Author: HackWatchit

As organizations adopt hybrid and multi-cloud architectures, the attack surface quickly expands, often outpacing defender’s ability to see and stop threats. This growing complexity fuels risk — creating blind spots adversaries exploit through cloud misconfigurations, excessive permissions, and unpatched vulnerabilities. These conditions allow attackers to break in, move laterally, and gain higher levels of access.  Identity and permission misuse has become central to modern adversary tradecraft. Valid account abuse has become the leading initial access vector to the cloud, accounting for 35% of cloud incidents in the first half of 2024, the CrowdStrike 2025 Global Threat Report states. Groups like…

Jordan Drysdale // ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques. (See Jordan’s Part 1 of this post here.) PCI-DSS strolled into town with the latest compliance package of minutiae laden IT speak at the end of last year. Business owners are now saddled with mapping, understanding and creating policies and procedures for handling “credit card data flow.” For the majority…

For years, the North Korean government has found a burgeoning source of sanctions-evading revenue by tasking its citizens with secretly applying for remote tech jobs in the West. A newly revealed takedown operation by American law enforcement makes clear just how much of the infrastructure used to pull off those schemes has been based in the United States—and just how many Americans’ identities were stolen by the North Korean impersonators to carry them out.On Monday, the Department of Justice announced a sweeping operation to crack down on US-based elements of the North Korean remote IT workers scheme, including indictments against…

is a versatile technique for exploring the solution space of various types of data science problems and incrementally constructing candidate solutions – a bit like navigating a maze. In this article, we will briefly go over the concept of backtracking before diving into a couple of intuitive, hands-on examples coded in Python. Note: All example code snippets in the following sections have been created by the author of this article. Conceptual Overview At a high level, the backtracking technique involves a step-by-step exploration of the solution space of a computational problem (usually a problem that can be framed as one…

In a concerning incident this April, unidentified hackers managed to breach the control systems of a Norwegian dam. Reportedly, hackers breached the control systems of a Norwegian dam, causing its water valve to open fully. The incident occurred at the Lake Risevatnet dam, situated near the city of Svelgen in Southwest Norway. The valve remained open for four hours before the unauthorized activity was detected. According to the Norwegian energy news outlet, Energiteknikk, the hack did not pose a danger, as the water flow barely exceeded the dam’s minimum requirement. The valve released an additional 497 litres per second, but…

Split tunnel vs full tunnel VPN: What’s the difference? The type of VPN tunnel you choose affects your VPN security and VPN performance. The good news? Understanding VPN tunnels is easy. A full tunnel VPN encrypts all internet traffic. Full tunnel sends traffic from all apps to a secure VPN server. A split tunnel VPN lets you control how you encrypt traffic. With split tunneling enabled, you can choose which apps or websites use the VPN. So, when should you use split tunneling versus full tunneling? That depends on whether you need system-wide privacy, flexible access, strong public Wi-Fi security, or…

Something interesting happened last week. A programmer by the name of Matthew Garrett gained access to the lighting and window controls to nearly every room of a hotel he was staying in. (You can read his post here:http://mjg59.dreamwidth.org/40505.html#cmt1611577) This made me think about network connected devices and home network security. I, too, have smart lights, and call me paranoid, but I don’t want someone gaining access to my systems. Apart from the annoyance of them being “funny” and changing my lights randomly, it could give them insight to when I’m awake, and when I’m home. (Granted, if they sat in…

The Berlin Commissioner for Data Protection has formally requested Google and Apple to remove the DeepSeek AI application from the application stores due to GDPR violations. The commissioner, Meike Kamp, alleges that DeepSeek’s owner, Hangzhou DeepSeek Artificial Intelligence, based in Beijing, unlawfully collects data from German users and transfers them for processing in servers in China. As per the GDPR and Article 46 (1) specifically, any personal data collected from individuals in the European Union must be protected according to the standards upheld by the regulatory act. However, China has very lax data protection regulations and a history of excessive data…

Denmark moves to protect personal identity from deepfakes with new copyright law Pierluigi Paganini June 30, 2025 Denmark plans to let citizens copyright their face, body, and voice to combat deepfakes under a new law strengthening personal digital rights. Denmark plans to amend its copyright law to give individuals rights over their body, face, and voice, to combat AI-generated deepfakes. Believed to be the first law of its kind in Europe, the proposal has broad political support and will be submitted for consultation before summer, with a formal amendment expected in the autumn. “The Danish government is to clamp down…