Aggregator

作者：Jafar Akhoundali, Hamidreza Hamidi, Kristian Rietveld, Olga Gadyatskaya 译者：知道创宇404实验室翻译组 原文链接：https://arxiv.org/html/2505.20186v1 摘要 开源软件中的漏洞可能会在现代数字生态系统中引发连锁反应。如果这些漏洞在许多项目中重复出现，尤其令人担忧，因为一旦攻击者发现...

HackerNews 编译，转载请注明出处： 苹果公司周二披露，过去五年累计阻止了价值超过90亿美元的欺诈交易，仅2024年就拦截逾20亿美元。苹果表示，其应用商店正面临各类威胁，从窃取个人信息的欺诈性应用到试图利用用户的非法支付手段层出不穷。 为防止不良行为者提交恶意应用，苹果已因欺诈风险终止超过4.6万个开发者账户，并额外拒绝了13.9万次开发者注册申请。去年该公司还拦截了7.11亿次可疑账户创建，停用了近1.29亿个用户账户，以阻止这些账户从事垃圾信息传播、评分评论操控、排行榜及搜索排名干扰等危害应用商店生态的行为。 2024年其他值得关注的数据包括： 在盗版应用商店检测并拦截超过1万个非法应用，涵盖恶意软件、色情应用、赌博应用及正版应用盗版； 阻止近460万次非官方渠道安装或启动非法应用的尝试；因安全漏洞、隐私侵犯或欺诈风险驳回190万份应用上架申请； 下架3.7万余个涉及欺诈的应用，并拒绝4.3万份包含隐藏功能的提交申请； 以抄袭、垃圾信息或误导用户为由驳回32万份应用，另有40万份因隐私问题被拒； 从应用商店榜单移除7400多个潜在欺诈应用，并在搜索结果过滤近9500个欺骗性应用； 清除1.43亿条虚假评分评论； 识别470万张被盗信用卡，封禁160万个违规交易账户。 对比数据显示，苹果2023年拦截约18亿美元潜在欺诈交易，2022年拦截超20亿美元。去年该公司终止近11.8万个开发者账户。此次年度报告发布之际，谷歌今年早些时候披露2024年已阻止236万款违规安卓应用上架Google Play，并封禁15.8万个恶意开发者账户。 当前苹果正面临对其应用商店政策更严格的审查。美国近期一项裁决要求该公司允许iOS应用展示外部购买链接，打破原有的应用内支付垄断体系。       消息来源：thehackernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

We've reached a point where customers won't wait even a few seconds for an app to load or a login to work. In this new era of digital impatience, CIAM platforms have become business critical, serving as direct contributors to conversion rates, user retention, and data protection.

The post Find the Best CIAM Solution for Your Business: A Comprehensive Guide to Modern Customer Identity Management appeared first on Security Boulevard.

Things to Include on Your CV When Your Job Focuses on Keeping Systems Running
If you're a junior SOC analyst, a GRC specialist or someone working in ICS environments, the idea of a cyber portfolio might seem irrelevant. It's not. Employers need tangible proof of your skills, and a well-constructed portfolio does just that - whether your job touches logs or legal frameworks.

APT31 Compromised the Czech Foreign Affairs Ministry in 2022
The Czech government on Wednesday said Chinese state hackers stole sensitive declassified information from the republic's foreign ministry as part of a years-long espionage campaign. Czech Ministry of Foreign Affairs attributed the hack to a Chinese nation-state group tracked as APT31.

Stealthy Malware Installs Cryptomining Software
A botnet targeting Internet of Things devices works by brute forcing credentials and downloading cryptomining software. Researchers call the botnet "PumaBot," since its malware checks for the string "Pumatronix," the name of a Brazilian manufacturer of surveillance and traffic camera systems.

'It's Just Totally Destabilizing,' Staffers Say Amid CISA's Leadership Exodus
An ongoing exodus of top officials and senior leadership at the Cybersecurity and Infrastructure Security Agency's regional offices has left staffers increasingly worried about a potential major shift in mission and continued cuts to staff and spending.

Researcher Analyzes System Prompts to Show How New Claude Models Work
System-level instructions guiding Anthropic's new Claude 4 models tell it to skip praise, avoid flattery and get to the point, said independent AI researcher Simon Willison, breaking down newly released and leaked system prompts for the Claude Opus 4 and Sonnet 4 models.

CRADLE is an open-source web application designed to empower Cyber Threat Intelligence (CTI) analysts. The platform streamlines threat analysis workflows through collaborative note-taking, visual relationship mapping, and comprehensive report generation. In today’s rapidly evolving...

The post CRADLE: Open-Source CTI Platform for Collaborative Threat Analysis appeared first on Penetration Testing Tools.

马斯克旗下 xAI 与通讯应用 Telegram 达成合作协议；荣耀确认进军机器人产业；腾讯音乐斥资 12.9 亿元，成韩国 SM 娱乐第二大股东

近日,“谛听”团队杨道青博士撰写的论文被国际期刊《IEEE Transactions on Information Forensics and Security》录用。

Linux Security and Monitoring Scripts These are a collection of security and monitoring scripts you can use to monitor your Linux installation for security-related events or for an investigation. Each script works on its...

The post LSMS: Linux Security and Monitoring Scripts appeared first on Penetration Testing Tools.

SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal

Campcodes Online Hospital Management System 1.0 - SQL Injection

WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing

Fortra GoAnywhere MFT 7.4.1 - Authentication Bypass