Author: HackWatchit
Brian King // All of our scanning tools tell us that we should disable the HTTP TRACE and TRACK methods. And we all think that’s because there’s something an attacker can do with it to steal secrets from legitimate users. But there’s another thing TRACE can do for an attacker, and it’s got nothing to do with other users. OWASP says you should disable HTTP TRACE because it can be used for Cross Site Tracing. https://www.owasp.org/index.php/Cross_Site_Tracing CERT says it can be “combined with cross-domain browser vulnerabilities to read sensitive header information from third-party domains.” https://www.kb.cert.org/vuls/id/867593 Deadliest (!) Web Attacks says…
In this Help Net Security interview, Chris McGranahan, Director of Security Architecture & Engineering at Backblaze, discusses how AI is shaping both offensive and defensive cybersecurity tactics. He talks about how AI is changing the threat landscape, the complications it brings to penetration testing, and what companies can do to stay ahead of AI-driven attacks. McGranahan also points out that human expertise remains essential, and we can’t depend on AI alone to protect cloud environments. Are we seeing AI being used to automate lateral movement, vulnerability chaining, or privilege escalation? If so, how? How accessible are these AI-powered capabilities to…
Beau Bullock // If you have been even remotely in touch with technology in the past thirty years you have probably heard of this thing called a “firewall”. If not, a “firewall” decides what does and does not get to proceed through it. Most organizations have one of these protecting their network from the rest of the Internet. Some organizations place them in the most opportune spots to segment off specific areas of their internal network. The system you are using right now to read this blog post most likely has a firewall built-in. The general consensus about what a…
If you try to access Pornhub, one of the world’s biggest websites, from any of 17 US states, you’ll be blocked. Pornhub’s parent company, Aylo Holdings, has restricted access in response to a slew of laws that says Pornhub itself should be responsible for checking that every visitor is over 18. Now, the United States Supreme Court has made a decision on a key age verification law, which could have ramifications for the entire country and the wider internet as a whole.On Friday, in a 6–3 decision that could reshape the landscape of online privacy and free speech, the Supreme…
Facebook wants access to your camera roll for AI photo edits Pierluigi Paganini June 29, 2025 Facebook asks users to allow “cloud processing” to access phone photos for AI-generated collages and recaps, even if not uploaded. Meta-owned Facebook is prompting users to enable “cloud processing” to access photos from their phones, even those not uploaded. If users opt into “cloud processing,” Facebook will continuously upload media to its servers and use details like time, location, and theme to generate creative suggestions. “The feature is being suggested to Facebook users when they’re creating a new Story on the social networking app.…
Is your online identity truly yours? Every click, every login, and every piece of data you generate across countless apps and platforms are collected and controlled by centralised entities. Now, the Moca Foundation is launching a direct challenge to this status quo with the announcement of Moca Chain, a new blockchain built from the ground up to restore ownership of your digital life to its rightful owner: you. The Moca Foundation unveiled its plans for a Layer 1 blockchain dedicated entirely to identity and user data. The Moca Chain, with its testnet and mainnet slated for launch in the third…
Are Your Non-Human Identities (NHIs) Defended Robustly Against Cyber Threats? Ever questioned the absolute security of your machine identities? With the rising interconnectedness of technologies, protection of Non-Human Identities (NHIs) is no longer a choice but an urgent necessity. Ensuring robust cybersecurity can be a daunting task, given the sophistication of modern digital threats. But with a comprehensive approach to NHIs protection, you can assure an impregnable defense system for your machines in cyberspace. Understanding the Integral Role of NHIs in Cybersecurity NHIs are machine identities created by combining a unique identifier, also known as a “Secret,” with the permissions…
Google is rolling out Veo 3 to everyone using Vertex AI, which is an ML-testing platform provided by Google Cloud. Unlike Sora and other generative video AI models, Veo 3 is a state-of-the-art video generator trained on millions of YouTube videos, and it can generate realistic videos, but great quality comes at a high cost. Veo 3 isn’t free, but since it’s part of Google Cloud, you can use it for free by subscribing to the $300 trial offered by Google. To get started, you can sign up for a Google Cloud trial credit, which applies to all Google Cloud…
Mike Perez // BHIS does a lot of outreach via our blog, HackNaked.TV, training, and especially webcasts. In the course of outreach, sometimes folks come to us whom never had a pentest, or interestingly, had a pentest and are unhappy with the results. When probing customers about those unhappy results, many of those experiences seem to have two common elements: Black Box testing and/or more fundamentally, mismatched expectations. Now Black Box testing definitely has its place. Examples might include: Your new application has security reviews baked into the development cycle. You perform your own internal pentests. Your site has…