Parse notes
Microsoft has reported that an Iranian cyber espionage group, tracked as Peach Sandstorm but known otherwise as Holmium, APT33, or Elfin, targeted organizations in the satellite, defense, and pharmaceutical sectors. The group compromised dozens of entities, exfiltrated data from a subset, and gained access using password spray attacks. The campaign began in February and targeted thousands of organizations.
From 2020 until 2022, a random sampling of users downloading the Free Download Manager software received a Trojan horse version of the app. The malicious software has a collector backdoor that collects secrets from systems and then utilizes another backdoor to download an uploaded script from a C2 and periodically upload the stolen secrets. IOCs are included in the article.
Researchers from Checkmarx discovered a new method to exploit a race condition in the GitHub retired namespaces protection process to repojack popular repositories. Repojacking is an attack where an attacker sets up a malicious mirror of a GitHub repository that was renamed with the goal of impersonating the old repository. To prevent these attacks, GitHub enabled a protection to automatically retire popular repository namespaces when they are renamed. However, attacks such as this one bypass this protection.
This document provides an in-depth analysis of TPM-based BitLocker Drive Encryption, which is a feature in Windows that allows users to encrypt their hard drives. It explains how the BitLocker keys are stored and how they are accessed using the TPM. Additionally, the author describes a vulnerability in BitLocker that allows attackers to bypass the encryption and provides a detailed explanation of how the attack works.
A vulnerability in Facebook/Meta's Canvas on the Comet platform could allow account takeover if a user plays a malicious Canvas game. The issue stems from Compat iframes used for OAuth dialogs. A malicious game could exploit cross-window messaging with the parent window to set up a rogue communication channel and take over the account. This blog post explains how the exploit works with examples.
Terraform’s remote-exec provisioner is a powerful tool that allows for executing commands on a remote server to configure it. However, without proper guardrails, this can pose security risks such as data exfiltration. This article features an example and discusses some mitigations.
Dropbox has released this repository of prompt injection example scripts for educational purposes to understand how to attack LLMs and learn how to defend against these types of prompts.
Invictus-AWS is a standalone Python script to enumerate relevant data and services in an AWS account.
Pynt is a security testing solution that automates security testing for developers and testers, enabling effortless vulnerability discovery and mitigation throughout the SDLC. It has raised a $6 million seed funding round.
The National Security Agency (NSA), Federal Bureau of Investigation (FBI), and Cybersecurity and Infrastructure Security Agency (CISA) have released a Cybersecurity Information Sheet (CSI) on deepfake threats. The CSI provides an overview of synthetic media threats, techniques, and trends. It includes recommended steps and best practices for organizations to prepare, identify, defend against, and respond to these threats.
Meta's Native Assurance team found a vulnerability in the Meta Quest 2's Android OS that could have allowed arbitrary code execution with system privileges by exploiting memory corruption over IPC. Though it never reached production, the vulnerability highlighted improvements needed in Quest security. Meta shares its review process to demonstrate its commitment to secure product development.
An article from AWS outlining some of the DDoS options offered by AWS as well as the options and processes for running DDoS simulations on AWS. Users have the option of running a simulated DDoS attack through an approved partner or a synthetic simulated DDoS attack with the AWS Shield Response Team.
A new possibly North Korean group named Konni has entered the ransomware game. It recently started to employ new techniques using WinRAR vulnerabilities to exploit for cryptocurrency.
The CISA has announced a new program offering free vulnerability scans for public water utilities. The program will install scanners in the organizations and send weekly scan reports with vulnerabilities and recommendations.
Scattered Spider, a cybercrime group known for social engineering attacks, has hit over 100 organizations and recently deployed ransomware in attacks. Mandiant reports they are expanding beyond telecom and outsourcing into hospitality, retail, media, and finance. Mitigations include monitoring for phishing links, credential theft, and ransomware.