Parse notes
The first set of patches addresses 15 vulnerabilities in Android’s Frameworks and Systems. One critical information disclosure vulnerability can lead to local information disclosure with no additional execution privileges needed while the rest of the vulnerabilities are rated as high. The second set of patches addresses vulnerabilities in Arm, MediaTek, and Qualcomm components.
The BlueNoroff hacking group, backed by North Korea, has developed a new macOS malware called ObjCShellz that can open remote shells on compromised devices. BlueNoroff is known for targeting cryptocurrency exchanges and financial organizations.
Veeam has issued patches for four severe security vulnerabilities that could expose users of its Veeam ONE product to remote code execution attacks. The flaws include two critical issues with CVSS severity scores of 9.9 out of 10.
A post from AWS that begins with an introduction to how the shared responsibility model applies to ECS and then launches into some best practices. The topics covered are IAM access to ECS, securing an ECS network, ECS secrets management, securing the ECS task and runtime, ECS logging and monitoring, and ECS security compliance.
Sniffnet is a cross-platform, multi-threaded tool to monitor internet traffic. It supports filtering and can generate graphs and other statistics in real time and output reports of captured data. Sniffnet’s GUI is fully translated into multiple languages.
GitHub has launched a beta version of secret scanning for non-provider patterns like database connection strings for MySQL, Postgres, MongoDB as well as private keys like RSA, SSH, etc.
Fully customizable, offensive security reporting solution designed for pentesters, red teamers, and other security-related people alike.
Two Russian nationals, Aleksandr Derebenetc and Kirill Shipulin, have been charged with conspiring to hack the taxi dispatch system at JFK airport with the help of two US citizens, Daniel Abayev and Peter Leyman. The group hacked the system to move certain taxis to the front of the line in exchange for payment, resulting in large numbers of taxi drivers skipping the line.
Part 2 of a deep dive from KrebsOnSecurity on unmasking the SWAT USA reshipping service. Krebs traces the operator of SWAT USA from his nickname to another nickname on the Verified forums. This username is then tracked via a password sent in a DM to four email addresses that use that password. A Russian individual is pinpointed through one of these emails.
Google Play Protect has launched a new feature that enables real-time analysis of an app’s code and blocks installation if it is determined to be malicious. Play Protect will recommend a scan for any never before seen app, including sideloaded apps. The authors of this article tested the feature with 30 different apps ranging from stalkerware to spyware to fake apps and loan scams and found that, while most were caught by the scan, the fake apps and some of the loan scams were allowed.
A fraudulent version of the Ledger Live app for cryptocurrency management was discovered in the Microsoft Store, resulting in users losing at least $768,000 worth of cryptocurrency assets. The fake app, named Ledger Live Web3, had been present in the Microsoft Store since October 19. The fraudster was able to transfer over $768,000 from victims before Microsoft removed the app.
Aqua Security has discovered that the Kinsing threat actor has shifted tactics in a new experimental campaign targeting cloud environments. The threat actor manually exploited the Looney Tunables vulnerability in GNU libc’s ld.so, marking the first known instance of such an exploit. This vulnerability was reported in October. Any unpatched systems should be patched urgently.
The UK government may introduce legislation requiring tech companies to inform them in advance of new security technologies and possibly disable them when necessary. The proposed Investigatory Powers (Amendment) Bill would update the "notices regime" to provide advance access to technical details of security measures employed by major tech companies, enabling access to user data and monitoring nefarious activity.