Parse notes
Mortgage giant Mr. Cooper confirmed customer data was compromised in a recent cyberattack but it is still investigating specifics. It says that it doesn’t store banking information for payments, and it believes its third-party provider was unaffected. Mr. Cooper plans to notify affected customers by mail in the coming weeks.
Sumo Logic reported that an attacker used stolen credentials to access a Sumo Logic AWS account. It stated that it immediately quarantined the environment, that none of its systems or networks were impacted, and that customer data was encrypted at all times. Sumo Logic is advising customers to rotate their API keys.
A September attack compromised Monero’s Community Wallet and wiped its entire balance. The Monero Community Wallet is used to fund development projects from its members. Monero developer Luigi disclosed the attack on November 2 but has not yet identified the source.
Docker makes many tasks easier for us. It is interesting to consider the surface risk it opens from a security perspective and the possibilities it offers for privilege escalation. This blog dives into the dangers of Docker and how having access to the Docker daemon opens the door to using it as an attack vector.
The blog post details how the author was able to abuse Akamai services to attack F5s and subsequently steal internal data including authorization and session tokens from their customers. It provides detailed explanations of how normal GET requests and malformed POST requests using a smuggling gadget can affect backend servers and potentially poison the response queue or cache.
Aqua Nautilus researchers found flaws in the vulnerability disclosure process for tens of thousands of open-source projects. These flaws allowed vulnerabilities to be harvested before they were patched and announced, potentially enabling attackers to exploit security holes before users were alerted. The research also introduces two additional states in the vulnerability disclosure process: 'Half-Day' and '0.75-Day' Vulnerability.
Sponsored
If you haven’t heard of RYSE yet, you will soon. The story of the smart home COMPANY that started out pitching on Dragons Den and receiving two offers [11] is about to become known nationwide, as their product rolls out in +100 Best Buy stores.
Medusa is a speedy, parallel, and modular login brute-forcer.
LLM-Guard ensures that your interactions with LLMs remain safe and secure by offering sanitization, detection of harmful language, prevention of data leakage, and resistance against prompt injection attacks.
Cover Your Tracks is a tool created by the EFF for testing how well your browser protects you from trackers and fingerprinting.
Researchers observed a malvertising campaign mimicking the legitimate Windows news site WindowsReport.com to distribute malware posing as the popular tool CPU-Z. The campaign leverages trusted site replicas instead of vendor sites and is part of a larger effort also targeting Notepad++, Citrix, and VNC Viewer.
The Predator AI pen testing tool can exploit misconfigurations in 30+ web services, but also has a semi-functional AI chatbot assistant. It is offered for "education" purposes but it could probe defenses or enable attacks. It looks for common flaws like CORS, Git exposure, SQLi, and XSS in a nice convenient package.
In this blog post, Troy Hunt of HaveIBeenPwned examines the recently released LinkedIn data breach. An attacker claims that they breached LinkedIn and have leaked full names, profile data, phone numbers, emails, and other confidential information of users. After analysis, Hunt notes that the data is a combination of scraped and publicly available information and fabricated emails.
US Radiology Specialists, a major private radiology group, was targeted in a ransomware attack in December 2021. The incident resulted in the personal and health information of nearly 200,000 patients, including 92,000 New Yorkers, getting compromised. The group was fined $450,000.
This blog post covers the new vulnerability scoring framework, CVSS 4.0, which was released on November 1, 2023.
Atlassian updated the CVSS score of the recently disclosed CVE-2023-22518 after discovering that an unauthenticated attacker could fully reset Confluence and create an administrator account. This vulnerability is actively being exploited.