いーじー

[いーじー @Rikunchuu]

https://t.co/2awKqtBPoi

[いーじー @Rikunchuu]

https://t.co/TlgUdeSF8b

[いーじー @Rikunchuu]

@Rikunchuu
AIエージェントはCloudflareに賭けろ｜yusukebe https://t.co/OtjfWHNPgQ #zenn

[いーじー @Rikunchuu]

https://t.co/52hRR2lbK1

[Anthropic @AnthropicAI]

The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees.

The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.

Access to all other Claude models is not affected.

We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible.

Read our full statement: https://t.co/bwn0sximKZ

[0xdf @0xdf_]

I think this N-day research is potentially the biggest story of AI, vulnerability finding, and exploit development.

https://t.co/NLGTI5kcN6

1/6

[Masato Kinugawa @kinugawamasato]

WordやExcelのテキスト1文字でもコピーしてブラウザに貼り付けると、<link id=Main-File rel=Main-File href="file:///C:/Users/[USER_NAME]/AppData/ ..."> みたいなのがクリップボードにtext/html形式で常に含まれててユーザー名が漏れ得ると知った。さりげなくて地味に嫌だな

[r1cksec @r1cksec]

A single, searchable directory of the community's Living-Off-the-Land security research — every LOLBin, LOLDriver, and adjacent project, indexed and cross-referenced by platform and focus area.

https://t.co/PWym4al3cx

#infosec #cybersecurity #redteam #pentest #threatintel

[Dark Web Intelligence @DailyDarkWeb]

🇯🇵 A threat actor is advertising an alleged dataset linked to Japan’s National Personnel Authority (https://t.co/xw4YyrSNLy), claiming exposure of approximately 742,000 records involving government employee and payroll-related data.

According to the listing, the alleged dataset includes:
• full names and demographic information
• dates of birth and personal contact details
• home addresses and postal information
• payroll and salary records
• pension and health insurance identifiers
• bank account and payroll administration data
• ministry and departmental assignment details
• employment status and organizational role information

Government personnel datasets are considered highly sensitive due to their potential value for espionage, social engineering, and financial fraud operations. The alleged inclusion of payroll and departmental assignment records could potentially enable:
• targeted phishing against government employees
• impersonation and identity theft
• financial fraud using payroll metadata
• mapping of government organizational structures
• intelligence gathering against public-sector personnel

The exposure of employee allocation, ministry affiliations, and payroll-related information may also present national security and insider-risk concerns depending on the authenticity and scope of the alleged data.

At this stage, the authenticity and scope of the alleged dataset remain unverified.

#DDW #Intelligence #Jinji

🇯🇵 A threat actor is advertising an alleged dataset linked to https://t.co/aFxxhbQ2tG, claiming exposure of approximately 243,000 customer and service-management records.

According to the listing, the alleged dataset includes:
• customer names and phone numbers
• email addresses and mailing information
• encrypted passwords
• service order and subscription records
• billing and payment-related metadata
• device and equipment serial references
• customer support ticket information
• account status and login activity details

Telecommunications and customer account datasets are frequently targeted because they can be leveraged for:
• credential stuffing and account takeover attacks
• SIM swap and mobile fraud operations
• phishing and impersonation campaigns
• social engineering using customer service history
• identity theft and subscription fraud

The alleged inclusion of encrypted passwords, billing cycles, subscription data, and service-order history may significantly increase the operational value of the dataset for cybercriminal actors.

At this stage, the authenticity and scope of the alleged dataset remain unverified.

#DDW #Intelligence #MyAU #DarkWeb

[いーじー @Rikunchuu]

@Rikunchuu
AIに攻撃者視点を持たせる Three Amigos 4視点 ― OWASPを先制する仕様化 https://t.co/y4o5r4Jefq #Qiita @narururu_ai_engより

[いーじー @Rikunchuu]

Linux Kernel Killswitch Proposed After Recent Vulnerability Disclosures https://t.co/2XTKqWYvmH

[SANS Japan @SANS_JAPAN]

このポスターはWindowsのフォレンジック解析に活用できるアーティファクトをカテゴリーごとにマッピングしています。コンピュータへの侵入、知的財産の盗難、サイバー犯罪捜査などのために、Windowsの重要なアーティファクトが確認できます！

https://t.co/ps7Dy2TqxG

[田中ザック (Zach Mathis) @yamatosecurity]

この度、アメリカ人を卒業して、日本国民となりました。引き続き、宜しくお願いいたします。

[カワミス.福袋ファイター @kawamisu]

怪盗レーニャの公式サイトドメインもオンカジ紹介サイトになってる。

[Analysis Center @jpcert_ac]

2025年2月から2025年3月までのJPCERT/CCが確認したフィッシングサイトのURLデータを追加公開しました。^SN https://t.co/GKpl0HYOsY

[r00tapple @r00tapple]

セキュアMXサービスから漏えいした可能性のある情報にメールのアカウントとパスワードが含まれていることから共通パスワードが社内で使われてる可能性が高い企業などはセキュアMXサービス以外の確認も行うことを推奨します。

該当企業で頻出しているパスワードフレーズ（初期キッティングパスワード）を取得した攻撃者が別サービスへの侵入などを行うことは推察されます。
漏洩情報ベースで侵入テストに活用する場合の一例図ですが、Microsoft365を使用されていれば条件付きアクセスポリシーの不備を悪用して侵入する試みなどは行われるかなと思います。

■IIJセキュアMXサービスにおけるお客様情報の漏えいについて
https://t.co/84afyc7z6g

[いーじー @Rikunchuu]

大和セキュリティ年末勉強会！ に参加を申し込みました！ https://t.co/q0gOZkqeoT #yamasec

[徳丸 浩 @ockeghem]

「アンチウイルスベンダーがマルウェア配布している」は都市伝説だと思っているが、こういうのが出てくると、もうね… / “医療機関向けセキュリティベンダCOO「事業拡大」のため病院をサイバー攻撃した罪を認める | ScanNetSecurity” https://t.co/aPIClv3Ve6

[いーじー @Rikunchuu]

新卒向け「テストコード」の研修資料　Sansanが無料公開　Python上でのテスト方法を解説 https://t.co/pSIEXtdfdM

[いーじー @Rikunchuu]

fo影の里が懐かしい...