Dark Reading Daily -- April 25, 2023

Rethinking Safer AI: Can There Really Be a 'TruthGPT'?

Is Elon Musk's "maximum truth-seeking AI" achievable? Overcoming bias in artificial technologies is crucial for cybersecurity, but doing it could be a challenge.

Millions of Artifacts, Misconfigured Enterprise Software Registries Are Ripe for Pwning

Researchers find 250 million artifacts and 65,000 container images exposed in registries and repositories scattered across the Internet.

Tangled Up: 'Tomiris' APT Uses Turla Malware, Confusing Researchers

Researchers are unraveling the threads connecting two separate, but in some ways overlapping, Russian-language APTs.

Critical Infrastructure Organizations Further Affected in 3CX Breach

As investigations continue, researchers find confirmation in their suspicions of a sprawling attack affecting multiple organizations.

Cybersecurity Survival: Hide From Adversarial AI

Consider adding some security-through-obscurity tactics to your organization's protection arsenal to boost protection. Mask your attack surface behind additional zero-trust layers to remove AI's predictive advantage.

(Sponsored Article) The New Frontier in Email Security: Goodbye, Gateways; Hello, Behavioral AI

As email attackers move to more targeted and sophisticated attacks, email security needs to understand the organization, not past attacks, to keep up with attacker innovation and stop novel threats on the first encounter.

The Tangled Web of IR Strategies

Attackers have their methods timed to the second, and they know they have to get in, do their damage, and get out quickly. CISOs today must detect and block in even less time.

'GhostToken' Opens Google Accounts to Permanent Infection

A bug in how Google Cloud Platform handles OAuth tokens opened the door to Trojan apps that could access anything in users' personal or business Google Drives, Photos, Gmail, and more.

3CX Supply Chain Attack Tied to Financial Trading App Breach

Mandiant found that North Korea's UNC4736 gained initial access on 3CX's network when an employee downloaded a weaponized but legitimately-signed app from Trading Technologies.

North Korea's Kimsuky APT Keeps Growing, Despite Public Outing

Kim Jong Un's Swiss Army knife APT continues to spread its tendrils around the world, showing it's not intimidated by the researchers closing in.

LATEST FROM THE EDGE

Are Low-Code Apps a Ticking Access Control Time Bomb?

Getting a handle on the new risks facing AppSec by low-code/no-code development patterns

LATEST FROM DR TECHNOLOGY

Bot Management Aims to Tame Attacker Automation

Websites, cloud services, and API servers are seeing ever more automated traffic — aka bots — forcing companies to find ways to separate the digital wheat from the chaff.

The 10 Most Impactful Types of Vulnerabilities for Enterprises Today