Parse notes
Fake websites have been popping up that offer a Trojan masquerading as the Bitwarden password manager that includes a new password-stealing malware dubbed ZenRAT. The malware specifically targets Windows devices and directs macOS or Linux users to the official download page. The malware uses WMI queries to acquire system information in addition to the credentials and sends them in a zip to a C2.
Operation Zero, a Russian company specializing in buying and selling zero-day software exploits, has increased its payments for zero-day vulnerabilities in iPhones and Android devices from $200,000 to $20 million. While traditionally, bug bounty platforms inform vendors of vulnerabilities, companies like Operation Zero sell these vulnerabilities to governments, leading to a lucrative yet unregulated gray market where prices and customer identities remain opaque.
A threat actor is using an alias of GitHub’s Dependabot feature to install password-stealing malware. By mimicking the Dependabot, which automatically scans projects for vulnerabilities, the attacker has convinced users to accept malicious commits.
An article providing an overview of some Okta features that are useful for red teaming. The first portion of the article discusses features that allow running Okta with Active Directory environments and how to pivot between the two. The article also includes a discussion of using a fake SAML provider with Okta.
MadPot is a large-scale honeypot network that Amazon runs to catch threats and gain threat intelligence which it shares publicly or with government agencies. MadPot intercepts over 100 million attempts per day and the insights can feed into AWS to bolster their threat detection and prevention offerings such as GuardDuty.
This document provides an overview of how WebGPU works through the eyes of an attacker, discusses vulnerability research methodologies, and describes important bugs found during the research. The report aims to give the security community a deeper understanding of vulnerabilities that may come with the addition of WebGPU.
LDAPWordlistHarvester is a tool for generating wordlists from information present in an LDAP for cracking non-random passwords of domain accounts. Once you have the wordlist, you can use hashcat with rules to crack passwords.
The Cybersecurity and Infrastructure Security Agency has launched a nationwide cybersecurity campaign called "Secure Our World". The campaign is part of CISA's Cybersecurity Awareness Program, which aims to raise public awareness of cyber threats and online security.
GitHub has made passkeys available to all users on its platform, following the successful beta launch in July.
An unknown party submitted a large number of backdated CVEs with high CVSS scores. The problem with this is that a researcher has found that many of these are just automatic submissions that are not actually vulnerabilities. This could cause issues when these CVEs are pulled in by systems that don’t check whether they are disputed.
A ransomware group named Ransomed.vc claims to have breached Sony's systems and has threatened to sell the stolen data. Although the claims remain unconfirmed, Cyber Security Connect reported that the group provided evidence such as screenshots of internal pages and Java files.
Potential iCloud Keychain issues have been identified by security researchers in iOS 17 and macOS Sonoma. The first problem is that the feature may automatically activate upon upgrading, even if it was previously turned off. The second issue is that if users disable iCloud Keychain, the data might not be deleted from Apple's servers, contrary to past practice.
The next generation of Raspberry Pi will be released this October and features 2-3x the speed of the previous model.
Roughly 80% of the staff at US cybersecurity agency CISA may be furloughed if a government shutdown occurs this week. While some personnel involved with cybersecurity operations are likely to be classified as essential and exempt from furlough, there will be fewer staff available for security monitoring and response.
Misconfigured instances of third-party data logging application TeslaMate may potentially expose Tesla cars and their drivers to malicious attacks, according to IoT security intelligence firm Redinent. While TeslaMate is a useful tool for tracking car data, it poses a significant risk if not properly configured.