Parse notes
Three new vulnerabilities related to the NGINX ingress component in Kubernetes (CVE-2023-5043, CVE-2023-5044, and CVE-2022-4886) were reported on October 27th. These vulnerabilities allow attackers who can control the configuration of the Ingress object to steal secret credentials from the cluster, including credentials for the Kubernetes API server with very high privileges.
Apple introduced a feature in iOS 14 that claimed to display a unique, private MAC address for each SSID an iPhone connected to. Two security researchers discovered that this feature doesn’t work on iOS 17.1. They then tested all versions of the feature since it was released and learned that it had never worked. The researchers discovered that the iPhone would send the private MAC address in the source field in multicast messages upon joining a network but the real MAC address would still be sent in a different field.
Citrix warns all admins of Netscaler ADC and Gateway appliances to immediately secure their systems from an actively exploited vulnerability dubbed Citrix Bleed (CVE-2023-4966). The 9.4 vulnerability allows unauthenticated attackers to launch a low complexity attack to remotely disclose session tokens and hijack authenticated sessions with no user interaction. This article includes commands to kill all sessions and details of the patched versions.
This little blog post walks through how you can turn a simple script that moves folders or files into a privilege escalation on a Mac.
This blog post goes into depth into how you can exploit an OAuth callback URL to create a zero-click account takeover.
This study looked at the behavior of human defenders against two different attack strategies, Beeline and Meander, and how it affected the emergence of defense strategies. The results showed that although human defenders initially had more difficulty stopping the Beeline adversary, they were able to learn to stop it by taking advantage of their attack strategy.
Postleaks is a tool to search for exposed secrets in public Postman collections.
MalwareBytes has launched a new product, Identity Theft Protection, that is meant to help secure digital identities and defend against identity and online threats. It does this through identity monitoring and alerting, credit monitoring, breach analysis, and identity recovery tools.
Gsec is a web security scanner based on custom vulnerability scanners and Nuclei. It can do passive scans (DNS enumeration, subdomain generation) and aggressive scans (http code, web crawler, http traversal scan, and more).
The StripedFly malware was first discovered by Kaspersky researchers in 2017 and was initially believed to be a cryptocurrency miner. Researchers discovered that the miner was actually a cover for a highly sophisticated spy platform. The malware uses a custom TOR client to transmit communication and siphoned data between infected systems and the attackers' command and control server and has a ransomware component that has infected a small subset of victims.
Amazon has released a notice that most Amazon RDS and Aurora SSL/TLS certificates will expire in 2024. After rotating the rds-ca-2019 CA certificates, the new CA certificates will expire in either 40 or 100 years. This article contains a tutorial on how to identify and rotate affected instances.
Researchers at Censored Planet and Google’s Jigsaw have been tracking internet blackouts by governments, which impacted 35 countries across 187+ instances in 2022. Outages lasting hours to weeks cut access to vital information for work and family. This post outlines how the researchers built the analysis dashboard and data pipelines to understand the impact of these blackouts.
After Okta’s recent breach, its shares slumped more than 11% - reducing its market cap by more than $2 billion.
Many organizations' expanding attack surfaces, from digital transformation and hybrid work, drive cyber risk, with threats rapidly evolving. Quantifying security solution efficacy through metrics like catch rate is challenging with the variables involved. This piece examines what catch rate indicates about financial risk mitigation.
A study of how generative AI chatbot “hallucinations”, or false information generated by AI chatbots, are harming search results. The study focuses on an example in which a researcher wrote a blog post that was meant to test how an LLM could be tricked into generating a summary using a fictional article. The researcher discovered that their fictional article was highlighted in Bing search results even after they added explicit text in the blog post to try and dissuade the Bing search results.