Parse notes
Microsoft's Threat Intel team posted a series of blogs about BlackCat’s new version of its Sphynx encryptor. Among the changes in the new version: popular post-exploitation tools Impakcet and RemCom were bundled with the encryptor.
A security flaw in the popular Windows file archiver WinRAR has been fixed after being reported by a researcher to RARLAB. The vulnerability, tracked as CVE-2023-40477, allowed attackers to execute arbitrary code on a computer by opening a specially crafted RAR archive. This was due to a lack of proper validation of user-supplied data. Users are advised to update their installations to version 6.23 to address the flaw before it is exploited by attackers.
Mandiant reports that it has seen an increase in the use of AI in information manipulation campaigns. The success of these campaigns has been fairly limited thus far.
Jamf published a report detailing methods to make an iPhone on iOS 16 appear to be in airplane mode. The report details modifications to the control center, airplane mode icon, and app network connectivity used to achieve this effect. No iOS vulnerabilities are exploited in this technique
This blog post embarks on the initial stages of kernel exploitation. The content serves as an introduction, leading to an imminent and comprehensive whitepaper centered around this subject matter. Through this, a foundation is laid for understanding how kernel drivers are developed, as well as a basic understanding of key concepts that are instrumental to comprehending the paper itself.
URL encoding converts non-standard characters to valid % escapes so URLs transmit reliably. The purpose of URL encoding is not to hide parts of a URL from an outside observer, but rather to ensure that the URL is easily and unequivocally interpretable by the receiving server and to prevent manipulation of the URL by the user of the client that is constructing and sending the URL.
Fast and customizable vulnerability scanner based on simple YAML based DSL. Nuclei offers scanning for a variety of protocols, including TCP, DNS, HTTP, SSL, File, Whois, Websocket, and Headless. With powerful and flexible templating, Nuclei can be used to model all kinds of security checks.
ProtoBurp is a Burp Suite extension that enables security researchers to encode and fuzz custom Protobuf messages. The tool allows users to convert JSON data into a Protobuf message, enabling them to fuzz inputs using Burp's Repeater and Intruder tools, as well as proxy traffic from other tools.
A terraform module to send notifications upon manual changes made in the AWS console. These changes could suggest a compromised account or otherwise lead to gaps in infrastructure as code observability.
Chrome 117 will add a new feature to the Privacy and Security setting to highlight extensions that have been removed from the Chrome Web Store along with a reason. The three reasons currently supported are a developer unpublishing the extension, a violation of a policy, or malware. Users can choose to ignore the warning or remove the extension
Despite hype, criminals struggle to use generative AI like ChatGPT for malware, with limited real world usage seen. Research from Trend Micro and Mandiant finds interesting but no groundbreaking criminal uses as AI isn't providing the exploit shortcut hackers hoped for.
A comparison of major security benchmarks against Microsoft Baselines. Only a small fraction deviate, usually redundant or erroneous suggestions undermining security. The analysis revealed ineffective or counterproductive advice in some benchmarks, highlighting the need for rigorous security guidance vetting.
The Flipper Zero is an incredibly popular multi-tool for interacting with digital interfaces. It had faced massive supply issues due to underestimating demand. Flipper Devices have announced that they have ironed out their supply issues and will have more regularly available stock.
CyCognito's report on external exposure reveals majorly exposed surfaces: 74% of assets with PII are exploitable, 70% of web apps have severe security gaps, and 3000+ enterprise web apps are exploitable. The report underscores the risks of unknown digital shadows and the critical need for full attack surface visibility.