Public Cloud Adoption Is Accelerating Shadow Data Risks

Using a risk-based approach to deal with policy violations and continuous compliance monitoring will help avoid data exposures and fines.

Ransomware's Favorite Target: Critical Infrastructure and Its Industrial Control Systems

The health, manufacturing, and energy sectors are the most vulnerable to ransomware.

The Promise and Reality of Cloud Security