company logo

Product

Our Product

We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.

Solutions

By Industry

BFSI

Healthcare

Education

IT & Telecom

Government

By Role

CISO/CTO

DevOps Engineer

Resources

Resource Library

Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.

Subscribe to Our Weekly Threat Digest

Company

Contact Us

Have queries, feedback or prospects? Get in touch and we shall be with you shortly.

loading..
loading..
loading..
Loading...

OWSAP

loading..
loading..
loading..

OWASP Reveals Top 10 Non-Human Identity Threats

Discover OWASP's NHI Top 10 framework for securing non-human identities. Learn key risks, best practices, and actionable steps to protect your systems

27-Jan-2025
9 min read

No content available.

Related Articles

loading..

AI

DeepSeek

A small Chinese startup, DeepSeek, has launched the R1 AI model, quietly shaking...

In a world dominated by AI giants like OpenAI and Google, a quiet but alarming disruption is brewing in the heart of China. DeepSeek, an unassuming startup from Hangzhou, has launched a new AI model, *R1*, that promises to challenge not just the technical superiority of Silicon Valley but the very structure of the global AI industry. While its emergence has been overshadowed by the usual headlines of AI wars, the subtle yet profound implications of *R1* are shaking up investors, researchers, and policymakers alike. At the surface, *R1* is simply another reasoning AI model, designed to tackle tasks in mathematics, coding, and logic. But scratch deeper, and it becomes clear: this isn’t just about another entrant into the AI race—it’s about how a small team, operating under tight constraints, may have just rewritten the playbook for the AI future. --- ### **How DeepSeek Did More With Less** Training an AI model like OpenAI’s GPT-4 requires staggering resources. And being conservative estimates, the cost to develop and train such models can exceed $100 million, utilizing tens of thousands of top-tier GPUs. [DeepSeek](https://status.deepseek.com/incidents/666k4t024szr), however, has achieved similar benchmarks for *R1* using just $5.58 million and a fraction of the computational infrastructure. Instead of relying on the high-end Nvidia H100 chips that power OpenAI’s systems, DeepSeek used lower-performance H800 GPUs, specially throttled for the Chinese market under U.S. export restrictions. Remarkably, *R1* doesn’t just compete—it excels. On reasoning tasks, it has been shown to outperform OpenAI’s o1 model, with initial tests suggesting up to a **20% improvement in efficiency and task accuracy** in certain benchmarks. This achievement isn't merely technical; it's political. The world is watching as [U.S. sanctions](https://www.technologyreview.com/2025/01/24/1110526/china-deepseek-top-ai-despite-sanctions/), intended to slow China's AI development, appear to have forced a pivot toward innovation rather than stagnation. --- ### **Geopolitical Undercurrents-A Model Built on Sanctioned Chips** DeepSeek’s founder, Liang Wenfeng, understood the gravity of the U.S. export controls well before they took effect. Years before the restrictions on Nvidia A100 chips were imposed, Liang stockpiled thousands of these units, ensuring his company could experiment and innovate while others scrambled for hardware. Today, it’s estimated that DeepSeek has access to **10,000–50,000 A100 units**, enough to sustain years of training cycles. But what sets DeepSeek apart is not just its foresight. It’s the way the company combined its hardware arsenal with engineering simplicity. Instead of brute-forcing computations like many Western models, *R1* uses a novel technique called _**“sparsity optimization.”**_ This approach allows it to train only the most relevant parameters of the model, slashing computational costs and enabling faster results. While this technique is gaining traction globally, DeepSeek has perfected it to the point where its models are not only cheaper to train but can also run on everyday devices. Imagine running a high-performing AI system locally on your laptop—DeepSeek has made that a reality with smaller versions of *R1*. --- ### **An Open-Source Trojan Horse?** In what some see as a strategic masterstroke, DeepSeek has taken the unusual step of open-sourcing *R1* and its smaller variants. These smaller models, which can even outperform OpenAI’s *o1-mini* on specific benchmarks, are freely available for anyone to download and use. This move has triggered a wave of excitement—and unease—across the AI community. For researchers in underfunded regions, particularly in the Global South, it’s a lifeline. Access to powerful AI models has been largely gated by expensive cloud services or high-end hardware. Now, DeepSeek is changing the rules, offering tools that can run locally on laptops without requiring an internet connection. However, there’s a darker side to this openness. Critics warn that open-sourcing such advanced models could accelerate misuse. With *R1* being available to anyone, including bad actors, questions around security and ethical safeguards loom large. Could this openness lead to unintended consequences, such as the proliferation of AI tools for malicious purposes? --- ### **Silicon Valley’s Nightmare** For years, AI development has been dominated by Silicon Valley, with companies like [OpenAI](https://www.secureblink.com/cyber-security-news/anonymous-sudan-admits-layer-7-d-do-s-attack-on-open-ai-s-chat-gpt), [Google](https://www.secureblink.com/cyber-security-news/google-reclassifies-zero-day-libwebp-vulnerability-as-critical-cve-2023-5129), and Microsoft commanding an outsized share of the industry. Their business models depend on cloud-based services, subscription fees, and tight control over access to their technology. DeepSeek’s *R1*, however, represents a fundamental challenge to this monopoly. By making powerful AI models free and [accessible](https://platform.deepseek.com/sign_up), DeepSeek is undermining the financial and technological gatekeeping that has defined the industry. Investors are already feeling the ripple effects. Since the release of *R1*, Nvidia has reportedly lost _**$600 billion in market value**_ amid concerns over how cost-efficient models like *R1* could disrupt demand for high-end GPUs. Tech insiders are calling this the "beginning of the end" for AI monopolies. If models like *R1* can deliver top-tier performance without requiring massive cloud infrastructure, the entire economic model of AI could shift—away from centralized services and toward local, distributed systems. --- ### **Innovation or Instability?** DeepSeek’s meteoric rise poses a paradox. On one hand, it democratizes AI, offering tools that empower researchers and developers across the globe. On the other, it raises difficult questions about security, regulation, and the unintended consequences of open-sourcing powerful technology. For now, DeepSeek’s *R1* [model](https://huggingface.co/deepseek-ai) remains a symbol of both promise and uncertainty. Will it usher in a new era of collaboration and accessibility? Or will it destabilize an already fragile tech ecosystem, paving the way for misuse and market chaos? As the world watches, one thing is clear: DeepSeek has changed the game. The question is whether the rest of the world is ready to play by these new rules.

loading..   28-Jan-2025
loading..   6 min read
loading..

Extortion

Data Theft

FBI warns of North Korean IT workers infiltrating U.S. firms to steal data and e...

The FBI has raised an alarming security warning about a growing cyber threat: North Korean IT workers infiltrating companies in the United States and around the world to steal sensitive data, extort firms, and exploit vulnerabilities in remote work infrastructures. These workers, often posing as legitimate employees, use sophisticated tactics to conceal their true identities, steal company source code, and demand ransoms to prevent the leaked data from becoming public. ### North Korean Cyber Workers North Korea's state-sponsored hacking operations have long been a subject of concern for global cybersecurity experts. Over the past few years, however, the FBI and other international security agencies have been monitoring a concerning trend—North Korean IT professionals (referred to as "IT warriors") infiltrating organizations by securing remote IT positions. These workers typically apply for jobs in U.S.-based companies, often through third-party staffing agencies, and leverage various methods, such as AI-powered face-swapping technology, to hide their identities during interviews. Once hired, these individuals gain access to corporate systems, where they can exfiltrate data, steal intellectual property, and compromise sensitive company information. The FBI’s warning emphasized that the stolen data is often used for extortion, with these workers threatening to publicly leak the information unless a ransom is paid. The scale and sophistication of these attacks go beyond typical data breaches. According to the FBI, the IT workers are exploiting the very mechanisms of remote work, such as virtual desktop infrastructures (VDI) and cloud services, which are becoming increasingly popular with companies. These tools, while designed to facilitate flexible working environments, inadvertently open doors for attackers to infiltrate networks with little detection. North Korean IT workers often work in large teams, accessing enterprise networks via U.S.-based “laptop farms”—remote access systems that appear to be legitimate workstations but are, in fact, operated by these threat actors. The FBI's advisory pointed out that these workers frequently use multiple IP addresses within short timeframes to access the same company accounts, making it harder to track their activities and raise alarms. The scale of this problem is significant. The FBI revealed that North Korean operatives have infiltrated at least 64 U.S. companies from April 2018 to August 2024. This long-term, coordinated effort highlights the persistence of these attacks and the sophistication with which North Korea’s IT army operates. ### Exfiltration & Extortion Tactics Once infiltrated, North Korean IT workers often target proprietary data, including source code and software repositories. The FBI identified that these operatives have copied sensitive company code repositories, such as GitHub profiles, into their personal cloud accounts, leaving companies vulnerable to large-scale theft. This is especially concerning for tech firms, whose intellectual property is central to their business model. But the threat doesn’t stop at data theft. North Korean IT workers have also been accused of using insider knowledge to extort their former employers. After being discovered and dismissed, these operatives leverage the data they exfiltrated to threaten companies with the public release of confidential or damaging information unless a ransom is paid. These extortion attempts are becoming more frequent, with firms being blackmailed into complying to avoid reputation damage. “The extent to which North Korean IT workers are infiltrating organizations is increasingly troubling. Not only are they stealing valuable intellectual property, but they are also turning the stolen data into a weapon, holding companies hostage to their ransom demands,” said Michael Barnhart, a principal analyst at Mandiant. ### Protecting Against the Threat: FBI's Guidelines To mitigate these risks, the FBI has outlined a series of best practices for organizations to follow. Central to these recommendations is the application of the principle of least privilege—ensuring that employees and contractors only have access to the data and systems necessary for their work. This includes disabling local administrator accounts, limiting the permissions for remote desktop applications, and implementing strong network monitoring systems to detect abnormal access patterns. The FBI also advised organizations to regularly review network logs, looking for signs of data exfiltration, particularly from shared drives, cloud accounts, or code repositories. It also emphasized the need for robust hiring practices, including thorough identity verification during the interview and onboarding processes. “The key to preventing these attacks is to scrutinize every aspect of the hiring process, especially for remote positions,” the FBI advisory noted. “Companies should cross-check resumes, verify educational claims, and ensure that applicants’ identities are genuine.” ### Hiring Protocols With North Korean IT workers using advanced techniques to falsify their identities, organizations must bolster their hiring protocols. One of the most critical steps in preventing infiltration is ensuring that third-party staffing firms are performing rigorous background checks on all applicants. Additionally, companies are urged to use “soft” interview questions to ask applicants about specific details regarding their educational background or location, as North Korean IT workers often claim to have attended non-U.S. educational institutions. Another strategy involves keeping the hiring process as in-person as possible, especially for candidates who will be working remotely. While this can be challenging in a remote-first environment, companies can use video calls and other technologies to verify the authenticity of applicants. ### Beyond the U.S. The problem is not confined to the United States. North Korean IT workers have infiltrated organizations worldwide, with significant concerns in South Korea and Japan. Both countries have issued warnings about the growing risk posed by these operatives. As the FBI’s advisory indicates, it’s not just companies in North America that are being targeted—North Korea is expanding its operations into Europe, where it is easier to deceive candidates who are unfamiliar with such sophisticated ploys. The global nature of the threat is also underscored by the growing number of countries offering rewards for information that could help disrupt the activities of North Korean front companies. The U.S. State Department has placed a reward of up to $5 million for information leading to the arrest or disruption of North Korean cybercriminals. ### A Coordinated Global Effort In response to this escalating threat, the United States has coordinated with its allies, including South Korea and Japan, to enhance cybersecurity intelligence sharing and collaborative defense strategies. These efforts aim to dismantle North Korea’s cyber infrastructure, which has been used to fund the regime’s activities through illicit remote IT work schemes. The joint statement issued by the three countries last week revealed that North Korean state-sponsored hackers were responsible for stealing over $659 million in cryptocurrency in 2024 alone, further emphasizing the scale and reach of their operations.

loading..   25-Jan-2025
loading..   6 min read
loading..

Zero Click

Discover how a critical flaw in Cloudflare’s CDN exposes users’ general location...

Digital privacy, a fundamental aspect of online interaction, is facing heightened scrutiny after a flaw in Cloudflare’s content delivery network (CDN) was discovered. This vulnerability has raised alarm among privacy advocates due to its potential to expose users’ general locations, emphasizing the urgent need for stronger security measures. The vulnerability, discovered by security researcher Daniel, underscores the fragility of online security and the ease with which attackers can exploit widely-used platforms like Signal and Discord to expose a user's geographic region. This critical flaw not only jeopardizes individual privacy but also raises broader questions about tech giants' accountability in ensuring their platforms' safety. It brings into focus the regulatory and legal responsibilities of these companies, challenging them to address vulnerabilities in their systems while maintaining user trust. Furthermore, the issue underscores the need for industry-wide standards to prevent similar flaws from being exploited in the future. Let’s dive into the nuances of this alarming discovery and its potential implications for millions of users worldwide. ### **Flaw That Exposes General Locations** Daniel’s research highlighted a significant vulnerability in how Cloudflare caches media resources. Specifically, Cloudflare's system identifies the closest data center to a user and caches media files there to optimize speed and reduce latency. This approach, while efficient, inadvertently exposes location information because the data center handling the request can be linked to the user's approximate geographic region. For example, if an attacker knows which data center processed a request, they can use its location to infer the user’s general whereabouts. The CDN, designed to optimize load times by routing data through the nearest data center, inadvertently enables attackers to approximate a user’s location within a 250-mile radius. An attacker can identify the victim's general location by simply sending an image to a target via platforms like Signal or Discord. This stealthy tactic becomes even more concerning when paired with apps that automatically download images, rendering it a zero-click attack. #### **How the Attack Works** 1. **Media Caching**: Cloudflare caches media files in the nearest data center to reduce latency. 2. **Payload Delivery**: An attacker sends a malicious image file to the target via messaging apps that support auto-downloading. 3. **Location Extraction**: By exploiting the Cloudflare data center’s location, the attacker determines the victim’s approximate geographic region. “Three months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250-mile radius,” explained Daniel. “The attack is effective within seconds, and the target wouldn’t even know they’re being tracked.” --- ### **Who Is at Risk?** While the attack is inaccurate enough for pinpointing specific addresses, it still poses a significant threat to individuals who value their privacy. Journalists, activists, dissidents, and whistleblowers are particularly vulnerable, as their safety often depends on remaining anonymous. Even cybercriminals and individuals under investigation could find themselves exposed, presenting both risks and opportunities for law enforcement agencies. #### **Targeting High-Profile Users** During his experiments, Daniel tested this vulnerability on Stanislav Vishnevskiy, CTO of Discord. The results highlighted that Cloudflare’s anycast routing—which utilizes multiple nearby data centers—can enhance accuracy around densely populated areas. In rural regions, however, the precision decreases due to fewer data centers. ### **Platform Responses** Daniel disclosed his findings to Cloudflare, Signal, and Discord in December 2024. The responses from these platforms reveal a concerning lack of uniform accountability. #### **Cloudflare’s Action** Cloudflare addressed the vulnerability by patching its Workers bug and awarded Daniel a $200 bounty. However, Daniel discovered that using a VPN in conjunction with a tool called Teleport could still bypass the fix. By leveraging a VPN with **3,000 servers** across 31 countries, he was able to access 54% of Cloudflare’s data centers, covering most major population hubs. A Cloudflare spokesperson stated, _“This was first disclosed in December 2024 through our bug bounty program, investigated and immediately resolved. We believe bug bounties are a vital part of every security team’s toolbox and encourage researchers to report such activities.”_ #### **Signal and Discord’s Dismissal** Signal and Discord, however, distanced themselves from the issue. While both platforms argued that the flaw lay within Cloudflare’s infrastructure, they could still explore implementing additional safeguards, such as stricter content delivery policies or transparency features, to better protect their users. Their dismissal has left privacy-conscious users questioning whether these platforms are doing enough to address secondary vulnerabilities that may arise from external dependencies. Both platforms argued that the flaw lay within Cloudflare’s infrastructure and was beyond their control. Signal further noted that implementing network-layer anonymity features falls outside its mission’s scope, leaving users with few solutions for enhanced privacy. This lack of coordinated action among platforms has left privacy-conscious users questioning the reliability of the services they rely on daily. ### **Implications for Privacy** The flaw raises critical questions about the balance between performance optimization and privacy. Similar trade-offs exist in other technologies, such as social media algorithms that prioritize engagement over mental health or data analytics tools that optimize business outcomes while risking user data exposure. These examples highlight a recurring challenge in the tech industry: how to maximize utility without compromising essential values like privacy and security. Cloudflare’s caching mechanism is a boon for faster load times, but at what cost? #### **Privacy vs. Performance** CDNs like Cloudflare have long been lauded for improving web performance, but this vulnerability highlights the trade-offs involved. With attackers exploiting caching mechanisms, the very tools designed to enhance user experience are now endangering privacy. ### **What Can Users Do?** While the responsibility for resolving such vulnerabilities largely falls on tech providers, users can take steps to protect their privacy: 1. **Use VPNs**: A reliable VPN can obscure your actual location, reducing the accuracy of geo-locating attacks. 2. **Disable Auto-Downloads**: Turn off automatic media downloads in apps like Signal and Discord. 3. **Stay Updated**: Ensure apps and devices are running the latest versions to benefit from security patches. 4. **Choose Privacy-Centric Tools**: Opt for platforms that prioritize anonymity and encryption.

loading..   23-Jan-2025
loading..   6 min read