Parse notes
A zero-day vulnerability in all versions of Exim mail transfer agent allows unauthenticated attackers to gain remote code execution on Internet-exposed servers. The vulnerability is due to an Out-of-bounds Write weakness found in the SMTP service, which can lead to software crashes or corruption of data following successful exploitation.
Johnson Controls International this week reported in a filing with the US Securities and Exchange Commission that it had suffered a cyberattack that caused disruptions to its internal IT infrastructure. The attack was perpetrated by cybergang Dark Angels, who posted a ransom letter claiming the attack. It was done with ransomware that encrypted Johnson Controls’ VMware ESXi machines.
Progress Software posted a security advisory for several vulnerabilities affecting WS_FTP Server, a secure file transfer solution. Rapid7 has observed that these vulnerabilities are being actively exploited and provided details of the attack chains it has been seeing.
This article teaches readers how to store and analyze Software Bill of Materials with OWASP Dependency-Track to identify security vulnerabilities in open-source components. It covers how Dependency-Track can be deployed in a production environment and summarizes the pros and cons of the platform.
NoSQL injection is a vulnerability where hackers can interfere with queries to NoSQL databases. This can let them bypass authentication, steal or edit data, cause denial of service, or execute server code. NoSQL databases do not use SQL, instead favoring non-relational data formats that open up for injection risks through the lack of standards. This blog dives into the different NoSQL injection techniques and provides labs for readers to try to exploit them.
Code Signing helps ensure the trust and security of deployed code using cryptographic signatures. This post from AWS walks through the process of configuring a CodeCatalyst CI/CD pipeline that uses AWS Signer to automatically sign deployed code.
Cloudflare has announced a new proposed standard called Encrypted Client Hello (ECH) that masks Server Name Indication (SNI), preventing networks from snooping on which websites a user is visiting. ECH is the last puzzle piece to privacy, and Cloudflare hopes that more providers will offer ECH, leading to a more private internet for everyone.
Discern Security has raised $3M to use AI for cybersecurity. Many firms buy expensive tools but don't know how to use them properly. Discern's software maps infrastructure and tools, then makes recommendations to optimize configurations and get the most protection.
Substation is a cloud-native, event-driven data pipeline toolkit. It allows for the deployment of modular, serverless data pipelines, data processing, and writing custom data processing applications in Go.
Palo Alto Networks is in talks to acquire Israeli cybersecurity startups Talon Cyber Security and Dig Security for around $1 billion in total. Talon protects distributed workforces with secure enterprise browsing. Dig secures data across public clouds. The deals would expand Palo Alto's security portfolio as demand grows.
ESET researchers uncovered a Lazarus cyberattack on a Spanish aerospace firm. Hackers posed as Meta recruiters on LinkedIn and sent coding challenges containing malware. Once inside the network, Lazarus deployed multiple tools including a new backdoor called LightlessCan. ESET analyzed the attack method and Lazarus' toolset through cooperation with the victim company.
Volatility3 is a memory forensic framework used for incident response. It recently added support for S3 object storage and released an in-depth blog post on how it was implemented.
A Krebs on Security reader noted that the 8base ransomware group was leaking a significant amount of information on its public error pages. Brian Krebs used this information to trace the website to a 36-year-old Moldovan programmer. The programmer denied the connection.
A viral TikTok account has amassed a following by utilizing off-the-shelf facial recognition tools to dox random people. The account usually starts by choosing a victim from other viral videos or comments and then goes through the process of processing the image and doxing the person. TikTok has commented that the account does not violate their policies.
Cloudflare has a vulnerability where customer-configured protection mechanisms can be bypassed due to gaps in cross-tenant security controls, potentially exposing customers to attacks Cloudflare is supposed to prevent.