Parse notes
Check Point discovered an active BBTok banking malware campaign in Latin America, with a new variant impersonating 40+ Mexican/Brazilian banks to steal 2FA codes and card numbers. Threat actors maintained diverse Windows infection chains with varied file types, showing continued evolution of the malware.
Microsoft researchers posted a link with a misconfigured Azure SAS token that granted access to the full storage account as opposed to just the intended dataset while publishing an open-source dataset on GitHub. The 38TB of accidentally-exposed data includes full backups of two employee workstations as well as secrets, private keys, and internal messages.
Apple has released security patches to address three zero-day flaws that were actively exploited in iOS, iPadOS, macOS, watchOS, and Safari. This brings the total number of zero-day bugs discovered in Apple's software this year to 16. The flaws include a certificate validation issue in the Security framework, a security flaw in Kernel, and a WebKit flaw that could result in arbitrary code execution.
The discussion around Android 14's CA certificate controls has sparked solutions going beyond previous root approaches. While directly writing certs is blocked, root access still enables control by digging into internals. Feedback has produced promising options to regain system-level CA management practically on the latest Android versions.
A blog post that begins with an overview of what cloud ransomware attacks look like and then an overview of AWS Backup. The post then continues to offer advice for deploying AWS Backup at scale using AWS Organizations. It includes terraform code to aid in deployment.
This blog post discusses security options in OpenAPI and what companies are doing regarding API security. Large companies like Facebook and Github use OAuth2 for API security. The post recommends using OAuth2 for authentication, but acknowledges that it can be complex. API keys are still commonly used for security in smaller APIs. Basic authentication is not recommended due to its lack of security.
Sponsored
Ready to wave goodbye 👋 to bugs? QA Wolf
The biggest enterprise software deal of the year to date goes to Cisco for acquiring the observability behemoth Splunk in a $28B deal, paying a premium of $157 per share on the average of $80 or $90 per share Splunk has had this year.
1Password has completed testing for its passkey support. Users can now create, manage, and sign in with passkeys via 1Password mobile apps and web extensions. Passkeys are a new login technology that is meant to replace passwords. 1Password has not enabled the ability to replace a master password with a passkey but teases that the feature is coming later in the fall.
Aftermath is a free macOS Incident Response framework from JAMF. It allows defenders to collect and analyze data from a compromised host. Aftermath can be run as a standalone tool or deployed via MDM and then a series of collection modules can be run to collect data for analysis.
This blog post dives into the group LUCR-3. LUCR-3 overlaps with groups such as Scattered Spider, Oktapus, UNC3944, and STORM-0875. It is a financially motivated attacker that leverages the Identity Provider (IDP) as initial access into an environment with the goal of stealing intellectual property for extortion. LUCR-3 targets Fortune 2000 companies across various sectors, including but not limited to software, retail, hospitality, manufacturing, and telecom.
Pizza Hut Australia says 190,000 customers' info – including names, delivery addresses, email addresses, phone numbers, and order information – have been accessed. It told customers it learned of the incident in early September and described it as "unauthorized third party" access to a subset of its data.
T-Mobile customers on X and Reddit reported that they were able to see other accounts’ information in the T-Mobile app. T-Mobile has fixed the issue. The issue was caused by a technology update glitch and was not a cyberattack.
Poland's watchdog is investigating whether ChatGPT breaches EU GDPR data laws, adding to privacy lawsuits OpenAI already faces in the US. The lack of clarity around how the chatbot handles and secures user data is drawing growing regulatory scrutiny.
AWS IAM has added Action Last Accessed support to over 140 services. Action Last Accessed allows admins to see when an IAM identity last accessed an action, which can aid in finding over-privileged identities.
Marvell has denied allegations that its subsidiary, Cavium, backdoored chips for US intelligence. Documents leaked by Edward Snowden in 2013 identified Cavium as a vendor of semiconductors backdoored for US intelligence. The allegations surfaced again in Jacob Appelbaum's PhD thesis, which was published in March 2022.