Parse notes
The PEACHPIT ad fraud botnet infected hundreds of thousands of Android/iOS devices via 39 apps with over 15 million installs. Part of the China-based BADBOX operation includes backdoored off-brand mobile devices. At its peak, it had 121K Android and 159K iOS bots across 227 countries generating illicit revenue.
There has been an increase in SMS phishing targeting USPS customers to steal personal and financial data. The scams spoof USPS and other postal services with landing pages impersonating their sites. They trick users to input address info and then request additional sensitive details. The attacks highlight the ongoing effectiveness of basic phishing page impersonation tactics. Users should be wary of unsolicited security messages and verify legitimacy before clicking.
A memory corruption vulnerability in the cue sheet parsing library libcue can be used for 1-click RCEs on systems running the GNOME desktop environment. This is caused by Tracker Miners, which is included by default in GNOME, automatically indexing all downloaded files to update the search index on GNOME Linux systems. A proof of concept is provided in the article.
A post from the AWS security team on how CloudFront automatically detected and mitigated a new form of DDoS. This DDoS attack is known as an HTTP/2 rapid reset attack. In this attack, an attacker issues multiple requests for streams and then issues a reset for each of those requests. This causes the server to waste resources generating logs even if nothing is returned to the clients.
A blog post covering four different patterns for managing secrets in Python code. The post begins with more traditional methods such as utilizing a .env file, a secrets.json file, or environment variables before covering some newer approaches like leveraging a cloud secrets store or KMS.
This is a two-part deep-dive into supply chain security and the various aspects involved. Part 1 provides an overview of three phases of the software supply chain: source, build and deployment, and package, and discusses the risks and processes for securing each stage. Part 2 is a comprehensive analysis of 12+ SSC vendors and their core differentiators within the software development lifecycle.
Gutsy comes out of stealth with an eye-watering $51M seed round, bringing a process-centric view to cybersecurity. They are following the steps of Celonis by working with organizations to understand how their different systems are interconnected, the events that are expected, and their outcomes through process mining applied to cybersecurity.
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management.
A website inspired by haveibeenpwned.com to check if a domain has been typosquatted. The tool scans registrars for permutations of given domains.
Cloudflare mitigated a 201 million RPS DDoS, nearly 3X of the previous record, and generated by only 20K bots. This shows the power of new attack methods as the entire web is about 1-3 billion RPS. This blog aims to highlight the growing DDoS threat for all kinds of networks and dive into the record-breaking attack.
A Secureworks study shows that ransomware dwell time - from initial access to deployment - in two-thirds of the cases analyzed had fallen to 24 hours, down from 4.5 days in 2022, and in 10%+ of cases, under 5 hours. This is consistent across variants and groups, highlighting the speed of modern attacks and how hard it is to react, as shorter dwell time doubles the overall extortion with data theft.
The UK’s Information Commissioner’s Office (ICO) has issued a preliminary enforcement notice to Snap over concerns over its My AI chatbot feature. The ICO reports that Snap did not adequately assess the privacy and data protection risks associated with its new generative AI chatbot. Snap will have the opportunity to respond to the ICO’s concerns before action is taken.
Google is launching v8CTF, a CTF focused on V8, the JavaScript engine that powers Chrome. kvmCTF is an upcoming CTF focused on Kernel-based Virtual Machine (KVM) that will be released later in the year.
Google is making passkeys the default option for personal accounts, providing a simpler and more secure way to sign into online accounts. Passkeys use fingerprints, face scans, or PINs and are 40% faster than passwords. Google is encouraging the industry to make the switch to passkeys and eventually make passwords obsolete.
Cloudflare has been working to replace traditional CAPTCHAs that involve visual or audio puzzles with its modern CAPTCHAs.