Parse notes
Okta is warning nearly 5,000 current and former employees that their personal information was exposed via Rightway Healthcare, a third-party healthcare vendor used by Okta. The exposed data includes full names, social security numbers, and medical plan numbers of affected employees.
Ace Hardware, a hardware store retailer-owned cooperative with 5,700 shops across the United States, China, Panama, and the UAE, suffered a cyberattack that has affected over 1,200 devices and is preventing stores and customers from placing orders. The company is working to restore 196 servers and has engaged with IT experts to help them restore the impacted systems.
The Socks5Systemz proxy botnet has infected 10,000 systems worldwide, turning them into traffic-forwarding proxies for malicious or anonymous traffic. The botnet has been operating since at least 2016 but has recently gained attention. The malware is distributed through phishing, exploit kits, malvertising, and trojanized executables.
The Wiki-Slack Attack is a social engineering attack that redirects business professionals to attacker-controlled websites using Wikipedia and Slack. Browser-based attacks, such as the Wiki-Slack Attack, are becoming the primary infection vector for ransomware. This article provides security recommendations to protect against browser-based attacks and increase cyber resilience.
This article discusses the use of Large Language Models (LLMs) to enhance the capabilities of threat intelligence analysts. It explains what prompt engineering is and provides an example of an ideally crafted prompt. The article also explores the practical applications of LLMs, including few-shot prompting and retrieval augmented generation (RAG) as well as embeddings.
File Integrity Monitoring is limited in the modern age as files containing things like access keys, API keys, and secrets are frequently used. Osquery on macOS can hook into the es_process_file_events table to allow users to define a set of sensitive files to monitor for any accesses or changes. This post contains a tutorial for enabling and configuring Osquery.
A new CTF from Wiz that focuses on an Amazon EKS cluster. The challenge contains 5 challenges with common EKS misconfigurations. A certificate is available upon completion.
Google Play Store has introduced an "Independent security review" badge for Android apps that have undergone a Mobile Application Security Assessment (MASA) audit. The badge is initially being launched for VPN apps due to the sensitive nature of the user data they handle. The MASA audit allows developers to have their apps independently validated against global security standards, providing more transparency and enabling users to make informed choices before downloading.
Rclone is a command line program to manage files on cloud storage. It supports over 70 different cloud storage products, including S3-compatible object stores. Rclone can be used to replicate many different common Unix tools such as cp, rsync, mv, mount, and ls across different cloud storage providers or file systems.
Part one of a series by the EFF on passkeys. A passkey is composed of 100-1400 bytes of random data stored on your computer in a safe location. They can be registered with a browser for a website and used to sign in. Passkeys can build in 2FA support which can increase security and convenience.
The Pixel 8/8 Pro are the first phones to enable ARM's MTE, a security feature that detects memory corruption at first occurrence. It's only available on Pixel as a developer option but can be configured for all apps. This article describes how to enable it on Android phones.
Apple's 'Find My' network could be abused by attackers to transmit sensitive information captured by keyloggers installed in keyboards. Researchers have created a PoC hardware device to highlight the risk to the public by integrating a Bluetooth transmitter into a USB keyboard. They demonstrated that it is possible to relay passwords and sensitive data typed on the keyboard through the 'Find My' network.
James Bethoty recaps some of the best vendors in various categories that he met with during the Global OWASP Conference. Categories range from buzzword of the year to best API security and best overall.
Discord will switch to temporary file links for all users by the end of the year to prevent attackers from using its CDN to host and distribute malware. All links to files uploaded to Discord servers will expire after 24 hours after the change rolls out. The new links will come with three parameters that will add expiration timestamps and unique signatures that will remain valid until the links expire, preventing the use of Discord's CDN for permanent file hosting.
This author attended the POC2023 conference and presented on Chrome exploit chains. He discovered a new WASM bypass method for the V8 sandbox. The author notes that the vulnerabilities were exploited through trial and error.