/Security

Securing AI Agents: Authentication Patterns For Operator And Computer Using Models

- Zack Proser tl;dr: The evolution from smart chatbots to digital assistants capable of autonomously performing multi-step tasks such as ordering groceries, scraping job postings, or researching and filling our complex web forms is natural. However, these expanded capabilities carry significant authentication, security, and compliance ramifications. This article explores these issues and discusses the emerging ecosystem around computer-using operators.

featured in #601

What Is Device Fingerprinting And How Does It Work?

- Zack Proser tl;dr: “Every time a device connects to your server, it broadcasts a wealth of information through its browser. Some of these signals are obvious, while others are subtle technical artifacts of how browsers and hardware work together.” Zack breaks down what servers can see and how to mitigate bad actors. 

featured in #600

Hidden Messages In Emojis And Hacking The US Treasury

- Nick Agliano tl;dr: “So how was there a zero-day in PostgreSQL, that had just been sitting there for at least 9 years, maybe longer? And not just that, but a SQL injection vulnerability?” Nick explores these questions. 

featured in #599

What Is Device Fingerprinting And How Does It Work?

- Zack Proser tl;dr: “Every time a device connects to your server, it broadcasts a wealth of information through its browser. Some of these signals are obvious, while others are subtle technical artifacts of how browsers and hardware work together.” Zack breaks down what servers can see and how to mitigate bad actors. 

featured in #594

What Is Device Fingerprinting And How Does It Work?

- Zack Proser tl;dr: “Every time a device connects to your server, it broadcasts a wealth of information through its browser. Some of these signals are obvious, while others are subtle technical artifacts of how browsers and hardware work together.” Zack breaks down what servers can see and how to mitigate bad actors. 

featured in #592

Nontraditional Red Teams

- Zach Holman tl;dr: “Most developers know about red teams: a specific group of people chosen to be the antagonist to your system, trying to sniff out vulnerabilities in your code or organization. Basically, like Sneakers, or the annoying plotline in The Newsroom season two. There’s a few other concepts of a red team I think that every development team should have some exposure to outside of the traditional cybersecurity angle.”

featured in #589

Exploiting McDonald’s APIs To Hijack Deliveries And Order Food For A Penny

- Eaton Zveare tl;dr: “I took a step back and looked at the cart object and an idea came to mind. The cart object was able to accept item updates, but could it accept price updates too? I put together a PUT request to update the price. Surprisingly, it worked.”

featured in #576

Control Data Access with Targeted Row-Level Security

tl;dr: Integrate Clerk with Neon Authorize to enforce Row-Level Security (RLS) in Postgres using JWTs. This setup enhances security by securing database queries based on user identity. For team leads, it simplifies security management and reduces risk, allowing teams to focus on development.

featured in #566

One Weird Trick To Get The Whole Planet To Send Abuse Complaints To Your Best Friend(s)

- Pierre Bourdon tl;dr: “One of my servers suddenly deciding to start sending SSH connections to the wider internet. This is usually a pretty strong indicator of malware compromise, and I had to act quickly if that was the case. Luckily, I’ve worked in infosec for a while, and some years ago I even did some freelance work doing forensics and cleanup of infected servers.”

featured in #563

Using YouTube To Steal Your Files

- Lyra Rebane tl;dr: “In my security research I often come across weird quirks and behaviours that aren’t particularly useful beyond a neat party trick. It’s always a good idea to keep track of them though, perhaps one day they’ll be just the missing piece you need.”

featured in #551