Parse notes
Patrick Wardle presented three techniques to bypass macOS' malware detection feature at DEFCON. The Background Task Manager functions by alerting users and third-party security tools when new persistent tasks are installed. Wardle discovered multiple exploit paths, including two that don’t require root access.
More than 4 million people had their sensitive medical and health information stolen after hackers exploited a zero-day vulnerability in the widely used MOVEit file transfer software.
Canadian dental benefits administrator Alberta Dental Service Corporation (ADSC) has started informing roughly 1.47 million individuals about a ransomware attack discovered on July 9 in which their personal information was compromised. The ADSC stated that less than 7,300 records contained personal banking information.
A guide from HashiCorp on monitoring Vault at scale. It covers threats facing Vault, the various logs and data sources available, core metrics, and tips on monitoring and reporting.
This educational post covers dynamic syscall ID extraction using Hell's Gate and C++ to build basic malware as a springboard for more advanced evasion. While open source tools provide some bypass potential, truly effective and subtle red team engagements require custom malware resilient to signature/behavioral detection. Mastering fundamentals like Hell's Gate lays the groundwork for advanced techniques.
Team82 deep dive into how it created a technique to impersonate NAS devices to redirect users to an attacker-controlled device, allowing attackers to access a user’s remote device, steal personal information, and access stored data.
AWS Backup is a feature for backing up and isolating data in the event of a ransomware attack. It allows for a further level of data isolation. This announcement post includes details of how the capability works and how to use it.
noir is an attack surface detector that uses source code analysis to identify frameworks and programming languages used and endpoints. The data can then be made available to tools like Burp Suite or ZAP.
The CVE Binary Tool helps you determine if your system includes known vulnerabilities. It can scan binaries for over 200 common vulnerable components, including openssl, libpng, libxml2, and expat. It can provide lists of known vulnerabilities associated with a Software Bill of Materials or a list of components and versions.
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.
Illinois has just unanimously passed the Civil Liability for Doxing Act. This law will allow for victims of doxxing recover damages and request a temporary restraining order from their attackers.
Cybercriminals are using maliciously crafted cryptocurrency investment apps as beta versions to steal cryptocurrency from mobile app stores. The malicious apps are submitted as betas, which are not subjected to a thorough code review process and are only superficially examined for safety. The FBI warns that the apps can be used to steal personally identifiable information, financial account access, and take over devices.
The current economic downturn has affected CISOs. 54% of cybersecurity budgets have been frozen or reduced. Startups have opportunities through cost/customization advantages, though vendors overall need to offer flexibility like free trials. Even in times of financial restraint, cyber remains a priority, and smart vendors can creatively align to needs.
AWS Network Load Balancers (NLBs) allow for load balancing arbitrary traffic in AWS. With this new update, security groups can be applied to NLBs. This allows for more advanced NLB filtering.
Synack Red Team has discovered that French company Iagona's ScrutisWeb ATM monitoring software has several vulnerabilities that could be exploited by hackers to remotely hack ATMs, including check deposit machines and payment terminals. The flaws were patched by the vendor in July 2023 with the release of ScrutisWeb version 2.1.38. The vulnerabilities include path traversal, authorization bypass, hard coded cryptographic key, and arbitrary file upload issues that can be exploited by remote, unauthenticated attackers.
Home buyers, sellers, real estate agents, and listing websites throughout the US have been stymied for five days by a cyberattack on a California company that provides a crucial online service used to track home listings. A reminder of the real-world disruptions that cyberattacks can impose on large numbers of people or businesses that depend on a service that gets hacked.