January 2023

git-credential Risks: When Helpers Leak What They Cache

Post author:Prabhu Kalyan Samal
Post published:January 25, 2023
Post category:Cryptography & PKI Security Supply Chain Security

Git's January 2023 advisory flagged plaintext credential stores and verbose logs echoing 2FA tokens. Developer tooling is production security surface.

T-Mobile API Scraping 2023: 37M Accounts, One Credential

Post author:Prabhu Kalyan Samal
Post published:January 19, 2023
Post category:Identity & Phishing Security Web & API Security

A single compromised API credential let an actor scrape ~37 million T-Mobile accounts over six weeks. Machine-identity governance lessons from a repeat offender.

Royal Mail vs LockBit: The $80M Ransom Refusal

Post author:Prabhu Kalyan Samal
Post published:January 18, 2023
Post category:Emerging Tech & Architecture Ransomware & Malware Security

LockBit encrypted Royal Mail's international sorting operations in January 2023 and demanded $80M. Royal Mail paid nothing and kept the letters moving.

KeePass Plaintext Export ‘Flaw’: The Trust-Boundary Debate

Post author:Prabhu Kalyan Samal
Post published:January 13, 2023
Post category:Cryptography & PKI Identity & Phishing Security

CVE-2023-24055 showed a config-planted trigger could export KeePass vaults in plaintext after unlock. The debate: feature, flaw, or threat model?