Like a sleeper cell awaiting activation, a never-before-seen Windows backdoor dubbed Sleepwalker waits silently in memory for one specifically crafted network packet to wake it up and deliver commands using the malware's 23-instruction language. The commands can do everything from running code directly in memory to moving data off the computer. Malware researcher Dominik Reichel discovered the passive backdoor, which also has its own command language, and detailed Sleepwalker in a technical analysis on Monday. “What makes it worth writing up is what that packet carries: not a readable command, but a short program written in a command language of the backdoor’s own design,” Reichel said. “Its 23 instructions cover scheduling, several ways to move data, staged file delivery and running code directly in memory. Recovering the encryption key is not enough to understand one of these programs. The internal command language must be reverse engineered as well.” In addition to having its own command language, it's also notable that the remote host can be a VMware VMCI target instead of a normal network address. “Taken as a whole, the approach here is consistent with a targeted, well-resourced operation rather than an opportunistic one,” Reichel wrote. The malware, hidden inside a 64-bit Windows DLL file, impersonates Microsoft's dpapi.dll, part of Windows' data protection API for protecting sensitive data. It exports the same seven functions as the real dpapi.dll, but attempts to forward calls to a file named dpapisvc.dll, which is not a real Windows component. The file also has a forged ESET Management Agent version resource, and loads via side-loading into ERAAgent.exe, the Windows executable for ESET Management Agent. After confirming that its host process is named ERAAgent.exe, Sleepwalker goes to sleep inside the computer's memory, which also helps it remain hidden from traditional anti-virus tools. Unlike most backdoors, which call back to an attacker-controlled command-and-control (C2) server and start receiving commands, Sleepwalker lies in wait, checking every packet that passes through the network looking for a specific pattern - this is called a magic packet. Once it sniffs out a packet that matches the exact pattern, the backdoor decrypts the data and treats it as a command. “Because the backdoor never sends anything out on its own and does not open any obvious listening port by default, tools that watch for connections to known-bad domains or unusual outbound traffic will not see anything unusual,” Reichel wrote. “The absence of outbound connections to known-bad infrastructure does not rule out an infection, either. A machine can be fully compromised by this backdoor while producing nothing at all for a network monitor to flag.” Hidden commands Every command sent to the backdoor is encrypted using AES-256-CCM, and the command language is unique in that, once decrypted, it is neither text nor a document. Instead, each command is a short sequence of raw bytes, and it only makes sense when read in a specific order. Reichel’s write-up includes a key that shows how to read the bytes, and each of Sleepwalker’s 23 instructions is written in this command language. Some of the instructions carry an inner program. For example, a scheduler can also contain a network listener, with a routine that waits for a particular file to be assembled and checked before it will run on the compromised computer. Beyond the two magic-packet sniffing instructions and basic instructions - such as an exit command that stops all running programs and the packet listener, and an instruction that starts a second, smaller program running concurrently with the parent program - the backdoor has multiple others. These include four instructions on sending and hiding data. One of these opens a TCP connection to a chosen address and port, and then sends a block of data to a remote host, which can be a VMware VMCI target instead of a normal network address. Another one writes a block of data to a Windows named pipe on a chosen computer, and can optionally log in with a username and password first. Five other instructions focus on inbound task reception, such as waiting to receive - or reaching out on its own - a follow-up instruction, opening a TCP or UDP port, or creating and/or connecting to a named pipe. Additionally, the malware has five different instructions on building and running programs. A lot of unknowns…and detection tools As Reichel notes, however, a lot remains unknown about Sleepwalker. “I have no collection context tying the file to a confirmed intrusion, so I cannot identify a victim, industry, country or affected organization,” he wrote. While we know that the DLL is designed to execute via side-loading after being placed beside ERAAgent.exe, we don't know how the malware operator first gained access to the computer or delivered the malicious file. We also don’t know the operator or developer, or what post-compromise activity, if any, took place. “I found no related code that would support attribution to a known group, and this one sample cannot establish when or how widely Sleepwalker was deployed, whether variants exist or whether it belongs to a continuing campaign,” Reichel wrote. Perhaps most importantly, for anyone who believes that they may be infected with Sleepwalker or a related malware sample, Reichel wrote, “I have created a toolkit to help decode its bytecode, examine encrypted and network artifacts, summarize behavior and indicators and safely reproduce its receiving pipeline without executing commands or transmitting traffic,” urging targeted individuals to contact him. He also created a mitigation guide, with a remediation script for use after Sleepwalker is detected.®

If you're curious how easily tech companies can fingerprint your browser and device and potentially single them out from the crowd, a new utility Glassbox will show you. Aside from pinging a public geolocation API, it runs entirely in a user’s browser and doesn’t ship any info out to the web while acting just like all the various trackers, anti-fraud scripts, and other browser fingerprinting tricks one is likely to encounter online. Unlike some other available tools that do the same, Glassbox provides a whole bunch of raw, unfiltered data you can sift through to see what makes your browser stand out, along with an estimate of how identifiable its fingerprint may be. In this vulture’s testing, Glassbox's estimate ranged from 99 percent in the Chrome window I use daily for work to a low of 56 percent in Tor Browser with an active circuit. “The ‘identifiability’ number is an honest model, not a measurement,” Glassbox developer David Dale said of his tool in a Hacker News thread. “It sums published per-signal entropy, discounts your browser masks, and caps at the ~33 bits needed to single out one person on Earth.” Dale added in the thread that, since it runs locally, that identifiability number is an estimate, as Glassbox doesn’t have a live population to pull against. AmIUnique and the EFF’s Cover Your Tracks, the other tools mentioned above, provide real population numbers, he noted. Dale got the idea for GlassBox after learning about silent sawtooth waves used by fingerprinting code found on Alibaba's AliExpress site to identify browsers using audio. Rather than fork one of the existing open source tools - both EFF's Cover Your Tracks and AmIUnique have GitHub repos - he decided to build his own, with some help from AI. “I'm a solo entrepreneur and long-time security engineer; tools like Claude Code have made it much easier to polish ideas and offer the useful ones to a wider audience,” Dale told us in an email. “I knew a fair number of fingerprinting methods but not that one, and I wanted to see all of them in one place, running against my own browser,” he said on Hacker News. In other words, Glassbox factors Alibaba’s tricks into its identifiability estimates alongside 30 other probes for unique browser data - things like canvas, WebGL, font libraries, WASM features, API matrices, and cross-site login states. According to Glassbox, my particular Chrome session I use for work is unique to around 1 in 7.6 billion browsers, and my IP address narrows that further (my ISP apparently uses IPv6, making me even more identifiable). As for which browsers appear to be safer, I have Safari, Edge, Firefox, and Tor on my machine alongside Chrome; Firefox and Tor are the only ones that didn’t label me “effectively unique,” giving me estimated identifiability ratings of 89 and 56 percent, respectively. What that means is that I share the same fingerprint as 1 in 681 million Firefox users and 1 in 408 thousand Tor users - that still doesn’t exactly make me a ghost online, but it definitely puts me in a pool much larger than Chrome, Edge, or Safari. Again, those are estimates, Dale reminded us, not a hard truth as, he says, “a no-server tool [can’t] measure true rarity.” “The single highest-impact move is to use a browser that puts you in a large, identical crowd,” Dale explained in an email. “Counterintuitively, a heavily customized ‘hardened’ setup often makes you more identifiable, because almost nobody else looks exactly like it. Blending in beats standing out.” Aside from using a browser that does a good job of obfuscating its user, Dale said a VPN or Tor is a must, as is finding a way to close the WebRTC leak that has long dogged internet users and leaves browsers identifiable through some VPNs thanks to being enabled by default in most web browsers. Glassbox includes a page of suggestions for how to anonymize yourself online, and let’s face it: With everything from invisible pixels to silent sound waves doing their damndest to figure out who’s behind a browser in order to make money off them, that’s more important than ever. ®

A suspected Iran-linked cyberattack shut down a small UK power plant around the time that a series of digital intrusions disrupted American water utilities across 12 states. A British government spokesperson confirmed the hack to The Register on Monday and told us that the security incident affected a “small-scale energy generator.” “At no point was there a risk to the wider energy system,” the spokesperson said, adding that the UK’s energy system is “highly resilient,” and that the government works “closely with the energy sector to protect infrastructure.” In a series of xeets about the cyberattack, UK Energy Minister Michael Shanks said that his department briefed energy CEOs after the incident and “shared further advice with companies on the steps they should take to stay secure.” Government officials did not disclose which power station shut down, and the UK has not formally attributed the cyberattack to Iran - or any other government or hacking group. The Telegraph, which first reported the news, said that the incident shut down the power plant for four days in what is believed to be the first disruptive Iranian cyberattack of its kind in the UK. In late July, suspected Iranian cyber operatives disrupted more than 30 water facilities in Minnesota, with similar intrusions subsequently reported across at least 11 other US states. While neither state nor federal officials have attributed these hacks to Iran, private-sector threat analysts have told The Register that Iran is “almost certainly” behind these breaches, which are a direct response to the ongoing Middle East conflict. While these earlier water-system intrusions didn’t appear to have an AI assist - most or all of the American utility cyberattacks involved internet-connected programmable logic controllers (PLCs) - last week the feds warned that attackers are now using AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series PLCs at water, manufacturing, energy, and other critical facilities. “This is not a theoretical risk – it is an active threat,” the FBI and four other federal agencies warned. “This appears to be a continuation of the same suite of activity we suspect is affiliated with Iran targeting PLCs,” Cynthia Kaiser, Halcyon Ransomware Research Center SVP and a former FBI cyber analyst, told The Register. “Iran-affiliated actors and adversaries are actively targeting a wide swath of operational technology because these PLCs underpin essential health, safety, and critical infrastructure across society,” Kaiser said. ®

Developer Matt Callaghan claims he caught Alibaba's B2C website, AliExpress, trying to track web users by playing sounds through browsers vulnerable to audio fingerprinting. The software engineer drew attention to the issue late last week after investigating why his Bluetooth headphones stopped playing music whenever he visited the AliExpress website. “Recently I ran into a strange problem with my Bluetooth headphones,” Callaghan wrote. “They support multipoint Bluetooth audio, so they can be connected to my PC and phone at the same time. Normally, the PC takes priority playing audio, with my phone being able to play audio when nothing is playing on the PC. “Usually I listen to music on my phone but with notifications or YouTube playing through the PC, this works reliably until I open an AliExpress page in Firefox or Chrome. “Shortly after loading the AliExpress homepage, audio from my phone would stop playing. Closing the AliExpress tab fixes it immediately. Muting the tab/Firefox/Windows does not help, and there is no visible video, music, or other media playing on the page.” Callaghan tried to find any hidden conventional media elements but found nothing. Further digging revealed two audio scripts that he said were “extremely obfuscated” within AliExpress's browser security and anti-abuse tooling. He said the scripts built a WebAudio graph that introduced a sawtooth oscillator to generate a waveform, an analyzer to measure the result after the waveform passes through a browser’s audio implementation, and a script to read the associated frequency data. The scripts set the audio’s gain to zero, meaning the end user won’t hear anything, but the WebAudio graph will still be processed by the browser. “This is very different from an autoplaying video,” said Callaghan. “There is no media element for the browser's normal tab mute control to stop. As far as the page is concerned, it is performing live audio processing. “In my case, that appears to have been enough for Firefox or Windows to keep the Bluetooth audio path active, preventing my multipoint headphones from switching cleanly back to the phone.” Callaghan found further evidence in the code looking for data related to screen dimensions, device memory, browser plugins, WebGL rendering, mouse events, and more. As well as signs that AliExpress is encrypting data and sending it to its telemetry services, the developer said all of it amounts to “a fairly comprehensive browser and device fingerprint.” The Register has asked Alibaba to comment. Despite Callaghan saying he could reliably reproduce this issue on both Firefox and Chrome, Firefox issued a Xtatement saying its anti-fingerprinting technology thwarts AliExpress’ tracking tricks. It pointed to a blog post from Tom Ritter, a security engineer on the Firefox team, who explained that as of version 118 (September 2023), the protections it introduced eliminated the efficacy of WebAudio-based fingerprinting. These protections are not designed to stifle fingerprinting efforts at the source. Instead, they work to group all users together, making it look like all fingerprinted users are the same, effectively nullifying the tracking attempts. For 99.24 percent of users, they fall into one of three “buckets” – user categories delineated by types of hardware. The vast majority fall into buckets one and two: Bucket one: x86/x64 CPUs lacking FMA (Fused Multiply-Add) instructions Bucket 2: x64 CPUs with FMA instructions And for the remaining 0.76 percent, the fingerprinting script failed entirely, according to Firefox’s data. However, Ritter said there are 48 users worldwide who do not fall into the three buckets, or the 0.76 percent whose machines did not allow the scripts to run. These 48 users fell into 23 other minuscule buckets, which means they are not grouped into the masses like the rest, and so fingerprinting is more effective on this vast minority of users. “This is very unfortunate, as it makes these users completely unique, but it is also not terribly unusual - computers are weird and these results could have been caused by bad RAM, a CPU bug, or possibly some crazy architecture (LoongArch??),” said Ritter. “But at the end of the day, WebAudio fingerprinting is nearly useless. I don't expect browser fingerprinting to disappear from websites entirely (unless some regulatory action occurs, fingers crossed) - it's still going to be effective against a majority of users on the web, but at least for privacy-focused browsers, it should be wildly less effective.” Brave, maker of the eponymous privacy-centric browser, also Xeeted a response to Calalghan’s findings, saying it has protected users from fingerprinting for six years. “Brave injects random data into the browser's output so you show a different fingerprint to different sites. This fingerprint also resets across sessions. “For added protection, we also block the specific scripts used by AliExpress for the tracking method mentioned above. Again, this is done by default for all Brave users. You don't have to change any settings to be shielded from this audio fingerprinting.” Ritter said Chrome and Safari “probably have defenses against this [brand of fingerprinting].” Safari deploys Advanced Tracking and Fingerprinting Protection to prevent WebAudio-based tracking and other methods of fingerprinting. It works differently to Firefox, though, injecting audio errors into an audio buffer, instead of trying to lump all users into an identical bucket. Chrome, on the other hand, does not aggressively protect users from fingerprinting, as privacy consultant Alexander Hanff said earlier in the year. "There are at least thirty distinct fingerprinting techniques that work in Chrome right now, today, as you read this," he wrote. "Not theoretical attacks from academic papers that might work under laboratory conditions – real, production techniques deployed on millions of websites to identify and track you without your knowledge or consent." ® Updated 08/25 at 1805 GMT to clarify the behavior was observed on AliExpress, which is Alibaba's B2C web site for small-scale purchases.

Are you sick and tired of maintaining a password manager? Struggling with choosing the right one for you? Well, readers who live Down Under can get themselves down to their local AusPost branch where they can pick up an old-school alternative for just AU$4.90 (US$3.51). Password books are something of a historical relic, phased out largely because of the scrutiny associated with using one and the now-gray-haired elders who once scoffed at the mere notion of such an opsec crime. They might not be able to suggest a strong password for each of your many online accounts, and they won’t do you much good if your house is burgled, but you could argue that there is still value to be found in a pen-and-paper password vault. That’s exactly the conclusion drawn by the thousands of social media users who flocked to a post this week from one Australian who found stacks of password books for sale in their local post office. Small books are priced at AU$4.90 (US$3.51), while larger options will set you back a dollar extra. Granted, there are myriad issues associated with relying on a physical document for digital account security. For one, it’s a single point of failure. Lose the book or have it stolen, and it’s a painful road to restoring access to all your accounts. One could argue that if it’s kept inside the home and it’s stolen, then you’ve got bigger problems on your hands, but perhaps that’s not as true nowadays, when so many of our valuables are either stored or primarily accessed online. That said, it might bring a quick end to a hostage scenario – the type that is becoming all the more common as crypto wealth becomes increasingly common. Password books are also not as easily manageable as a modern password manager. The technological equivalent can auto-fill credentials, auto-update them if they’re found in public breaches, and suggest unique, strong strings to minimize the risk of compromise. You can’t store a passkey in a password book, either – a major issue now that the world is transitioning toward the new authentication standard. But using a password book no longer carries the same stigma as it once did among infosec types. The general consensus, gleaned from the hundreds of social media comments on the post, now seems to be that there's little wrong with storing passwords on paper at home. It’s certainly more secure than reusing the same weak password across multiple accounts, provided the book contains strong strings unique to each website. With the prevalence of infostealers nowadays, it's far more likely that crims will use a weak, reused, seldom-changed password to break into an online account than burgle a house to gain access to someone’s online banking. Plus, as many pointed out, it’s a much better route than writing passwords in a cloud document, which can be accessed by any device that has access to it – think Apple Notes, Google Docs, etc. At work, though, it’s probably best to stick to the password manager, the IT guys say. Mistakes by staff working at even the lowest rungs of the corporate ladder could lead to multimillion-dollar cyberattacks should that password book fall into the wrong hands. Pentesting consultants often send hired white hats to breach a company’s office and extract whatever value they can, sometimes through piss corridors. Such access can lead to malicious USB sticks dropping malware, bugs planted near the water fountain, and even someone stealing the password book from your desk drawer. Don’t believe it’s real? Security consultant Alethe Denis told us two years ago that’s exactly how her pentest team was able to surreptitiously extract corporate data over a company’s own Wi-Fi for over a week. They went dumpster diving, got the Wi-Fi creds, walked straight into a conference room, and deployed a data-stealing implant. In and out, all using physically stolen secrets. Helpful in the worst of times So, yes, password books contain plenty of potential pitfalls, Poignantly, however, they often prove invaluable in the event of a loved one’s passing. Having access to a password book, or at least some sort of plan to share passwords in the event of a death, is vital to ensuring family and friends have space to grieve without going through the arduous process of recovering an account through a platform provider, or via the courts. A slew of Redditors agreed, saying it made the whole process so much easier. One shared the tale of how their mother’s own special way of storing passwords resulted in a treasured family investigation. After password books spent years as outcasts of the cybersecurity world, they’re now having a second moment in the sun. And while the leading minds in cybersecurity are busy working on ways to stop phisherfolk from hacking into your accounts, or rogue AI agents from doing the same, there’s still something to celebrate in the safeguards of yesteryear, both in life and death. ®

AI agents excel at hacking organizations, as they’ve demonstrated in real-life attacks multiple times over the past few weeks. They also expose a whole new attack surface for organizations trying to protect against both human and AI intrusions. As if defenders needed more worries to keep them up at night, agents introduce new data-integration channels that attackers can abuse. They also introduce a new type – and ever growing number – of non-human identities that are difficult to manage and can bypass traditional, static security policies. “There is tremendous risk associated with agentic AI and machine identities,” Matt Hartman, former acting head of cyber of the US Cybersecurity and Infrastructure Security Agency (CISA), told The Register. “As AI moves from generating content – yesterday's use case – to taking actions, it is inevitable that agents are going to receive access to sensitive systems and sensitive data,” Hartman said. “One area where organizations are struggling today is that they're going to need to treat every agent as a privileged identity.” Enterprises also face agentic threats from outside their organization, he added. “AI-enabled or AI-amplified identity and social engineering attacks are increasing significantly by the minute,” Hartman said. “We're seeing very highly personalized phishing, very good impersonation, automated reconnaissance. That really makes traditional indicators of trust increasingly unreliable.” For defenders, this means a “continued focus on strong identity, on phishing-resistant authentication, on behavioral signals, and on zero-trust principles therein,” he added. “Nothing deeply new here - but it is a whole new attack surface.” Meanwhile, on the attackers’ side, agents don’t take time off, and they remain singularly focused on completing a task, whether that’s finding vulnerabilities and exploit chains or mapping networks and identifying sensitive files. All of this makes these near-autonomous attack bots a gift from the heavens for financially motivated criminals and government-backed cyber operatives. It also presents a security use case for defenders: agentic red teaming. As former NSA cyber boss Rob Joyce said during a talk at RSAC: if you aren’t using AI agents to attack your own organizations, you can bet that someone else is. “You are going to be red-teamed whether you pay for it or not,” Joyce said. “The only difference is, you know who gets the results delivered to them.” Hartman echoed Joyce’s words. “What we are seeing as the leading capabilities to help defenders – there is a burgeoning market for continuous, AI-native, AI-enabled, automated red teaming and pen-testing,” he told us. After spending nearly two decades in the federal government at CISA, Hartman joined Merlin Group in October as its chief strategy officer. In his new private-sector role, he helps determine which early- to growth-stage cybersecurity and emerging technology companies the group invests in, and then works with these firms to navigate government, critical infrastructure, and other highly regulated markets. The goal is to integrate and scale “promising technologies” into critical environments, Hartman said. Right now, most of these technologies use AI agents to fight AI agents. “Organizations are just inundated with vulnerabilities, and adversaries are able to leverage AI to find vulnerabilities and exploit them in seconds when it used to take days,” he said. Agentic red teaming “is a category of products that every organization, including federal agencies, absolutely needs in the near term just to keep pace.” 'Largest controlled live AI cyberattack on record' Mandiant founder and former CEO Kevin Mandia has a new company, Armadin, which launched in March with a startling $190 million in seed and Series A funding. The firm builds and trains autonomous attacker swarms – thousands of AI agents that run 24/7 in organizations’ infrastructure to simulate real-life attackers. Ahead of Black Hat earlier this month, the startup said it and Tenex.ai, an agentic security operations provider, executed what they called the “largest controlled live AI cyberattack on record” for an unnamed “leading” global institution. Over the three-day attack, Armadin's swarm generated 17 million offensive actions, discovered 38 validated attack paths, and produced 238 security findings. Tenex.ai's agentic platform separately triaged 100 percent of 101,169 alerts and reconstructed the entire attack across 231 billion raw events. This exercise, we’re told, would have taken a five-person analyst team about 2,400 hours – or four months – to pull off. Co-founder and Chief Offensive Security Officer Evan Peña was the global red-team lead at Mandiant before co-founding Armadin. At Mandiant, he led a 210-person team whose members spanned the globe. “The problem was it was 100 percent human-led security assessments, and that would generally limit the amount of time that we would have,” Peña told The Register. His red team “would do a couple weeks or a one-month engagement, and then we would report on the engagement, give them a PDF file, walk away, and they would hire us again in a year. In today’s age of AI, it’s very archaic to think about that when we can scale so significantly with AI.” Attack yourself before someone else does At Armadin, Peña leads the human team that trains the AI agents. One of the lessons learned from OpenAI’s models autonomously attacking Hugging Face, according to Peña, is that organizations need to perform safe offensive AI attacks against their own systems. "Safe" is the keyword here: remember OpenAI’s rogue models intentionally didn’t have any guardrails in place. Yes, his statement is self-serving as it's core to Armadin's business. But he’s not wrong. “Organizations can cover so much more attack surface because we are able to leverage these agents at scale, and we have three things that we didn’t have before,” he said. “We have more time, because agents don’t sleep and they don’t take holidays. There’s no workforce requirements for them.” Number two, he said, is expertise. Attack agents need pre-training before they are set loose on organizations’ infrastructure. They need to know how to code, and perform source-code review. They need to know how to do application security, how to spot network misconfigurations, and hack into different systems and networks. “And then you add post-training to that from human expertise,” Peña said. “Number three is coverage,” he said. “We were only able to cover a finite amount of attack surface in the past. So if you had 10,000 external systems with a limited amount of time and humans, you could maybe cover 2,000 or 1,000 of those within that particular period of time. Now we can cover all 10,000 in probably hours.” Armadin’s AI agents have broken into every single customer’s environment, according to Peña. “We have found over 50 zero-days, and by zero-days, I don't just mean this zero-day allowed you to deface a web page. That’s cool, but I want to break into your network from the internet,” he said. “The zero-days I'm referring to allow an attacker to get remote code execution on an actual system. They're very high-impact zero-days. We don't care about noise, we care about impact.” Quarterly pen-testing doesn't cut it anymore The biggest challenge these days for defenders is the scale and speed AI brings to previously manual attackers’ dirty work – like scoping potential victims, performing reconnaissance, identifying vulnerable systems and exploits, and reading logs. Now all of these tasks can be automated. Penetration testing needs to keep up, Jay Bavisi, founder and group president of EC-Council, told The Register. The largest and best organizations do pen-testing once a year to meet compliance requirements, and “the better ones” run these exercises quarterly, Bavisi said. This is largely because human-led pen-tests take about three months. “So you have a serious problem with speed,” he said in an interview. “Then comes the second problem, which is scope. Nobody pen tests the entire organization.” There’s also what Bavisi calls a “sophistication problem,” because different human pen-testers will produce varied results, and organizations can’t hire hundreds of thousands of humans to try to break into their networks on a continuous basis. “The bad guys are already using AI to get rid of the speed problem. You pen-test once a year for compliance. They do it all the time because you're a gold mine. They don't have a scope problem because they're not just looking at the crown jewels - they're looking at your entire organization. And they don't have a sophistication problem because they're using algorithmic systems.” In June, the global cybersecurity training organization began offering pen-testing professionals a sponsored attempt to take the CPENT AI examination, and upskill themselves for the AI era. For every participant who passes, the council donates $1,000 in cybersecurity training and certification credits to nonprofit partners. For every completed training program, regardless of an exam pass or fail, the nonprofits get $250, and all of this has a $1 million max. “The traditional model of pen-testing once a year or once a quarter, that’s going away, and AI will take over with automated pen-testing,” Bavisi said. “But will the role of pen testers vanish? No, it will not. It will evolve into something much bigger and something far more important.” AI systems and AI-integrated applications mean there’s a lot more for security professionals to try to break and break into, and humans need to determine: What is the result of this system breaking? What’s the business impact? What do I prioritize fixing? “The present pen-testers have to be reskilled into understanding business impact and being able to make those important engineering decisions,” Bavisi said. Meanwhile, “offensive AI security professionals are the ones that are going to have to test the robustness of AI systems, because AI systems will become the heartbeat of organizations,” he added. “Pen-testers have to become masters of testing LLMs, understanding agentic behavior, thinking about what is the harm taxonomy, figuring out what kind of guardrails did we put in place.” The job of pen-testers has changed, in other words. “It now has a far wider scope.” ®

One of the best ways to lower your AWS bill by 99 percent or more is by not checking your keys into public GitHub repositories. Many of us have done this inadvertently over the years, and the defenses against it have improved dramatically (my personal favorite being "using non-ephemeral credentials derived from OIDC or SSO is an anti-pattern"), but it still happens. On Friday, BleepingComputer reported on a Truffle Security finding that hundreds of leaked AWS keys are root keys and are somehow still active and valid. AWS Security is full of very smart people who care deeply about a number of things, including "not abetting crime." If they detect (usually via automated means) that a credential has been leaked, they're quick to apply a Quarantine Policy to it. Trouble is, that policy enumerates a bunch of bad behaviors in an ever-expanding graph of principals and associated behaviors. AWS' considered position on this is that they don't want to break customer environments: "The policy aims to limit the potential damage that may be caused by fraud-related activity leading to unauthorized charges, while not impacting the existing resources." AWS' considered position on this is wrong. If I get access to your credentials (much less a root credential, good god), deactivating them may very well break your workload because anything that relies on those credentials will start failing. Until you rotate them, those workloads will continue to fail. That's not good! But I promise you, as a bad actor, I can do far worse to you. Hold my tea Go ahead and apply a quarantine policy to a credential set and toss it my way. I won't be able to buy savings plans, read your S3 data, modify Lambda functions, and do a host of other things. But here's what I can do. Anything I damn well feel like on RDS. You don't have anything important in databases, right? ssm:SendCommand / ssm:StartSession are permitted, which means I can run commands as root on EC2 instances, which will in turn invoke with that instance role’s permissions. sts:AssumeRole means that I can assume any other role in the account and get its permissions, rendering the entire restriction list potentially moot. I can use autoscaling:CreateAutoScalingGroup / UpdateAutoScalingGroup to launch instances via the Auto Scaling service-linked role, so the ec2:RunInstances deny never applies. cloudtrail:LookupEvents gets denied (that'll stop you from... reading the audit log), but I can call both cloudtrail:StopLogging and DeleteTrail which do exactly what you expect; you don't have an audit log anymore. SES denies ses:GetSendQuota / ListIdentities actions, but y'know what's missing? SendEmail, so I can blast my spam out to your entire list. sns:GetSMSAttributes means I can't get your SMS configuration, but I can absolutely sns:Publish to send fraudulent text messages wherever I'd like. s3:DeleteObject gets denied, but s3:PutObject is allowed. I can't delete your data, but I can fill a bucket to petabytes. Next, they fail to block s3:PutBucketVersioning, s3:PutObjectLockConfiguration, s3:PutObjectRetention, and s3:PutObjectLegalHold. So on any existing bucket, like that one I just stuffed petabytes into, I can enable versioning, turn on Object Lock, and set a bucket-default COMPLIANCE-mode retention out to 2126, or alternatively slap it on per object. COMPLIANCE retention can't be shortened or removed by anyone, including the account root and AWS Support. The only way to remove it is to delete the entire AWS account. secretsmanager:GetSecretValue, ssm:GetParameter* (WithDecryption), and kms:Decrypt are all unencumbered, so your secrets are now my secrets. Sharing is good! Backups are important, so it's a shame you don't have any. Well, not after I kick off backup:DeleteRecoveryPoint / DeleteBackupVault, and rds:DeleteDBSnapshot. If you're using CloudFormation, and for some things you almost certainly are, cloudformation:DeleteStack going unmentioned means you're not using it anymore and all of your stacks are gone. I would make different choices This isn't a comprehensive list - just a few things that occurred to me over the course of about an hour. I'm not a bad actor; I'm almost positive that I'm missing a whole bunch. AWS is almost certainly going to change this. My question for them is simply, "how big of a customer incident needs to happen before you do?" ®

CISA has ordered US federal agencies to patch two exploited flaws in TrueConf, a Russian-built video conferencing platform, after compromised servers were caught handing malware to unsuspecting meeting participants. The US cybersecurity agency on Thursday added CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities catalog, saying both have been used in real-world attacks. What CISA doesn't say is who is being attacked, or where. The only publicly documented attacks exploiting these two bugs so far come from Kaspersky, which linked them to Head Mare, a pro-Ukrainian hacktivist group that has repeatedly gone after Russian organizations. Its latest campaign targeted Russian companies across industries including transport, energy, electronics, IT, and software development. CISA doesn't say whether it added the flaws to KEV because of those attacks or because it has evidence of exploitation elsewhere, potentially including against organizations in the US. That question is particularly interesting given what TrueConf is and who uses it. TrueConf is a Moscow-based maker of video conferencing software that offers an on-premises alternative to cloud services such as Zoom and Microsoft Teams. Organizations can run TrueConf Server on their own infrastructure, including in private networks, giving them control over where their calls and associated data go. While the company's roots and much of its customer base are Russian, TrueConf has users worldwide. It says it has users in its portfolio that include Switzerland’s Department of Justice and Home Affairs, Istanbul Airport, and a news org, which The Reg has contacted to confirm. Most of the customer success stories are dated before 2022. Used together, the two bugs flagged by CISA can give an attacker control of the underlying server. According to Kaspersky, an unauthenticated attacker with network access to TCP port 4307, which TrueConf documentation says is open by default, can exploit the first flaw to run a malicious script. The second flaw lets the attacker break out of the isolated environment where the script runs and execute arbitrary code on the underlying server. Kaspersky says Head Mare used that access to plant a web shell, move through victims' infrastructure, and gain privileged access to the TrueConf database. From there, the attackers replaced the legitimate TrueConf Windows client installer on compromised servers with a trojanized version carrying the PhantomCore backdoor. Kaspersky warns that this creates a risk beyond organizations actually running vulnerable TrueConf servers. Employees joining conferences hosted by suppliers or other third parties could potentially download a compromised client from someone else's hacked infrastructure. The researcher says the flaws affect TrueConf Server releases going back to 2022. TrueConf shipped fixes in versions 5.3.9, 5.4.9 and 5.5.5 on June 18, warning customers that skipping the update could leave their conferencing systems exposed to attacks over the public internet. That doesn't mean every TrueConf box is sitting on the internet waiting to be popped. Exploitation requires network access to the vulnerable service, so a server confined to an internal network would not be directly reachable from outside unless an attacker had another route in. Federal agencies have until September 10 to patch the flaws. Other TrueConf admins can take their time, as long as they're comfortable with a conferencing server potentially moonlighting as a malware distribution point. ®

Hackers slipped malware into several popular Rust packages this week, turning routine software builds into a route onto developers' machines. The Rust Security Response Team disclosed the supply chain attack on Thursday after receiving a tip about a crate called proc-macro1. An investigation found that its build script fetched malware from a remote server. The attack extended beyond a single dodgy crate. Someone had published a new version of arrayref, a legitimate and widely used Rust package, with proc-macro1 added as a dependency. The attacker had also yanked recent legitimate releases of arrayref, helping steer users toward the poisoned release. The Rust team does not believe arrayref's maintainer was responsible. It suspects the developer's computer or credentials were compromised and locked the account while attempting to contact them. The attacker also published malicious versions of two other crates maintained by the same developer, internment and append-only-vec. The poisoned releases weren't around for long. Arrayref 0.3.10 was available on crates.io for 86 minutes, internment 0.8.7 for 90 minutes, and append-only-vec 0.1.9 for 107 minutes before they were removed. That's a narrow window, but arrayref is hardly some forgotten package gathering dust in the registry. Security firm Aikido, which separately analyzed the attack, puts arrayref at roughly 245 million lifetime downloads and append-only-vec at more than 4 million. However, those figures don't tell us how many developers pulled the malicious versions during the brief period they were live. Aikido found that the attacker largely left the legitimate source code untouched, adding only a dependency on proc-macro1, a typosquat of the legitimate proc-macro2 package. The malicious code was tucked inside proc-macro1's build.rs file. Cargo, Rust's package manager, runs build scripts during compilation. This allowed proc-macro1 to identify the operating system and processor architecture of the developer or build machine, download a matching payload, and execute it. Aikido found malware built for Linux, Windows, Intel Macs, and Apple Silicon Macs. The second-stage payload was more than a simple downloader. Aikido found code targeting Chromium-based browser data, including profiles for Google Chrome, Brave, and Microsoft Edge, as well as browser extension storage used by cryptocurrency wallets. It also found functionality to establish persistence and receive commands from the attacker's server. The Rust team also deleted proc-macro-en, aovine, arone, aronenao, and tinymember, warning that every version of those crates should be considered malicious. Developers have been urged to check their Cargo lockfiles and local registry caches for the affected packages. Rust credits Nextron Systems' research team with initially discovering and reporting the attack. It has not said how the legitimate maintainer was compromised, how many developers downloaded the poisoned releases, or how many systems ultimately executed the payload. The malicious packages may have lasted less than two hours on crates.io, but whoever was behind them chose a well-traveled route into developers' machines. ®

Cisco has revealed its Secure Workload Software, a micro-segmentation tool formerly known as Tetration that is supposed to stop attackers moving laterally across a network, has four critical flaws plus another high-severity bug. CVE-2026-20315 and CVE-2026-20317 are the two perfect-ten-rated bugs. Both relate to improper access control. Cisco has not offered much detail about either, saying only that 20315 “covers authorization, authentication, privileges, and bypasses” and that 20317 has to do with “missing authentication, authentication bypass, and reliance on untrusted inputs.” The 9.9-rated flaw is CVE-2026-20231, which describes issues related to “Improper neutralization of special elements (covers command, OS, argument injection).” CVE-2026-20318 is the 9.6-er and is an improper input validation problem. Coming in last, at 7.5, is CVE-2026-20319, a problem related to “Improper restriction of operations within the bounds of a memory buffer” including overflows and out-of-bounds writes. Cisco offers Secure Workload Software as a SaaS-y service and for on-prem deployment. The company has fixed the flaws with its SaaS, but users still need to upgrade the Agent and Connector tools needed to use the cloudy software. On-prem users who have deployed version 3.10 or earlier need to get to version 3.10.9.1. Users of version 4.0 or later need to adopt 4.0.4.16 sooner rather than later. Cisco revealed the flaws on Thursday and says it discovered them after “a comprehensive internal security review” that involved “existing testing processes as well as frontier AI models.” Cisco is a known participant in Project Glasswing, which grants access to Anthropic’s too-powerful-for-public-release Mythos bug-finding model. So maybe that’s the frontier model involved in this research. Thankfully, Cisco says it has detected no malicious use of the vulnerabilities. ®