Stolen Credentials, Not Hacking, Now Drive Most Cloud Storage Breaches

·1 views

Cloud storage security is increasingly undermined by identity-based attacks rather than infrastructure exploits, with stolen credentials serving as the initial access vector in roughly 22% of confirmed breaches according to Verizon's 2025 Data Breach Investigations Report. Automated tools continuously test stolen login combinations against cloud services, a technique known as credential stuffing, making reused passwords a critical liability. Researchers analyzing a 19-billion-password leak found reused or duplicated credentials were widespread, lowering the bar for attackers significantly. Configuration errors compound the risk, as misconfigured public-facing storage buckets can expose sensitive data without requiring any login at all. Security experts emphasize that under the cloud shared responsibility model, customers — not providers — are accountable for access controls, making multi-factor authentication and proper permissions essential defenses.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

user-scanner OSINT Tool Combines Username and Email Recon in One Engine

A new open-source tool called user-scanner aims to replace separate OSINT utilities Sherlock and Holehe by handling both username and email reconnaissance in a single platform. The tool supports over 380 active scan vectors and extracts metadata such as profile avatars, account UIDs, bios, and follower statistics, which legacy tools do not provide. A key feature called cross-scan enables automated recursive pivoting, where handles and links discovered during an email scan are automatically fed into a follow-up username sweep. user-scanner also integrates with Hudson Rock to cross-reference targets against infostealer malware infection logs within the same run. The tool is available via pip or Nix and supports export formats including PDF, JSON, and CSV, with a Python API for custom automation pipelines.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Self-Attention Explained: The Core Idea Behind Every Modern AI Model

Self-attention is the foundational mechanism powering large language models, image generators, and modern recommender systems, first introduced in the landmark 2017 paper 'Attention Is All You Need.' The concept works by allowing each word in a sequence to weigh the relevance of every other word, building context-aware representations rather than treating words in isolation. Unlike older RNN and LSTM models that processed sequences step by step and struggled with long-range memory, self-attention computes all relationships in parallel, enabling far greater scale and efficiency. Each word generates three vectors — a query, a key, and a value — and attention weights are determined by how closely queries match keys across the sequence. The same mechanism extends beyond language, underpinning recommendation systems that predict user behavior by treating interaction histories as sequences.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Multilingual Telehealth Voice AI for Rural India in 10 Days

A developer built Arogya Seva, a real-time multilingual voice AI assistant aimed at improving healthcare access in rural and semi-urban India, as part of the VoiceForBharat challenge. The system supports Indian English, Hindi in Devanagari script, and regional languages, targeting users in low-literacy areas who find text-based interfaces difficult to use. Built on the LiveKit Agents SDK, it uses Deepgram Nova-3 for speech recognition and Murf Falcon for voice synthesis, achieving speech response latency under 300 milliseconds. Key safety features include an emergency protocol that flags critical symptoms such as chest pain and directs users to call 108, along with consent-based data collection and mandatory opt-out disclosures. The developer overcame challenges including TTS latency spikes, mixed-script language errors, and agent handoff state loss during the 10-day build.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Rebuilds AI Agent Gatekeeper in 3 Days After 14 Developers Exposed Critical Gaps

A developer shipped v0.1.0 of 'agent-tooltrust', an open-source gatekeeper that scores AI agent tool calls across five risk dimensions before execution, publishing it to PyPI and GitHub. Within days, 14 developers left pointed feedback revealing significant blind spots, including missing argument-level validation, environment scoping, and semantic checks. Each comment was converted into a GitHub issue, and all 14 were addressed and shipped in v0.2.0 just three days later. Key additions include per-tool argument policy enforcement, resource and environment scoping with default-deny rules, a new 'allow_with_obligation' decision state, and tiered deny-reason exposure to prevent agents from reverse-engineering rule sets. What began as a simple gatekeeper has evolved into a broader control plane for AI agent oversight.

0 comments Read more at DEV Community