May 2024

Snowflake-Ticketmaster: The Credential Wave That Broke the Cloud-Secure Myth

Post author:Prabhu Kalyan Samal
Post published:May 30, 2024
Post category:Cloud & Infrastructure Identity & Phishing Security

Live Nation's May 2024 SEC filing confirmed criminal access to roughly 560 million Ticketmaster customer records — taken not by exploiting Snowflake but by logging into it with infostealer-derived credentials on a tenant without MFA. This account explains the UNC5537 tradecraft that chained $20 stealer logs into Fortune-500 data lakes, why the 'no Snowflake breach' defense only half-worked, what the ~560M-record dataset contained, and the mandatory-MFA wave that reshaped SaaS identity through 2024.

Windows Recall: The Privacy Architecture Debate Before a Single Line Shipped

Post author:Prabhu Kalyan Samal
Post published:May 25, 2024
Post category:AI & Agent Security Identity & Phishing Security

Announced May 20, 2024 as a Copilot+ flagship, Windows Recall promised searchable memory of everything on screen — and researchers found the archive in a plaintext SQLite database any user-context malware could read, with a runtime API to match. This account covers Kevin Beaumont's teardown, the TotalRecall extraction tool, the threat-model fallacies in each Microsoft defense, the June climb-down to opt-in plus Windows Hello and encryption, and the rare process win of an architecture changed before deployment.

Google AI Overviews: Prompt Injection Hits the Homepage of the Internet

Post author:Prabhu Kalyan Samal
Post published:May 21, 2024
Post category:AI & Agent Security Security

When Google rolled AI Overviews into US search in May 2024, satirical sources got quoted as fact at national scale — glue on pizza, rocks as vitamins — and security researchers reframed the comedy as indirect prompt injection: retrieved content steering the answer in Google's own voice. This piece tracks the launch-week failures, the overview-bait SEO economy that followed, the manual-removal treadmill, provenance-aware retrieval as the real fix, and why RAG systems inherit the trust profile of their worst-cited source.