In this article, Kaspersky researchers explore how the Model Context Protocol (MCP) — the new “plug-in bus” for AI assistants — can be weaponized as a supply chain foothold.
The researchers start with a primer on MCP, map out protocol-level and supply chain attack paths, then walk through a hands-on proof of concept: a seemingly legitimate MCP server that harvests sensitive data every time a developer runs a tool. Then they break down the source code to reveal the server’s true intent and provide a set of mitigations for defenders to spot and stop similar threats.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Adobe Patches 11 Critical Bugs in Popular Acrobat PDF Reader
July 13, 2021
Eleven critical bugs in Adobe’s popular and free PDF reader, Acrobat, open both Window and macOS users to attacks ranging from an adversary arbitrarily executing commands on a targeted system to data leakage tied to system-read and memory flaws. In a Tuesday security bulletin, which included patches for all flaws, the company reported that Windows and ...
- SolarWinds patches critical Serv-U vulnerability exploited in the wild
July 12, 2021
SolarWinds is urging customers to patch a Serv-U remote code execution vulnerability exploited in the wild by “a single threat actor” in attacks targeting a limited number of customers. “Microsoft has provided evidence of limited, targeted customer impact, though SolarWinds does not currently have an estimate of how many customers may be directly affected by the ...
- Voice cloning of growing interest to actors and cybercriminals
July 12, 2021
As voice cloning technology has become ever more effective, it is of increasing interest to actors… and cybercriminals. When Tim Heller first heard his cloned voice he says it was so accurate that “my jaw hit the floor… it was mind-blowing”. Voice cloning is when a computer program is used to generate a synthetic, adaptable copy of ...
- Lazarus Targets Job-Seeking Engineers with Malicious Documents
July 9, 2021
The notorious Lazarus advanced persistent threat (APT) group has been identified as the cybergang behind a campaign spreading malicious documents to job-seeking engineers. The ploy involves impersonating defense contractors seeking job candidates. Researchers have been tracking Lazarus activity for months with engineering targets in the United States and Europe, according to a report published online by ...
- Oil & Gas Targeted in Year-Long Cyber-Espionage Campaign
July 8, 2021
A sophisticated campaign targeting large international companies in the oil and gas sector has been underway for more than a year, researchers said, spreading common remote access trojans (RATs) for cyber-espionage purposes. According to Intezer analysis, spear-phishing emails with malicious attachments are used to drop various RATs on infected machines, including Agent Tesla, AZORult, Formbook, Loki ...
- Quick look at CVE-2021-1675 & CVE-2021-34527 (aka PrintNightmare)
July 8, 2021
Last week Microsoft warned Windows users about vulnerabilities in the Windows Print Spooler service – CVE-2021-1675 and CVE-2021-34527 (also known as PrintNightmare). Both vulnerabilities can be used by an attacker with a regular user account to take control of a vulnerable server or client machine that runs the Windows Print Spooler service. This service is ...