You don’t need a kernel 0day

I’ve been in security engineering for more than ten years, and I’m still learning from others. There are some incredibly smart people in this field. If you stay humble, there’s always someone who can teach you something. One thing I think we sometimes overlook is how much an attacker can achieve by earning someone’s trust. When people imagine a sophisticated attack, they often picture someone digging through code, hunting for a kernel 0day, or studying a company’s infrastructure. Sometimes, a convincing request is enough. Take the recent Revolut incident. Revolut confirmed that an attacker used an email address on a legitimate government agency domain to submit fraudulent requests for information. The company handed over sensitive customer data in response. Impersonating a trusted entity is one example. But there’s another scenario I keep thinking about: an attacker running a business with a service people actually want to use. Imagine a product that works, solves a problem, and gives…