AI attacks, AI defends: how to use neural networks in information security
Hello! We share with you the material prepared by Roman Strelnikov — head of the information security department at Bitrix24. Roman is the person who controls everything…
Security - Articles for the year 2025
Read interesting articles and reviews for the year 2025. Analysis of key events in the "Security" sector
Analysis of CVE-2025-27736 vulnerability in Power Dependency Coordinator
This article is dedicated to the bug in Power Dependency Coordinator, patched by Microsoft in April of this year.
Here's the translated text you requested: How I made friends with Yandex Cloud and Gemini API without migrating to foreign servers
When I started writing the Node.js service that was supposed to integrate with the LLM model, I already understood that access to some foreign APIs from Russia could…
Kristina Svechinskaya: How a Young Russian Woman Became a Star of the Cybercriminal World
If you enter the phrase "most famous female hackers" into any foreign search engine, the impartial search engine will instantly generate a list, with Kristina Svechinskaya…
Frontend Risks #1: Bitrix CMS sends your clients' data to Ireland
As a result of my security research of 3,000 Russian frontend applications, it was discovered that Bitrix CMS has been transmitting website visitors' personal data to…
When Language Models Turn Against You: A Study of Backdoors in LLM
Imagine you're running a call center and decide to implement an open LLM for automating communication. Everything works great—until a scammer whispers a strange phrase,…
Hydroph0bia — from bypassing SecureBoot to modifying the DXE volume in Insyde H2O UEFI-compatible firmware
Hello, reader. In front of you is the second article about a serious vulnerability I found in UEFI-compatible firmware based on the Insyde H2O platform, which I named…
Electronic signature leak: how to lose property, money, and a company
Electronic signatures have long been an integral part of corporate processes. They are used to sign crucial documents, confirm transactions, and conduct financial operations.…
A hole in Cloudflare’s shield: how the attack on Jabber.ru exposed a problem no one has talked about since 2023
Many remember the year-before-last incident with the Man-in-the-Middle attack on the XMPP service jabber.ru. This story caused a lot of noise, but I think the main point…
No security exists: how the NSA hacks your secrets
Finite fields, hash mincers, covert radio channels, and trojans soldered into silicon. While we pride ourselves on AES-256 locks, intelligence agencies seek workarounds:…
AI Security with a French Flavor or an Analysis of Securing Artificial Intelligence from ETSI. Part 1
Artificial intelligence technologies are developing rapidly, but with new opportunities come new risks. Prompt injections, abuse of agent tools, vulnerabilities in the…
Zerotrust the Streetwise Way #3. Endpoint Protection
Let’s recall the main idea of ZT for admin panel protection: you can only access the admin panel by providing a certificate that’s stored in a secure device keystore.…
How HTTP is Used for DNS: DNS-over-HTTPS in Practice
HTTPS makes it possible to implement secure interaction with the DNS resolver interface, concealing the DNS traffic that would otherwise be transmitted in plain text.…
![How a Designer’s Stolen Passwords Nearly Tanked a Startup [MITRE: T1078 — Valid Accounts]](https://cdn.tekkix.com/assets/image-cache/w_1000h_625q_90/77/jpg/2025/04/c0c6e4f15f610e2a1d3502225ce59c2ecc05e85a.47d520d6.webp)
How a Designer’s Stolen Passwords Nearly Tanked a Startup [MITRE: T1078 — Valid Accounts]
Incident Description: The attacker uses stolen credentials to access the company’s server, website, or cloud.
Protection Without Encryption: Paradox or Alternative?
Is it possible to protect data without encryption? In 2025, as algorithms become outdated, quantum computing is on the rise, and most data breaches are caused by human…
How one developer prevented the largest cyberattack: the story of the XZ Utils hack
Exactly one year has passed since the world watched in awe as the investigation of one of the most sophisticated backdoors in Linux history unfolded. The story of the…
Digest of Information Security Regulation. January – March 2025
Hello, tekkix! We continue our series of reviews on laws, orders, decrees, and regulatory initiatives related to information security. In this article, we cover what…
