Netcrook
Cloud, SaaS & Identity Security
La privacy vende, ma il vero test di sicurezza sta nelle chiavi
Le offerte di storage cloud costruite su sconti, accesso a vita e branding sulla crittografia sono allettanti, ma il valore difensivo dipende da chi controlla la decrittazione e da quanto il provider può davvero vedere.
Fake App IDs, Real Password Tests: The Entra Trick Hiding in Plain Sight
A stealthy abuse of OAuth client IDs in Microsoft Entra ID can turn sign-in failures into an oracle for account discovery and credential checks.
ITDR Is Not One Market: The Real Prize Is Seeing the Right Identity Signals
A use-case guide turns into a sharper lesson: identity security tools only work when they match the way an organization actually authenticates, escalates privilege, and moves trust around.
Oak Bets That Identity Is the New Control Plane for Everything
With $60 million in funding, the startup is pushing an AI-powered identity platform into a security category already defined by complexity, drift, and high-stakes access decisions.
When Checkout Depends on Shared Secrets, Passkeys Become the Security Upgrade Payments Need
Credential-sharing habits make password-based checkout brittle, and the shift to passkeys changes the risk model for Click to Pay without making identity security automatic.
When a "Lifetime" Cloud Deal Sells More Than Storage
Internxt’s promotional bundle mixes encrypted cloud space, VPN access, and antivirus software, but the real story is how privacy marketing leans on trust, key management, and endpoint security.
RabbitMQ’s Control Plane Comes Into Focus as Access Checks Draw Scrutiny
Two disclosed authorization flaws could let a low-privilege view into OAuth material and cross-tenant broker metadata, underscoring how messaging systems depend on disciplined boundary enforcement.
Healthcare’s Quiet Weak Spot Is Not a Hack - It Is the Gaps Between Vendors, Logins, and Practice
A new healthcare warning puts supply-chain security, identity management, and staff readiness in the same frame: cyber risk becomes operational risk when hospitals cannot trust who connects, who updates, or who responds.
When a Login Never Lands: The Quiet Identity Trick Hiding Inside Entra Telemetry
A stealthy OAuth abuse pattern is turning Microsoft Entra ID into a credential-checking tool, showing how authentication systems can leak signals even when no successful sign-in is recorded.
When the Login Field Becomes a Test Probe: Spoofed OAuth Client IDs in Entra
A quiet identity trick is turning Microsoft Entra authentication into a validation oracle, where fake client IDs and direct-password flows can help attackers learn which accounts and credentials are worth pursuing.
When Fake App IDs Become Noise: The OAuth Trick That Can Blur Entra ID Defenses
A credential attack that rotates through fictional OAuth client identities does not break encryption - it tries to break the defender’s ability to see a pattern.
Microsoft’s Entra Identity Turns Toward Passkeys, and the Fallback Problem Gets Real
Microsoft has set passkeys to become the default authentication method for Entra ID in September 2026, a change that shifts the security conversation from passwords to enrollment, recovery, and policy design.
AI Coding Tools Can Move More Than Code: Grok Build’s Repo Boundary Comes Into Focus
A wire-level analysis of Grok Build CLI v0.2.93 raises a sharper question than simple file access: what, exactly, did the agent package and transmit by default?
AI Coding Assistant, Hidden Secrets: What Grok Build May Have Been Sending Home
A technical teardown of Grok Build CLI v0.2.93 points to a familiar cloud-security problem in a new wrapper: repo-aware tooling can move more sensitive data than users realize.
AI Coding Tools Can Leak the Whole Repo, Not Just the Prompt
A Grok Build test exposed a deeper risk in AI-assisted coding: separate storage channels can move repository history and tracked secrets even when the model itself sees only a tiny slice of traffic.
When a Coding Agent Sends the Whole Repo, the Cloud Becomes the Risk
A repository-scoping failure in Grok Build shows how an AI coding tool can turn a simple task into a much larger data-movement problem.
When a Fake App Name Becomes a Cloak: The Entra Campaign Hiding Behind OAuth Noise
Spoofed OAuth client IDs are giving attackers a way to probe Microsoft Entra accounts while making their activity look like ordinary sign-in churn.
Salesforce Trust Becomes the Breach Path in a Long-Running Theft Pattern
Microsoft mapped a year-long campaign tied to ShinyHunters-linked activity that appears to have moved through OAuth trust rather than a Salesforce platform flaw.
OAuth Trust Turns Into a Quiet Salesforce Standoff
Microsoft warned that ShinyHunters-linked tradecraft may be using trusted OAuth relationships to keep Salesforce access alive while bypassing ordinary sign-in checks.
Italy’s New Delegation Model Tries to Kill Password Sharing in Public Services
A formal digital proxy system for public-administration access shifts trust from informal help to regulated authorization, but the security value depends on identity assurance, revocation, and careful implementation.