Parse notes
Sponsored
Companies are using more external software than ever. Third-party risk is a key concern, and compliance frameworks like SOC 2 and ISO 27001 require a robust vendor management program. At the same time, the proliferation of SaaS and shadow IT
A new vulnerability was found in which GCC’s stack smashing protection has no effect on variable length arrays or buffers allocated with alloca(). The vulnerability targeted 64-bit ARM architecture. This article includes details about the vulnerability, a demonstration of the vulnerability, and a discussion of the response. A fix is available on the GCC mailing list.
Israeli tech firm Insanet has developed spyware capable of being delivered through online ad networks and infecting Windows-based computers and Android phones as well as iPhones. The "Sherlock'' spyware's deployment has raised concerns due to its ability to clandestinely infiltrate devices, monitor activities, and collect sensitive information. The Israeli government has approved its sale, which potentially puts many at risk.
The Gelsemium cyberespionage group, which has been operational since 2014, has been spotted in attacks targeting a Southeast Asian government. The group is known for its technical capacity and programming knowledge, which has helped them fly under the radar for many years.
Helpdesk operators are prime targets for exploitation. Recent breaches have highlighted the need for better defense against attacks on these targets. This post says helpdesk vulnerabilities are mostly tech and process gaps, not people. It covers attacker tactics and recommends processes and tech fixes to protect against helpdesk attacks.
This blog post from Elastic Security on leveraging call stacks to reduce false positives, reduce false negatives, and increase visibility. The post begins with an overview of what call stacks are, then discusses how to leverage them for event explainability and walks through examples of other detection use cases.
Microsoft added a tunnel feature to VS Code in July 2023 that allows users to share their Visual Studio desktop via the web. This is a prime utility for attackers to establish persistence. This article provides some methods to disable the usage of VS Code tunnel as well as some methods to detect its usage.
ExtractBitLockerKeys is a Powershell or Python script for system administrators or attackers conducting post-exploitation to extract BitLocker recovery keys from a domain.
donut-decryptor is a Python script that searches files for known indicators of the donut obfuscator’s loader shell code. If found, it will locate, decrypt, and parse the shell code, dumping any configuration data or modules to disk.
kernel-hardening-checker (formerly kconfig-hardened-check) is a tool for checking the security hardening options of the Linux kernel. It supports checking Kconfig options, sysctl parameters, and boot configs. The repository also contains a map of kernel configuration options and vulnerability classes.
Hex-Rays runs a contest every year to develop novel and interesting plug-ins for IDA. This year, 9 plug-ins were selected from the submissions, including tools to query ChatGPT, analyze functions, and generate unique URIs from disassembled code.
The GitHub Security Lab has reached the milestone of disclosing over 500 CVEs (records of security vulnerabilities) in open source projects. The Security Lab is a team of security experts who audit open source projects and help their maintainers fix vulnerabilities for free. They have reported and helped fix over 1,000 vulnerabilities with a fix rate of 96%.
The FBI claims that Beijing has a cyber espionage program that is larger than all of its major competitors combined. Even if every FBI cyber agent and intelligence analyst focused on China exclusively, Chinese hackers would still outnumber them by at least 50 to 1.
This post talks about how the "Verified Fan" sale that Ticketmaster is doing for the most recent Olivia Rodrigo tour tickets isn't working because scalpers have many accounts and credit cards to quickly buy tickets for resale whereas non-scalpers do not.
APT29, a Russian state-sponsored hacking group, has increased its phishing operations in Ukraine, particularly targeting foreign embassies in Kyiv. This follows an uptick in the group's routine espionage operations against global diplomatic entities, with a focus on European Ministries of Foreign Affairs and embassies, as well as governments in Turkey, India, and Africa.
The hackers who are believed to be behind a major cyberattack that disrupted several casinos and hotels in Las Vegas are part of a small but prolific cybercrime clique whose members have also hit other major U.S. companies in the past year by talking their way into access to computer networks.