October 2024 Newsletter

Achieve Better Cybersecurity Happy Halloween!    Cybersecurity Awareness Month is wrapping up, just in time for users reset their passwords to their dog's name or… By the way, if you haven't scheduled your 2024 pentest yet, there are only two months left!   In this edition: Bondo @ BSides Weaponization of AI Internship Program! IN THE NEWS ⚖️ Government & Regulation New cybersecurity program regulations for New York general hospitals took effect The D.O.D. released the final program rule for CMMC, simplifying compliance for defense contractors, reducing assessment levels, and enabling self-assessment for lower tiers Spying on the spy: Chinese hackers infiltrate government wiretaps in U.S. IPs ⚔️ Hacks and Attacks American Water, the largest U.S. water utility, was breached. While operations were unaffected (beyond an intentional shutdown), customers are unhappy about potential PII loss. A security flaw in Ecovacs Deebot X2 robot vacuums allowed hackers to access devices, raising privacy and cybersecurity concerns 📖 Technical Deep Dives A 15-year-old discovered a Zendesk vulnerability that allowed the reading of customer support tickets from any company Palo Alto patched some serious vulnerabilities that allowed unauthenticated OS command injections, unauthenticated SQL injections, and the storage of credentials in cleartext 🏆 Wins for the Good Guys The FBI and Mandiant uncovered Jesse Kipf's attempt to fake his own death Remember when everyone's SSN was stolen? Brazil may have arrested the hacker who stole them Two brothers behind Anonymous Sudan were arrested for running a DDoS-for-hire service, targeting hospitals, cloud providers, and government websites Stephen Bondurich is taking the stage to reveal some of his social engineering playbook at BSides Philly on December 6 at Live! Casino & Hotel Philadelphia.   Whether you’re a code warrior or a cyber sleuth, you won’t want to miss this chance to level up your skills and network with the best in the biz. See you there! INHUMAN Premiere The concept of weaponized Artificial Intelligence is defined as the act of altering existing AI systems or the development of new AI programs and tools with the specific intention of undermining their performance and causing disruptions to normal operations.   AI doesn’t need to be smart to be destructive, it only needs the ability to manipulate the environment. This documentary will inevitably reshape how you view AI, technology, and human consciousness. After its West Coast premiere at BlackHat this summer, the InHuman documentary premiered for the East Coast at the AI for Everyone conference on October 22 in Philadelphia. If you missed it, stay tuned for its official release this winter. Calling all interns SEVN-X has reached a new growth milestone: the internship program!   We're looking to expand our team with some driven and talented students and entry-level cybersecurity folks. If you are one or know any, reach out to Stephen.Bondurich@sevnx.com!   Primary functions include: Social Engineering Penetration Testing Physical Security Stephen at the  Penn State CCSO career fair Conference Schedule ICYMI Read Last Month's Newsletter 2011 Renaissance Blvd | Suite 210 King of Prussia, PA 19406, USA